Network security anomaly detection method and device, medium and product

Abstract

The embodiment of the invention provides a network security anomaly detection method and device, a medium and a product, and relates to the technical field of network security services. The method comprises the following steps: acquiring training data in a real-time traffic scene; using the training data to train through a gradient path bifurcation optimization mode, and determining a neural network model used for identifying abnormal behaviors; and according to the neural network model, identifying the abnormal behavior in the real-time network data. According to the scheme of the invention, through the full-process design of targeted data acquisition, gradient path bifurcation optimization training and real-time accurate recognition, the recognition precision of the abnormal behaviors of the complex network is improved from the three aspects of data basis, model learning ability and practical application adaptation, and the problem of low recognition accuracy of the abnormal behaviors of the complex network in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security services, and in particular to a network security anomaly detection method and device, medium and product. BACKGROUND

[0002] In the prior art, with the development of the Internet, network attack means are diverse, and network security problems are serious. Common network protocol traffic behavior is complex, and attackers use protocol vulnerabilities to launch various attacks. Existing anomaly detection methods have many shortcomings, such as relying on a single data source, simple feature extraction, neural network training prone to gradient problems, poor generalization ability for processing complex low-frequency anomalies, and difficulty in adapting to changes based on a fixed model, making it difficult to efficiently and real-time identify abnormal behavior. SUMMARY

[0003] At least one embodiment of the present application provides a network security anomaly detection method, device, medium and product, to solve the problem of poor accuracy in identifying complex network anomaly behavior in the prior art.

[0004] To solve the above technical problems, the present application is implemented as follows:

[0005] In a first aspect, the present application provides a network security anomaly detection method, comprising:

[0006] Obtaining training data under a real-time traffic scenario;

[0007] Training a neural network model for identifying abnormal behavior by gradient path bifurcation optimization using the training data;

[0008] Identifying abnormal behavior in real-time network data according to the neural network model.

[0009] Optionally, obtaining training data under a real-time traffic scenario comprises:

[0010] Obtaining real-time network traffic data packets, node log data and abnormal event records under a real-time traffic scenario;

[0011] Converting the real-time network traffic data packets, node log data and abnormal event records into structured data, performing sliding window aggregation, extracting time series features and labeling abnormal data to obtain training data with discrete attribute form; the abnormal labeling categories in the abnormal data labeling include at least one of normal traffic, distributed denial of service attack, transmission control protocol connection hijacking, domain name system amplification attack, ARP spoofing and malicious software communication.

[0012] Optionally, training a neural network model for identifying abnormal behavior by gradient path bifurcation optimization using the training data comprises:

[0013] randomly initializing weight matrix and bias term of initial neural network model; initialization parameter of the random initialization obeys normal distribution with mean value of 0 and variance of unit matrix;

[0014] inputting the training data into the initial neural network model after random initialization, calculating activation value by layer, introducing activation function in calculation process, and obtaining output feature of each layer;

[0015] calculating gradient information of different granularities for the output feature of each layer, and determining comprehensive gradient information based on the gradient information of different granularities;

[0016] in the case of back propagation, introducing adjustment coefficient and adjustment factor of the bifurcation point based on the comprehensive gradient information and the bifurcation point of gradient path, and calculating weight matrix update amount;

[0017] adjusting weights of each layer according to the weight matrix update amount to generate final feature representation;

[0018] in the process of continuous iterative training, dynamically adjusting learning rate according to L2 norm sum of gradient of each layer to adapt to current gradient strength until loss function of the model reaches a set threshold or the gradient path bifurcation point converges to an optimal solution, ending the training, and determining the neural network model for identifying abnormal behavior.

[0019] Optionally, for the output feature of each layer, gradient information of different granularities is calculated, and comprehensive gradient information is determined based on the gradient information of different granularities, including:

[0020] calculating a first gradient component related to the output feature of the current layer and itself; the first gradient component is obtained by summarizing the influence degree of loss function of all input samples on activation value of the current layer, and the influence degree of activation value of the current layer on its own weight; the activation value of the current layer is used to represent the protocol feature extracted by the current layer;

[0021] calculating a second gradient component related to the output feature of the current layer and other layers; the loss second gradient component is obtained by multiplying a control coefficient and the sum of the influence of all layer features; the control coefficient is calculated based on the weighted coefficient of each layer and the L2 norm sum of all layer gradients;

[0022] combining the first gradient component and the second gradient component to obtain comprehensive gradient information of the current layer.

[0023] Optionally, in the case of back propagation, the adjustment coefficient and the adjustment factor of the bifurcation point are introduced based on the comprehensive gradient information and the bifurcation point of the gradient path, and the weight matrix update amount is calculated, including:

[0024] determining a split point of a gradient path; each of the split points corresponds to a gradient update path;

[0025] calculating an adjustment coefficient of the split point; the adjustment coefficient is used to dynamically adjust the influence degree of each split path on weight update;

[0026] calculating an adjustment factor of the split point; the adjustment factor is determined based on the sensitivity of the activation function to the activation value of each layer and the overall intensity of all layer gradients;

[0027] According to the comprehensive gradient information, the adjustment coefficient and the adjustment factor, the weight matrix update amount of each layer is calculated under the control of the learning rate.

[0028] Optionally, according to the weight matrix update amount, the weights of each layer are adjusted to generate a final feature representation, including:

[0029] According to the weight matrix update amount, the weights of each layer of the initial neural network model are adjusted;

[0030] calculating a weighting coefficient of each layer feature;

[0031] Based on the weighting coefficient, the features extracted from each layer are fused to generate a final feature representation containing multi-layer feature information.

[0032] Optionally, according to the neural network model, an abnormal behavior in real-time network data is identified, including:

[0033] Using the neural network model to receive real-time network data, the real-time network data is predicted to obtain a prediction result of the real-time network data;

[0034] According to the prediction result, it is judged whether there is abnormal traffic in the real-time network data;

[0035] If it is judged that there is abnormal traffic, an alarm is triggered and a preset response measure is executed.

[0036] In a second aspect, the embodiments of the present application provide a network security anomaly detection device, comprising:

[0037] An acquisition module is configured to acquire training data in a real-time traffic scenario;

[0038] A first determination module is configured to use the training data to train a neural network model for identifying abnormal behaviors by a gradient path split optimization method;

[0039] A first processing module is configured to identify abnormal behaviors in real-time network data according to the neural network model.

[0040] In a third aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of the method according to any one of the first aspect.

[0041] In a fourth aspect, an embodiment of the present application provides a computer program product, and the computer program product comprises computer instructions. The computer instructions are executed by a processor to implement the steps of the method according to any one of the first aspect.

