A deep firewall intrusion detection method based on joint modeling of behavior characteristics and packet header fields

Abstract

The present application relates to the technical field of security detection, and particularly relates to a deep firewall intrusion detection method based on joint modeling of behavior characteristics and packet header fields, comprising the following steps: capturing network data flow in real time, and synchronously disassembling into a packet header field set and a behavior characteristic unit; inputting the packet header field set output by S1 into a protocol decoupling engine, stripping the constraint field set of protocol specifications, and obtaining a naked field vector; performing tensor outer product operation on the naked field vector and the behavior characteristic unit output by S1, and generating an attack intention chain matrix; inputting the attack intention chain matrix output by S2 into a pre-trained double-flow adversarial network; when the deviation degree exceeds a protocol-independent judgment threshold, the intrusion is determined and intercepted. The present application can actively erase attack characteristic channels and maintain structural symmetry, and the detection delay of new ransomware and obfuscated communication flow is reduced without relying on a signature rule library.

Description

Technical Field

[0001] This invention relates to the field of security detection technology, and in particular to a deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields. Background Technology

[0002] With the increasing intelligence and encryption of cyber threats, traditional firewall detection mechanisms based on rule matching or signature-based methods are no longer sufficient to meet the intrusion prevention needs in highly dynamic and obfuscated scenarios. Existing intrusion detection systems primarily rely on the following two methods:

[0003] Deep Packet Inspection (DPI) based on field rules: This type of method relies on a static rule base of protocol fields, such as TCP ports, DNS flags, and HTTP header fields, to detect anomalies. However, in modern attacks, attackers often use methods such as port reuse, protocol encapsulation, and field obfuscation to circumvent rule judgment, which limits the detection capability.

[0004] Sequence modeling methods based on behavioral features, such as LSTM or TCN, attempt to identify abnormal intentions from time-series patterns. However, these methods generally suffer from two problems: first, they lack semantic support for protocol fields, making it difficult to effectively explain the source and structure of behavioral patterns; second, the models lack adaptability to changes in protocol layer structures, making them susceptible to misjudgments due to interference fields or traffic variations. Especially when dealing with highly covert attacks, such as port scanning, encrypted tunnels, and C2 control channels, single-pattern modeling methods struggle to cover the deep coupling between fields and behaviors, resulting in low identification accuracy, weak generalization ability, and a high likelihood of false positives or false negatives. Summary of the Invention

[0005] This invention provides a deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields. It integrates protocol fields and behavioral feature information, has the ability to model attack intent, and supports dynamic threshold adaptation, so as to realize intelligent firewall enhancement for complex scenarios such as protocol obfuscation, behavioral chaos, and feature weakening.

[0006] A deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields includes the following steps:

[0007] S1, Attack Intent Analysis:

[0008] Real-time capture of network data streams, synchronously decomposing them into packet header field sets and behavioral feature units;

[0009] The behavioral feature unit is generated by causal convolution of the behavioral features of multiple consecutive data packets, representing the smallest segment of attack intent.

[0010] S2, Dynamic Protocol Decoupling and Reassembly:

[0011] Input the header field set output by S1 into the protocol decoupling engine, strip away the constraint field set of the protocol specification, and obtain the raw field vector;

[0012] The raw field vector is subjected to tensor outer product operation with the behavioral feature unit output by S1 to generate the attack intent chain matrix.

[0013] S3, Adversarial Intent Verification: Input the attack intent chain matrix output from S2 into the pre-trained two-stream adversarial network:

[0014] The generator network reconstructs the normal traffic intent chain;

[0015] The discriminator network calculates the deviation from the attack intent;

[0016] When the deviation exceeds the protocol irrelevance threshold, it is identified as an intrusion and intercepted.

[0017] Optionally, S1 includes copying the network data stream at line speed through a bypass mirror port and storing the original data packets using a zero-copy ring buffer.

[0018] Optionally, S1 further includes parallel execution of a dual-channel parsing engine, specifically including:

[0019] Packet header channel: After stripping the Ethernet frame header, fields are extracted iteratively according to the protocol stack level to generate a packet header field set;

[0020] Behavioral channel: Calculate the spatiotemporal behavioral fingerprint of N consecutive data packets at the data link layer. The spatiotemporal behavioral fingerprint includes packet direction hopping frequency and payload chaos.

