Computer network security detection system and method
By filtering key features through feature dependency functions and combining multi-stage detection with KNN-LightGBM and BERT models, the problems of false negatives and false positives in network security detection in existing technologies are solved, and efficient and accurate network attack identification and classification are achieved.
Patent Information
- Application Number
- CN202511148152.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-16
- Publication Date
- 2025-12-09
AI Technical Summary
Existing network security detection methods are prone to false positives or false negatives when faced with complex or covert attack scenarios, and lack in-depth analysis capabilities, making it difficult to effectively deal with complex attacks such as advanced persistent threats and distributed denial-of-service attacks.
A multi-stage cybersecurity detection system is constructed by using a feature dependency function to calculate and screen key features, combining a KNN-LightGBM joint voting model for preliminary detection, and then using a BERT model for in-depth analysis.
It significantly improves the efficiency and accuracy of network security detection, enabling rapid identification of high-risk data, reducing computational complexity, and enhancing the detection accuracy and fine-grained analysis capabilities for complex attacks.
Smart Images
Figure CN121098544A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer network security detection technology, specifically to a computer network security detection system and method. Background Technology
[0002] With the rapid development of information technology, computer networks have become the foundation of modern society. Connecting computers and devices globally, they play a vital role in information transmission, data sharing, and resource collaboration across various fields. The rapid development of technologies such as the Internet, big data, cloud computing, and the Internet of Things has further promoted the widespread adoption of computer networks, greatly improving work efficiency, economic benefits, and the convenience of social life.
[0003] With the widespread application of computer networks, network security issues have become increasingly prominent. Network security refers to the process of protecting network systems and data from unauthorized access, tampering, damage, or theft through technical means and management measures. The goal of network security is to ensure the confidentiality, integrity, and availability of information, and to guarantee the stability and normal operation of systems in the face of security threats.
[0004] Most current network security detection methods employ single-stage detection, meaning that attack judgment is made directly after initial screening of traffic data. While this method can quickly identify common attack behaviors to some extent, it often lacks in-depth analysis capabilities and is prone to false positives or false negatives in complex or covert attack scenarios. As network attack methods continue to evolve, especially when facing complex attacks such as advanced persistent threats and distributed denial-of-service attacks, the limitations of single-stage detection are becoming increasingly apparent.
[0005] To address this, a computer network security detection system and method are proposed. Summary of the Invention
[0006] The purpose of this invention is to provide a computer network security detection system and method for detecting attack data on computer networks. To address the problems existing in the prior art, this invention first proposes a feature dependency function to calculate the feature dependency degree related to network attacks, and then filters out key features based on the feature dependency degree, significantly reducing the feature dimensionality of network traffic data. Second, this invention proposes a KNN-LightGBM joint voting model and applies it to the first stage of detection in the network security detection system. This model can quickly filter out high-risk data, thereby significantly reducing the workload of subsequent detection tasks. Finally, this invention applies the natural language model BERT to the second stage of detection in the network security detection system, analyzing network traffic data in the form of text sequences to improve the detection accuracy of complex network attacks. To achieve the above objectives, this invention provides the following technical solutions:
[0007] A computer network security detection system includes:
[0008] The feature selection module is used to calculate the dependency of features in the existing dataset according to the feature dependency function, select key features related to network attacks, and compress the network node traffic data according to the key features to obtain compressed traffic data.
[0009] The first detection module is used to initially predict the compressed flow data, obtain the prediction result, and classify the prediction result according to the first threshold and the second threshold.
[0010] If the prediction result is greater than the first threshold, the prediction result is classified as high-risk data;
[0011] If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, then the prediction result is classified as suspicious data.
[0012] If the prediction result is less than or equal to the second threshold, the prediction result is classified as first safe data;
[0013] The second detection module is used to receive the suspicious data from the first detection module and classify the suspicious data. The classification results include attack data and second security data.
[0014] The early warning and isolation module is used to issue early warnings and isolate the high-risk data and the attack data.
[0015] Furthermore, the network nodes include: client nodes, server nodes, firewall nodes, router nodes, switch nodes, and virtual nodes.