[0042] Compared with the prior art, the network security anomaly detection method, device, medium and product provided by the embodiment of the present application obtain training data in a real-time traffic scenario; the training data are used to train a neural network model for identifying abnormal behaviors by gradient path bifurcation optimization; and the neural network model is used to identify abnormal behaviors in real-time network data. Through the whole process design of targeted data collection, gradient path bifurcation optimization training and real-time accurate identification, the identification accuracy of complex network abnormal behaviors is improved from three aspects of data basis, model learning ability and actual application adaptation, and the problem of low identification accuracy of complex network abnormal behaviors in the prior art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0043] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the present application. Moreover, like reference numerals designate similar parts throughout the several views. In the drawings:

[0044] Figure 1 A flowchart of a network security anomaly detection method provided by an embodiment of the present application is shown in FIG. 1;

[0045] Figure 2 A comparison diagram of training curves of different initialization methods provided by an embodiment of the present application is shown in FIG. 2;

[0046] Figure 3 A comparison diagram of performances of different methods in DDoS detection provided by an embodiment of the present application is shown in FIG. 3;

[0047] Figure 4 A feature space distribution diagram provided by an embodiment of the present application is shown in FIG. 4;

[0048] Figure 5 A structure diagram of a network security anomaly detection device provided by an embodiment of the present application is shown in FIG. 5. DETAILED DESCRIPTION

[0049] The terms "first", "second", and the like in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence. It should be understood that the terms used in this way can be interchanged as appropriate, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second" are generally of a kind and do not limit the number of objects, for example, the first object can be one or more. In addition, "or" in this application means at least one of the connected objects. For example, "A or B" covers three scenarios, namely, scenario one: including A and not including B; scenario two: including B and not including A; scenario three: including A and B. The character " / " generally represents that the objects before and after are in an "or" relationship.

[0050] The term "indication" in this application can be a direct indication (or explicit indication) or an indirect indication (or implicit indication). Among them, the direct indication can be understood as that the sender explicitly informs the receiver of specific information, operations to be performed or requested results, etc. in the sent indication; the indirect indication can be understood as that the receiver determines the corresponding information according to the indication sent by the sender, or judges and determines the operation to be performed or the requested result according to the judgment result.

[0051] As described in the background, in the prior art, many anomaly detection methods mainly rely on a single source of network traffic data or node log data, ignoring the improvement of the comprehensiveness and accuracy of anomaly detection from multi-dimensional data (such as network protocol, traffic pattern, etc.). Traditional anomaly detection methods usually use relatively simple feature extraction methods, which are difficult to deeply analyze the data characteristics of different protocol layers. The existing neural network training method is prone to gradient disappearance or explosion in a high-dimensional feature space, resulting in a slow or unstable training process. Traditional methods often show poor generalization ability when dealing with complex and low-frequency anomalies, and are prone to false positives or false negatives. Most of the existing anomaly detection systems are based on fixed models, which are difficult to adapt to changing attack patterns. To solve at least one of the above problems, the embodiments of the present application provide a network security anomaly detection method, device, medium and product, which can reduce or avoid the above situations, and solve the problem of poor recognition accuracy of complex network anomaly behavior in the prior art.

[0052] The embodiments of the present application provide a network security anomaly detection method, device, medium and product. The method and device are based on the same application concept, and since the principles of solving problems are similar, the implementation of the device and the method can be mutually referred to, and the repeated parts will not be described again.

[0053] Please refer to Figure 1The network security anomaly detection method provided by the embodiment of the application comprises the following steps:

[0054] Step 11, acquiring training data in a real-time traffic scenario.

[0055] In the embodiment of the application, step 11 is the data basis for model training, and original data highly consistent with the actual network operation environment is collected, thereby providing support for subsequent model learning of real abnormal characteristics. For the target network scenario, a traffic collection tool is deployed to collect full network data, covering normal traffic and abnormal traffic; not only the basic information of the data packet is acquired, but also deep features are collected, such as the data packet frequency per unit time, the traffic byte number, the timing mode of TCP connection establishment or disconnection, the field abnormal value of the application layer protocol, etc.; the collection process is synchronized with the real-time operation of the network, so that static historical data is avoided, and it is ensured that the training data can reflect the characteristics of new attacks in the current network.

[0056] It should be noted that the real-time traffic scenario refers to a traffic environment completely synchronized with the current actual operation state of the target network, which is a key concept distinguishing from the static historical scenario. The traffic mode in the scenario dynamically changes over time, for example, a large number of employee terminal networking requests will occur in the morning peak of the enterprise network, and the server background data synchronization is mainly in the night; the attack traffic also presents real-time changes, rather than a fixed historical sample mode; the actual operation environment of the target network is completely reproduced, including the network topology, the device type, and the business type, so as to ensure that the collected traffic contains a real scenario in which normal business interference and abnormal attacks are mixed; the time difference between the collected data and the network event is extremely small, so that transient abnormalities, such as port scanning in a short time and a flash of malicious data packets, can be captured, and the lack of new attack characteristics caused by the lag of historical data is avoided.

[0057] Step 12, training a neural network model for identifying abnormal behaviors by using the training data and through gradient path bifurcation optimization.

[0058] Step 13, identifying abnormal behaviors in real-time network data according to the neural network model.

[0059] In the embodiments of the present application, step 12 solves the problem that the traditional model falls into local optimum and cannot accurately learn complex features by optimizing the gradient update path. In step 12, the real-time traffic data collected in step 11 is input into the neural network, and each layer extracts features of different granularities; the multi-dimensional gradient information of each layer is calculated, and the bifurcation point adjustment coefficient and the bifurcation point adjustment factor are introduced to dynamically generate multiple gradient update paths; the weights of each layer of the neural network are adjusted by combining the bifurcated and optimized gradient information, so that the sensitivity of the model to complex abnormal features is improved, and the situation that normal traffic is misjudged as abnormal and abnormal traffic is missed as normal is reduced. Step 13 is the landing application of the method, and the trained neural network model is used for anomaly detection of the actual network. The real-time traffic data of the target network (consistent with the dimension of the training data collected in step 11) is input into the trained neural network model in real time; after the neural network model extracts features from the input data, it matches the normal feature pattern and the abnormal feature pattern learned in the training process, and determines whether it is abnormal by calculating the feature deviation; if it is determined to be abnormal, the key information such as abnormal type, abnormal occurrence time, involved IP or port is output for subsequent disposal by the operation and maintenance personnel; if it is determined to be normal, the next batch of real-time data is continuously monitored.

[0060] The scheme of the present application trains the model through real-time scene data, optimizes the model learning through the link of real-time data recognition, and the model can accurately adapt to the dynamic environment of the current network, effectively identify complex abnormal behaviors that are difficult to distinguish by traditional methods, and improve the accuracy of anomaly detection.

[0061] Optionally, the step 11 described above comprises:

[0062] Obtain real-time network traffic data packets, node log data and abnormal event records in real-time traffic scenarios;

[0063] Perform structured data conversion, sliding window aggregation, time series feature extraction and abnormal data labeling on the real-time network traffic data packets, the node log data and the abnormal event records to obtain training data with discrete attribute form; the abnormal labeling categories in the abnormal data labeling include at least one of normal traffic, distributed denial of service attack, transmission control protocol (TCP) connection hijacking, domain name system (DNS) amplification attack, ARP spoofing and malicious software communication.

[0064] In the network protocol anomaly identification task in the real-time traffic scenario in the embodiments of the present application, the collection sources of the training data mainly include the following aspects: 1) network traffic data: collecting data packets from actual network environments through network traffic monitoring systems, including different types of network protocols such as TCP, UDP, HTTP, DNS, etc., and behaviors in various real-time traffic scenarios. 2) Network node log data: collecting real-time logs through network devices such as routers, switches, load balancers, etc., recording network requests, responses, errors, etc. 3) Abnormal event records: capturing network attack or protocol anomaly events through detection systems such as IDS or IPS, WAF, etc. These abnormal events include Distributed Denial of Service (DDoS) attacks, protocol stack vulnerability exploitation, illegal packets, etc.