[0021] Optionally, after the spatiotemporal behavioral fingerprint is obtained, it is input into a causal convolutional layer, wherein the convolutional kernel size K=3 and the dilation factor D=2, and the output feature map is max-pooled to generate behavioral feature units.

[0022] Optionally, the protocol decoupling engine in S2 includes a preset RFC protocol template table. The packet header field set is input into the protocol decoupling engine, matched with the RFC protocol template table, and the constraint field set defined in the protocol template is stripped off, leaving the remaining fields to form a raw field vector.

[0023] Optionally, the constraint field set includes:

[0024] HTTP Protocol Content-Length;

[0025] The Window Scale option of the TCP protocol;

[0026] The QR flag in the DNS protocol.

[0027] Optionally, the construction of the attack intent chain matrix includes:

[0028] Reshape the raw field vector into a column vector;

[0029] Reshape the behavioral feature units output by S1 into row vectors;

[0030] An attack intent chain matrix is ​​generated by tensor outer product.

[0031] Optionally, the dual-stream adversarial network architecture in S3 specifically includes:

[0032] Generator network: Receives an attack intent chain matrix and reconstructs a normal intent chain matrix through a de-attack autoencoder; the de-attack autoencoder includes multiple deconvolutional layers, with L1 sparsity constraints applied to the neurons in the intermediate layers.

[0033] Discriminator network: It receives the attack intent chain matrix and the normal intent chain matrix in parallel and outputs the attack intent deviation. The discriminator network is composed of multiple layers of depthwise separable convolutions.

[0034] Optionally, the deviation of the attack intent is calculated as follows:

[0035] δ=||sigmoid(D(M attack ))-tanh(D(M normal ))||2;

[0036] Where δ represents the deviation from the attack intent, M attack M is the attack intent chain matrix. normal Let D be the normal intent chain matrix, and let D() represent the discriminator network.

[0037] Optionally, S3 further includes a dynamic determination mechanism:

[0038] When δ>τ dynamic When an intrusion is detected, an interception is triggered.

[0039] The protocol-independent determination threshold τ dynarmic The KL divergence is dynamically adjusted based on the historical normal traffic intention chain distribution and calculated as follows: Where, μ KL σ represents the mean KL divergence of the normal flow intention chain distribution. KL The standard deviation of the KL divergence is represented by tu, where tu is the current operating time of the detection system or the monitoring cycle, and t is the standard deviation of the KL divergence. half This represents the half-life parameter.

[0040] The beneficial effects of this invention are:

[0041] This invention, by constructing an attack intent chain matrix, for the first time models protocol field features and behavioral fingerprint features using tensor outer product to explicitly express the second-order coupling relationship between "fields and behaviors". Compared with traditional solutions that rely solely on field rules or behavioral sequence matching, this method can identify multi-dimensional combined anomalies such as TTL transitions + ICMP bursts and port obfuscation + direction transitions. It has stronger semantic sensitivity in detecting covert composite attacks such as Nmap intermittent scanning, C2 control channels, and encrypted tunnels, and is suitable for early identification of zero-day attacks.

[0042] This invention employs an attack-de-attack autoencoder to reconstruct the attack intent chain matrix and compares it with the original matrix. By using a depthwise separable convolutional discriminant network to output the attack intent deviation, it achieves unsupervised anomaly detection. The autoencoder introduces L1 sparse regularization and gradient reversal penalty mechanisms, which can actively erase attack feature channels and maintain structural symmetry. This solves the misjudgment problem of existing models in handling "protocol packaging + feature masquerading" type attacks. Without relying on a signature rule base, it reduces the detection latency of new ransomware and obfuscated communication traffic.

