Network security monitoring device and method thereof

Abstract

The invention discloses a network security monitoring device and method, and relates to the technical field of network security. The method comprises the steps of firstly obtaining and cleaning an original data set, then performing feature construction and label processing on the cleaned data based on a lightweight feature type determined through feature screening to obtain a first feature set, then converting the dimension of the first feature set into a two-dimensional feature matrix set, substituting the two-dimensional feature matrix set into a probability detection model to obtain a monitoring and early warning probability value, and performing early warning. And finally, comparing with an early warning threshold to obtain an early warning result. According to the scheme, the data processing efficiency and key information retention are both considered by means of lightweight feature construction, the accuracy of the early warning probability value is improved through feature enhancement, the final early warning result is more reliable, and therefore the monitoring efficiency is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network security monitoring device and a method thereof. BACKGROUND

[0002] With the rapid development of information technology, networks have become the core infrastructure of social operation, economic development and personal life, but they are also facing increasingly complex and diverse security threats, such as malicious attacks, virus invasions, data breaches, etc. These threats not only cause network service interruptions, but also may cause significant economic losses and information security risks. Therefore, building an efficient and accurate network security monitoring system to realize real-time perception and early warning of network abnormal states has become a key requirement for network security. Traditional network security monitoring methods directly use full features for analysis, and redundant features may interfere with the identification of key threat features by the model.

[0003] Patent CN119603069A discloses a computer network information security monitoring method, which relates to the technical field of network information security monitoring. The monitoring and collecting module is used to monitor and collect network traffic data in real time, and extract historical network traffic data. The comprehensive evaluation and adjustment module is used to judge the abnormality degree of the current traffic, evaluate the overall risk level of network security, and adjust the network security strategy, and generate a strategy adjustment report. Based on the strategy adjustment report, the security execution module is used to execute the adjusted network security strategy. The monitoring and collecting module is used to continuously monitor the network traffic. The invention realizes the beneficial effects and optimization and innovation of comprehensive evaluation, dynamic risk assessment, flexible strategy adjustment and improved sensitivity. These optimizations and innovations not only solve the problems and deficiencies of existing technologies, but also improve the accuracy and reliability of the monitoring system, providing more comprehensive and effective protection for computer network information security. However, the use of full features for analysis and calculation results in low data processing efficiency, and redundant features may interfere with the identification of key threat features by the model, thereby reducing the monitoring efficiency. SUMMARY

[0004] The purpose of the present application is to solve the problem of low monitoring efficiency, and to provide a network security monitoring device and a method thereof.

[0005] In the first aspect of the present application, a network security monitoring method is first proposed, which comprises:

[0006] obtaining an original data set; the original data set is traffic data for network security monitoring on a time series;

[0007] performing data cleaning on the original data set to obtain a cleaned data set;

[0008] Performing feature construction and label processing of the light feature type on the cleaned data set to obtain a first feature set; the light feature type is a subset of a preset feature parameter set;

[0009] Performing dimension conversion on each first feature in the first feature set to obtain a two-dimensional feature matrix set;

[0010] Substituting the two-dimensional feature matrix set into a probability detection model to obtain a monitoring and early warning probability value;

[0011] Comparing the monitoring and early warning probability value with a warning threshold to obtain a warning result.

[0012] Optionally, before the method of performing feature construction and label processing of the light feature type on the cleaned data set to obtain a first feature set, the method further comprises:

[0013] Obtaining historical traffic data of network security monitoring and extracting feature parameters to obtain a preset feature parameter set;

[0014] Performing importance scoring on the feature parameter set to obtain a feature parameter weight value set;

[0015] Analyzing the feature correlation of the feature parameter set to obtain an association weight value set;

[0016] Mapping the feature parameter weight set and the association feature weight set to a two-dimensional graph; wherein the abscissa of the two-dimensional graph is the association weight value, and the ordinate is the feature parameter weight value;

[0017] Calculating the density value of the feature parameter aggregation area in the two-dimensional graph by the network density method to obtain an aggregation area density value set;

[0018] If the density value in the aggregation area density value set is greater than a preset density value, marking the aggregation area as a potential danger area;

[0019] Arranging the feature parameter weight values in descending order, and screening feature parameters corresponding to preset proportion feature parameter weight values to obtain a first feature parameter type;

[0020] Marking the first feature parameter in the potential danger area to obtain a light feature type.

[0021] Optionally, aggregating the light feature type in the cleaned data set in a preset time window to obtain a light feature set;

[0022] Performing single-hot encoding and then normalization on the light feature set to obtain a first light feature set;

[0023] Labeling the light feature set by a public data set to obtain a labeled feature set; the label labeling includes a security state and an attacked state;

[0024] Encoding the label feature set to obtain an encoded label feature set;

[0025] Aligning the first light feature of the first light feature set and the encoded label feature of the encoded label feature set by time stamp to obtain a first feature set.

[0026] Optionally, the length of the first feature in the first feature set is counted to obtain a feature length;

[0027] Square root of the feature length is taken and rounded up to obtain a target dimension;

[0028] The first feature in the first feature set is filled with zero values to make the length of the first feature meet the square of the target dimension to obtain a standard feature set;

[0029] The standard feature set is dimensionally converted to obtain a two-dimensional feature matrix set.