[0065] The data collection methods mainly include the following: 1) Real-time monitoring and packet capture: Real-time monitoring and capturing network data packets through network packet capture tools such as Wireshark, tcpdump, etc. 2) Device log collection: Configure the log recording function of network devices to regularly or in real-time transmit the running data on the network devices to the centralized storage system in the form of structured logs.

[0066] The collected data is stored in a structured format, and each data packet or log item is encoded as a structure containing fields such as timestamp, source or destination IP, source or destination port, protocol type, data length, etc. The storage format uses JSON or Protobuf format, where each field has a clear meaning, supporting flexible query and analysis.

[0067] After completing data collection, the original data is processed to convert it into discrete data suitable for machine learning models. Specifically, first, protocol identification and extraction are performed to identify and analyze the protocol type of each data packet or log item. The purpose is to extract the key fields of the network protocol from the original data, such as protocol type (e.g. TCP, UDP, ICMP, etc.), source IP, destination IP, source port, destination port, data length, TTL (Time to Live), etc. Through the protocol analysis module, these protocol-related fields are extracted to form structured data.

[0068] Further, time series and windowing are performed. Due to the characteristics of network traffic, data packets often have a time sequence. In order to capture this characteristic, data needs to be serialized according to time, and a sliding window is used to aggregate network data at each time. The data in each time window includes statistical information such as the number of network packets in a certain time range, the frequency of protocol types, and the total amount of traffic. By extracting these features, time series data can be obtained.

[0069] Further, anomaly labeling and data augmentation are performed. For the collected network data, according to the alarm records of existing network anomaly detection systems (such as IDS / IPS, etc.), the data is labeled, and the labeling method is manual labeling. The categories of anomaly labeling include: normal traffic, DDoS attack, TCP connection hijacking, DNS amplification attack, ARP spoofing, TCP connection hijacking, and malicious software communication. The specific explanations of these labeled categories are as follows: normal traffic indicates network traffic that conforms to expected protocol and behavior patterns. DDoS attack indicates an attack behavior that occupies bandwidth and crashes servers through a large number of fake requests. Port scanning indicates the behavior of detecting open ports in the network, which may be an attacker scanning targets. DNS amplification attack indicates that the attack traffic is amplified by exploiting the characteristics of the DNS protocol, causing the target server or network bandwidth to be exhausted. ARP spoofing indicates that network traffic is hijacked by forging ARP requests and responses. TCP connection hijacking indicates that the communication content is hijacked or tampered by tampering with the sequence number and other information in the TCP connection. Malicious software communication indicates the traffic of malicious software communicating with external servers through specific protocols.

[0070] Further, the processed data will be converted into the following discrete attribute form: Ra represents the protocol type, such as TCP, UDP, HTTP, DNS, etc.; Da represents the source IP address; Ea represents the destination IP address; Fa represents the source port; Ga represents the destination port; Ha represents the packet size; Ia represents the TTL value; Ja represents the timestamp (specific to milliseconds); Ka represents the number of packets in the window; La represents the RTT (Round Trip Time) of the packet. Part of the data examples are shown in Table 1 as follows.

[0071] Table 1:

[0072]

[0073]

[0074] Further, the collected data and machine learning modeling are utilized. A model capable of identifying abnormal behavior is constructed through a machine learning algorithm. The machine learning model adopted in the application is a neural network model. Unlike the training method of gradient descent of traditional neural networks, the neural network is trained by gradient path bifurcation optimization in the application, which optimizes the training process of the neural network model, solves the gradient vanishing or explosion problem in the high-dimensional feature space, and improves the expressiveness and generalization ability of the model in the feature extraction process.

[0075] Specifically, the above step 12 comprises:

[0076] The weight matrix and bias term of the initial neural network model are randomly initialized; the initialization parameters of the random initialization obey a normal distribution with a mean of 0 and a variance of a unit matrix;

[0077] The training data is input into the initial neural network model after random initialization, and the activation value is calculated layer by layer, the calculation process introduces an activation function, and the output features of each layer are obtained;

[0078] For each layer of the output features, the gradient information of different granularities is calculated, and the comprehensive gradient information is determined based on the gradient information of different granularities;

[0079] In the case of back propagation, based on the comprehensive gradient information and the bifurcation point of the gradient path, the adjustment coefficient and the adjustment factor of the bifurcation point are introduced, and the weight matrix update amount is calculated;

[0080] According to the weight matrix update amount, the weights of each layer are adjusted to generate the final feature representation;

[0081] During the continuous iterative training process, the learning rate is dynamically adjusted according to the total sum of the gradient L2 norm of each layer to adapt to the current gradient strength until the loss function of the model reaches a set threshold, or the gradient path bifurcation point converges to an optimal solution, the training is ended, and the neural network model for identifying abnormal behavior is determined.

[0082] In the embodiment of the application, the above process is the core training process of the initial neural network model from the initial state to the neural network model with abnormal recognition capability. Through the whole process optimization of parameter initialization, feature extraction, gradient calculation, weight update, learning rate adaptation, and iterative convergence, it is ensured that the model can accurately learn the complex abnormal features in real-time traffic.

[0083] Further, the step of randomly initializing the initial neural network model parameters lays the foundation for model training, avoiding the model falling into local optimum or training stagnation through standardized random initialization: the initialization object is the core parameters of the initial neural network, the weight matrix (controlling the intensity of feature transmission of each layer) and the bias term (adjusting the baseline value of the output of each layer) are randomly assigned; the initialization parameters follow a normal distribution with a mean of 0 and a variance of a unit matrix (i.e. variance of 1), which can ensure that the initial value of each layer parameter is neither too large to avoid saturation of the activation function, leading to gradient disappearance, nor too small to avoid weak feature transmission and low training efficiency, providing a balanced starting point for subsequent gradient update. Avoiding the problem of uniform function of each layer neuron caused by the convergence of parameter initial value (such as all 0), ensuring that the model can learn differentiated features from the early stage of training.

[0084] Further, the step of inputting training data and calculating activation values and output features by layer is the core of model forward propagation, realizing the conversion of training data to layered features and providing the basis for subsequent gradient calculation. The real-time traffic training data collected in step 11, such as structured data containing normal or abnormal traffic features, are input into the initialized model; the activation values are calculated by layer, and the model processes the data layer by layer from the input layer to the output layer. Each layer first calculates the linear output through "weight matrix * input feature + bias term", and then introduces an activation function (such as Sigmoid) to nonlinearly convert the linear output to obtain the activation value of the layer. The role of the activation function is to inject nonlinear learning ability into the model, enabling it to capture complex nonlinear features in network traffic, such as the nonlinear pattern of sudden growth-stable-sudden drop of DDoS attack traffic. Obtain the output feature of each layer: the activation value of each layer is the output feature of the layer. The output features of low layers are usually basic attributes of traffic, such as packet size and protocol type, and the output features of high layers are the fusion and abstraction of low layer features, such as the combination feature of UDP packet proportion per unit time and port scanning frequency.