[0016] Furthermore, the collection of traffic data from the network nodes includes both online and offline collection.
[0017] Furthermore, the feature dependency function is based on a mutual information matrix containing the relationships between various data features in the traffic data and known attack types. The contribution of each data feature to identifying network attacks is evaluated and quantified by performing matrix operations. The matrix operations include calculating the determinant of the product of the mutual information matrix and its transpose. The quantified value of the contribution is represented as the dependency of the data feature.
[0018] Furthermore, the existing datasets include at least the following: CICIDS2017 dataset, UNSW-NB15 dataset, KDD99 dataset, and CSE-CIC-IDS2018 dataset.
[0019] Furthermore, the predicted compressed flow data includes:
[0020] The compressed flow data is preprocessed to obtain preprocessed data;
[0021] The preprocessed data is processed in parallel using the LightGBM module and the KNN module to obtain the LightGBM prediction probability and the KNN prediction probability.
[0022] The LightGBM prediction probability and the KNN prediction probability are processed using a joint voting strategy to obtain the prediction result; the probability output by the LightGBM module is multiplied by the weight assigned to the LightGBM module, and the probability output by the KNN module is multiplied by the weight assigned to the KNN module to obtain the weighted combination probability. The sum of the weights of the two modules is always one.
[0023] A first threshold and a second threshold are set, and the prediction results are classified according to the first threshold and the second threshold. The classification results include high-risk data, suspicious data, and first safe data.
[0024] Data is forwarded according to the classification results, wherein the high-risk data is forwarded to the early warning and isolation module, the suspicious data is forwarded to the second detection module, and the first safe data is forwarded to the destination network node.
[0025] Furthermore, the classification of the suspicious data includes:
[0026] Collect the suspicious data and serialize its key features to obtain a text sequence;
[0027] Each text sequence is assigned a multi-class label, which corresponds to various types of network attack and normal traffic.
[0028] The text sequence is converted into an input tensor using the tokenizer of the BERT model;
[0029] Load a pre-trained BERT model and add a multi-class output layer to compute and classify the input tensor. The classification results include attack data and second security data.
[0030] Data is forwarded according to the classification results, wherein the attack data is forwarded to the early warning and isolation module, and the second security data is forwarded to the destination network node.
[0031] Furthermore, the early warning and isolation module includes an early warning device and an isolation device. The early warning device uses a buzzer sound to warn of the high-risk data and the attack data. The isolation device includes a high-risk data sandbox and an attack data sandbox. The high-risk data sandbox isolates all high-risk data without distinguishing between specific attack types. The attack data sandbox can isolate each type of data separately.
[0032] Furthermore, the computer network security detection system further includes a log management module, which is an optional plug-in applied to the first detection module and the second detection module, and saves the operation logs of the first detection module and the second detection module.
[0033] Furthermore, to achieve the above objectives, the present invention also proposes a computer network security detection method, comprising:
[0034] Acquire and collect network node traffic data;
[0035] The dependency of features in the existing dataset is calculated based on the feature dependency function. Key features related to network attacks are selected, and the network node traffic data is compressed based on the key features to obtain compressed traffic data.
[0036] The compressed traffic data is predicted to obtain a prediction result, and the prediction result is classified according to a first threshold and a second threshold. If the prediction result is greater than the first threshold, it is classified as high-risk data. If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, it is classified as suspicious data. If the prediction result is less than or equal to the second threshold, it is classified as first safe data.
[0037] Receive and classify the suspicious data to obtain classification results, including attack data and second security data;
[0038] Receive the high-risk data and the attack data, and issue warnings and isolate the high-risk data and the attack data.
[0039] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0040] 1. This invention proposes a feature dependency function to calculate the feature dependency degree related to network attacks, enabling key feature selection from network traffic data and significantly improving the efficiency of network security detection systems. By assessing the importance of features through feature dependency degree, the system can automatically identify and filter the features most relevant to network attacks, reducing data dimensionality and thus lowering computational complexity and accelerating detection speed. Simultaneously, it retains the features that have the greatest impact on detection accuracy, allowing the model to maintain high recognition accuracy even in complex attack scenarios. This feature selection method not only optimizes the model's operating efficiency but also improves the overall detection effect.
