Abnormal traffic monitoring method and device of zero-trust network, electronic equipment and storage medium
By employing multi-task learning and deep learning models combined with GAN and reinforcement learning in zero-trust networks, the problem of insufficient traffic monitoring in existing technologies is solved, achieving efficient abnormal traffic detection and real-time defense, and improving network security and detection accuracy.
Patent Information
- Application Number
- CN202511048867.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-29
- Publication Date
- 2025-11-11
AI Technical Summary
Existing zero-trust network architectures are inadequate in terms of traffic monitoring and detection, and are unable to respond to and defend against complex threats in a timely manner.
A deep learning model based on multi-task learning is used to analyze data packets, and convolutional neural networks and long short-term memory networks are combined for traffic prediction. Sample augmentation is performed through a GAN model, and reinforcement learning is used to adjust access strategies to form a distributed collaborative defense system.
It improves the real-time performance of traffic detection and the accuracy of abnormal behavior identification, enhances network security defense capabilities, reduces false alarm and missed alarm rates, and protects node privacy.
Smart Images
Figure CN120934799A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and more specifically, to a method for monitoring abnormal traffic in zero-trust networks. Background Technology
[0002] Zero-trust network architecture is an emerging network security model based on the principle of "never trust, always verify." Every user and device needs to undergo identity authentication and permission verification when accessing network resources. Its architecture is as follows: Figure 1 As shown. However, existing zero-trust architectures still fall short in combining traffic monitoring and detection, failing to respond promptly to and defend against complex threats. Summary of the Invention
[0003] In view of this, this application provides a method, apparatus, electronic device, and storage medium for monitoring abnormal traffic in a zero-trust network, so as to ensure network security.
[0004] To achieve the above objectives, the following solution is proposed:
[0005] An abnormal traffic monitoring method for zero-trust networks, applied to electronic devices, includes the following steps:
[0006] All data packets flowing through the zero-trust network are captured in real time;
[0007] A deep learning model based on multi-task learning is used to analyze and process each data packet to determine whether abnormal traffic will occur at a future time.
[0008] Optionally, the captured data packets may include some or all of the following: source IP address, destination IP address, source port, destination port, packet size, protocol type, and application layer protocol characteristics.
[0009] Optionally, the step of using a deep learning model based on multi-task learning to analyze and process each data packet to determine whether the data packet is abnormal traffic includes the following steps:
[0010] Each data packet is represented as a feature vector;
[0011] The feature vector is processed using a convolutional neural network to obtain the local features of the data packet;
[0012] The local features are processed using a long short-term memory network to predict whether abnormal traffic will occur in future time periods.
[0013] Optional steps may also be included:
[0014] Network sample augmentation based on GAN model.
[0015] Optional steps may also be included:
[0016] By dynamically adjusting access policies under the zero-trust architecture through reinforcement learning, abnormal traffic is blocked in real time, and detection models are shared according to the federated learning mechanism to form a distributed collaborative defense system.
[0017] An abnormal traffic monitoring device for zero-trust networks, applied to electronic devices, the abnormal traffic monitoring device comprising:
[0018] The traffic acquisition module is configured to capture all data packets flowing through the zero-trust network in real time;
[0019] The anomaly prediction module is configured to use a deep learning model based on multi-task learning to analyze and process each data packet to determine whether abnormal traffic will occur at a future time.
[0020] Optional, also includes:
[0021] The sample augmentation module is configured to perform network sample augmentation based on the GAN model.
[0022] Optional, also includes:
[0023] The access control module is configured to dynamically adjust access policies under the zero-trust architecture through reinforcement learning, block abnormal traffic in real time, and share detection models according to the federated learning mechanism to form a distributed collaborative defense system.
[0024] An electronic device includes at least one processor and a memory connected to the processor, wherein:
[0025] The memory is used to store computer programs or instructions;
[0026] The processor is used to execute the computer program or instructions to enable the electronic device to implement the abnormal traffic monitoring method as described above.
[0027] A computer-readable storage medium is applied to an electronic device, the storage medium carrying one or more computer programs that can be executed by the electronic device, thereby enabling the electronic device to implement the abnormal traffic monitoring method as described above.