[0085] Further, the step of calculating different granularity gradient information and determining comprehensive gradient information is the premise of model back propagation optimization. The gradient information can fully reflect the contribution of each layer feature to anomaly recognition through multi-granularity gradient calculation. The core significance of gradient information is that the gradient is the partial derivative of the loss function to the model parameter (weight / bias), which reflects the influence degree of parameter change on the prediction error of the model. The gradient direction is the direction of the fastest error reduction, which is the key basis for weight update. The different granularity gradients are calculated for each layer output feature, including the self-layer granularity gradient and the cross-layer associated granularity gradient. The self-layer granularity gradient only considers the influence of the current layer output feature on the loss function. The cross-layer associated granularity gradient considers the indirect influence of other layer output features on the current layer parameters, such as the contribution of low-layer data packet protocol features to high-layer parameter gradient through feature transmission. The self-layer granularity gradient and the cross-layer associated granularity gradient are fused according to the weight to obtain comprehensive gradient information. This fusion can avoid the limitations of single granularity gradient and ensure that the gradient reflects not only the direct effect of the current layer feature but also the synergistic effect of all layer features, providing comprehensive gradient basis for subsequent path bifurcation optimization.

[0086] Further, the weight matrix update amount is calculated in the back propagation, and a bifurcation point adjustment coefficient and a factor are introduced. This step is the core operation of gradient path bifurcation optimization, which solves the problem of traditional models easily falling into local optimum and being difficult to identify complex anomalies by dynamically adjusting the gradient update path. Forward propagation calculates the output feature and loss (error between predicted value and true label), and back propagation updates the parameters along the gradient direction from the output layer to the input layer to reduce the loss. The gradient path bifurcation point is introduced, which is a key node in the gradient update process with multiple optimization directions. For example, when identifying "traffic surge", it may correspond to two different scenarios of DDoS attack or normal business peak, which requires different update paths.

[0087] Optionally, the roles of the bifurcation point adjustment coefficient and the adjustment factor are as follows: the adjustment coefficient dynamically allocates the weight of each bifurcation path, such as allocating higher weight to the path corresponding to DDoS attack features to strengthen the model's learning of this anomaly; the adjustment factor precisely controls the path selection direction, such as judging whether the traffic surge is abnormal or normal through features such as traffic growth rate and data packet type proportion to guide the gradient to update along the correct path. Combined with comprehensive gradient information, bifurcation point adjustment coefficient, bifurcation point adjustment factor, and learning rate (control update step), the update amount of each layer weight matrix is finally calculated. This update amount can ensure that the model adjusts the parameters along the optimal gradient path in complex feature scenarios, avoiding the limitations of traditional single path.

[0088] Further, adjust the weight of each layer and generate the final feature representation, convert the weight update amount into model performance improvement, optimize the feature extraction ability through weight adjustment. Use the calculated weight matrix update amount to iteratively correct the weight matrix of each layer of the neural network, such as weight new value = weight old value - update amount, reduce the loss along the gradient descent direction; After weight adjustment, the model's feature extraction ability for training data is improved. The output features of each layer will be more suitable for anomaly recognition requirements, such as more accurate extraction of malformed data packet fields at the low level, more efficient fusion of multi-dimensional attack features at the high level, and finally obtaining the final feature representation through the high-level output, which can clearly distinguish the core feature combination of normal and abnormal traffic. Through weight adjustment, the model transits from preliminary learning features to precise capture of abnormal features, laying a feature foundation for subsequent identification of real-time network anomalies.

[0089] Further, dynamically adjusting the learning rate and iteratively training to convergence is the final stage of the model from training to maturity, through dynamic learning rate and iterative convergence mechanism, to ensure that the model reaches the optimal performance. Learning rate is a key parameter to control the weight update step, too large step is easy to oscillate and not to converge, too small step is slow to train, here the learning rate is dynamically adjusted according to the sum of the gradient L2 norm of each layer (reflecting the overall strength of the current gradient): if the sum of the gradient L2 norm is large, such as in the early stage of training, the model error is large, the gradient is strong, and the learning rate is appropriately increased to speed up the error reduction; if the sum of the gradient L2 norm is small, such as in the later stage of training, the model is close to optimal, the gradient is weak, and the learning rate is appropriately reduced to avoid parameter oscillation and precise convergence.

[0090] For example, when a new attack feature appears in real-time traffic, the gradient strength increases sharply, and the dynamic learning rate can quickly respond to accelerate the model's learning of new anomalies; The iterative convergence condition is: continue to repeat the process of forward propagation (calculate features) and backward propagation (calculate gradient and weight update) until any of the following conditions is met: the model's loss function (an index to measure prediction error) is reduced to a set threshold (such as error less than 0.001, indicating that the model's prediction accuracy meets the standard); the gradient path bifurcation point converges to the optimal solution (i.e. the bifurcation path selection is stable, and the model no longer changes in performance due to path fluctuations). When the convergence condition is met, stop training, and the neural network model at this time has the ability to accurately identify real-time network anomalies, that is, the neural network model for identifying abnormal behavior.

[0091] Specifically, network traffic data usually has a large amount of irrelevant noise, and the initialization parameters ensure that the network does not bias any specific features, thereby providing a stronger learning basis for subsequent anomaly identification. In the initialization of the parameters of the neural network model, improper parameter initialization in the traditional method can lead to slow model convergence or local optimum, while the present application initializes through normal distribution, and the network can have a better starting point at the beginning of training, which helps to speed up the learning of the model, especially when facing highly complex and high-dimensional network data, the feature weight can be quickly adjusted. Let the weight matrix of the neural network be The bias term of the neural network is In one embodiment, the parameters of the neural network model are initialized, the initialization method is random initialization, and the initialized parameters follow a normal distribution with a mean of 0 and a variance of a unit matrix. To verify the effectiveness of the initialization strategy of the present application, the experimental results refer to Figure 2 As shown in the experimental results, the loss value of the method of the present application decreases faster than the traditional method in the initial stage (0-20 rounds), and the curve fluctuation amplitude is smaller. Normal distribution initialization effectively alleviates the gradient direction deviation problem of high-dimensional protocol feature space, and lays a foundation for subsequent gradient optimization.

[0092] Further, for each layer of the output feature, the gradient information of different granularities is calculated, and the comprehensive gradient information is determined based on the gradient information of different granularities, including:

[0093] A first gradient component related to the output feature of the current layer and itself is calculated; the first gradient component is obtained by summarizing the influence degree of the loss function of all input samples on the activation value of the current layer, and the influence degree of the activation value of the current layer on its own weight; the activation value of the current layer is used to represent the protocol features extracted by the current layer;

[0094] A second gradient component related to the output feature of the current layer and other layers is calculated; the loss second gradient component is obtained by multiplying the control coefficient and the sum of the influence of all layer features; the control coefficient is calculated based on the weighted coefficient of each layer and the sum of the L2 norm of all layer gradients;

[0095] The first gradient component and the second gradient component are combined to obtain the comprehensive gradient information of the current layer.