[0041] 2. This invention proposes a KNN-LightGBM joint voting model and applies it to the first stage of network security detection systems. This model can quickly filter out high-risk data, thereby significantly reducing the workload of subsequent detection tasks. By combining the similarity analysis of KNN with the powerful classification capabilities of LightGBM, the KNN-LightGBM joint voting model can efficiently identify potential attack traffic and perform preliminary classification. This approach not only improves the filtering speed but also ensures the accuracy of the filtering, reduces the computational burden of subsequent detection, and makes the entire network security detection system more efficient and faster.
[0042] 3. This invention applies the BERT natural language model to the second-stage detection of a network security detection system. Through BERT's multi-classification capabilities, the detection accuracy for complex network attacks is significantly improved. Based on BERT's advantages in natural language processing and the similarity in word order between network traffic and natural language, the second-stage detection can deeply analyze the feature patterns in network traffic, effectively handle and classify various complex and similar attack types, and demonstrate excellent classification performance. By employing a multi-classification strategy, the second-stage detection accurately distinguishes various network attack types, avoiding potential misjudgments caused by traditional binary classification models, thereby enhancing the fine-grained analysis capabilities and security of the entire detection system. Attached Figure Description
[0043] Figure 1 A structural diagram of a computer network security detection system provided in an embodiment of the present invention;
[0044] Figure 2 A flowchart illustrating the process of the first detection module acquiring prediction results provided in an embodiment of the present invention;
[0045] Figure 3 This is a schematic diagram of the KNN-LightGBM joint voting model structure provided in an embodiment of the present invention;
[0046] Figure 4 This is a flowchart illustrating the process of the second detection module acquiring classification results according to an embodiment of the present invention.
[0047] Figure 5 This is a flowchart of a computer network security detection method provided in an embodiment of the present invention. Detailed Implementation
[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0049] Example 1
[0050] A computer network security detection system, such as Figure 1 As shown, it includes: a traffic data acquisition module, a feature selection module, a first detection module, a second detection module, and an early warning and isolation module;
[0051] See Figure 1 The traffic data acquisition module in the middle;
[0052] Furthermore, the traffic data acquisition module is used to acquire and collect network node traffic data; the network nodes include: client nodes, server nodes, firewall nodes, router nodes, switch nodes, and virtual nodes.
[0053] By collecting traffic data from multiple network nodes through a traffic data acquisition module, comprehensive coverage of traffic information at all key locations within the network can be achieved. This approach ensures meticulous monitoring of the entire network, helps capture potential threats on different nodes, enhances the global perspective and comprehensive analysis capabilities of the network security detection system, and thus improves the system's ability to detect and defend against complex attacks.
[0054] Furthermore, the collection of traffic data from the network nodes includes both online and offline collection.
[0055] Specifically, online data collection methods are typically used in business scenarios with high real-time requirements and high traffic volumes, such as e-commerce platforms, online shopping, financial transactions, and online games. In these scenarios, available online data collection solutions include: mirrored ports, traffic acquisition probes, network traffic splitters, NetFlow, and software proxy data collection. Offline data collection methods are typically used in business scenarios with lower real-time requirements and higher security requirements, such as financial institutions and network auditing. In these scenarios, available offline data collection solutions include: periodic packet capture, data log export, network device data buffer storage, and sFlow offline data extraction.
[0056] Choosing between online and offline data collection methods for different business scenarios effectively balances the needs for real-time performance, performance, and security. In scenarios with high real-time requirements and high traffic volumes, online data collection solutions, such as mirrored ports and traffic probes, ensure the system can quickly respond to changes in network traffic, guaranteeing business continuity and user experience. Conversely, in scenarios with strict security requirements and lower real-time requirements, offline data collection solutions, such as periodic packet capture and data log export, allow for in-depth security auditing and data analysis, providing stronger data privacy protection and compliance support, thereby achieving comprehensive network security management.