[0043] This invention proposes a dynamic threshold adjustment method based on KL divergence distribution drift to control the deviation judgment threshold. It can sense the periodic changes in network traffic in real time (such as peak load and weekend protocol behavior fluctuations) and dynamically adjust the model's interception sensitivity to avoid misjudging normal sudden behaviors. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of a two-stream adversarial network architecture according to an embodiment of the present invention. Detailed Implementation

[0047] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. For some well-known technologies, those skilled in the art may also use other alternative methods to implement the invention. Moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0048] like Figures 1-2 As shown, a deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields includes the following steps:

[0049] S1, Attack Intent Analysis:

[0050] Real-time capture of network data streams, synchronously decomposing them into packet header field sets and behavioral feature units;

[0051] The behavioral feature unit is generated by causal convolution of the behavioral features of multiple consecutive data packets, representing the smallest segment of attack intent.

[0052] S2, Dynamic Protocol Decoupling and Reassembly:

[0053] Input the header field set output by S1 into the protocol decoupling engine, strip away the constraint field set of the protocol specification, and obtain the raw field vector;

[0054] The raw field vector is subjected to tensor outer product operation with the behavioral feature unit output by S1 to generate the attack intent chain matrix.

[0055] S3, Adversarial Intent Verification: Input the attack intent chain matrix output from S2 into the pre-trained two-stream adversarial network:

[0056] The generator network reconstructs the normal traffic intent chain;

[0057] The discriminator network calculates the deviation from the attack intent;

[0058] When the deviation exceeds the protocol irrelevance threshold, it is identified as an intrusion and intercepted.

[0059] S1 specifically includes:

[0060] S11, Bypass Mirroring Capture and Zero-Copy Buffering: Network traffic is copied at line speed via a bypass mirroring port (SPAN or TAP), and the original data packets are stored in a zero-copy ring buffer to avoid the processing latency caused by memory copying. Specifically, this involves configuring the SPAN (Switched Port Analyzer) or TAP (Test AccessPoint) interface on the network switch or border router for real-time copying of the target service flow.

[0061] SPAN port: Logical mirroring, where the switching chip mirrors the incoming and outgoing traffic of the original port to the configured SPAN port;

[0062] TAP devices: Physical traffic offloading, inserted into the link, providing 100% mirroring, independent of device configuration, suitable for high availability and security scenarios.

[0063] Deploy it at the network egress point or in front of the firewall to ensure that all north-south traffic can be intercepted.

[0064] The zero-copy ring buffer uses the rte_ring structure based on DPDK to implement a zero-copy shared memory buffer mechanism. The high-performance transceiver engine based on DPDK directly interfaces with the network card DMA channel, bypassing the kernel protocol stack and reducing interrupt response latency.

[0065] S12, dual-channel parsing engine executes in parallel:

[0066] S121, Packet Header Path: Starting from the data link layer, the Ethernet frame header is stripped, and fields (including IP address, port number, and protocol type flag) are extracted layer by layer according to the OSI protocol stack. These fields are then assembled into a packet header field set for use by the subsequent protocol decoupling engine, as detailed below:

[0067] 1. Protocol decoding path design (layer-by-layer stripping): Following the protocol stack structure in the OSI model, the protocol fields of each layer are passed up from the data link layer and decoded.

[0068] 2. Extracting content from each layer's fields

[0069] 2.1. Data Link Layer:

[0070] Starting field:

[0071] Dst_MAC: Target MAC address (6 bytes);

[0072] Src_MAC: Source MAC address (6 bytes);

[0073] Ethertype: Protocol type (2 bytes): 0x0800: IPv4, 0x86DD: IPv6; 2.2. Network layer, IPv4 field:

[0074] Version (4 bits): Protocol version;

[0075] IHL (4 bits): Header length;

[0076] TOS: Service Type;

[0077] Total Length: Total message length;

[0078] Identification: Segment identifier;

[0079] Flags+Offset: Slice control;

[0080] TTL: Time to Live;

[0081] Protocol: Upper-layer protocol number;

[0082] Header Checksum: Header checksum;

[0083] Src_IP: Source IP address;

[0084] Dst_IP: Target IP address;

[0085] 2.3. Transport Layer (TCP / UDP)

[0086] If Protocol = 6 (TCP):

[0087] Src_Port: Source port;

[0088] Dst_Port: Target port;

[0089] Sequence Number, Acknowledgment Number;

[0090] Flags: such as SYN, ACK, FIN, RST;

[0091] Window Size, Checksum;

[0092] If Protocol = 17 (UDP):

[0093] Src_Port, Dst_Port;

[0094] Length, Checksum.