[0096] In the embodiments of the present application, when data propagates through the neural network in a feedforward manner, the output features of each layer can generate multiple gradient layers according to different granularities. The present application adopts multi-granularity gradient calculation, which enhances the expressiveness of feature extraction and the generalization ability of the model by calculating and aggregating the gradients of different granularity features. The characteristics of network protocol and node log data determine that abnormal patterns are usually multi-level, involving time series, packet size, traffic patterns and other features. Traditional neural network methods usually use single-scale feature extraction methods, which are difficult to capture subtle abnormalities in network protocols. Multi-granularity gradient calculation allows the model to analyze data at different scales at each layer, thereby more carefully extracting abnormal patterns in network traffic, especially in capturing complex and low-frequency attack behaviors (such as covert DDoS attacks, port scanning, etc.), which can improve the performance of the model in network security monitoring. The network first performs forward propagation to calculate the activation value of each layer Then calculate the gradient of each layer, the calculation method is represented as:

[0097] Wherein, represents the activation value of the lth layer of the neural network; represents the activation value of the (l-1)th layer of the neural network; represents the weight matrix of the (l-1)th layer of the neural network, which is used to adjust the attention degree of the neural network to different protocol features; represents the bias term of the (l-1)th layer of the neural network, which is used to correct the network layer output to ensure that different types of traffic features are balanced in the initial stage; Sig() is a Sigmoid activation function, which is used to introduce nonlinear characteristics to better capture complex abnormal patterns.

[0098] Further, the gradient information of each layer is combined through multi-granularity gradient calculation, which is represented as:

[0099]

[0100] Wherein, represents the gradient of the lth layer; L c represents the loss function; represents the weight of the lth layer; represents the activation value of the mth input sample, which is used to represent the protocol features extracted by the layer, such as traffic statistics or connection state within a certain time window; M is the number of samples, that is, the number of network traffic data points for training.

[0101] Further, is a control coefficient, which represents the gradient path correction factor of the layer, which is used to dynamically adjust the influence weight of each layer feature, and the calculation method is: Wherein, is the weighting coefficient of the lth layer, is the gradient of the i-th layer, used to measure the contribution of the layer to the loss function, and then optimize the network weight, |||| is the L2 norm.

[0102] Optionally, to evaluate the ability of multi-granularity feature fusion to capture complex attack patterns, relevant experiments are conducted, and the experimental results are shown in Figure 3 Figure 3 The experimental results shown in the table show that, in the mixed attack detection scene, the method of the application improves the accuracy by 17.4% compared with the single-granularity model, indicating that the hierarchical gradient aggregation mechanism realizes the complementary features across protocol layers.

[0103] Further, in the case of back propagation, based on the comprehensive gradient information and the bifurcation points of the gradient path, an adjustment coefficient and an adjustment factor of the bifurcation point are introduced, and the weight matrix update amount is calculated, including:

[0104] determining the bifurcation points of the gradient path; each bifurcation point corresponds to a gradient update path;

[0105] calculating the adjustment coefficient of the bifurcation point; the adjustment coefficient is used to dynamically adjust the influence degree of each bifurcation path on the weight update;

[0106] calculating the adjustment factor of the bifurcation point; the adjustment factor is determined based on the sensitivity of the activation function to the activation value of each layer and the overall strength of all layer gradients;

[0107] According to the comprehensive gradient information, the adjustment coefficient and the adjustment factor, the weight matrix update amount of each layer is calculated under the regulation of the learning rate.

[0108] In the embodiments of the application, during back propagation, the gradient path bifurcation optimization algorithm is used to dynamically adjust the path selection of the bifurcation point, avoid local minimum value, and improve the model convergence speed and stability. Network traffic and node log data are usually highly nonlinear and complex, which may cause the traditional gradient descent method to fall into local minimum value or slow convergence speed. Through bifurcation path optimization, the neural network can select the optimal path among multiple paths, effectively avoiding the problems of gradient disappearance and explosion. Especially in deep network, the network weight can be adjusted more accurately, and the stability and convergence speed of the model can be improved. Specifically, the optimization process optimizes the gradient update by dynamically adjusting the path of the bifurcation point according to the bifurcation point of the gradient path, which is represented as:

[0109]

[0110] wherein, is the weight matrix update amount of the l-th layer of the neural network, used to adjust the learning direction of the network layer, prevent ​Adjustment is made so that specific types of attacks (such as DNS amplification attacks) can be learned through optimal gradient paths, improving detection accuracy. is the adjustment factor of the bifurcation point, which controls path selection; c is the learning rate of the neural network, and n is the number of bifurcation points; represents the local gradient representing class c in the l-th layer, which is used to update the weight or bias.

[0111] Further, in order to accurately adjust each path, the influence of the bifurcation path can be dynamically adjusted to ensure that the direction of gradient update is more accurate. The calculation method of the adjustment factor of the bifurcation point is represented as:

[0112]

[0113] wherein, is the adjustment factor of the bifurcation point, which controls path selection, for example, when detecting DDoS attacks, the path of sudden surge of total traffic is prioritized; when detecting ARP spoofing, the path of abnormal source IP-MAC mapping is focused on, represents the derivative of the activation function with respect to the activation value of the j-th layer, which measures the sensitivity of the activation function to the change of protocol features (such as the nonlinear response of TCP state machine jump), is the gradient of the m-th layer, which normalizes the global gradient strength to prevent burst traffic (such as DDoS) from interfering with path selection.

[0114] Further, for each bifurcation path, the optimization value of the path is calculated, which represents the stability and convergence of the current path. Network protocol features often have different granularities and hierarchical data representations. In anomaly identification, different types of anomalies may exhibit different feature patterns (such as traffic surge and protocol inconsistency). By dynamically adjusting the stability of the path, the model can be more flexible to adapt to different patterns of abnormal behavior, thereby reducing false positives and false negatives and improving the model's ability to respond to unknown attacks. It is represented as:

[0115]

[0116] wherein, λ c is a parameter that controls the stability of path selection; is the j-th bifurcation path; is the optimization value of the j-th bifurcation path. is the partial derivative of the loss function with respect to the weight, which represents the weight of the j-th path the change in the loss function L c for every 1 unit change; is the partial derivative of the predicted value with respect to the activation value, which represents the intermediate feature of the j-th path the predicted value of the model for the n-th sample a change amount of the weight.

[0117] Through the weight update optimized by multiple gradient path branching, the feature extraction process is further refined. By adopting the feature refinement mechanism, the model can perform local optimization for specific feature space during the training process, improve the expression ability for complex data patterns, and the network data contains a large amount of redundant information and noise. The traditional method is difficult to extract the most discriminative features from it. Through the feature refinement mechanism, the model can finely adjust the attention to each feature at different training stages. It is particularly important for complex network protocol analysis, such as abnormal behavior of protocol stack or hidden attacks in encrypted traffic, especially those features that are helpful for anomaly detection, thereby improving the expression ability for complex data patterns. The update mode of the weight matrix is represented as: wherein, is the weight matrix of the lth layer, is the weight matrix update amount of the lth layer of the neural network.

[0118] Further, according to the weight matrix update amount, the weights of each layer are adjusted to generate the final feature representation, including:

[0119] According to the weight matrix update amount, the weights of each layer of the initial neural network model are adjusted;

[0120] The weighting coefficients of each layer feature are calculated;

[0121] Based on the weighting coefficients, the features extracted by each layer are fused to generate the final feature representation containing multi-layer feature information.