[0057] See Figure 1 The feature selection module in the middle;
[0058] Furthermore, the dependency of features in the existing dataset is calculated based on the feature dependency function, key features related to network attacks are selected, and the network node traffic data is compressed based on the key features to obtain compressed traffic data. The feature dependency is calculated as follows: First, a "mutual information matrix" is constructed, which is used to quantify the statistical correlation strength between each feature in the dataset and each known attack type.
[0059] The first determinant value, representing the complete information of the system, is calculated by multiplying the complete mutual information matrix by its transpose and then calculating the determinant of the resulting matrix. This first determinant value will be used as the divisor of the final ratio.
[0060] The second determinant value, representing the remaining information of the system, is calculated by repeating the same transpose, multiplication, and determinant calculations on the remaining matrix after removing the row corresponding to the currently evaluated feature from the complete mutual information matrix. The second determinant value will be used as the divisor of the final ratio.
[0061] Dividing the first determinant value by the second determinant value yields the dependency of that specific feature. The higher the dependency value, the more important that feature is in identifying network attacks.
[0062] Specifically, the existing dataset contains 80 known features, including basic network traffic features, time features, packet-level features, and TCP / IP connection features; and 14 known labels, including distributed denial-of-service attacks, brute-force attacks, botnet attacks, web attacks, and Heartbleed vulnerability exploits. A mutual information matrix A is calculated based on the features and labels, where A∈ Subsequently, according to Calculate the mutual information covariance matrix, and then calculate the dependency of feature i based on the average mutual information of the 14 attack types corresponding to feature i. Iterate through all features and use the top-k algorithm to sort the feature dependencies of all features, where the k value is set to 20, that is, retain the 20 features with the highest dependencies as key features. Use the Pandas library in Python to compress the key features of the network node traffic data, so that only key features are retained, to obtain compressed traffic data.
[0063] Using feature dependency functions to calculate dependencies and filter key features provides a numerical and intuitive reflection of the importance of each feature to the model's predictions. This method effectively identifies the most informative features for network attack detection, thereby reducing data dimensionality and complexity, and improving the model's prediction accuracy and computational efficiency. By retaining key features, the system can focus more on effectively learning attack patterns while reducing computational resource consumption, making the network security detection process more efficient and reliable.
[0064] Furthermore, the existing datasets include at least the following: CICIDS2017 dataset, UNSW-NB15 dataset, KDD99 dataset, and CSE-CIC-IDS2018 dataset.
[0065] Using diverse dataset combinations enables coverage of a wider range of network attack types and characteristics, enhancing the model's generalization ability and robustness. By training and testing on different datasets, the system can better adapt to various complex network environments, improving detection accuracy and reducing the likelihood of false positives and false negatives.
[0066] See Figure 1 The first detection module in the middle;
[0067] Furthermore, the first detection module is used to initially predict the compressed flow data, obtain prediction results, and classify the prediction results according to a first threshold and a second threshold;
[0068] If the prediction result is greater than the first threshold, the prediction result is classified as high-risk data;
[0069] If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, then the prediction result is classified as suspicious data.
[0070] If the prediction result is less than or equal to the second threshold, the prediction result is classified as first safe data;
[0071] The first detection module obtains the prediction result through the KNN-LightGBM joint voting model, such as Figure 2 As shown, it includes:
[0072] S301: Preprocess the compressed flow data to obtain preprocessed data;
[0073] S302: Use the LightGBM module and the KNN module to process the preprocessed data in parallel to obtain the LightGBM prediction probability and the KNN prediction probability;
[0074] S303: Use a joint voting strategy to process the LightGBM prediction probability and the KNN prediction probability to obtain the prediction result;
[0075] S304: Set a first threshold and a second threshold, and classify the prediction results according to the first threshold and the second threshold. The classification results include high-risk data, suspicious data and first safe data.
[0076] S305: Forward data according to the classification results, wherein the high-risk data is forwarded to the early warning and isolation module, the suspicious data is forwarded to the second detection module, and the first safe data is forwarded to the destination network node.
