Computer network intrusion detection system and method based on abnormal behavior analysis

Abstract

The present application relates to the field of computer network intrusion detection based on abnormal behavior analysis, in particular to a computer network intrusion detection system and method based on abnormal behavior analysis. Through the use of a data acquisition module to collect network traffic data, the network traffic data is fused to obtain fused network traffic data; a feature extraction module uses a GGNN gated graph neural network to extract features from the fused network traffic data, establishes an ST-Transformer spatiotemporal joint detection model, optimizes the parameters of the detection model using a multi-objective particle swarm optimization algorithm, and a data detection module inputs the feature network traffic data into the spatiotemporal joint detection model for detection, outputting a data anomaly score; an active response module is used for the system to actively respond according to the level division of the data anomaly score. The threat discovery and disposal capability in complex attack scenarios is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a computer network intrusion detection system and method based on abnormal behavior analysis. BACKGROUND

[0002] Current network intrusion detection technology generally faces the challenges of multi-dimensional information fragmentation and insufficient dynamic threat adaptation capability. Traditional methods mainly rely on single data source analysis, network traffic statistical features or host log rule matching, which is difficult to capture collaborative attack behaviors across networks, hosts and users. Detection systems based on static models are prone to detection performance degradation due to feature distribution drift when facing continuously evolving attack methods, and lack effective identification mechanisms for zero-day attacks. Although existing technologies can handle entity association, they do not solve the problem of spatio-temporal alignment of multi-modal heterogeneous data, and there is computational redundancy in real-time streaming scenarios. In addition, defense response mechanisms are mostly limited to passive alerts, lack of dynamic isolation and induced countermeasures linked to detection results, and cannot effectively contain the lateral penetration of advanced persistent threats. SUMMARY

[0003] The purpose of the present application is to solve the above problems, and a computer network intrusion detection system and method based on abnormal behavior analysis are designed.

[0004] To achieve the above purpose, the technical scheme of the present application is as follows: further, in the computer network intrusion detection system based on abnormal behavior analysis, the computer network intrusion detection system comprises the following modules:

[0005] A data acquisition module is used to acquire network traffic data, fuse the network traffic data, and obtain fused network traffic data;

[0006] A feature extraction module is used to extract features from the fused network traffic data using a GGNN gated graph neural network to obtain feature network traffic data;

[0007] A model establishment module is used to establish an ST-Transformer spatio-temporal joint detection model, optimize the detection model parameters using an improved IPSO particle swarm algorithm, and obtain a target ST-Transformer spatio-temporal joint detection model;

[0008] A data detection module is used to input the feature network traffic data into the target ST-Transformer spatio-temporal joint detection model for detection, and output a data anomaly score;

[0009] An active response module is used to perform active response according to the level division of the data anomaly score, and the active response at least includes dynamic honeypot deployment and resource isolation containment.

[0010] Further, in the above computer network intrusion detection system based on abnormal behavior analysis, the data collection module comprises the following sub-modules:

[0011] The collection sub-module is configured to deploy FPGA acceleration probes at network boundary to collect network traffic data, wherein the network traffic data at least comprises network traffic packet sequence, host process call chain and user operation behavior graph;

[0012] The mapping sub-module is configured to perform time alignment on the network traffic data by using Lamport logical clock, and perform spatial correlation mapping on the aligned network traffic data to obtain initial network traffic data;

[0013] The fusion sub-module is configured to fuse spatial dimension features in the initial network traffic data, and compress space-time features in the initial network traffic data to obtain fused network traffic data.

[0014] Further, in the above computer network intrusion detection system based on abnormal behavior analysis, the feature extraction module comprises the following sub-modules:

[0015] The type sub-module is configured to define entity nodes and edge types of the fused network traffic data, at least comprising network layer nodes, host layer nodes, user layer nodes, communication relationship edges, process call edges and ownership relationship edges;

[0016] The encoding sub-module is configured to perform node feature encoding on the fused network traffic data, including network node feature vector, host node feature vector and user node feature vector, to obtain graph structure traffic data;

[0017] The message function in the graph structure traffic data is defined :

[0018]

[0019] Wherein, represents the hidden state of node at time step , represents the hidden state of node at time step , represents edge features, including delay and frequency, represents training parameters, used to map the spliced vector to dimensional space, is the dimension of hidden state and ;

[0020] An updating submodule is configured to define a gating updating mechanism of the GGNN gated graph neural network as follows:

[0021]

[0022]

[0023]

[0024]

[0025] wherein, represents an updating gate output, controlling the fusion proportion of the old hidden state and the new candidate state ; represents a Sigmoid activation function, and the output value is between (0, 1); represents a training parameter matrix, acting on the spliced vector ; represents a resetting gate output, controlling the influence degree of the old hidden state and the new candidate state ; represents a training parameter matrix, acting on the spliced vector ; represents a hyperbolic tangent activation function, normalizing the output value to (-1, 1); represents an updating gate output, linearly combining the old hidden state and the new candidate state ; represents a training parameter matrix, acting on the spliced vector ; represents an element-level multiplication;

[0026] An obtaining submodule is configured to perform hierarchical feature extraction on the graph structure traffic data by using the GGNN gated graph neural network, and obtain feature network traffic data.