[0030] Optionally, the two-dimensional feature matrix set is traversed, and the continuous two-dimensional feature matrices are spliced by a sliding fusion window according to the channel dimension to obtain a fusion feature matrix set; the label feature of the fusion feature matrix in the fusion feature matrix set is the label feature corresponding to the last fused two-dimensional feature matrix;

[0031] The fusion feature matrix in the fusion feature matrix set is sequentially subjected to 1*3 convolution and 3*1 convolution to obtain a first convolution matrix;

[0032] The first convolution matrix is subjected to 1*1 point-by-point convolution to obtain a second convolution matrix;

[0033] The second convolution matrix is subjected to 2*2 average pooling to obtain a convolution pooling matrix;

[0034] The convolution pooling matrix is subjected to a flattening operation to obtain a first pool vector;

[0035] The first pool vector is subjected to non-linear transformation and feature mapping through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector;

[0036] The fully connected feature vector is subjected to probabilistic processing through a softmax layer with a softmax activation function to obtain a monitoring and early warning probability value.

[0037] In a second aspect of the embodiment of the present application, a network security monitoring device is provided, comprising:

[0038] An original data set generation module is configured to obtain an original data set; the original data set is a time series of flow data for network security monitoring;

[0039] The cleaning dataset generation module is configured to clean the original dataset to obtain a cleaned dataset;

[0040] The first feature set generation module is configured to construct and label features of a lightweight feature type based on the cleaned dataset to obtain a first feature set. The lightweight feature type is a subset of a preset feature parameter set.

[0041] The two-dimensional feature matrix set generation module is configured to convert the dimensions of each first feature in the first feature set to obtain a two-dimensional feature matrix set.

[0042] The monitoring and early warning probability value generation module is configured to substitute the two-dimensional feature matrix set into a probability detection model to obtain a monitoring and early warning probability value.

[0043] The early warning result generation module is configured to compare the monitoring and early warning probability value with an early warning threshold to obtain an early warning result.

[0044] Optionally, the first feature set generation module further includes:

[0045] The feature parameter set generation module is configured to obtain historical traffic data of network security monitoring and extract feature parameters to obtain a preset feature parameter set.

[0046] The feature parameter weight value set generation module is configured to score the importance of the feature parameter set to obtain a feature parameter weight value set.

[0047] The correlation weight value set generation module is configured to analyze the feature correlation of the feature parameter set to obtain a correlation weight value set.

[0048] The two-dimensional graph generation module is configured to map the feature parameter weight set and the correlation feature weight set to a two-dimensional graph. In the two-dimensional graph, the abscissa is the correlation weight value, and the ordinate is the feature parameter weight value.

[0049] The aggregated area density value set generation module is configured to calculate the density values of the feature parameter aggregated areas in the two-dimensional graph by a network density method to obtain an aggregated area density value set.

[0050] The potential danger area generation module is configured to mark the aggregated areas as potential danger areas if the density values in the aggregated area density value set are greater than a preset density value.

[0051] The first feature parameter type generation module is configured to arrange the feature parameter weight values in descending order, and screen feature parameters corresponding to preset proportion feature parameter weight values to obtain a first feature parameter type.

[0052] The lightweight feature type generation module is configured to mark the first feature parameters in the potential danger areas to obtain a lightweight feature type.

[0053] Optionally, the first feature set generation module comprises:

[0054] a lightweight feature set generation module configured to aggregate the cleaning data in the cleaning data set by the lightweight feature type to obtain a lightweight feature set through a preset time window;

[0055] a first lightweight feature set generation module configured to perform single-hot encoding and normalization on the lightweight feature set to obtain a first lightweight feature set;

[0056] a label feature set generation module configured to perform label annotation on the lightweight feature set by the public data set to obtain a label feature set; the label annotation comprises a security state and an attack state;

[0057] an encoded label feature set generation module configured to encode the label feature set to obtain an encoded label feature set;

[0058] a first feature set generation module configured to align the first lightweight features of the first lightweight feature set and the encoded label features of the encoded label feature set by timestamps to obtain a first feature set.

[0059] Optionally, the two-dimensional feature matrix set generation module comprises:

[0060] a feature length generation module configured to count the length of the first features in the first feature set to obtain a feature length;

[0061] a target dimension generation module configured to square and round up the feature length to obtain a target dimension;

[0062] a standard feature set generation module configured to fill the first features in the first feature set with zero values to make the length of the first features meet the square of the target dimension to obtain a standard feature set;

[0063] a two-dimensional feature matrix set generation module configured to perform dimension conversion on the standard feature set to obtain a two-dimensional feature matrix set.