[0077] Specifically, in step S301, the compressed traffic data is preprocessed, including handling missing values, removing noise data, and formatting it into the same feature format as during training. The training data is data from a dataset compressed with key features, and the labels on the training data use a binarization strategy, being labeled only with 0 and 1, where 0 represents safe data and 1 represents unsafe data. In step S302, the LightGBM module and the KNN module are two parallel modules of the KNN-LightGBM joint voting model, such as... Figure 3 As shown, the same preprocessed data is simultaneously fed into the LightGBM module and the KNN module. In the LightGBM module, a grid search strategy is used to dynamically optimize the number of leaf nodes, learning rate, tree height, and minimum leaf node. In the KNN module, Manhattan distance and cross-validation strategies are used for cluster analysis. After calculation, the LightGBM prediction probability and the KNN prediction probability are obtained respectively. In step S303, a joint voting strategy is used to process the LightGBM prediction probability and the KNN prediction probability to obtain the prediction result. The value of the prediction result is distributed in [0,1]. The calculation method is as follows: multiply the prediction probability output by the LightGBM module by the weight assigned to the LightGBM module, and then add the prediction probability output by the KNN module multiplied by the weight assigned to the KNN module to obtain the weighted sum of the two. The sum of the weights of the LightGBM module and the KNN module is always one.
[0078] In step S304, the first threshold is set to 0.7, and the second threshold is set to 0.3. When the prediction result > 0.7, it indicates that the voting result has high credibility and the data can be considered high-risk data. When 0.3 < prediction result ≤ 0.7, it indicates that the voting result has low credibility or that the prediction results of the LightGBM module and the KNN module have large errors, and the data can be considered suspicious data, requiring more accurate prediction. When the prediction result ≤ 0.3, it indicates that the data is likely to be misclassified and the data can be considered safe data. In step S305, high-risk data is forwarded to the early warning and isolation module, suspicious data is forwarded to the second detection module, and safe data is forwarded to the corresponding network node according to the destination IP. In addition, the safe data mentioned in step S304 is the first safe data.
[0079] The KNN-LightGBM joint voting model effectively combines the advantages of both algorithms, thereby improving the accuracy and robustness of network security detection. KNN, by calculating the similarity of neighboring samples, can capture local patterns in traffic data, making it suitable for detecting similar attack behaviors; while LightGBM, as an efficient gradient boosting decision tree algorithm, can handle large amounts of data and identify complex nonlinear relationships. The joint voting mechanism makes the first-stage detection results more robust, reducing the possibility of false positives and false negatives. Simultaneously, based on the setting of a first and second threshold, high-risk and safe data are effectively filtered, reducing the workload for subsequent processing.
[0080] See Figure 1 The second detection module in;
[0081] Furthermore, the second detection module is used to receive the suspicious data forwarded by the first detection module, and classify the suspicious data to obtain a classification result, including attack data and second security data;
[0082] If the classification result is the attack data, then the attack data is forwarded to the early warning and isolation module;
[0083] If the classification result is the second security data, then the second security data is forwarded to the destination network node;
[0084] The second detection module obtains the classification result through the BERT model, such as Figure 4 As shown, it includes:
[0085] S401: Collect the suspicious data and serialize its key features to obtain a text sequence;
[0086] S402: Assign multi-class labels to each text sequence, with the multi-class labels corresponding to various types of network attack and normal traffic;
[0087] S403: Use the BERT model's tokenizer to convert text sequences into input tensors;
[0088] S404: Load the pre-trained BERT model and add a multi-class output layer. Calculate the input tensor and obtain the classification results, which include attack data and second security data.
[0089] S405: Forward data according to the classification results. Among them, attack data is forwarded to the early warning and isolation module, and second security data is forwarded to the destination network node.