[0095] 3. Field standardization structure: All the above fields are uniformly mapped to an ordered "packet header field set" for subsequent protocol decoupling and tensor operations.

[0096] S122, Behavioral Channel: Spatiotemporal behavioral fingerprinting is performed on N consecutive data packets at the data link layer to obtain the following two main characteristics:

[0097] Packet direction change frequency: Among them, f dir Indicates the packet direction switching frequency, representing the frequency of inbound / outbound direction switching within consecutive data packets. out (t) is the outgoing packet indication function at time t, where t is the time series index (the t-th data packet). If the t-th packet is an outgoing packet, then I out (t) = 1, otherwise 0. This frequency is used to measure the degree of change in the outflow direction of the packet. N is the total number of consecutive data packets involved in the calculation.

[0098] Load chaos degree: Where C represents the load chaos degree, the larger the value, the more difficult the load is to compress and the higher the degree of chaos, B compressible B represents the number of compressible bytes obtained through the compression algorithm. originalis the original payload length, which reflects the data entropy value and measures the complexity of abnormal payloads.

[0099] S13. Causal convolution generates behavior feature units: Input the above spatio-temporal behavior fingerprint sequence into the causal convolution network for local temporal correlation modeling. The convolution kernel size: K = 3; dilation factor: D = 2; After the output feature map undergoes max pooling operation, the final behavior feature unit is formed.

[0100] The core design logic of causal convolution: Only the packet fingerprints within the range of K·D before convolution are convolved, ensuring that the model can only rely on historical information, meeting the requirements of causal inference, and thus ensuring that the behavior feature unit represents the smallest attack segment in the time direction.

[0101] S131. Two types of behavior fingerprints have been extracted from N consecutive packets: the packet direction jump frequency f dir and the payload chaos degree C. Each packet corresponds to a two-dimensional feature vector: represents the dimension; The input sequence formed is:

[0102] S132. Causal convolution structure design: One-dimensional dilated causal convolution is adopted to ensure that the output feature at each moment only depends on the information of past time points, avoiding information leakage. The convolution structure parameters are as follows:

[0103] Convolution kernel size: K = 3, dilation factor: D = 2, input dimension: Output channel number: C out = 16;

[0104] Convolution calculation method: For time point t, the output feature is: where, W i represents the weight matrix at the i-th position, x t-D·i represents the input at the (t - D·i)-th time step, b is the bias vector. When t < D·(K - 1), forward zero padding is adopted, that is, a vector of all 0s is filled in.

[0105] S133. Output dimension of the feature map after convolution:

[0106] If the input length is N, the output dimension of the causal convolution layer is: represents the local causal correlation features extracted at each time point, with a total of C out dimensions.

[0107] S134. To extract the globally most significant attack features in the entire time series, a temporal direction max pooling operation is introduced: Pooling window size P = 4; stride S = 4; The output dimension after pooling is:

[0108] For example, if N = 64, then the output dimension after pooling is 16×16.

[0109] S135, Construction of Behavioral Feature Units: To ensure compact representation of global features, the pooling results are further integrated into the final behavioral feature units through temporal averaging. F behavior For behavioral feature units, there is a set of units of length C. out =16 embedding vector, which represents the smallest segment of attack behavior consisting of N consecutive data packets.

[0110] S14, Dual-channel synchronization mechanism: To ensure the timing consistency between the packet header field set and the behavioral feature unit, the following alignment strategy is adopted:

[0111] Table 1. Dual-channel strategy table

[0112]

[0113]

[0114] When the delay difference between channels is greater than 0.5μs, the behavior channel will discard the oldest data packet to achieve cross-channel alignment.