[0027] Further, in the computer network intrusion detection system based on abnormal behavior analysis, the model establishing module comprises the following submodules:

[0028] A constructing submodule is configured to construct the ST-Transformer spatio-temporal joint detection model based on a double-flow spatio-temporal attention mechanism.

[0029] A spatial feature extraction submodule is configured to use an improved C2FDark backbone network to extract target spatial features through multi-scale convolution,

[0030] The time attention fusion submodule is configured to construct a dynamic spatial relationship graph, capture potential correlations of non-adjacent nodes through a graph attention mechanism, and model time sequence dependence of continuous frames through a variable time window mechanism.

[0031] The dynamic weight distribution submodule is configured to adjust fusion weights of spatial and time features according to traffic characteristics of data, and a calculation formula is as follows:

[0032]

[0033] wherein, represents a fusion weight, represents a Sigmoid activation function, , and represents a fusion weight coefficient, which is used to measure relative importance of spatial features, time features and environmental features. represents a spatial feature value, represents a time feature value, represents an environmental feature value.

[0034] Further, in the computer network intrusion detection system based on abnormal behavior analysis, the model establishing module further includes the following submodules:

[0035] The optimization submodule is configured to globally optimize parameters of the ST-Transformer spatiotemporal joint detection model by using an improved multi-objective particle swarm optimization algorithm.

[0036] The initialization submodule is configured to initialize a population of the multi-objective particle swarm optimization algorithm, wherein the population is a set of optimization parameters of the model, and at least includes: a number of spatiotemporal attention heads, a feature fusion weight coefficient , and , a time window length and a learning rate decay factor.

[0037] The adjustment submodule is configured to adjust an inertia weight and an acceleration factor and when population diversity < 0.3, the base value of the acceleration factor is increased.

[0038] A population update formula of the multi-objective particle swarm optimization algorithm is as follows:

[0039]

[0040]

[0041] wherein, represents a particle at the i th iteration, represents a particle at the i th iteration. speed, Indicates the first In the next iteration, the particles speed, Indicates the first In the next iteration, the particles Location, Indicates the first In the next iteration, the particles Location, and This represents a random number between (0,1). Represents particles The individual's historical optimal position; Indicates the globally best historical position;

[0042] A submodule is obtained to retain the top 10% of the fittest particles in each generation for the next generation, and to handle particles that have not been updated for three consecutive generations. Perform local perturbation, in New particles are randomly sampled within ±10% of the neighborhood, and the process is repeated 100 times to obtain the optimal parameter set of the algorithm. The optimal parameter set is then substituted into the ST-Transformer spatiotemporal joint detection model.

[0043] Furthermore, in the aforementioned computer network intrusion detection system based on abnormal behavior analysis, the data detection module further includes the following units:

[0044] The data input unit is used to input the feature network traffic data into the target ST-Transformer spatiotemporal joint detection model for detection;

[0045] The scanning and extraction unit is used to scan the protocol field using the depthwise separable convolution kernel in the model, extract the TCP flag combination pattern, and calculate the temporal and spatial attention in the feature network traffic data.

[0046] The divergence calculation unit is used to calculate the KL divergence in the feature network traffic data using the sliding window algorithm. When the KL value is greater than 0.15 for three consecutive windows, the particle swarm algorithm is triggered to update the model parameters.

[0047] The scoring calculation unit is used to project high-dimensional features onto a 2D plane using t-SNE and detect significant shifts in cluster centers to obtain data anomaly scores.

[0048] Furthermore, in the aforementioned computer network intrusion detection system based on abnormal behavior analysis, the proactive response module further includes the following units:

[0049] A grade division unit is configured to perform active response according to grade division of the data anomaly score, automatically deploy a high-interaction honeypot in the target subnet when the score is greater than or equal to 80%, and generate a decoy document matched with the attacker's fingerprint when the score is greater than or equal to 95%.

[0050] A system control unit is configured to control the suspicious process, limit the CPU usage to be less than or equal to 10% and the memory to be less than or equal to 100 MB by using cgroups, and block dangerous system calls by using seccomp.

[0051] A system monitoring unit is configured to enable a copy-on-write mechanism for a sensitive directory and set inotify monitoring for a key configuration file.

[0052] Further, in the computer network intrusion detection method based on abnormal behavior analysis, the computer network intrusion detection method comprises the following steps:

[0053] Network traffic data is collected, and the network traffic data is fused to obtain fused network traffic data.

[0054] GGNN gate graph neural network is used to extract features from the fused network traffic data to obtain feature network traffic data.

[0055] An ST-Transformer space-time joint detection model is established, an improved IPSO particle swarm algorithm is used to optimize parameters of the detection model, and a target ST-Transformer space-time joint detection model is obtained.

[0056] The feature network traffic data is input into the target ST-Transformer space-time joint detection model for detection, and a data anomaly score is output.