[0122] In this application, the features obtained through the foregoing steps are finally fused through multiple levels to generate high-quality feature representation. The features extracted by each layer are fused through weighted summation, and the information of multiple levels is integrated to improve the adaptability of the model to complex data. The calculation mode is represented as:

[0123]

[0124] wherein, is the final feature representation, such as the low-level feature (protocol type distribution) and the high-level feature (cross-time window traffic pattern) are fused, is the weighting coefficient of the lth layer, such as the high-level time window feature weight is higher in HTTPFlood attack.

[0125] Further, the calculation of the weighting coefficient is not only based on the static weight, but also considers the gradient information and path stability. The calculation mode is represented as:

[0126]

[0127] wherein, cd is a dynamic adjustment coefficient, adjusting the severity of the change in protocol characteristics (such as the initial gradient surge of port scanning), and L is the number of layers of the neural network. Preferably, cd is set to 2.

[0128] Optionally, during the training process, the learning rate and weight update amplitude are dynamically adjusted according to the feature extraction effect of each layer, and an adaptive learning rate adjustment strategy is adopted, so as to better adapt to the feature extraction requirements in different training stages. The adjustment of the learning rate is calculated according to the size of the gradient. In the analysis of network protocols and node log data, the distribution and change of features often change in different training stages. The adaptive learning rate can dynamically adjust the learning rate according to the change of the current gradient, so that the model can flexibly adapt to the feature extraction requirements in different stages during the training process. The model can avoid premature convergence to a suboptimal solution, and improve the learning ability of key features in the data. The calculation method is represented as:

[0129]

[0130] wherein, ← is a parameter update operation; λ c is a constant for controlling the learning rate adjustment, which is suitable for different attack stages (such as rapid convergence in the initial stage of DDoS attack and fine-tuning in the later stage); is the L2 norm of the gradient of the lth layer. Preferably, λ c is set to 0.3.

[0131] Optionally, in order to evaluate the improvement effect of adaptive learning rate on feature space separability, relevant experiments are carried out, and the experimental results are shown in Figure 4 , Figure 4 The experimental results shown in the above table show that the method of the present application forms a more compact intra-class distribution (radius standard deviation 0.35 vs. 0.52 of the traditional method), and the dynamic learning rate adjustment improves the adaptability of the model to burst traffic (such as the right oval area), and the abnormality detection F1-score is improved by 15.2%.

[0132] Optionally, when the loss function of the model reaches a set threshold, or the bifurcation point in the gradient path optimization process converges to an optimal solution, the training process ends, and the model can be used for subsequent feature dimension reduction and classification tasks. The final output is represented as: wherein, is the prediction output of the neural network, which can be any one of the categories such as normal traffic, DDoS attack, TCP connection hijacking, DNS amplification attack, ARP spoofing, TCP connection hijacking, and malware communication; and is the weight matrix and bias term obtained by final training, is the input of the model in the application process.

[0133] Optionally, step 13 above comprises:

[0134] receiving real-time network data using the neural network model, performing prediction on the real-time network data, and obtaining a prediction result of the real-time network data;

[0135] judging whether there is abnormal traffic in the real-time network data according to the prediction result;

[0136] if it is judged that there is abnormal traffic, triggering an alarm and performing a preset response measure.

[0137] In the embodiments of the present application, a mature neural network model is used to realize real-time anomaly recognition; meanwhile, combined with data storage, feedback updating, alarm response and other extended operations, a complete closed loop of detection-storage-optimization-disposal is formed to ensure that the system continuously adapts to the dynamic network environment. The real-time network data of the target network, such as the real-time collected data packets and traffic session records, is consistent with the feature dimension of the training data, for example, including source IP, protocol type, packet size, connection frequency, etc., and is input into the trained neural network model; the model performs prediction on the real-time data through the built-in feature extraction and calculation logic, i.e., the normal or abnormal traffic feature patterns learned in the training stage, and outputs the prediction result y pred , which is represented as: y pred = h θ (x new ); wherein x new is a real-time data sample; h θ () is a trained machine learning model (θ represents the optimized weights, biases and other parameters of the model); the prediction result means: y pred is usually a category label (such as y pred = 1 represents abnormal traffic, and y pred = 0 represents normal traffic), or an abnormal probability value (such as y pred = 0.92 represents that the probability of the data being abnormal is 92%), and the specific form is designed by the model, such as a classification model outputting a category and a regression model outputting a probability.

[0138] The prediction result y pred output by the model is compared with a preset abnormality judgment threshold. If the prediction result y pred belongs to the abnormal category (such as the label is 1) or the abnormal probability exceeds the threshold (such as the probability > 0.8), it is judged that there is abnormal traffic in the current real-time network data; if the prediction result y pred belongs to the normal category (such as the label is 0) or the abnormal probability is below the threshold, it is judged that there is no abnormality, and the system continues to monitor the next batch of real-time data;

[0139] Because the model training stage adopts real-time traffic scene data and gradient path bifurcation optimization, the learned feature patterns are highly matched with the actual network environment, which can effectively distinguish normal large traffic from DDoS attacks, legal port access from port scanning, and other easily confused scenes, reducing false positives and false negatives.

[0140] Further, once it is determined that there is abnormal traffic, the system immediately generates an alarm information, the information content needs to include the abnormal type, such as DDoS attack, SQL injection, abnormal timestamp, affected IP or port, key features of abnormal traffic, such as packet size distribution, etc., to ensure that the administrator can quickly locate the problem; according to the severity of the abnormal type, automatically execute the pre-configured response strategy, for example: high-risk abnormalities, such as DDoS attacks, automatically trigger traffic limiting mechanisms, such as limiting the bandwidth of the attack source IP, blocking the attack link, such as adding a blacklist to the firewall. Low-risk abnormalities, such as suspicious port scanning, only generate an alarm to notify the administrator, and further manual verification is required to avoid excessive handling affecting normal business.

[0141] Further, to ensure long-term stable operation of the system and adapt to changes in the network environment, the following operations are also required after step 13 to form a continuous improvement mechanism of detection-optimization-iteration: data storage and management operations. Efficiently store system full-process data to support subsequent model optimization, problem tracing, and compliance auditing. Optionally, the storage content can include: raw data, real-time collected network traffic raw data packets, log records; feature data, time features, device features, and behavior features extracted in the data preprocessing stage; model-related data, intermediate parameters in the training process, final trained model files, and prediction results; storage optimization: through timestamp indexing (sorted by collection time), abnormal type indexing (classified by attack type), etc., to realize fast data retrieval, while using a distributed storage architecture to support the expansion needs of massive data.

[0142] According to the actual operation feedback, the dynamic optimization model is used to solve the problems of new attack features not being covered, environmental changes causing the model to fail, and the like. The specific operation process can include: (1) feedback information collection: the administrator manually checks the misjudgment or missed judgment records, such as the model misjudging normal business traffic as abnormal or failing to identify new variant attacks; new abnormal mode data, such as AI-generated covert attack traffic that appears for the first time; (2) model updating: adding the feedback labeled data, such as the corrected normal or abnormal labels, the feature data of new attacks, to the training set, incrementally training the original model, without retraining the full data, only updating the weight parameters corresponding to the new features, or retraining based on the full new data when necessary; (3) update effect: through continuous feedback, the model can gradually cover new abnormal features, such as updating the model once a month to adapt to the evolution of attack methods, avoiding the problem of precision decline caused by long-term use of a one-time trained model, and ensuring the timeliness of the abnormal detection capability.