[0115] S2 specifically includes:

[0116] S21, Protocol Decoupling Engine Operation: The header field set output from S1 is input into the protocol decoupling engine, which matches it against a pre-set RFC protocol template table; it identifies and extracts the constraint field set defined in the protocol template, retaining the remaining fields to form the raw field vector V. field ;

[0117] The constraint field set includes:

[0118] Content-Length in the HTTP protocol

[0119] Window Scale option in the TCP protocol

[0120] Fields in the DNS protocol, such as the QR flag, that restrict protocol behavior.

[0121] S22, Intent chain matrix construction:

[0122] The bare field vector v obtained by decoupling the protocol field Remodeling into dimension d f Column vectors:

[0123]

[0124] v represents the normalized / encoded value of the field, d fIndicates the number of dimensions for the retained fields (3 ≤ df ≤ 32);

[0125] The behavioral feature unit F output by S1 behavior Remodeling into dimension d b Row vectors:

[0126]

[0127] Constructing the attack intent chain matrix using tensor outer product operations:

[0128] in The output dimension is d f ×d b M ij This represents the joint association strength between the i-th field and the j-th behavioral feature.

[0129] In deep firewall detection, attack behavior is not caused by behavioral features or field features alone, but is often a coupled expression of "abnormal values ​​of fields + abnormal behavior".

[0130] For example:

[0131] Field anomalies (e.g., TTL=1) could be due to routing tests or a DoS attack.

[0132] Abnormal behavior (such as high directional jump rate) → may be due to CDN or scanner;

[0133] However, when both occur together: TTL = 1 + frequent directional jumps → typical LAND attack (routing spoofing), and tensor outer product is precisely the way to model this cross-modal interaction behavior.

[0134] Each row and column of the Attack Intent Chain Matrix (Mattack) has a definite physical meaning:

[0135] Rows (fixed fields → multiple rows): The reaction of a field under different behavioral scenarios;

[0136] Column (Fixed Behavior → Multiple Fields): The trigger strength of this behavior in different field scenarios;

[0137] Therefore, the matrix can be: transformed into an attack "intent heatmap", used for feature visualization, and used as input for subsequent adversarial networks to improve the ability to generate and identify attack samples.

[0138] Tensor outer product is the most locally resolving and attack semantic discriminative structure for expressing the "field-behavior coupling strength". The entire process of constructing the attack intent chain matrix by tensor outer product operation is as follows:

[0139] Obtain two key inputs from the processing results of the previous stage:

[0140] A set of "protocol raw field" vectors, representing field values ​​after processing by the protocol decoupling engine, such as source port, destination port, TTL, etc.;

[0141] A "behavioral feature unit" vector represents the result of extracting multiple behavioral indicators within the same time window, such as directional jump frequency, load chaos degree, and sudden response delay.

[0142] Vector standardization: Before the operation, both sets of vectors are standardized so that the values ​​of all their elements are in a uniform range (0 to 1), ensuring that features of different dimensions can be compared and coupled.

[0143] Cross-combination operation: During the operation, each field value in the raw field vector is combined with each behavioral indicator in the behavioral feature vector in turn. Each combination forms a two-dimensional matrix unit, which represents the interaction strength or coupling degree between the field and the behavior.

[0144] Matrix construction: After all fields and behaviors are combined, the system will fill these units into a complete two-dimensional matrix in the order of fields as rows and behaviors as columns. Each element of this matrix corresponds to the response relationship between "a certain field" and "a certain behavior feature".

[0145] If the value at a certain position in the matrix is ​​high, it means that there is a strong abnormal correlation between that field and that behavior; if the matrix exhibits a certain structure (such as a group of fields and multiple behaviors having obvious strength), it may reflect a specific attack intent pattern, such as session reuse, protocol switching, establishment of encrypted tunnels, etc.

[0146] This matrix is ​​named the "Attack Intent Chain Matrix" and serves as input to subsequent discriminators or classifiers to further analyze whether the current traffic exhibits chain-like signs of attack tendencies or strategic behaviors.