[0064] Optionally, the monitoring and early warning probability value generation module comprises:

[0065] a fused feature matrix set generation module configured to traverse the two-dimensional feature matrix set, and perform channel dimension splicing on the continuous two-dimensional feature matrices through a sliding fusion window to obtain a fused feature matrix set; the label features of the fused feature matrices in the fused feature matrix set are the label features corresponding to the last fused two-dimensional feature matrix;

[0066] a first convolution matrix generation module configured to sequentially perform 1x3 convolution and 3x1 convolution on the fused feature matrices in the fused feature matrix set to obtain a first convolution matrix;

[0067] a second convolution matrix generation module configured to perform 1*1 point-wise convolution on the first convolution matrix to obtain a second convolution matrix;

[0068] a convolution pooling matrix generation module configured to perform 2*2 average pooling on the second convolution matrix to obtain a convolution pooling matrix;

[0069] a first convolution pooling vector generation module configured to perform flattening operation on the convolution pooling matrix to obtain a first convolution pooling vector;

[0070] a fully connected feature vector generation module configured to perform non-linear transformation and feature mapping on the first convolution pooling vector through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector;

[0071] a monitoring and early warning probability value generation module configured to perform probabilistic processing on the fully connected feature vector through a softmax layer with a softmax activation function to obtain a monitoring and early warning probability value.

[0072] The present application proposes a network security monitoring method, which first acquires an original data set and cleans it, then performs feature construction and label processing on the cleaned data based on a light feature type determined through feature screening to obtain a first feature set, then converts its dimension to a two-dimensional feature matrix set, substitutes it into a probability detection model to obtain a monitoring and early warning probability value, and finally compares it with a warning threshold to obtain a warning result. BRIEF DESCRIPTION OF DRAWINGS

[0073] The present application will be further described below in conjunction with the accompanying drawings.

[0074] Figure 1 A flowchart of a network security monitoring method provided by an embodiment of the present application;

[0075] Figure 2 A structural schematic diagram of a network security monitoring device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0076] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present application.

[0077] All other embodiments obtained by a person of ordinary skill in the art without creative labor based on the embodiments of the present application shall fall within the protection scope of the present application.

[0078] The embodiment of the present application provides a network security monitoring method. Figure 1 , Figure 1 The embodiment of the present application provides a flowchart of the network security monitoring method. The method comprises the following steps:

[0079] S101, obtaining an original data set;

[0080] S102, performing data cleaning on the original data set to obtain a cleaned data set;

[0081] S103, performing feature construction and label processing of a lightweight feature type on the cleaned data set to obtain a first feature set;

[0082] S104, performing dimension conversion on each first feature in the first feature set to obtain a two-dimensional feature matrix set;

[0083] S105, substituting the two-dimensional feature matrix set into a probability detection model to obtain a monitoring early warning probability value;

[0084] S106, comparing the monitoring early warning probability value with a warning threshold to obtain a warning result;

[0085] The original data set is traffic data for network security monitoring on a time sequence; and the lightweight feature type is a subset of a preset feature parameter set.

[0086] In an implementation manner, the data cleaning is repairing or deleting incorrect, repeated or incomplete data in the public data set. For example, when the numerical value format of some attribute fields does not conform to the specification, the incorrect data needs to be repaired and converted into a correct format; the repeated records are directly deleted to avoid interference of the repeated data on model training; and the incomplete records with missing key attributes are also deleted to ensure the quality of the data set.

[0087] Based on the network security monitoring method provided by the embodiment of the present application, the original data set is obtained and cleaned, then the first feature set is obtained by performing feature construction and label processing on the cleaned data based on the lightweight feature type determined through feature screening, then the dimension conversion is performed on the first feature set to obtain the two-dimensional feature matrix set, the monitoring early warning probability value is obtained by substituting the two-dimensional feature matrix set into the probability detection model, and finally the warning result is obtained by comparing the monitoring early warning probability value with the warning threshold. The scheme not only considers the efficiency of data processing and the reservation of key information by means of the lightweight feature construction, but also improves the accuracy of the early warning probability value through feature strengthening, so that the final warning result is more reliable, thereby improving the monitoring efficiency.

[0088] In an implementation, data is collected from the time dimension, which can record the change process of network traffic over time and capture the dynamic characteristics of network behavior. Some network attacks may have specific time patterns, such as attacks launched in a specific time period. Time series collection can include these patterns in the original data set, providing a basis for subsequent analysis of attack patterns. The original data set covers first-hand information of network traffic, which has not been processed multiple times and retains the integrity and authenticity of the data. This enables subsequent feature construction and analysis to be based on comprehensive and reliable data, reducing analysis errors caused by data loss or distortion.

[0089] In an implementation, lightweight feature types are used for feature construction, which can reduce the complexity of data processing and the consumption of computing resources while ensuring the effectiveness of the features. Lightweight features are key features selected to avoid interference from redundant features in the analysis process and improve processing efficiency. Label processing gives the features a clear meaning, such as security status and attack status, which makes the first feature set have classification attributes. This provides supervision information for subsequent model training and early warning probability calculation, which helps to improve the accuracy of the model in judging the network status.

[0090] In an implementation, feature enhancement processing can deeply mine key information hidden in the first feature set to enhance the discrimination of the features. Through a series of processing operations, the original features are converted into higher-order features that are more representative, thus more accurately reflecting the security status of the network. The monitoring and early warning probability value obtained is a quantitative indicator that can intuitively represent the likelihood of the network being in an attack state. Compared with simple feature description, the probability value is more convenient for threshold judgment and decision-making, providing a clear reference for network security early warning.