[0057] The system performs active response according to the grade division of the data anomaly score, and the active response at least includes dynamic honeypot deployment and resource isolation containment.

[0058] Further, in the computer network intrusion detection method based on abnormal behavior analysis, the collection of network traffic data and the fusion of the network traffic data to obtain fused network traffic data comprise:

[0059] An FPGA acceleration probe is deployed at a network boundary to collect network traffic data, and the network traffic data at least includes network traffic packet sequences, host process call chains, and user operation behavior graphs.

[0060] The network traffic data is time-aligned by using a Lamport logical clock, and the aligned network traffic data is spatially correlated and mapped to obtain initial network traffic data.

[0061] The spatial dimension features in the initial network traffic data are fused, and the space-time features in the initial network traffic data are compressed to obtain fused network traffic data.

[0062] Further, in the computer network intrusion detection method based on abnormal behavior analysis, the ST-Transformer space-time joint detection model is established, including:

[0063] The ST-Transformer space-time joint detection model is constructed based on a double-flow space-time attention mechanism;

[0064] An improved C2FDark backbone network is used to extract target spatial features through multi-scale convolution;

[0065] A dynamic spatial relationship graph is constructed, the potential association of non-adjacent nodes is captured through a graph attention mechanism, and a variable time window mechanism is used to model the time sequence dependence of continuous frames;

[0066] The fusion weight of the spatial and time features is adjusted according to the traffic characteristics of the data, and the calculation formula is as follows:

[0067]

[0068] wherein, represents the fusion weight, represents a Sigmoid activation function, , and represents a fusion weight coefficient, used to measure the relative importance of the spatial features, the time features and the environmental features; represents a spatial feature value, represents a time feature value, represents an environmental feature value.

[0069] Its beneficial effect lies in, through multi-modal space-time fusion and adaptive learning mechanism, significantly improve the threat discovery and disposal ability under complex attack scene. First, build a three-dimensional feature cube across network, host and user layer, use graph attention mechanism to analyze the dynamic association between entities, break through the visual limitation of traditional single-dimensional analysis, accurately capture the hidden behavior patterns of cross-layer attack chain. Second, the space-time joint modeling algorithm fuses local protocol features and long-range dependence relationship, combined with double attention weight distribution, effectively distinguishes normal behavior fluctuation from real attack signal, greatly reduces environmental noise interference. The elastic incremental learning framework continuously tracks the evolution of network behavior, through parameter fine-tuning and history memory playback, ensures the stability of the model while quickly adapting to new attack features. The active response module innovatively converts the detection results into dynamic defense strategies, realizes the closed-loop protection from threat identification to automatic suppression, through intelligent honeypot deployment and resource isolation mechanism, actively disrupts the attacker's operation chain, improves the active confrontation ability of the overall security system. BRIEF DESCRIPTION OF DRAWINGS

[0070] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the application.

[0071] Figure 1 The first embodiment schematic diagram of the computer network intrusion detection system based on abnormal behavior analysis in the embodiment of the application;

[0072] Figure 2 The second embodiment schematic diagram of the computer network intrusion detection system based on abnormal behavior analysis in the embodiment of the application;

[0073] Figure 3 The third embodiment schematic diagram of the computer network intrusion detection system based on abnormal behavior analysis in the embodiment of the application;

[0074] Figure 4 The first embodiment schematic diagram of the computer network intrusion detection method based on abnormal behavior analysis in the embodiment of the application;

[0075] Figure 5 The C2FDark backbone network structure schematic diagram in the computer network intrusion detection method based on abnormal behavior analysis in the embodiment of the application. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical scheme and advantages of the present application clearer, the following will be further described in detail in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0077] As will be understood by one of skill in the art, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. It is further understood that the terms "comprise" and "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0078] The application will be described in greater detail with reference to the drawings, in which Figure 1 As shown in the figure, the computer network intrusion detection system based on abnormal behavior analysis comprises the following modules:

[0079] 101, a data acquisition module, configured to acquire network traffic data, and fuse the network traffic data to obtain fused network traffic data;

[0080] Specifically, the embodiment further comprises,

[0081] The acquisition submodule is configured to deploy an FPGA acceleration probe at a network boundary, and acquire network traffic data, wherein the network traffic data at least comprises a network traffic packet sequence, a host process call chain, and a user operation behavior graph;

[0082] The mapping submodule is configured to perform time alignment on the network traffic data by using a Lamport logical clock, and perform spatial correlation mapping on the aligned network traffic data to obtain initial network traffic data;

[0083] The fusion submodule is configured to fuse spatial dimension features in the initial network traffic data, and compress spatio-temporal features in the initial network traffic data to obtain fused network traffic data.

[0084] 102, a feature extraction module, configured to extract features from the fused network traffic data by using a GGNN gated graph neural network to obtain feature network traffic data;

[0085] Specifically, the embodiment further comprises,

[0086] The type submodule is configured to define entity nodes and edge types of the fused network traffic data, and the entity nodes and edge types at least comprise network layer nodes, host layer nodes, user layer nodes, communication relationship edges, process call edges, and ownership relationship edges;

[0087] The encoding submodule is configured to encode node features of the fused network traffic data to obtain graph structure traffic data, wherein the node features comprise network node feature vectors, host node feature vectors, and user node feature vectors.