[0090] Specifically, in step S401, missing values and outliers need to be removed, and the data needs to be standardized or normalized. When serializing or texturing key features, various features of the traffic data (such as protocol type, IP address, port number, etc.) can be encoded into a text sequence. For example, a traffic record can be converted into the text sequence "TCP 192.168.1.1:80 10.0.0.1:8080 SYN 60”, where TCP is the protocol type, 192.168.1.1 is the source IP, 80 is the source port, 10.0.0.1 is the destination IP, 8080 is the destination port, SYN is the flag bit, and 60 is the data length; in step S402, multi-class labels are assigned to each text sequence, corresponding to 14 attack types such as distributed denial-of-service attacks, brute-force attacks, botnet attacks, web attacks, and Heartbleed vulnerability exploits, as well as normal traffic; in step S403, BERT's tokenizer is used to convert the preprocessed text sequence into sub-word units that can be understood by the model, and then the sub-word units are further converted into input IDs that the model can process. Each sub-word unit corresponds to a unique ID, and then the encode_ function in the BertTokenizer class is called. The plus function pads and truncates the text sequence to generate an attention mask. Finally, the input ID and attention mask are converted into tensors for input into the BERT model for processing. In step S404, the added multi-class output layer is a softmax layer with a classification parameter n=15, representing 14 types of attack data and 1 type of normal traffic data. After classification by the softmax layer, attack data and second security data are obtained. The attack data includes 14 types of attack data, such as distributed denial-of-service attacks, brute-force attacks, botnet attacks, web attacks, and Heartbleed vulnerability exploits. The second security data is the normal traffic data. In step S405, the attack data is forwarded to the early warning and isolation module, and the second security data is forwarded to the corresponding network node according to the destination IP.
[0091] The second detection module introduces the BERT model, which possesses powerful language parsing capabilities, effectively capturing complex sequences and contextual relationships in network traffic data and fully applying it to network attack classification tasks. Utilizing BERT's multi-head self-attention mechanism, the second detection module can accurately identify various network attack types from the initially screened suspicious data, significantly improving classification accuracy and robustness. This module not only compensates for potential missed detections by the first detection module but also deeply analyzes complex traffic data, thereby enhancing the overall defense capabilities of the entire network security detection system.
[0092] See Figure 1 Early warning and isolation devices in the system;
[0093] Furthermore, the early warning and isolation module is used to warn of and isolate the high-risk data and the attack data. The early warning and isolation device includes an early warning device and an isolation device. The early warning device uses a buzzer sound to warn of the high-risk data and the attack data. The isolation device includes a high-risk data sandbox and an attack data sandbox. The high-risk data sandbox isolates all high-risk data without distinguishing between specific attack types. The attack data sandbox can isolate each type of data separately.
[0094] By combining early warning and isolation devices, the early warning and isolation module provides dual protection against both high-risk and attack data. The early warning device uses an audible alert to promptly notify security administrators of potential security threats, enabling swift response. The isolation device is further divided into a high-risk data sandbox and an attack data sandbox. The high-risk data sandbox effectively isolates all high-risk data, ensuring the overall system is protected from potential threats; while the attack data sandbox isolates data separately based on different attack types, allowing the system to implement targeted defenses against each attack. This design not only improves detection and response efficiency but also enhances the defense capabilities against diverse network attacks, ensuring the system's security and robustness.
[0095] In some optional implementations, the computer network security detection system, in addition to all the modules mentioned above, also includes a log management module; the log management module is an optional plug-in applied to the first detection module and the second detection module, and is used to save the operation logs of the first detection module and the second detection module.
[0096] By adding a log management module as an optional plugin, the system gains additional auditing and tracing capabilities. This module can record and save the operation logs of both the first and second detection modules, ensuring detailed documentation of every step in the detection process. Furthermore, when the system is attacked or breached, the log management module can perform timely backtracking analysis to help identify attack paths and vulnerabilities, thereby ensuring the system's robustness and resilience.
[0097] This application embodiment performs computer network security detection by capturing network traffic data. The specific implementation process mainly involves the following modules: a feature selection module, a first detection module, and a second detection module. Specifically, the feature selection module employs a random forest feature selection strategy to sort network traffic data by features and select key features, significantly reducing the feature dimensionality of the network traffic data. In the first detection module, a KNN-LightGBM joint voting model is used for the first stage of data detection, quickly filtering out safe and high-risk data, reducing the workload of subsequent detection tasks. In the second detection module, a BERT model is used for the second stage of data detection, accurately classifying data that could not be determined in the first detection module, achieving refined and multi-layered security detection.
[0098] Example 2
[0099] A computer network security detection method, such as Figure 5 As shown, it includes:
[0100] Acquire and collect network node traffic data;
[0101] The dependency of features in the existing dataset is calculated based on the feature dependency function. Key features related to network attacks are selected, and the network node traffic data is compressed based on the key features to obtain compressed traffic data.