[0091] In one embodiment, the method further comprises, before the first feature set is obtained by performing lightweight feature type feature construction and label processing on the cleaned data set:

[0092] Obtaining historical traffic data for network security monitoring and extracting feature parameters to obtain a set of preset feature parameters;

[0093] Performing importance scoring on the set of feature parameters to obtain a set of feature parameter weight values;

[0094] Performing feature correlation analysis on the set of feature parameters to obtain a set of correlation weight values;

[0095] Mapping the set of feature parameter weights and the set of correlation feature weights to a two-dimensional graph; wherein the horizontal coordinate of the two-dimensional graph is the correlation weight value and the vertical coordinate is the feature parameter weight value;

[0096] The density value set of the aggregation area is obtained by calculating the density value of the aggregation area in the two-dimensional graph through the network density method.

[0097] If the density value in the density value set of the aggregation area is greater than a preset density value, the aggregation area is marked as a potential danger area.

[0098] The feature parameter weight values are arranged in descending order, and the feature parameters corresponding to the preset proportion of feature parameter weight values are screened to obtain a first feature parameter type.

[0099] The first feature parameter in the potential danger area is marked as a lightweight feature type.

[0100] In an implementation, the obtained historical traffic data includes the size of a data packet, a source IP address, a destination IP address, a port number, a protocol type, a transmission time, etc. For the collected historical traffic data, specific algorithms and techniques are used to extract feature parameters, which are key indicators that can reflect the characteristics and behaviors of network traffic. For example, through descriptive statistics and quantile methods, basic features such as mean value, standard deviation, and protocol proportion are obtained from raw data such as packet size, transmission time, and protocol type. With time series techniques such as sliding window, Fourier transform, and moving average, short-term changes, periodicity, and long-term trends of traffic are captured. Based on protocol state analysis and session feature extraction of finite state machines, behavior characteristics that conform to protocol specifications can be mined, such as TCP half-connection number and session duration. High-dimensional data is processed using feature engineering and dimensionality reduction techniques such as aggregation encoding and PCA to simplify features and retain key information. Entropy calculation, mutual information analysis, and other anomaly detection-oriented techniques can extract features that distinguish between normal and abnormal. These techniques are usually combined to convert raw data into quantifiable and comparable key indicators, serving network monitoring, anomaly detection, and other scenarios. By extracting these feature parameters, raw traffic data is converted into a more analytically valuable form for further in-depth analysis.

[0101] In an implementation, the feature parameter weight value set is obtained by i The number of times that the feature parameter value corresponding to the i-th feature parameter exceeds a preset parameter threshold in the total number n of historical danger state samples.

[0102] The higher the proportion of the feature parameter exceeding the threshold in the danger state sample, the more likely the feature parameter is to appear abnormal in the danger state, indicating that the feature parameter is more closely related to the danger state.

[0103] In an implementation, the feature parameter weight value set is obtained by ​The feature correlation of the feature parameter set is analyzed to obtain a correlation weight value set, wherein r ij is the correlation coefficient of the i th feature parameter and the j th feature parameter calculated by the Pearson coefficient, ∑ j≠i |r ij | is the sum of the absolute values of the correlation coefficients of the i th feature and all other features, reflecting the total correlation strength with the global feature, and N is the total number of historical samples.

[0104] The Pearson coefficient is used to objectively quantify the linear correlation of the features, and a mathematical index is used to replace subjective judgment, which is accurate and unbiased. From a global perspective, the synergistic relationship between the features and other features is considered by the total correlation strength, avoiding the one-sidedness of manual screening. The calculation result directly reflects the correlation of the features to the global, which has strong interpretability and helps feature screening and anomaly detection, providing an effective analysis tool for multi-dimensional scenarios such as network traffic.

[0105] In an implementation manner, the preset density value is obtained according to analysis of a large amount of historical data; when the calculated density value of the aggregation area is greater than the preset density value, it indicates that the degree of aggregation of the feature parameters in the area is high, and the possibility of abnormality is greater; therefore, such an aggregation area is marked as a potential danger area. The combination of feature parameters in the potential danger area may represent a mode different from the normal network traffic behavior, implying that there may be a security threat in the network.

[0106] In an implementation manner, the first feature parameters located in the potential danger area are marked, and these marked feature parameters constitute a lightweight feature type; the lightweight feature type not only has high importance, but also is related to the potential network security threat. In subsequent network security monitoring, focusing on these lightweight feature types can more efficiently detect and identify security risks in the network, reducing the amount of calculation and resource consumption, and meeting the requirements of lightweight monitoring.

[0107] In one embodiment, the lightweight feature set is obtained by aggregating the lightweight feature type of the cleaning data in the cleaning data set through a preset time window;

[0108] The first lightweight feature set is obtained by one-hot encoding and then normalizing the lightweight feature set;

[0109] The labeled feature set is obtained by labeling the lightweight feature set through a public data set; the label annotation includes a security state and an attack state;

[0110] The encoded labeled feature set is obtained by encoding the labeled feature set;

[0111] The first feature set is obtained by aligning the first lightweight feature of the first lightweight feature set and the encoded labeled feature of the encoded labeled feature set according to the timestamp.

[0112] In an implementation, the original discrete data is converted into more representative aggregated features by aggregating different lightweight feature types within a preset time window, and the instantaneous time series data is converted into trend features, to obtain a lightweight feature set, wherein the preset time window is set by a technician.