[0028] As can be seen from the above technical solution, this application discloses a method, apparatus, electronic device, and storage medium for abnormal traffic monitoring in zero-trust networks. The method and apparatus are applied to electronic devices, specifically involving real-time capture of all data packets flowing through the zero-trust network; and the analysis and processing of each data packet using a deep learning model based on multi-task learning to determine whether abnormal traffic will occur in the future. The technical solution of this application combines deep learning and multi-task learning techniques, improving the real-time performance of traffic detection and the accuracy of abnormal behavior identification, thereby ensuring network security. Attached Figure Description
[0029] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0030] Figure 1 An architecture diagram of a zero-trust network provided for this application;
[0031] Figure 2 This is a flowchart illustrating an abnormal traffic monitoring method for a zero-trust network according to an embodiment of this application.
[0032] Figure 3 This is a schematic diagram of the traffic collection process according to an embodiment of this application;
[0033] Figure 4 This is a flowchart illustrating another method for detecting abnormal traffic in a zero-trust network according to an embodiment of this application.
[0034] Figure 5 This is a flowchart illustrating another method for detecting abnormal traffic in a zero-trust network according to an embodiment of this application.
[0035] Figure 6 This is a block diagram of an abnormal traffic monitoring device for a zero-trust network according to an embodiment of this application;
[0036] Figure 7 This is a block diagram of another abnormal traffic monitoring method for a zero-trust network according to an embodiment of this application;
[0037] Figure 8 This is a block diagram illustrating another method for detecting abnormal traffic in a zero-trust network according to an embodiment of this application.
[0038] Figure 9 This is a block diagram of an electronic device according to an embodiment of this application. Detailed Implementation
[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0040] Zero Trust Network is a network security model based on the concept of "never trust, always verify". It emphasizes that no user, device or application can be trusted in the network. Trust assessment and continuous verification are required based on multiple factors such as the identity of the access subject, the status of the terminal device, and the network environment. This allows for dynamic authorization of all users and devices, and strict enforcement of the principle of least privilege in access control.
[0041] Deep learning is a large-scale machine learning algorithm based on neural networks that can learn features and patterns from large amounts of data and is suitable for complex traffic detection tasks.
[0042] Generative Adversarial Networks (GANs) use adversarial generators and discriminators to simulate and generate anomalous traffic in order to improve the system's ability to detect new types of attacks.
[0043] Reinforcement learning (RL) is an algorithm that learns the optimal policy through feedback, and can dynamically adjust network access control policies based on traffic analysis results.
[0044] Federated Learning (FL) is a distributed machine learning approach that trains a model locally on multiple agents (devices, nodes, or servers) and then collaborates by sharing model update weights without sharing the data itself, thus ensuring data privacy and security.
[0045] Figure 2 This is a flowchart illustrating an abnormal traffic monitoring method for a zero-trust network according to an embodiment of this application.
[0046] like Figure 2 As shown, the abnormal traffic monitoring method provided in this embodiment is applied to an electronic device to predict abnormal traffic that may occur in a zero-trust network at future times. This electronic device can be understood as a computer, server, or cloud platform with data computing and information processing capabilities. The abnormal traffic monitoring method specifically includes the following steps:
[0047] S1. Capture all data packets flowing through the zero-trust network in real time.
[0048] This involves using modules installed at the front end of the zero-trust network to capture all data packets flowing through it in real time. The collected data packets include, but are not limited to, source IP address, destination IP address, source port, destination port, packet size, protocol type (TCP, UDP, etc.), and application layer protocol characteristics (such as HTTP, HTTPS, DNS, etc.).
[0049] Traffic collection process as follows Figure 3 As shown, the collected network traffic data undergoes preprocessing for data cleaning and formatting to remove invalid information and ensure data consistency, providing high-quality input for subsequent traffic analysis.
[0050] S2. Determine whether abnormal traffic will occur in the future by analyzing and processing data packets.
[0051] A deep learning model based on multi-task learning is used to analyze and process each data packet to determine whether abnormal traffic will occur in the future. The specific process is as follows:
[0052] First, the collected data packets are represented as feature vectors X = {x1, x2, ..., x...} n} contains n traffic samples, each represented by a d-dimensional feature x. i ={f1,f2,...,f d}, where f i Different traffic characteristics can be represented, such as packet size, packet arrival time interval, and protocol type.