[0147] Table 2 RFC Protocol Template Table

[0148]

[0149] S3 specifically includes:

[0150] S31, a dual-stream adversarial network architecture:

[0151] S311, Generator Network: Receives the attack intent chain matrix M output by S2. attack The input is fed into the attack-removal autoencoder, and the output is the reconstructed normal intent chain matrix M. normalThe attack-removing autoencoder consists of three deconvolutional layers. The neurons in the middle hidden layers are subject to L1 sparse constraints to enhance the ability to eliminate anomalous features. Essentially, it is a denoising symmetric autoencoder structure. The key difference lies in the use of an attack erasure mechanism (regularization + gradient penalty) in the middle layers, specifically designed to suppress aggressive coupling patterns. This includes inputting the attack intent chain matrix, encoding, erasing anomalies, and decoding, as detailed below:

[0152] S3111, Input data format: Attack intent chain matrix M attack It is a two-dimensional matrix representing the interaction strength between protocol fields and behavioral features, with dimension d. f =8~16,d b =8~32, input shape 16×16.

[0153] S3112, Network Structure Design:

[0154] Encoding stage (feature compression): The input layer receives M... attack The matrix is ​​treated as a single-channel two-dimensional tensor; the first layer uses deconvolution to downsample the matrix to 8×8 and extract the interactive distribution local structure; the second layer compresses it to 4×4×64 to form the attack potential representation Z. latent .

[0155] Intermediate suppression phase (attack signature erasure): for Z latent Two types of attack suppression mechanisms have been added:

[0156] a. Sparsity constraint: Add an L1 regularization term to force the activation values ​​to become sparsity (retaining a small number of high-signal channels):

[0157]

[0158] b. Gradient Reversal Penalty: During the backpropagation phase, certain channel locations are designated as attack channel masks, forcing the backpropagation gradient direction to be negative, thus suppressing attack paths. Mask generation can be based on deviation statistics, outer product peak index, or external weak supervision labels.

[0159] S3113, Decoding Stage (Reconstruction): Using a three-layer deconvolution structure, for Z... latent Perform upsampling and restoration, with the output dimension being the same as the input dimension d. f ×d b , that is, M normal .

[0160] S312, Discriminator Network: Parallel Reception and The discriminant function D(·) composed of five depthwise separable convolutions outputs the attack intent deviation δ, and the data is received in parallel. and However, when inputting the discriminator network separately, the network parameters and weights are shared; that is, the discriminant function has the same structure for both, only the inputs differ. The calculation method is as follows:

[0161] δ=||sigmoid(D(M attack ))-tanh(D(M normal ))||2, specifically:

[0162] Enter M attack M normal Each component enters the isomorphic discriminant network;

[0163] The b network extracts deep features from both, and outputs two values ​​through a fully connected layer;

[0164] c One enters the Sigmoid function, and the other enters the Tanh activation function;

[0165] d calculates the L2 distance between the two outputs to obtain the deviation δ.

[0166] The discriminator consists of five depthwise separable convolutional layers, including the following components:

[0167] Network structure hierarchy (taking a 16×16 input dimension as an example):

[0168] Level L1: Operation type is DepthwiseConv(3×3); Output size is 16×16×16; Feature mechanism: Independent convolution per channel (dilation rate = 2);

[0169] Level L2: Operation type is PointwiseConv(1×1)+BN; Output size is 16×16×32; Feature mechanism: Channel aggregation + batch normalization;

[0170] Level L3: Operation type is SE attention module; output size is 16×16×32; feature mechanism: channel importance weighting (compression ratio = 16);

[0171] Level L4: Operation type is DepthwiseConv(5×5); Output size is 8×8×64; Feature mechanism: Feature map downsampling (step size = 2);

[0172] Level L5: Operation type is spatial pyramid pooling; output size is 1×1×256; feature mechanism: multi-scale integration (window = 1×1, 2×2, 4×4).

[0173] Hierarchical FC (fully connected): Operation type is fully connected output; output size is 1; feature mechanism: LeakyReLU activation, output score.

[0174] ReLU activation is used after each layer (except the last layer) to enhance nonlinear expressive power.

[0175] S32, Dynamic Judgment Mechanism: If δ is small, it indicates that the two structures are similar, and it is inferred to be "non-aggressive behavior"; when δ > τ... dynamic When an intrusion is detected, an interception is triggered.