[0113] In an implementation, one-hot encoding is used to process the categorical features that may exist in the lightweight feature set. For each categorical lightweight feature, it is converted into a binary vector, where only one position is 1 and the other positions are 0. The position of the 1 corresponds to the index of the category among all possible categories. For example, for the lightweight feature of protocol type, if there are categories such as TCP, UDP, and HTTP, TCP is encoded as [1, 0, 0], UDP is encoded as [0, 1, 0], and HTTP is encoded as [0, 0, 1]. Normalization can be Z-score normalization, etc.

[0114] In an implementation, the lightweight features include network traffic related features. These features are used to train a machine learning model with the labels provided in the public dataset, so that the lightweight features can be labeled to determine whether the network is in a safe state at the current or future time point.

[0115] In an implementation, the labels in the label feature set are usually encoded in binary form, such as encoding the safe state as 0 and the attack state as 1. Through this encoding method, the text labels in the label feature set are converted into numerical form to obtain an encoded label feature set. Such encoding form is easier to use in subsequent feature alignment and model training operations.

[0116] In one embodiment, the length of the first feature in the first feature set is counted to obtain a feature length;

[0117] The square root of the feature length is taken and rounded up to obtain a target dimension;

[0118] The first feature in the first feature set is padded with zeros to make the length of the first feature meet the square of the target dimension to obtain a standard feature set;

[0119] The standard feature set is dimensionally converted to obtain a two-dimensional feature matrix set.

[0120] In an implementation, all first features are padded with zeros to make the length of each first feature uniform to the square of the target dimension to obtain a standard feature set. After this processing, all features have consistency in length, which facilitates subsequent uniform dimension conversion and processing.

[0121] In one embodiment, a set of two-dimensional feature matrices is traversed, and a set of fused feature matrices is obtained by concatenating the continuous two-dimensional feature matrices in the channel dimension through a sliding fusion window; the label feature of the fused feature matrix in the set of fused feature matrices is the label feature corresponding to the last fused two-dimensional feature matrix;

[0122] The fused feature matrix in the set of fused feature matrices is sequentially subjected to 1x3 convolution and 3x1 convolution to obtain a first convolution matrix;

[0123] The first convolution matrix is subjected to 1x1 point-by-point convolution to obtain a second convolution matrix;

[0124] The second convolution matrix is subjected to 2x2 average pooling to obtain a convolution-pooling matrix;

[0125] The convolution-pooling matrix is subjected to a flattening operation to obtain a first pool vector;

[0126] The first pool vector is subjected to nonlinear transformation and feature mapping through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector;

[0127] The fully connected feature vector is subjected to probabilistic processing through a softmax layer with a softmax activation function to obtain a monitoring and early warning probability value.

[0128] In one implementation, when the size of the sliding fusion window is 3, the first, second, and third two-dimensional feature matrices are selected, and then the two-dimensional feature matrices are concatenated in the channel dimension. For a two-dimensional feature matrix, it can be regarded as a matrix with one channel; by concatenating in the channel dimension, multiple two-dimensional feature matrices are merged into a fused feature matrix with higher dimension; this way of sliding fusion window and concatenating in the channel dimension can fuse the feature information on the continuous time sequence, extract more representative features, and retain the corresponding label features for subsequent feature enhancement and monitoring and early warning probability value calculation.

[0129] In an implementation, a 1x3 convolution operation uses a 1-row 3-column convolution kernel. The logic is to extract the local features of the two-dimensional matrix in the horizontal direction by sliding the convolution kernel on the two-dimensional matrix row by row, using the multiplication and summation operation of the convolution kernel and the corresponding position elements of the two-dimensional matrix. When the convolution kernel slides on the two-dimensional matrix, each calculation is performed on a group of three elements covered by the convolution kernel. After obtaining the intermediate result matrix of the 1x3 convolution, a 3x1 convolution operation is performed. Here, a 3-row 1-column convolution kernel is used, and the operation is similar to the 1x3 convolution, but the direction is changed to the vertical direction. The convolution kernel slides on the intermediate result matrix column by column, and the multiplication and summation operation of the convolution kernel and the corresponding position elements are also performed each time. Through these two convolution operations in different directions, the features of the original two-dimensional matrix are extracted and integrated from different angles to obtain a first convolution matrix. The first convolution matrix integrates the local feature information in the horizontal and vertical directions, laying a foundation for subsequent more in-depth feature analysis and processing.

[0130] In an implementation, a 1x1 size convolution kernel is used to perform point-by-point operation on the first convolution matrix, without changing the spatial dimension of the matrix, but realizing dimension conversion and nonlinear mapping through cross-channel feature fusion. For example, the traffic features contained in the first convolution matrix can be converted into more abstract threat features such as the strength of abnormal connection patterns and the weighted value of attack frequency, while reducing feature redundancy and enhancing the sensitivity of the model to key features.

[0131] In an implementation, average pooling is used to calculate the average of all elements in the window, smooth the local features and preserve the overall trend.