[0088] The message function in the graph structure traffic data is defined as :

[0089]

[0090] wherein, represents a node at time step , the hidden state, represents a node at time step , the hidden state, represents edge features, including time delay and frequency, represents training parameters for mapping the concatenated vector to dimensional space, is the dimension of hidden state and ;

[0091] update submodule for defining the gating update mechanism of GGNN as follows:

[0092]

[0093]

[0094]

[0095]

[0096] wherein, represents the update gate output, controlling the fusion ratio of the old hidden state and the new candidate state ; represents the Sigmoid activation function, the output value is between (0, 1); represents the training parameter matrix, acting on the concatenated vector ; represents the reset gate output, controlling the influence degree of the old hidden state and the new candidate state ; represents the training parameter matrix, acting on the concatenated vector ; represents the hyperbolic tangent activation function, normalizing the output value to (-1, 1); represents the update gate output, linearly combining the old hidden state and the new candidate state ; represents the training parameter matrix, acting on the concatenated vector ; represents element-level multiplication;

[0097] A submodule is obtained for performing hierarchical feature extraction on the graph structure traffic data by using a GGNN gated graph neural network to obtain characteristic network traffic data.

[0098] 103. A model establishing module is configured to establish an ST-Transformer spatiotemporal joint detection model, and to perform parameter optimization on the detection model by using an improved IPSO particle swarm algorithm to obtain a target ST-Transformer spatiotemporal joint detection model.

[0099] Specifically, the embodiment further includes,

[0100] A construction submodule is configured to construct an ST-Transformer spatiotemporal joint detection model based on a dual-flow spatiotemporal attention mechanism.

[0101] A spatial feature extraction submodule is configured to extract target spatial features by using an improved C2FDark backbone network through multi-scale convolution,

[0102] A temporal attention fusion submodule is configured to construct a dynamic spatial relationship graph, capture potential correlations of non-adjacent nodes by using a graph attention mechanism, and model the time sequence dependence of continuous frames by using a variable time window mechanism.

[0103] A dynamic weight distribution submodule is configured to adjust the fusion weights of spatial and temporal features according to the traffic characteristics of the data, and the calculation formula is as follows:

[0104]

[0105] Among them, the fusion weight is denoted as the Sigmoid activation function is denoted as , and the fusion weight coefficient is denoted as, which is used to measure the relative importance of the spatial features, the temporal features, and the environmental features. the spatial feature value is denoted as the temporal feature value is denoted as and the environmental feature value is denoted as.

[0106] An optimization submodule is configured to perform global optimization on the parameters of the ST-Transformer spatiotemporal joint detection model by using an improved multi-objective particle swarm optimization algorithm.

[0107] An initialization submodule is configured to initialize the population of the multi-objective particle swarm optimization algorithm, and the population is a set of optimization parameters of the model, and at least includes: the number of spatiotemporal attention heads, the feature fusion weight coefficient , and , the time window length, and the learning rate decay factor.

[0108] an adjusting sub-module, configured to adjust the inertia weight by using a non-linear decreasing strategy and an acceleration factor and when the population diversity is less than 0.3, the base value of the acceleration factor is increased;

[0109] The population updating formula of the multi-objective particle swarm optimization algorithm is as follows:

[0110]

[0111]

[0112] wherein, denotes the speed of the particle at the i-th iteration, denotes the speed of the particle at the i-th iteration, denotes the position of the particle at the i-th iteration, denotes the position of the particle at the i-th iteration, denotes the position of the particle at the i-th iteration, denotes the position of the particle at the i-th iteration, and denotes a random number between 0 and 1, denotes the individual historical optimal position of the particle denotes the global historical optimal position; A retaining submodule is configured to retain the particles with top 10% fitness in each generation to enter the next generation, and perform local disturbance on the particles that have not been updated for three consecutive generations, and randomly sample new particles in a neighborhood of ±10%, and iterate 100 times to obtain an optimal parameter set of the algorithm, and the optimal parameter set is substituted into the ST-Transformer spatiotemporal joint detection model.

[0113]

[0114] 104. A data detection module is configured to input the feature network traffic data into the target ST-Transformer spatiotemporal joint detection model for detection, and output a data anomaly score.

[0115] Specifically, the embodiment further includes,

[0116] A data input unit is configured to input the feature network traffic data into the target ST-Transformer spatiotemporal joint detection model for detection.

[0117] ​​​The scanning extraction unit is configured to scan a protocol field in the model by using a depth separable convolution kernel, extract a TCP flag combination mode, and calculate time attention and space attention in feature network traffic data.

[0118] The divergence calculation unit is configured to calculate KL divergence in the feature network traffic data by using a sliding window algorithm, and trigger a particle swarm algorithm to update model parameters when the KL value is greater than 0.15 for 3 windows.

[0119] The score calculation unit is configured to project high-dimensional features to a 2D plane by using t-SNE, detect significant deviation of a cluster center, and obtain a data anomaly score.