[0053] This task distinguishes network traffic by differentiating data packets into different types (e.g., HTTP, FTP, SSH), dividing network traffic into different subsets of traffic types to provide contextual information for subsequent detection. A Convolutional Neural Network (CNN) is used to extract local features of the traffic to differentiate traffic types. The convolution operation is as follows:
[0054]
[0055] Finally, the Long Short-Term Memory (LSTM) network is used to predict abnormal traffic behavior over a future period. Assume X... t Representing the flow input at time t, the model not only outputs Y t This indicates the current abnormal traffic assessment and also predicts Y. t+k This represents the potential abnormal traffic within the next k time steps.
[0056] Y t+k =f(X) t h t+k )
[0057] Multi-task learning, which combines CNN and LSTM in a hybrid model, can capture both the spatial features of traffic and identify its temporal dependencies, significantly enhancing defense capabilities.
[0058] As can be seen from the above technical solution, this embodiment provides a method for monitoring abnormal traffic in a zero-trust network. This method is applied to electronic devices and specifically involves real-time capture of all data packets flowing through the zero-trust network. A deep learning model based on multi-task learning is used to analyze and process each data packet to determine whether abnormal traffic will occur in the future. The technical solution of this application combines deep learning and multi-task learning techniques, improving the real-time performance of traffic detection and the accuracy of abnormal behavior identification, thereby ensuring network security.
[0059] In addition, in one specific embodiment of this application, the following steps are also included: Figure 4 As shown.
[0060] S3. Implement network sample augmentation based on GAN model.
[0061] In traffic detection tasks, actual network traffic data may be insufficient for training due to factors such as sparse attack behavior and class imbalance. To enhance the generalization ability of the traffic detection system, this module uses GANs for sample augmentation, generating additional traffic samples to balance the number of samples of each class and improve the performance of the detection model.
[0062] A GAN model consists of a generator and a discriminator. The generator's task is to receive random noise z as input and generate realistic samples G(z). Its goal is to confuse the discriminator, making it unable to distinguish the generated samples from real data. The generator's loss function is:
[0063]
[0064] The discriminator's task is to distinguish whether the input sample is real data x or a sample G(z) generated by the generator, attempting to differentiate between the generated sample and the real sample. The discriminator's loss function is:
[0065]
[0066] The steps for sample augmentation using a GAN model include:
[0067] ① Generator initialization: The generator receives input noise z to generate data similar to normal or attack traffic. The input noise can be a random vector from a standard distribution.
[0068] ② Training the discriminator: The discriminator is trained to distinguish between real traffic data x and traffic G(z) generated by the generator.
[0069] ③ Generate traffic data: After the GAN model is trained, the generator can generate realistic network traffic samples. These generated samples can be used to augment the original dataset, especially in scenarios where attack samples are scarce, to generate synthetic attack traffic samples.
[0070] ④ Model training: Combine the generated samples with real samples to train the detection model, such as a deep learning-based network traffic detector.
[0071] After generating a large number of realistic network traffic samples, the traffic samples generated by the GAN model are combined with real data to form a larger and more balanced training dataset. The generated attack traffic samples can help enhance the deep learning model's ability to detect abnormal traffic, especially improving the detection effect on rare attack types, thereby improving generalization ability and reducing false negative and false positive rates.
[0072] In another specific embodiment of this application, the following steps are also included: Figure 5 As shown.
[0073] S4. Block abnormal traffic in real time by adjusting access policies.
[0074] By dynamically adjusting access policies under the zero-trust architecture through reinforcement learning, abnormal traffic is blocked in real time, and detection models are shared according to the federated learning mechanism to form a distributed collaborative defense system.
[0075] Specifically, network access permissions are dynamically adjusted through reinforcement learning. The system updates its policies in real time based on detected abnormal traffic to maximize system security and performance. The reinforcement learning state S... t Representing the current traffic detection result, action A t For defensive measures (such as speed limiting, blocking), the reward function R t The definition is as follows:
[0076] R t =λ·SecurityLevel-μ·Cost
[0077] Reinforcement learning maximizes long-term cumulative rewards through a policy optimization function:
[0078]
[0079] Through reinforcement learning, the system automatically learns the best defense strategy and dynamically adjusts the traffic control mechanism.