[0132] In an implementation, a two-dimensional convolution pooling matrix is converted into a one-dimensional vector in row-first or column-first order; the flattening operation converts spatial features into sequence features, enabling them to be input into a fully connected layer for processing; for a multi-channel matrix, the length of the vector after flattening is the number of channels x the number of rows x the number of columns, ensuring that all features are completely passed to the subsequent network layer.

[0133] In an implementation, the length of the first convolution pooling vector is n, and the first fully connected layer contains m neurons, obtaining an m-dimensional intermediate vector, which is converted into a k-dimensional fully connected feature vector by the second fully connected layer, deepening the degree of feature abstraction through secondary nonlinear transformation. For example, the first layer extracts basic threat features, and the second layer integrates them into a comprehensive threat index.

[0134] The full-connection feature vector is an output result after nonlinear transformation of two full-connection layers, and it fuses various key features of network flow. The features are not direct probability values, but quantitative representations of different network states; the numerical value of each element reflects the support degree of the feature to the corresponding network state, and the greater the numerical value, the higher the support degree; the full-connection feature vector is converted into a probability distribution in the interval [0, 1] through a softmax activation function, and after obtaining the probability distribution of various categories, a monitoring and early warning probability value is determined according to the target of network security monitoring.

[0135] Based on the same inventive concept, the embodiment of the present application also provides a network security monitoring device. Referring to Figure 2 , Figure 2 A structural schematic diagram of a network security monitoring device provided by the embodiment of the present application comprises:

[0136] An original data set generation module is configured to acquire an original data set;

[0137] A cleaned data set generation module is configured to clean the original data set to obtain a cleaned data set;

[0138] A first feature set generation module is configured to construct and label a light feature type based on the cleaned data set to obtain a first feature set;

[0139] A two-dimensional feature matrix set generation module is configured to convert the dimension of each first feature in the first feature set to obtain a two-dimensional feature matrix set;

[0140] A monitoring and early warning probability value generation module is configured to input the two-dimensional feature matrix set into a probability detection model to obtain a monitoring and early warning probability value;

[0141] An early warning result generation module is configured to compare the monitoring and early warning probability value with a warning threshold to obtain an early warning result.

[0142] The original data set is flow data for network security monitoring on a time sequence; the light feature type is a subset of a preset feature parameter set.

[0143] The network security monitoring device provided by the embodiment of the present application is configured to acquire an original data set and clean it, construct and label a light feature type based on the cleaned data set to obtain a first feature set, convert the dimension of the first feature set to a two-dimensional feature matrix set, input the two-dimensional feature matrix set into a probability detection model to obtain a monitoring and early warning probability value, and finally compare the monitoring and early warning probability value with a warning threshold to obtain an early warning result. The scheme not only takes into account the efficiency of data processing and the retention of key information by means of light feature construction, but also improves the accuracy of the early warning probability value through feature enhancement, so that the final early warning result is more reliable, thereby improving the efficiency of monitoring.

[0144] In an embodiment, the first feature set generation module further comprises:

[0145] a feature parameter set generation module, configured to obtain historical traffic data of network security monitoring and extract feature parameters to obtain a preset feature parameter set;

[0146] a feature parameter weight value set generation module, configured to perform importance scoring on the feature parameter set to obtain a feature parameter weight value set;

[0147] a correlation weight value set generation module, configured to analyze feature correlation of the feature parameter set to obtain a correlation weight value set;

[0148] a two-dimensional graph generation module, configured to map the feature parameter weight set and the correlation feature weight set into a two-dimensional graph; wherein the abscissa of the two-dimensional graph is the correlation weight value, and the ordinate is the feature parameter weight value;

[0149] a cluster area density value set generation module, configured to calculate the density value of the feature parameter cluster area in the two-dimensional graph by a network density method to obtain a cluster area density value set;

[0150] a potential danger area generation module, configured to mark the cluster area as a potential danger area if the density value in the cluster area density value set is greater than a preset density value;

[0151] a first feature parameter type generation module, configured to arrange the feature parameter weight values in descending order, and screen feature parameters corresponding to preset proportion feature parameter weight values to obtain a first feature parameter type;

[0152] a lightweight feature type generation module, configured to mark the first feature parameters in the potential danger area to obtain a lightweight feature type.

[0153] In an embodiment, the first feature set generation module comprises:

[0154] a lightweight feature set generation module, configured to aggregate the lightweight feature type in the cleaning data set through a preset time window to obtain a lightweight feature set;

[0155] a first lightweight feature set generation module, configured to perform single-hot encoding and then normalization on the lightweight feature set to obtain a first lightweight feature set;

[0156] a label feature set generation module, configured to label the lightweight feature set through a public data set to obtain a label feature set; the label annotation includes a security state and an attack state;

[0157] an encoded label feature set generation module, configured to encode the label feature set to obtain an encoded label feature set;

[0158] The first feature set generation module is configured to align the first lightweight features of the first lightweight feature set and the encoded label features of the encoded label feature set according to timestamps to obtain a first feature set.

[0159] In one embodiment, the monitoring early warning probability value generation module comprises:

[0160] The feature length generation module is configured to count the length of the first features in the first feature set to obtain a feature length.

[0161] The target dimension generation module is configured to square and round up the feature length to obtain a target dimension.