[0120] 105. The active response module is configured to actively respond to the system according to the level division of the data anomaly score, and the active response at least includes dynamic honeypot deployment and resource isolation containment.

[0121] Specifically, the embodiment further includes,

[0122] The level division unit is configured to actively respond to the system according to the level division of the data anomaly score, automatically deploy a high-interaction honeypot in the target subnet when the score is greater than or equal to 80%, and generate a decoy document matched with the attacker's fingerprint when the score is greater than or equal to 95%.

[0123] The system control unit is configured to control the suspicious process, limit CPU usage to be less than or equal to 10% and memory to be less than or equal to 100MB by using cgroups, and block dangerous system calls by using seccomp.

[0124] The system monitoring unit is configured to enable a copy-on-write mechanism for a sensitive directory, and set inotify monitoring for a key configuration file.

[0125] The beneficial effects are that, through the multi-modal spatio-temporal fusion and adaptive learning mechanism, the threat discovery and disposal capability in a complex attack scene is significantly improved. First, a three-dimensional feature cube is constructed across networks, hosts and users, and a graph attention mechanism is used to analyze the dynamic association between entities, breaking through the limitations of traditional single-dimensional analysis, and accurately capturing the hidden behavior patterns of cross-layer attack chains. Second, the spatio-temporal joint modeling algorithm fuses local protocol features and long-range dependencies, and combines double attention weight distribution to effectively distinguish between normal behavior fluctuations and real attack signals, greatly reducing environmental noise interference. The elastic incremental learning framework continuously tracks network behavior evolution, and through parameter fine-tuning, it quickly adapts to new attack features while ensuring model stability. The active response module innovatively converts the detection results into dynamic defense strategies, realizing a closed-loop protection from threat identification to automatic containment, and through intelligent honeypot deployment and resource isolation mechanism, it actively disrupts the attacker's operation chain, improving the active confrontation ability of the overall security system.

[0126] In this embodiment, please refer to Figure 2 The second embodiment of the computer network intrusion detection system based on abnormal behavior analysis in the embodiment of the application, the feature extraction module includes the following sub-modules:

[0127] The type sub-module is used for defining the entity node and edge type of the fused network traffic data, and at least includes a network layer node, a host layer node, a user layer node, a communication relationship edge, a process call edge and a belonging relationship edge.

[0128] The encoding sub-module is used for performing node feature encoding on the fused network traffic data, including a network node feature vector, a host node feature vector and a user node feature vector, to obtain the graph structure traffic data.

[0129] The message function in the graph structure traffic data is defined

[0130]

[0131] wherein, represents the hidden state of the node at the time step , represents the hidden state of the node at the time step , represents the edge feature, including the delay and the frequency, represents the training parameter, used for mapping the spliced vector to a space with a dimension of is the dimension of the hidden state and .

[0132] The update sub-module is used for defining the gating update mechanism of the GGNN gating graph neural network as follows:

[0133]

[0134]

[0135]

[0136]

[0137] wherein, represents the update gate output, controlling the fusion ratio of the old hidden state and the new candidate state ; represents the Sigmoid activation function, and the output value is between (0, 1); represents the training parameter matrix, acting on the spliced vector .​ denotes the reset gate output, controlling the old hidden state and the influence degree of the new candidate state ; denotes the training parameter matrix, acting on the spliced vector ; denotes the hyperbolic tangent activation function, normalizing the output value to (-1, 1); denotes the update gate output, linearly combining the old hidden state and the new candidate state ; denotes the training parameter matrix, acting on the spliced vector ; denotes the element-level multiplication;

[0138] The submodule is used for hierarchical feature extraction of graph structure traffic data by using a GGNN gated graph neural network, to obtain characteristic network traffic data.

[0139] The beneficial effects are that the hierarchical feature extraction of graph structure traffic data by using the GGNN gated graph neural network can improve the accuracy and efficiency of subsequent model analysis and identification of network traffic data abnormal behavior.

[0140] In the embodiment, please refer to Figure 3 , the third embodiment of the computer network intrusion detection system based on abnormal behavior analysis in the embodiment of the application, the model establishment module comprises the following subunits:

[0141] The optimization submodule is used for globally optimizing the parameters of the ST-Transformer space-time joint detection model by using an improved multi-objective particle swarm optimization algorithm.

[0142] The initialization submodule is used for initializing the population of the multi-objective particle swarm optimization algorithm, and the population is a set of optimization parameters of the model, at least comprising: the number of space-time attention heads, the feature fusion weight coefficient , and , the length of the time window and the learning rate decay factor.

[0143] The adjustment submodule is used for adjusting the inertia weight and the acceleration factor and , when the population diversity is less than 0.3, the base value of the acceleration factor is improved.