[0102] The compressed traffic data is predicted to obtain a prediction result, and the prediction result is classified according to a first threshold and a second threshold. If the prediction result is greater than the first threshold, it is classified as high-risk data. If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, it is classified as suspicious data. If the prediction result is less than or equal to the second threshold, it is classified as first safe data.
[0103] Receive and classify the suspicious data to obtain classification results, including attack data and second security data;
[0104] Receive the high-risk data and the attack data, and issue warnings and isolate the high-risk data and the attack data.
[0105] Furthermore, the network nodes include: client nodes, server nodes, firewall nodes, router nodes, switch nodes, and virtual nodes.
[0106] Furthermore, the collection of traffic data from the network nodes includes both online and offline collection.
[0107] Furthermore, the feature dependency function is based on a mutual information matrix containing the relationships between various data features in the traffic data and known attack types. The contribution of each data feature to identifying network attacks is evaluated and quantified by performing matrix operations. The matrix operations include calculating the determinant of the product of the mutual information matrix and its transpose. The quantified value of the contribution is represented as the dependency of the data feature.
[0108] Furthermore, the existing datasets include at least the following: CICIDS2017 dataset, UNSW-NB15 dataset, KDD99 dataset, and CSE-CIC-IDS2018 dataset.
[0109] Further, the prediction of the compressed traffic data is performed in the first detection module, which obtains the prediction result through the KNN-LightGBM joint voting model, including:
[0110] The compressed flow data is preprocessed to obtain preprocessed data;
[0111] The preprocessed data is processed in parallel using the LightGBM module and the KNN module to obtain the LightGBM prediction probability and the KNN prediction probability.
[0112] The LightGBM prediction probability and the KNN prediction probability are processed using a joint voting strategy to obtain the prediction result. The probability output by the LightGBM module is multiplied by the weight assigned to the LightGBM module, and the probability output by the KNN module is multiplied by the weight assigned to the KNN module to obtain the weighted combination probability. The sum of the weights of the two modules is always one.
[0113] A first threshold and a second threshold are set, and the prediction results are classified according to the first threshold and the second threshold. The classification results include high-risk data, suspicious data, and first safe data.
[0114] Data is forwarded according to the classification results, wherein the high-risk data is forwarded to the early warning and isolation module, the suspicious data is forwarded to the second detection module, and the first safe data is forwarded to the destination network node.
[0115] Further, the receiving and classification of the suspicious data is performed on the second detection module, which obtains the classification result through the BERT model, including:
[0116] Collect the suspicious data and serialize its key features to obtain a text sequence;
[0117] Each text sequence is assigned a multi-class label, which corresponds to various types of network attack and normal traffic.
[0118] The text sequence is converted into an input tensor using the tokenizer of the BERT model;
[0119] Load a pre-trained BERT model and add a multi-class output layer to compute and classify the input tensor. The classification results include attack data and second security data.
[0120] Data is forwarded according to the classification results, wherein the attack data is forwarded to the early warning and isolation module, and the second security data is forwarded to the destination network node.
[0121] Furthermore, the reception of the high-risk data and the attack data is performed on the early warning and isolation module. The early warning and isolation module includes an early warning device and an isolation device. The early warning device uses a buzzer sound to warn of the high-risk data and the attack data. The isolation device includes a high-risk data sandbox and an attack data sandbox. The high-risk data sandbox isolates all high-risk data without distinguishing between specific attack types. The attack data sandbox can isolate each type of attack data separately.
[0122] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A computer network security detection system, characterized in that, include: The traffic data acquisition module is used to acquire and collect network node traffic data; The feature selection module is used to calculate the dependency of features in the existing dataset according to the feature dependency function, select key features related to network attacks, and compress the network node traffic data according to the key features to obtain compressed traffic data. The first detection module is used to initially predict the compressed flow data, obtain the prediction result, and classify the prediction result according to the first threshold and the second threshold. If the prediction result is greater than the first threshold, the prediction result is classified as high-risk data; If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, then the prediction result is classified as suspicious data. If the prediction result is less than or equal to the second threshold, the prediction result is classified as first safe data; The second detection module is used to receive the suspicious data from the first detection module and classify the suspicious data. The classification results include attack data and second security data. The early warning and isolation module is used to issue early warnings and isolate the high-risk data and the attack data.