[0162] The standard feature set generation module is configured to pad the first features in the first feature set with zero values to make the length of the first features meet the square of the target dimension to obtain a standard feature set.

[0163] The two-dimensional feature matrix set generation module is configured to perform dimension conversion on the standard feature set to obtain a two-dimensional feature matrix set.

[0164] In one embodiment, the fused feature matrix set generation module is configured to traverse the two-dimensional feature matrix set, and concatenate the continuous two-dimensional feature matrices in the two-dimensional feature matrix set according to the channel dimension through a sliding fusion window to obtain a fused feature matrix set; the label features of the fused feature matrices in the fused feature matrix set are the label features corresponding to the last fused two-dimensional feature matrix.

[0165] The first convolution matrix generation module is configured to sequentially perform 1x3 convolution and 3x1 convolution on the fused feature matrices in the fused feature matrix set to obtain a first convolution matrix; the second convolution matrix generation module is configured to perform 1x1 point-by-point convolution on the first convolution matrix to obtain a second convolution matrix.

[0166] The convolution pooling matrix generation module is configured to perform 2x2 average pooling on the second convolution matrix to obtain a convolution pooling matrix.

[0167] The first convolution pooling vector generation module is configured to perform a flattening operation on the convolution pooling matrix to obtain a first convolution pooling vector.

[0168] The fully connected feature vector generation module is configured to perform non-linear transformation and feature mapping on the first convolution pooling vector through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector.

[0169] The monitoring early warning probability value generation module is configured to perform probabilistic processing on the fully connected feature vector through a softmax layer with a softmax activation function to obtain a monitoring early warning probability value.

[0170] The above has been described in detail one embodiment of the present application, but the content is only the preferred embodiment of the present application, cannot be considered for limiting the scope of the present application. Any equivalent changes and improvements made in the scope of the present application, should still belong to the scope of the present application.

Claims

1. A network security monitoring method characterized by, The method comprises: obtaining an original data set; the original data set is the flow data of network security monitoring on a time sequence; performing data cleaning on the original data set to obtain a cleaned data set; performing feature construction and label processing of a lightweight feature type on the cleaned data set to obtain a first feature set; the lightweight feature type is a subset of a preset feature parameter set; performing dimension conversion on each first feature in the first feature set to obtain a two-dimensional feature matrix set; substituting the two-dimensional feature matrix set into a probability detection model to obtain a monitoring early warning probability value; comparing the monitoring early warning probability value with a warning threshold to obtain a warning result.

2. The network security monitoring method of claim 1, wherein, Before the method of performing feature construction and label processing of a lightweight feature type on the cleaned data set to obtain a first feature set, the method further comprises: obtaining historical flow data of network security monitoring and extracting feature parameters to obtain a preset feature parameter set; performing importance scoring on the feature parameter set to obtain a feature parameter weight value set; analyzing the feature correlation of the feature parameter set to obtain a correlation weight value set; mapping the feature parameter weight set and the correlation feature weight set to a two-dimensional graph; wherein the abscissa of the two-dimensional graph is the correlation weight value, and the ordinate is the feature parameter weight value; calculating the density value of the feature parameter aggregation area in the two-dimensional graph by a network density method to obtain an aggregation area density value set; if the density value in the aggregation area density value set is greater than a preset density value, marking the aggregation area as a potential danger area; arranging the feature parameter weight values in descending order, and screening feature parameters corresponding to preset proportion feature parameter weight values to obtain a first feature parameter type; marking the first feature parameters in the potential danger area to obtain a lightweight feature type.

3. The network security monitoring method of claim 1, wherein, The method of performing feature construction and label processing of a lightweight feature type on the cleaned data set to obtain a first feature set comprises: aggregating the lightweight feature type in the cleaned data set in a preset time window to obtain a lightweight feature set; performing single-hot encoding and then normalization on the lightweight feature set to obtain a first lightweight feature set; performing label annotation on the lightweight feature set by using a public data set to obtain a labeled feature set; the label annotation comprises a security state and an attack state; encoding the labeled feature set to obtain an encoded labeled feature set; aligning the first lightweight features of the first lightweight feature set and the encoded labeled features of the encoded labeled feature set according to timestamps to obtain a first feature set.

4. The network security monitoring method of claim 1, wherein, The method of performing dimension conversion on the first feature set to obtain a two-dimensional feature matrix set comprises: statistically obtaining the length of the first feature in the first feature set to obtain a feature length; performing square root operation on the feature length and taking the upper integer part to obtain a target dimension; filling zero values in the first feature in the first feature set to make the length of the first feature meet the square of the target dimension to obtain a standard feature set; performing dimension conversion on the standard feature set to obtain a two-dimensional feature matrix set.