[0144] The population update formula of the multi-objective particle swarm optimization algorithm is as follows:

[0145]

[0146]

[0147] in, Indicates the first In the next iteration, the particles speed, Indicates the first In the next iteration, the particles speed, Indicates the first In the next iteration, the particles Location, Indicates the first In the next iteration, the particles Location, and This represents a random number between (0,1). Represents particles The individual's historical optimal position; Indicates the globally best historical position;

[0148] A submodule is obtained to retain the top 10% of the fittest particles in each generation for the next generation, and to handle particles that have not been updated for three consecutive generations. Perform local perturbation, in New particles are randomly sampled within ±10% of the neighborhood, and the process is repeated 100 times to obtain the optimal parameter set of the algorithm. The optimal parameter set is then substituted into the ST-Transformer spatiotemporal joint detection model.

[0149] Its beneficial effect is that by using the optimized particle swarm optimization algorithm to optimize the parameters of the ST-Transformer spatiotemporal joint detection model, the stability and recognition accuracy of the model can be improved, thereby enhancing the stability and efficiency of subsequent data detection and recognition.

[0150] The above describes the computer network intrusion detection system based on abnormal behavior analysis provided by the embodiments of the present invention. The following describes the computer network intrusion detection method based on abnormal behavior analysis according to the embodiments of the present invention. Please refer to [link / reference]. Figure 4 One embodiment of the computer network intrusion detection method based on abnormal behavior analysis in this invention includes:

[0151] Step 401: Collect network traffic data and fuse the network traffic data to obtain fused network traffic data;

[0152] Step 402: Use GGNN gated graph neural network to extract features from the fused network traffic data to obtain feature network traffic data;

[0153] Step 403, establish the ST-Transformer spatio-temporal joint detection model, and use the improved IPSO particle swarm algorithm to optimize the parameters of the detection model to obtain the target ST-Transformer spatio-temporal joint detection model;

[0154] Step 404, input the feature network traffic data into the target ST-Transformer spatio-temporal joint detection model for detection, and output the data anomaly score;

[0155] Step 405, the system actively responds according to the grade division of the data anomaly score, and the active response at least includes dynamic honeypot deployment and resource isolation containment.

[0156] Please refer to Figure 5 , the C2FDark backbone network structure diagram in the computer network intrusion detection method based on abnormal behavior analysis in the embodiment of the application.

[0157] The C2FDark backbone network is a core component as a spatial feature extraction module, which is used to extract target spatial features from the fused network traffic data. The design goal is to capture the spatial correlation in the network traffic data through multi-scale convolution operation, so as to provide high-quality feature input for subsequent spatio-temporal joint detection (ST-Transformer).

[0158] 1. Network positioning and function, location: the C2FDark backbone network is located in the spatial feature extraction submodule of the model establishment module. Action: responsible for extracting spatial features from the fused network traffic data (node communication relationship, process call chain, etc.), providing basic feature representation for spatio-temporal joint detection.

[0159] 2. Design of multi-scale convolution, core idea: capture spatial patterns of different granularities through multi-scale convolution (Multi-scale Convolution). Multi-scale convolution: use different size convolution kernels (3x3) to extract local and global features in parallel.

[0160] Advantages: can adapt to different levels of spatial structure in network traffic data (single node behavior, subnet communication mode, cross-layer interaction, etc.). Improvement point, introduce depthwise separable convolution (Depthwise Separable Convolution) to reduce the amount of calculation. Residual connection, through the jump connection (Residual Connections) to alleviate the problem of gradient disappearance, improve the efficiency of feature transmission. Attention mechanism combined with channel attention (SE Block) or spatial attention, enhance the weight of important features.

[0161] 3. Processing of input data, input form: fused network traffic data (graph structure traffic data). The data contains entity nodes (network layer, host layer, user layer nodes) and edge types (communication relationship, process call, etc.). Node features are encoded to form vectors (such as network node feature vectors, host node feature vectors, etc.). Preprocessing: The original graph data may be spatially associated and mapped (such as adjacency matrix construction), and the relationship between nodes and edges is converted into a tensor format suitable for convolution operation.

[0162] 4. Network structure speculation (based on context), as the document does not provide a complete structure diagram of C2FDark, combined with the context and technical background, it is speculated that it may contain the following components: multi-scale convolutional layer: parallel stacking of multiple convolution kernels of different sizes (3x3) to extract multi-scale features. Each branch is followed by a nonlinear activation (ReLU) and a normalization layer (such as BatchNorm).

[0163] Feature fusion layer, concatenating the outputs of multi-scale convolution in the channel dimension to form high-dimensional features. Or generate a unified representation through weighted fusion (Global Average Pooling + fully connected layer). Down-sampling layer: using pooling operations (MaxPooling or Strided Convolution) to gradually reduce the spatial dimension and preserve key features. Improvement point, lightweight design uses C2F module (similar to the structure in YOLOv7), which improves efficiency through grouped convolution and cross-layer connection. Dynamic adjustment: dynamically adjust the size of the convolution kernel or the number of channels according to the spatio-temporal characteristics of the input data.

[0164] Output and subsequent process, the extracted spatial feature vector is one of the inputs of the ST-Transformer model. Subsequent processing: spatio-temporal joint modeling: combine spatial features with temporal features (extracted through graph attention mechanism) and use the dual-flow attention mechanism of ST-Transformer for fusion.