[0080] Without sharing data, each node uses the same initial model to train its local network traffic data. Let D be the local data of each node i. i The loss function is L i(θ), where θ represents the model parameters. Each node updates its local model parameters θ during training. i Then, the updated parameters are sent to the central server. The central server aggregates the updates from all nodes using the following formula:
[0081]
[0082] Among them, w i This refers to the weight of each node, which is typically determined based on the amount of data or other factors. The central server receives parameter updates from each node, performs a weighted average, and generates a new global model θ. global Then, the central server distributes the updated model to each node for a new round of local training. This process continues until the model converges.
[0083] In a federated learning framework, while each node does not share raw traffic data, they can share detected threat information, such as attack type, timestamp, and target. This information is transmitted encrypted to a central server and then distributed to other nodes, forming a real-time updated threat intelligence database. Through federated learning, different nodes do not need to share raw data, thus effectively protecting the privacy of each node. In today's cybersecurity environment where privacy is increasingly important, this privacy-preserving traffic detection method has significant advantages.
[0084] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0085] Although the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous.
[0086] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.
[0087] Computer program code for performing the operations of this disclosure can be written in one or more programming languages or a combination thereof, including but not limited to object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer.
[0088] Figure 6 This is a block diagram of an abnormal traffic monitoring device for a zero-trust network according to an embodiment of this application.
[0089] like Figure 6 As shown, the abnormal traffic monitoring device provided in this embodiment is applied to an electronic device to predict abnormal traffic that may occur in a zero-trust network at future times. This electronic device can be understood as a computer, server, or cloud platform with data computing and information processing capabilities. Specifically, the abnormal traffic monitoring device includes a traffic acquisition module 10 and an abnormal prediction module 20.
[0090] The traffic acquisition module is used to capture all data packets flowing through the zero-trust network in real time.
[0091] This involves using modules installed at the front end of the zero-trust network to capture all data packets flowing through it in real time. The collected data packets include, but are not limited to, source IP address, destination IP address, source port, destination port, packet size, protocol type (TCP, UDP, etc.), and application layer protocol characteristics (such as HTTP, HTTPS, DNS, etc.).
[0092] Traffic collection process as follows Figure 3 As shown, the collected network traffic data undergoes preprocessing for data cleaning and formatting to remove invalid information and ensure data consistency, providing high-quality input for subsequent traffic analysis.
[0093] The anomaly prediction module is used to determine whether abnormal traffic will occur in the future by analyzing and processing data packets.
[0094] This module specifically uses a deep learning model based on multi-task learning to analyze and process each data packet to determine whether abnormal traffic will occur in the future. The specific process is as follows:
[0095] First, the collected data packets are represented as feature vectors X = {x1, x2, ..., x...} n} contains n traffic samples, each represented by a d-dimensional feature x. i ={f1,f2,...,f d}, where f i Different traffic characteristics can be represented, such as packet size, packet arrival time interval, and protocol type.
[0096] This task distinguishes network traffic by differentiating data packets into different types (e.g., HTTP, FTP, SSH), dividing network traffic into different subsets of traffic types to provide contextual information for subsequent detection. A Convolutional Neural Network (CNN) is used to extract local features of the traffic to differentiate traffic types. The convolution operation is as follows:
[0097]
[0098] Finally, the Long Short-Term Memory (LSTM) network is used to predict abnormal traffic behavior over a future period. Assume X... t Representing the flow input at time t, the model not only outputs Y t This indicates the current abnormal traffic assessment and also predicts Y. t+k This represents the potential abnormal traffic within the next k time steps.
[0099] Y t+k =f(X) t h t+k )
[0100] Multi-task learning, which combines CNN and LSTM in a hybrid model, can capture both the spatial features of traffic and identify its temporal dependencies, significantly enhancing defense capabilities.
[0101] As can be seen from the above technical solution, this embodiment provides an abnormal traffic monitoring device for zero-trust networks. This device is applied to electronic devices and specifically captures all data packets flowing through the zero-trust network in real time. It employs a deep learning model based on multi-task learning to analyze and process each data packet to determine whether abnormal traffic will occur in the future. The technical solution of this application combines deep learning and multi-task learning techniques, improving the real-time performance of traffic detection and the accuracy of abnormal behavior identification, thereby ensuring network security.