2. The computer network security detection system according to claim 1, characterized in that, The network nodes include: client nodes, server nodes, firewall nodes, router nodes, switch nodes, and virtual nodes.
3. The computer network security detection system according to claim 1, characterized in that, The collection of traffic data from the network nodes includes both online and offline collection.
4. The computer network security detection system according to claim 1, characterized in that, The feature dependency function is based on a mutual information matrix containing the relationships between various data features in the traffic data and known attack types. It evaluates and quantifies the contribution of each data feature to identifying network attacks by performing matrix operations. The matrix operations include calculating the determinant of the product of the mutual information matrix and its transpose. The quantified value of the contribution is represented as the dependency of the data feature.
5. A computer network security detection system according to claim 4, characterized in that, The existing datasets include at least the following: CICIDS2017 dataset, UNSW-NB15 dataset, KDD99 dataset, and CSE-CIC-IDS2018 dataset.
6. The computer network security detection system according to claim 1, characterized in that, The predicted compressed flow data includes: The compressed flow data is preprocessed to obtain preprocessed data; The preprocessed data is processed in parallel using the LightGBM module and the KNN module to obtain the LightGBM prediction probability and the KNN prediction probability. The LightGBM prediction probability and the KNN prediction probability are processed using a joint voting strategy to obtain the prediction result; the probability output by the LightGBM module is multiplied by the weight assigned to the LightGBM module, and the probability output by the KNN module is multiplied by the weight assigned to the KNN module to obtain the weighted combination probability. The sum of the weights of the two modules is always one. A first threshold and a second threshold are set, and the prediction results are classified according to the first threshold and the second threshold. The classification results include high-risk data, suspicious data, and first safe data. Data is forwarded according to the classification results, wherein the high-risk data is forwarded to the early warning and isolation module, the suspicious data is forwarded to the second detection module, and the first safe data is forwarded to the destination network node.
7. A computer network security detection system according to claim 1, characterized in that, The suspicious data categorized as follows includes: Collect the suspicious data and serialize its key features to obtain a text sequence; Each text sequence is assigned a multi-class label, which corresponds to various types of network attack and normal traffic. The text sequence is converted into an input tensor using the tokenizer of the BERT model; Load a pre-trained BERT model and add a multi-class output layer to compute and classify the input tensor. The classification results include attack data and second security data. Data is forwarded according to the classification results, wherein the attack data is forwarded to the early warning and isolation module, and the second security data is forwarded to the destination network node.
8. A computer network security detection system according to claim 1, characterized in that, The early warning and isolation module includes an early warning device and an isolation device; the early warning device uses a buzzer sound to warn of the high-risk data and the attack data; the isolation device includes a high-risk data sandbox and an attack data sandbox; the high-risk data sandbox isolates all high-risk data without distinguishing specific attack types; the attack data sandbox isolates each type separately.
9. The computer network security detection system according to claim 1 further includes a log management module, characterized in that, The log management module is an optional plugin applied to the first detection module and the second detection module, and saves the operation logs of the first detection module and the second detection module.
10. A computer network security detection method, characterized in that, include: Acquire and collect network node traffic data; The dependency of features in the existing dataset is calculated based on the feature dependency function. Key features related to network attacks are selected, and the network node traffic data is compressed based on the key features to obtain compressed traffic data. The compressed traffic data is predicted to obtain a prediction result, and the prediction result is classified according to a first threshold and a second threshold. If the prediction result is greater than the first threshold, it is classified as high-risk data. If the prediction result is greater than the second threshold and the prediction result is less than or equal to the first threshold, it is classified as suspicious data. If the prediction result is less than or equal to the second threshold, it is classified as first safe data. Receive and classify the suspicious data to obtain classification results, including attack data and second security data; Receive the high-risk data and the attack data, and issue warnings and isolate the high-risk data and the attack data.