[0165] Multi-modal spatial modeling, C2FDark solves the limitations of single-scale analysis in traditional methods through multi-scale convolution, which can capture hidden behavior patterns of cross-layer attack chains (such as horizontal penetration, abnormal communication patterns). Collaborate with graph neural networks, GGNN (gated graph neural network) extracts node-level features that complement the multi-scale spatial features of C2FDark, together building a three-dimensional feature cube to enhance the model's adaptability to complex attack scenarios.

[0166] The above shows and describes the basic principles, main features and advantages of the present application. Those skilled in the art should understand that the present application is not limited to the above-mentioned embodiments, and the above-mentioned embodiments and descriptions in the specification are only preferred examples of the present application and are not intended to limit the present application. Various modifications and improvements can be made to the present application without departing from the spirit and scope of the present application, and these modifications and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A computer network intrusion detection system based on abnormal behavior analysis, characterized in that, The computer network intrusion detection system includes the following modules: The data acquisition module is used to collect network traffic data and fuse the network traffic data to obtain fused network traffic data. The feature extraction module is used to extract features from the fused network traffic data using a GGNN gated graph neural network to obtain feature network traffic data. The feature extraction module includes the following sub-modules: The type submodule is used to define the entity nodes and edge types of the fused network traffic data, including at least network layer nodes, host layer nodes, user layer nodes, communication relationship edges, process call edges, and affiliation relationship edges; The encoding submodule is used to encode the node features of the fused network traffic data, including network node feature vectors, host node feature vectors and user node feature vectors, to obtain graph structure traffic data. Define the message functions in the graph structure traffic data. : ； in, Represents a node At time step The hidden state, Represents a node At time step The hidden state, The edge features are represented, including latency and frequency. Represents the training parameters, used to map the concatenated vector to... 3D space Hidden state and Dimensions This represents a vector concatenation operation; The update submodule defines the gating update mechanism of the GGNN gated graph neural network as follows: ； ； ； ； in, This indicates an update to the gate output, controlling the old hidden state. With new candidate status The fusion ratio; This represents the Sigmoid activation function, with output values ​​between (0,1); This represents the training parameter matrix, which is applied to the concatenated vector. ; This indicates that the gate output is reset, controlling the old hidden state. With new candidate status The extent of the impact; This represents the training parameter matrix, which is applied to the concatenated vector. ; This represents the hyperbolic tangent activation function, which normalizes the output value to (-1, 1); This indicates that the gate output is updated, and the old hidden state is linearly combined. and new candidate status ; This represents the training parameter matrix, which is applied to the concatenated vector. ; Represents element-wise multiplication; A submodule is obtained, which is used to perform hierarchical feature extraction on the graph structure traffic data using the GGNN gated graph neural network to obtain feature network traffic data; The model building module is used to build the ST-Transformer spatiotemporal joint detection model. The multi-objective particle swarm optimization algorithm is used to optimize the parameters of the detection model to obtain the target ST-Transformer spatiotemporal joint detection model. The model building module includes the following sub-modules: A submodule is constructed to build the ST-Transformer spatiotemporal joint detection model based on a dual-stream spatiotemporal attention mechanism. The spatial feature extraction submodule utilizes the improved C2FDark backbone network to extract target spatial features through multi-scale convolution. The temporal attention fusion submodule is used to construct a dynamic spatial relationship graph. It captures the potential associations between non-adjacent nodes through a graph attention mechanism and models the temporal dependencies of consecutive frames using a variable time window mechanism. The dynamic weight allocation submodule is used to adjust the fusion weights of spatial and temporal features based on the data's traffic characteristics. The calculation formula is as follows: ； in, Indicates the fusion weight. This represents the Sigmoid activation function. , and This represents the fusion weighting coefficient, used to measure the relative importance of spatial characteristics, temporal characteristics, and external network threats; Represents spatial eigenvalues. Represents time feature values, Indicates the external network threat value; The data detection module is used to input the characteristic network traffic data into the target ST-Transformer spatiotemporal joint detection model for detection and output a data anomaly score. The proactive response module is used by the system to proactively respond based on the level classification of the data anomaly score. The proactive response includes at least dynamic honeypot deployment and resource isolation and containment.

2. The computer network intrusion detection system based on abnormal behavior analysis as described in claim 1, characterized in that, The data acquisition module includes the following sub-modules: The acquisition submodule is used to deploy FPGA-accelerated probes at the network boundary to acquire network traffic data, which includes at least network traffic packet sequences, host process call chains, and user operation behavior graphs. The mapping submodule is used to time-align the network traffic data using the Lamport logical clock, and then spatially correlate and map the aligned network traffic data to obtain the initial network traffic data. The fusion submodule is used to fuse the spatial dimension features in the initial network traffic data and compress the spatiotemporal features in the initial network traffic data to obtain fused network traffic data.