[0143] The millisecond-level prediction and response of step 13 of the present application can quickly block ongoing attacks and reduce losses; the optimized trained model and dynamic feedback mechanism ensure the recognition accuracy of easily confused abnormalities and new abnormalities (such as unknown attacks); data storage provides the basis for tracing, and feedback updating realizes model iteration, enabling the system to adapt to changes in the network environment for a long time, such as device addition, business upgrade, and attack method evolution, avoiding the limitations of one-time static detection.

[0144] Optionally, the data storage and management operation functions to store all data in the system, including raw traffic data, feature data, and intermediate model parameters in the training process, including efficiently storing and managing massive network traffic data and model-related information to support the real-time and scalability of the system. The data storage and management operation also needs to provide fast indexing and retrieval capabilities for data access, for example, by timestamp indexing the data, time-based queries and data retrieval can be realized. Assuming the stored data set is S = {S1, S2, …, Si, …, S m}, where S i represents the i-th collected traffic data or trained model parameters.

[0145] Optionally, the feedback and update operation functions to optimize the machine learning model and update the parameters according to the feedback information collected during system operation. The feedback and update operation functions include online updating the model according to the results of abnormal detection to improve the prediction ability of the model. Specifically, when a new abnormal mode is detected, the system will provide new labeled data or abnormal features to the machine learning modeling operation through the feedback mechanism to help the model learn new patterns.

[0146] Optionally, the alarm and response operation functions to timely alarm the administrator and take appropriate response measures when abnormal behavior in network traffic is identified. The alarm and response operation functions include generating alarm information, notifying the network administrator, or automatically triggering system response measures such as cutting off abnormal traffic or starting the firewall. The alarm information should include detailed information such as the type of anomaly, the time of occurrence, and the affected devices. The alarm logic can design different response strategies according to different types of anomalies, for example, when a denial-of-service attack is detected, a traffic limiting mechanism or attack source IP blocking may be automatically triggered.

[0147] In summary, the present application constructs a training data set through multiple data sources (network traffic, node logs, and abnormal event records) and converts the data into structured time series data. The data is stored in a standardized format (such as JSON or Protobuf) to effectively support queries and analysis. The fusion and efficient storage of multi-source data enable network anomaly detection to rely not only on a single data source, but also to consider various behavior patterns in the network environment.

[0148] After data collection, the protocol type identification and extraction of network traffic is performed by the protocol analysis module, and the key fields of network protocol (such as protocol type, source IP, destination IP, port, TTL, etc.) are extracted. Fine-grained protocol analysis can more accurately identify and label different types of abnormal traffic.

[0149] The neural network training method using gradient path bifurcation optimization may encounter gradient vanishing or explosion problems when dealing with high-dimensional feature space. The present application uses gradient path bifurcation optimization training process to select the optimal path among multiple paths for the neural network when training the model using complex network data, avoiding local minimum and accelerating convergence, improving the stability and convergence speed of the model.

[0150] Through multi-granularity feature extraction and gradient calculation, the present application can analyze data at different scales, enabling the model to capture subtle anomalies in network protocols more meticulously, especially low-frequency and hidden attack behaviors (such as hidden DDoS, port scanning, etc.), significantly improving the accuracy of anomaly detection.

[0151] During the training process, a dynamic learning rate adjustment strategy is used to automatically adjust the learning rate based on the current gradient changes, which can flexibly adapt to the feature extraction needs of different training stages, avoid premature convergence to a suboptimal solution, and improve the learning ability of key features in the data.

[0152] The application greatly improves the abnormal recognition ability of the model in a complex network environment through multi-level and multi-granularity feature extraction and optimized training methods, and the accuracy is obviously improved, especially when dealing with low-frequency and hidden attacks (such as hidden DDoS attacks, port scanning, etc.). The gradient path bifurcation optimization and adaptive learning rate strategy effectively avoid the gradient vanishing and explosion problem in the traditional method, accelerate the convergence process of the neural network, and perform more efficiently especially in the processing of high-dimensional network data. The application can continuously optimize and adjust itself through real-time feedback and updating mechanism, adapt to the changing network security environment, and improve the ability to respond to new attacks. Based on the real-time detection and alarm mechanism, the application can quickly alarm the administrator when an anomaly occurs, and trigger appropriate response measures, thereby improving the response speed and network security protection ability.

[0153] The above introduces various methods of embodiments of the application. The following will further provide a device for implementing the above method.

[0154] Please refer to Figure 5 The embodiments of the application also provide a network security anomaly detection device, comprising:

[0155] The acquisition module 51 is configured to acquire training data under a real-time traffic scenario.

[0156] The first determination module 52 is configured to determine a neural network model for identifying abnormal behaviors by gradient path bifurcation optimization training using the training data.

[0157] The first processing module 53 is configured to identify abnormal behaviors in real-time network data according to the neural network model.

[0158] Optionally, the acquisition module 51 comprises:

[0159] The first acquisition unit is configured to acquire real-time network traffic data packets, node log data and abnormal event records under a real-time traffic scenario.

[0160] The second acquisition unit is configured to perform structured data conversion, sliding window aggregation, time series feature extraction and abnormal data labeling on the real-time network traffic data packets, the node log data and the abnormal event records, and acquire training data with discrete attribute form; the abnormal labeling category in the abnormal data labeling comprises at least one of normal traffic, distributed denial of service attack, transmission control protocol connection hijacking, domain name system amplification attack, ARP spoofing and malicious software communication.

[0161] Optionally, the first processing module 53 comprises:

[0162] The first processing unit is configured to randomly initialize a weight matrix and a bias term of an initial neural network model, wherein the initialization parameter of the random initialization follows a normal distribution with a mean of 0 and a variance of a unit matrix.

[0163] The second processing unit is configured to input the training data into the initial neural network model after the random initialization, calculate an activation value layer by layer, introduce an activation function in the calculation process, and obtain an output feature of each layer.

[0164] The third processing unit is configured to calculate gradient information of different granularities for the output feature of each layer, and determine comprehensive gradient information based on the gradient information of different granularities.

[0165] The fourth processing unit is configured to introduce an adjustment coefficient and an adjustment factor of a bifurcation point of the gradient path based on the comprehensive gradient information and the bifurcation point in the case of back propagation, and calculate a weight matrix update amount.

[0166] The fifth processing unit is configured to adjust weights of each layer according to the weight matrix update amount, and generate a final feature representation.

[0167] The sixth processing unit is configured to dynamically adjust a learning rate according to a sum of L2 norms of gradients of each layer to adapt to a current gradient strength in a process of continuous iterative training, until a loss function of a model reaches a set threshold value or a bifurcation point of a gradient path converges to an optimal solution, and the training is ended to determine a neural network model for identifying abnormal behaviors.

[0168] Optionally, the third processing unit is specifically configured to:

[0169] calculate a first gradient component related to the output feature of the current layer and itself; the first gradient component is obtained by summarizing an influence degree of a loss function of all input samples on an activation value of the current layer, and an influence degree of the activation value of the current layer on its own weight; and the activation value of the current layer is used to represent a protocol feature extracted by the current layer;

[0170] calculate a second gradient component related to the output feature of the current layer and other layers; the second gradient component is obtained by multiplying a control coefficient and a sum of influences of all layer features; and the control coefficient is calculated based on a weighting coefficient of each layer and a sum of L2 norms of gradients of all layers;

[0171] combine the first gradient component and the second gradient component to obtain comprehensive gradient information of the current layer.