5. The network security monitoring method of claim 1, wherein, The method of substituting the two-dimensional feature matrix set into a probability detection model to obtain a monitoring early warning probability value comprises: Traverse the set of two-dimensional feature matrices, and obtain a set of fused feature matrices by concatenating the continuous two-dimensional feature matrices in the channel dimension through a sliding fusion window; the label feature of a fused feature matrix in the set of fused feature matrices is the label feature corresponding to the last fused two-dimensional feature matrix; perform 1x3 convolution and 3x1 convolution on the fused feature matrices in the set of fused feature matrices in turn to obtain a first convolution matrix; perform 1x1 point-by-point convolution on the first convolution matrix to obtain a second convolution matrix; perform 2x2 average pooling on the second convolution matrix to obtain a convolution-pooling matrix; perform a flattening operation on the convolution-pooling matrix to obtain a first pool vector; perform non-linear transformation and feature mapping on the first pool vector through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector; perform probabilistic processing on the fully connected feature vector through a softmax activation function to obtain a monitoring and early warning probability value.

6. A network security monitoring apparatus characterized by comprising: The device comprises: an original data set generation module configured to obtain an original data set; the original data set is traffic data for network security monitoring on a time sequence; a cleaned data set generation module configured to perform data cleaning on the original data set to obtain a cleaned data set; a first feature set generation module configured to perform feature construction and label processing of a lightweight feature type on the cleaned data set to obtain a first feature set; the lightweight feature type is a subset of a preset feature parameter set; a two-dimensional feature matrix set generation module configured to perform dimension conversion on each first feature in the first feature set to obtain a set of two-dimensional feature matrices; a monitoring and early warning probability value generation module configured to input the set of two-dimensional feature matrices into a probability detection model to obtain a monitoring and early warning probability value; an early warning result generation module configured to compare the monitoring and early warning probability value with a warning threshold to obtain an early warning result.

7. The network security monitoring device of claim 6, wherein, The first feature set generation module further comprises: a feature parameter set generation module configured to obtain historical traffic data for network security monitoring and extract feature parameters to obtain a preset feature parameter set; a feature parameter weight value set generation module configured to perform importance scoring on the feature parameter set to obtain a feature parameter weight value set; a correlation weight value set generation module configured to perform feature correlation analysis on the feature parameter set to obtain a correlation weight value set; a two-dimensional graph generation module configured to map the feature parameter weight set and the correlation feature weight set to a two-dimensional graph; wherein the abscissa of the two-dimensional graph is the correlation weight value, and the ordinate is the feature parameter weight value; an aggregated area density value set generation module configured to calculate the density values of the feature parameter aggregated areas in the two-dimensional graph through a network density method to obtain an aggregated area density value set; a potential danger area generation module configured to mark the aggregated area as a potential danger area if the density value in the aggregated area density value set is greater than a preset density value; a first feature parameter type generation module configured to arrange the feature parameter weight values in descending order, and select feature parameters corresponding to preset proportion feature parameter weight values to obtain a first feature parameter type. The light feature type generation module is configured to mark the first feature parameter in the potential danger area as a light feature type.

8. The network security monitoring device of claim 6, wherein, The first feature set generation module includes: The light feature set generation module is configured to aggregate the light feature type of the cleaning data in the cleaning data set through a preset time window to obtain a light feature set. The first light feature set generation module is configured to perform single-hot encoding and normalization on the light feature set to obtain a first light feature set. The label feature set generation module is configured to perform label annotation on the light feature set through the public data set to obtain a label feature set, and the label annotation includes a security state and an attack state. The encoded label feature set generation module is configured to encode the label feature set to obtain an encoded label feature set. The first feature set generation module is configured to align the first light feature of the first light feature set and the encoded label feature of the encoded label feature set according to a timestamp to obtain a first feature set.

9. The network security monitoring device of claim 6, wherein, The two-dimensional feature matrix set generation module includes: The feature length generation module is configured to count the length of the first feature in the first feature set to obtain a feature length. The target dimension generation module is configured to square and round up the feature length to obtain a target dimension. The standard feature set generation module is configured to fill the first feature in the first feature set with zero values to make the length of the first feature meet the square of the target dimension to obtain a standard feature set. The two-dimensional feature matrix set generation module is configured to convert the dimension of the standard feature set to obtain a two-dimensional feature matrix set.

10. The network security monitoring device of claim 6, wherein, The monitoring and early warning probability value generation module includes: The fusion feature matrix set generation module is configured to traverse the two-dimensional feature matrix set, and concatenate the continuous two-dimensional feature matrices according to the channel dimension through a sliding fusion window to obtain a fusion feature matrix set; the label feature of the fusion feature matrix in the fusion feature matrix set is the label feature corresponding to the last fusion two-dimensional feature matrix; The first convolution matrix generation module is configured to sequentially perform 1x3 convolution and 3x1 convolution on the fusion feature matrix in the fusion feature matrix set to obtain a first convolution matrix. The second convolution matrix generation module is configured to perform 1x1 point-by-point convolution on the first convolution matrix to obtain a second convolution matrix. The convolution pooling matrix generation module is configured to perform 2x2 average pooling on the second convolution matrix to obtain a convolution pooling matrix. The first convolution pooling vector generation module is configured to perform a flattening operation on the convolution pooling matrix to obtain a first convolution pooling vector. The fully connected feature vector generation module is configured to perform non-linear transformation and feature mapping on the first convolution pooling vector through two fully connected layers with a preset number of neurons to obtain a fully connected feature vector. The monitoring and early warning probability value generation module is configured to perform probabilistic processing on the fully connected feature vector through a softmax layer with a softmax activation function to obtain a monitoring and early warning probability value.

Images