3. The computer network intrusion detection system based on abnormal behavior analysis as described in claim 1, characterized in that, The model building module also includes the following sub-modules: The optimization submodule is used to globally optimize the parameters of the ST-Transformer spatiotemporal joint detection model using a multi-objective particle swarm optimization algorithm. The initialization submodule is used to initialize the population of the multi-objective particle swarm optimization algorithm. The population is the set of optimization parameters for the model, which includes at least: the number of spatiotemporal attention heads and feature fusion weight coefficients. , and Time window length and learning rate decay factor; The adjustment submodule is used to adjust the inertia weights using a non-linear decreasing strategy. and acceleration factor and When population diversity < 0.3, increase the base value of the acceleration factor; The population update formula for the multi-objective particle swarm optimization algorithm is as follows: ； ； in, Indicates the first In the next iteration, the particles speed, Indicates the first In the next iteration, the particles speed, Indicates the first In the next iteration, the particles Location, Indicates the first In the next iteration, the particles Location, and This represents a random number between (0,1). Represents particles The individual's historical optimal position; Indicates the globally best historical position; A submodule is obtained to retain the top 10% of the fittest particles in each generation for the next generation, and to handle particles that have not been updated for three consecutive generations. Perform local perturbation, in New particles are randomly sampled within ±10% of the neighborhood, and the process is repeated 100 times to obtain the optimal parameter set of the algorithm. The optimal parameter set is then substituted into the ST-Transformer spatiotemporal joint detection model.

4. The computer network intrusion detection system based on abnormal behavior analysis as described in claim 1, characterized in that, The data detection module also includes the following units: The data input unit is used to input the feature network traffic data into the target ST-Transformer spatiotemporal joint detection model for detection; The scanning and extraction unit is used to scan the protocol field using the depthwise separable convolution kernel in the model, extract the TCP flag combination pattern, and calculate the temporal and spatial attention in the feature network traffic data. The divergence calculation unit is used to calculate the KL divergence in the feature network traffic data using the sliding window algorithm. When the KL value is greater than 0.15 for three consecutive windows, the particle swarm algorithm is triggered to update the model parameters. The scoring calculation unit is used to project high-dimensional features onto a 2D plane using t-SNE and detect significant shifts in cluster centers to obtain data anomaly scores.

5. The computer network intrusion detection system based on abnormal behavior analysis as described in claim 1, characterized in that, The active response module also includes the following units: The rating unit is used by the system to actively respond based on the rating of the data anomaly score. When the score is ≥80%, a high-interaction honeypot is automatically deployed in the target subnet. When the score is ≥95%, a decoy document matching the attacker's fingerprint is generated. The system control unit is used to control suspicious processes, using cgroups to limit CPU usage to ≤10% and memory usage to ≤100MB, and using seccomp to block dangerous system calls; The system monitoring unit is used to enable copy-on-write mechanism for sensitive directories and to set up inotify monitoring for critical configuration files.

6. A detection method for a computer network intrusion detection system based on abnormal behavior analysis according to any one of claims 1-5, characterized in that, The detection method includes the following steps: Collect network traffic data, and fuse the network traffic data to obtain fused network traffic data; Feature network traffic data is obtained by using a GGNN gated graph neural network to extract features from the fused network traffic data. A spatiotemporal joint detection model of ST-Transformer was established, and the parameters of the detection model were optimized by a multi-objective particle swarm optimization algorithm to obtain the target ST-Transformer spatiotemporal joint detection model. The characteristic network traffic data is input into the target ST-Transformer spatiotemporal joint detection model for detection, and an anomaly score is output. The system takes proactive measures based on the level classification of the data anomaly score. The proactive measures include at least dynamic honeypot deployment and resource isolation and containment.

7. The computer network intrusion detection method based on abnormal behavior analysis as described in claim 6, characterized in that, The process of collecting network traffic data and fusing the network traffic data to obtain fused network traffic data includes: FPGA acceleration probes are deployed at the network boundary to collect network traffic data, which includes at least network traffic packet sequences, host process call chains, and user operation behavior graphs. The network traffic data is time-aligned using the Lamport logical clock, and the aligned network traffic data is spatially correlated and mapped to obtain the initial network traffic data. The spatial dimension features in the initial network traffic data are fused, and the spatiotemporal features in the initial network traffic data are compressed to obtain fused network traffic data.

8. The computer network intrusion detection method based on abnormal behavior analysis as described in claim 7, characterized in that, The establishment of the ST-Transformer spatiotemporal joint detection model includes: The ST-Transformer spatiotemporal joint detection model is constructed based on a dual-stream spatiotemporal attention mechanism. By utilizing the improved C2FDark backbone network, spatial features of the target are extracted through multi-scale convolution; A dynamic spatial relationship graph is constructed, and the potential associations between non-adjacent nodes are captured through the graph attention mechanism. The temporal dependency of consecutive frames is modeled using the variable time window mechanism. The fusion weights of spatial and temporal features are adjusted based on the data's flow characteristics, calculated using the following formula: ； in, Indicates the fusion weight. This represents the Sigmoid activation function. , and This represents the fusion weighting coefficient, used to measure the relative importance of spatial characteristics, temporal characteristics, and external network threats; Represents spatial eigenvalues. Represents time feature values, This indicates the external network threat value.

Images