[0102] In addition, in one specific embodiment of this application, a sample enhancement module 30 is also included, such as... Figure 7 As shown.
[0103] The sample augmentation module is used to perform network sample augmentation based on the GAN model.
[0104] In traffic detection tasks, actual network traffic data may be insufficient for training due to factors such as sparse attack behavior and class imbalance. To enhance the generalization ability of the traffic detection system, this module uses GANs for sample augmentation, generating additional traffic samples to balance the number of samples of each class and improve the performance of the detection model.
[0105] A GAN model consists of a generator and a discriminator. The generator's task is to receive random noise z as input and generate realistic samples G(z). Its goal is to confuse the discriminator, making it unable to distinguish the generated samples from real data. The generator's loss function is:
[0106]
[0107] The discriminator's task is to distinguish whether the input sample is real data x or a sample G(z) generated by the generator, attempting to differentiate between the generated sample and the real sample. The discriminator's loss function is:
[0108]
[0109] The steps for sample augmentation using a GAN model include:
[0110] ① Generator initialization: The generator receives input noise z to generate data similar to normal or attack traffic. The input noise can be a random vector from a standard distribution.
[0111] ② Training the discriminator: The discriminator is trained to distinguish between real traffic data x and traffic G(z) generated by the generator.
[0112] ③ Generate traffic data: After the GAN model is trained, the generator can generate realistic network traffic samples. These generated samples can be used to augment the original dataset, especially in scenarios where attack samples are scarce, to generate synthetic attack traffic samples.
[0113] ④ Model training: Combine the generated samples with real samples to train the detection model, such as a deep learning-based network traffic detector.
[0114] After generating a large number of realistic network traffic samples, the traffic samples generated by the GAN model are combined with real data to form a larger and more balanced training dataset. The generated attack traffic samples can help enhance the deep learning model's ability to detect abnormal traffic, especially improving the detection effect on rare attack types, thereby improving generalization ability and reducing false negative and false positive rates.
[0115] In another specific embodiment of this application, an access control module 40 is also included, such as... Figure 8 As shown.
[0116] The access control module is used to block abnormal traffic in real time by adjusting access policies.
[0117] By dynamically adjusting access policies under the zero-trust architecture through reinforcement learning, abnormal traffic is blocked in real time, and detection models are shared according to the federated learning mechanism to form a distributed collaborative defense system.
[0118] Specifically, network access permissions are dynamically adjusted through reinforcement learning. The system updates its policies in real time based on detected abnormal traffic to maximize system security and performance. The reinforcement learning state S... t Representing the current traffic detection result, action A t For defensive measures (such as speed limiting, blocking), the reward function R t The definition is as follows:
[0119] R t =λ·SecurityLevel-μ·Cost
[0120] Reinforcement learning maximizes long-term cumulative rewards through a policy optimization function:
[0121]
[0122] Through reinforcement learning, the system automatically learns the best defense strategy and dynamically adjusts the traffic control mechanism.
[0123] Without sharing data, each node uses the same initial model to train its local network traffic data. Let D be the local data of each node i. i The loss function is L i (θ), where θ represents the model parameters. Each node updates its local model parameters θ during training. i Then, the updated parameters are sent to the central server. The central server aggregates the updates from all nodes using the following formula:
[0124]
[0125] Among them, w i This refers to the weight of each node, which is typically determined based on the amount of data or other factors. The central server receives parameter updates from each node, performs a weighted average, and generates a new global model θ. global Then, the central server distributes the updated model to each node for a new round of local training. This process continues until the model converges.
[0126] In a federated learning framework, while each node does not share raw traffic data, they can share detected threat information, such as attack type, timestamp, and target. This information is transmitted encrypted to a central server and then distributed to other nodes, forming a real-time updated threat intelligence database. Through federated learning, different nodes do not need to share raw data, thus effectively protecting the privacy of each node. In today's cybersecurity environment where privacy is increasingly important, this privacy-preserving traffic detection method has significant advantages.