[0176] Protocol irrelevance threshold τ dynarmic The KL divergence is dynamically adjusted based on the historical normal traffic intention chain distribution, and the calculation formula is as follows: Where, μ KL σ represents the mean KL divergence of the normal traffic intention chain distribution. KL The standard deviation of the KL divergence is represented by tu, where tu is the current operating time of the detection system or the monitoring cycle, and t is the standard deviation of the KL divergence. half This represents the half-life parameter and controls the threshold adjustment rate.

[0177] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0178] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields, characterized in that, Includes the following steps: S1, Attack Intent Analysis: Real-time capture of network data streams, synchronously decomposing them into packet header field sets and behavioral feature units; The behavioral feature unit is generated by causal convolution of the behavioral features of multiple consecutive data packets, representing the smallest segment of attack intent. S2, Dynamic Protocol Decoupling and Reassembly: Input the header field set output by S1 into the protocol decoupling engine, strip away the constraint field set of the protocol specification, and obtain the raw field vector; The raw field vector is subjected to tensor outer product operation with the behavioral feature unit output by S1 to generate the attack intent chain matrix. S3, Adversarial Intent Verification: Input the attack intent chain matrix output from S2 into the pre-trained two-stream adversarial network: The generator network reconstructs the normal traffic intent chain; the generator network receives the attack intent chain matrix and reconstructs the normal intent chain matrix through the attack-removing autoencoder; the attack-removing autoencoder includes multiple deconvolution layers, with L1 sparsity constraints applied to the intermediate layer neurons. The discriminator network calculates the deviation from the attack intent; The discriminator network receives attack intent chain matrices and normal intent chain matrices in parallel. These matrices are input separately to the discriminator network, with shared network parameter weights. The network outputs an attack intent deviation score. The discriminator network consists of five depthwise separable convolutional layers. The attack intent deviation score is calculated as follows: ； in, The degree of deviation from the attack intent. This is a matrix representing the chain of attack intent. This is a normal intent chain matrix. This represents the discriminator network; When the deviation exceeds the protocol irrelevance threshold, it is identified as an intrusion and intercepted.

2. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 1, characterized in that, S1 includes copying the network data stream at line speed through a bypass mirror port and storing the original data packets using a zero-copy ring buffer.

3. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 1, characterized in that, The S1 also includes a dual-channel parsing engine that executes in parallel, specifically including: Packet header channel: After stripping the Ethernet frame header, fields are extracted iteratively according to the protocol stack level to generate a packet header field set; Behavioral channel: Calculate the spatiotemporal behavioral fingerprint of N consecutive data packets at the data link layer. The spatiotemporal behavioral fingerprint includes packet direction hopping frequency and payload chaos.

4. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 3, characterized in that, After the spatiotemporal behavioral fingerprint is obtained, it is input into a causal convolutional layer, where the kernel size K=3 and the dilation factor D=2. The output feature map is then max-pooled to generate behavioral feature units.

5. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 1, characterized in that, The protocol decoupling engine in S2 includes a pre-set RFC protocol template table. The packet header field set is input into the protocol decoupling engine, matched with the RFC protocol template table, and the constraint field set defined in the protocol template is stripped off, leaving the remaining fields to form a raw field vector.

6. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 5, characterized in that, The constraint field set includes: HTTP Protocol Content-Length; The Window Scale option of the TCP protocol; The QR flag in the DNS protocol.

7. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 5, characterized in that, The construction of the attack intent chain matrix includes: Reshape the raw field vector into a column vector; Reshape the behavioral feature units output by S1 into row vectors; An attack intent chain matrix is ​​generated by tensor outer product.

8. The deep firewall intrusion detection method based on joint modeling of behavioral features and packet header fields according to claim 1, characterized in that, S3 also includes a dynamic determination mechanism: when When an intrusion is detected, an interception is triggered. The protocol-independent determination threshold The KL divergence is dynamically adjusted based on the historical normal traffic intention chain distribution and is calculated as follows: ;in, The mean KL divergence represents the distribution of the normal traffic intent chain. The standard deviation of the KL divergence is represented by... This refers to the current operating time or monitoring cycle of the detection system. This represents the half-life parameter.

Images