[0172] Optionally, the fourth processing unit is specifically configured to:

[0173] determine a bifurcation point of a gradient path; each bifurcation point corresponds to a gradient update path;

[0174] calculate an adjustment coefficient of the branch point; the adjustment coefficient is used to dynamically adjust the influence degree of each branch path on the weight update;

[0175] calculate an adjustment factor of the branch point; the adjustment factor is determined based on the sensitivity of the activation function to the activation value of each layer and the overall intensity of all layer gradients;

[0176] According to the comprehensive gradient information, the adjustment coefficient and the adjustment factor, the weight matrix update amount of each layer is calculated under the control of the learning rate.

[0177] Optionally, the fifth processing unit described above is specifically used for:

[0178] adjust the weight of each layer of the initial neural network model according to the weight matrix update amount;

[0179] calculate a weighting coefficient of each layer feature;

[0180] fuse the features extracted from each layer based on the weighting coefficient to generate a final feature representation containing multi-layer feature information.

[0181] Optionally, the first processing module 53 described above comprises:

[0182] a seventh processing unit, configured to receive real-time network data by using the neural network model, predict the real-time network data, and obtain a prediction result of the real-time network data;

[0183] an eighth processing unit, configured to determine whether there is abnormal traffic in the real-time network data according to the prediction result;

[0184] a ninth processing unit, configured to trigger an alarm and perform a preset response measure if it is determined that there is abnormal traffic.

[0185] It should be noted that the device in this embodiment corresponds to the network security anomaly detection method described above, and the implementation modes in each of the above embodiments are applicable to the embodiments of the device and can achieve the same technical effects. The device described above provided in the embodiments of the present application can implement all the method steps realized by the method embodiments and achieve the same technical effects. Therefore, the same parts and beneficial effects in the method embodiments will not be described in detail.

[0186] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program.

[0187] The embodiment of the present application further provides a computer program product, which comprises computer instructions, and the computer instructions are executed by a processor to realize each process of the network security anomaly detection method embodiment and achieve the same technical effects.

[0188] It should be noted that, in this document, the term "comprising" or any other variant thereof is intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or further include elements inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0189] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of software products, and the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a plurality of instructions to make a terminal (which can be a mobile phone, computer, server, air conditioner, or network equipment, etc.) execute the method described in each embodiment of the present application.

[0190] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative, not restrictive, and those skilled in the art can make many forms under the inspiration of the present application without departing from the scope of the present application and the protection scope of the claims.

Claims

1. A network security anomaly detection method, characterized by, The method comprises the following steps: obtaining training data under a real-time traffic scenario; training a neural network model for identifying abnormal behaviors by gradient path bifurcation optimization based on the training data; identifying abnormal behaviors in real-time network data based on the neural network model.

2. The method of claim 1, wherein, The method of obtaining training data under a real-time traffic scenario comprises the following steps: obtaining real-time network traffic data packets, node log data and abnormal event records under a real-time traffic scenario; performing structural data conversion, sliding window aggregation, time series feature extraction and abnormal data labeling on the real-time network traffic data packets, the node log data and the abnormal event records to obtain training data with discrete attribute forms; the abnormal labeling categories in the abnormal data labeling include at least one of normal traffic, distributed denial of service attack, transmission control protocol connection hijacking, domain name system amplification attack, ARP spoofing and malicious software communication.

3. The method of claim 1, wherein, The method of training a neural network model for identifying abnormal behaviors by gradient path bifurcation optimization based on the training data comprises the following steps: randomly initializing weight matrices and bias terms of an initial neural network model; the initialization parameters of the random initialization follow a normal distribution with a mean of 0 and a variance of a unit matrix; inputting the training data into the initial neural network model after random initialization, calculating activation values layer by layer, introducing an activation function in the calculation process, and obtaining output features of each layer; calculating gradient information of different granularities for each layer of the output features, and determining comprehensive gradient information based on the gradient information of different granularities; based on the comprehensive gradient information and the bifurcation points of the gradient path, introducing adjustment coefficients and adjustment factors of the bifurcation points, and calculating weight matrix update amounts in the case of back propagation; adjusting the weights of each layer based on the weight matrix update amounts to generate final feature representations; in the process of continuous iterative training, the learning rate is dynamically adjusted according to the total sum of gradient L2 norms of each layer to adapt to the current gradient intensity until the loss function of the model reaches a set threshold or the gradient path bifurcation point converges to an optimal solution, the training is ended, and the neural network model for identifying abnormal behaviors is determined.

4. The method of claim 3, wherein, The method of calculating gradient information of different granularities for each layer of the output features, and determining comprehensive gradient information based on the gradient information of different granularities comprises the following steps: calculating a first gradient component related to the output features of the current layer and itself; the first gradient component is obtained by summarizing the influence degree of the loss function of all input samples on the activation value of the current layer and the influence degree of the activation value of the current layer on its own weight; the activation value of the current layer is used to represent the protocol features extracted by the current layer; calculating a second gradient component related to the output features of the current layer and other layers; the second gradient component is obtained by multiplying a control coefficient by the influence of all layer features; the control coefficient is calculated based on the weighting coefficients of each layer and the total sum of gradient L2 norms of all layers; combining the first gradient component and the second gradient component to obtain the comprehensive gradient information of the current layer.

5. The method of claim 3, wherein, In the case of back propagation, based on the comprehensive gradient information and the bifurcation points of the gradient path, an adjustment coefficient and an adjustment factor of the bifurcation points are introduced, and a weight matrix update amount is calculated, including: Determine the bifurcation points of the gradient path; each bifurcation point corresponds to a gradient update path; Calculate the adjustment coefficient of the bifurcation point; the adjustment coefficient is used to dynamically adjust the influence degree of each bifurcation path on weight update; Calculate the adjustment factor of the bifurcation point; the adjustment factor is determined based on the sensitivity of the activation function to the activation value of each layer and the overall strength of all layer gradients; According to the comprehensive gradient information, the adjustment coefficient and the adjustment factor, the weight matrix update amount of each layer is calculated under the regulation of the learning rate.

6. The method of claim 3, wherein, According to the weight matrix update amount, adjust the weights of each layer to generate the final feature representation, including: According to the weight matrix update amount, adjust the weights of each layer of the initial neural network model; Calculate the weighting coefficient of each layer feature; Based on the weighting coefficient, fuse the features extracted from each layer to generate a final feature representation containing multi-layer feature information.

7. The method of claim 1, wherein, According to the neural network model, identify abnormal behavior in real-time network data, including: Using the neural network model to receive real-time network data, predicting the real-time network data to obtain the prediction result of the real-time network data; According to the prediction result, judge whether the real-time network data has abnormal traffic; If it is judged that there is abnormal traffic, trigger an alarm and execute a preset response measure.

8. A network security anomaly detection apparatus characterized by comprising: Including: An acquisition module is configured to acquire training data in a real-time traffic scenario; A first determination module is configured to train a neural network model for identifying abnormal behavior by gradient path bifurcation optimization using the training data; A first processing module is configured to identify abnormal behavior in real-time network data according to the neural network model.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

10. A computer program product, characterised in that, The computer instructions are executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images