[0127] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The name of a unit does not necessarily limit the unit itself; for example, the first acquisition unit can also be described as "a unit that acquires at least two Internet Protocol addresses".
[0128] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.
[0129] Figure 9 This is a block diagram of an electronic device according to an embodiment of this application.
[0130] The following is for reference. Figure 9 This document illustrates a structural diagram suitable for implementing the electronic device in the embodiments of this disclosure. The terminal device in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. This electronic device is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this disclosure.
[0131] The electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from an input device 906 into a random access memory (RAM) 903. The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.
[0132] Typically, the following devices can be connected to the I / O interface: input devices including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 907 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 908 including, for example, magnetic tapes, hard disks, etc.; and communication devices 909. Communication device 909 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although electronic devices with various devices are shown in the figures, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.
[0133] This application also provides an embodiment of a computer-readable storage medium.
[0134] The aforementioned computer-readable storage medium is applied to an electronic device and carries one or more computer programs. When these programs are executed by the electronic device, the device captures all data packets flowing through the zero-trust network in real time. A deep learning model based on multi-task learning is used to analyze and process each data packet to determine whether abnormal traffic will occur in the future. The technical solution of this application combines deep learning and multi-task learning techniques, improving the real-time performance of traffic detection and the accuracy of abnormal behavior identification, thereby ensuring network security.
[0135] It should be noted that the computer-readable medium described above in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.
[0136] In this disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.
[0137] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0138] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.
[0139] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0140] The technical solution provided by the present invention has been described in detail above. Specific examples have been used to illustrate the principle and implementation of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core idea of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation and application scope based on the idea of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for detecting abnormal traffic in a zero-trust network, applied to electronic devices, characterized in that, The abnormal traffic monitoring method includes the following steps: All data packets flowing through the zero-trust network are captured in real time; A deep learning model based on multi-task learning is used to analyze and process each data packet to determine whether abnormal traffic will occur at a future time.
2. The abnormal flow monitoring method as described in claim 1, characterized in that, The captured data packets include some or all of the following: source IP address, destination IP address, source port, destination port, packet size, protocol type, and application layer protocol characteristics.
3. The abnormal flow monitoring method as described in claim 1, characterized in that, The step of using a deep learning model based on multi-task learning to analyze and process each data packet to determine whether the data packet is abnormal traffic includes the following steps: Each data packet is represented as a feature vector; The feature vector is processed using a convolutional neural network to obtain the local features of the data packet; The local features are processed using a long short-term memory network to predict whether abnormal traffic will occur in future time periods.
4. The abnormal flow monitoring method according to any one of claims 1 to 3, characterized in that, It also includes the following steps: Network sample augmentation based on GAN model.
5. The abnormal force monitoring method as described in claim 4, characterized in that, It also includes the following steps: By dynamically adjusting access policies under the zero-trust architecture through reinforcement learning, abnormal traffic is blocked in real time, and detection models are shared according to the federated learning mechanism to form a distributed collaborative defense system.
6. An abnormal traffic monitoring device for zero-trust networks, applied to electronic devices, characterized in that, The abnormal flow monitoring device includes: The traffic acquisition module is configured to capture all data packets flowing through the zero-trust network in real time; The anomaly prediction module is configured to use a deep learning model based on multi-task learning to analyze and process each data packet to determine whether abnormal traffic will occur at a future time.
7. The abnormal flow monitoring device as described in claim 6, characterized in that, Also includes: The sample augmentation module is configured to perform network sample augmentation based on the GAN model.
8. The abnormal force monitoring device as described in claim 7, characterized in that, Also includes: The access control module is configured to dynamically adjust access policies under the zero-trust architecture through reinforcement learning, block abnormal traffic in real time, and share detection models according to the federated learning mechanism to form a distributed collaborative defense system.
9. An electronic device, characterized in that, The electronic device includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs or instructions; The processor is used to execute the computer program or instructions to enable the electronic device to implement the abnormal traffic monitoring method as described in any one of claims 1 to 5.
10. A computer-readable storage medium for use in electronic devices, characterized in that, The storage medium carries one or more computer programs that can be executed by the electronic device, thereby enabling the electronic device to implement the abnormal traffic monitoring method as described in any one of claims 1 to 5.