A method and system for intelligent protection of network information security

Abstract

This invention relates to the field of digital information transmission, specifically to an intelligent network information security protection method and system, comprising: segmenting target data through a sliding window to obtain multiple sub-sequences, wherein the target data is any historically collected network time-series data; constructing training samples corresponding to the target data based on the multiple sub-sequences and calculating the corresponding sample weights; traversing to obtain the training samples and sample weights corresponding to each network time-series data; training a preset model based on all the training samples and all the sample weights to obtain an anomaly detection model; inputting real-time collected network time-series data into the anomaly detection model to obtain an anomaly probability; and performing security protection based on the anomaly probability. This invention can improve the accuracy of information security protection.

Description

Technical Field

[0001] This invention relates to the field of digital information transmission. More specifically, this invention relates to an intelligent protection method and system for network information security. Background Technology

[0002] With the acceleration of digitalization, cyberattacks are becoming increasingly sophisticated and covert, leading to frequent security incidents such as malicious intrusions and data breaches, which places higher demands on network information security protection technologies. Network time-series data contains rich traffic characteristics and behavioral patterns, making it a core basis for anomaly detection; however, how to efficiently extract its value remains an industry challenge.

[0003] Traditional protection methods, such as firewalls and basic intrusion detection systems, rely heavily on fixed rule matching, making them ill-equipped to handle unknown and encrypted traffic attacks, and resulting in insufficient detection timeliness and accuracy. Existing anomaly detection schemes based on LSTM models often directly train the model using raw time-series data, ignoring the impact of data heterogeneity (different structures of data with different characteristics related to network information security) on sample validity. This limits the model's training accuracy, affects detection results, and consequently leads to loopholes and false positives in information security protection. Summary of the Invention

[0004] The main objective of this application is to propose an intelligent network information security protection method and system, which aims to improve the accuracy of information security protection.

[0005] To achieve the above objectives, an embodiment of the first aspect of this application proposes an intelligent network information security protection method. The method includes: segmenting target data through a sliding window to obtain multiple sub-sequences, wherein the target data is any historically collected network time-series data; constructing training samples corresponding to the target data based on the multiple sub-sequences and calculating the corresponding sample weights; traversing to obtain the training samples and sample weights corresponding to each network time-series data; training a preset model based on all the training samples and all the sample weights to obtain an anomaly detection model; inputting real-time collected network time-series data into the anomaly detection model to obtain an anomaly probability; and performing security protection based on the anomaly probability. The calculation of the corresponding sample weights includes: taking any sub-sequence as the target sequence, constructing the original feature vector of the target sequence; obtaining the compressed feature vector obtained after compressing the original feature vector; calculating the reconstruction loss between the original feature vector and the compressed feature vector; calculating the compression quality based on the reconstruction loss; traversing to obtain the compressed feature vector and corresponding compression quality of each sub-sequence; concatenating all weighted compressed feature vectors to obtain the training samples corresponding to the target data; and using the average compression quality of all the sub-sequences as the sample weight of the training samples corresponding to the target data.

[0006] In some embodiments, calculating the compression quality based on the reconstruction loss includes: performing a negative correlation mapping on the reconstruction loss using an exponential function, and using the mapping result as the compression quality.

[0007] In some embodiments, an intelligent network information security protection method further includes: taking the feature corresponding to any dimension of the compressed feature vector as the target feature, obtaining the vector element corresponding to the target feature in each compressed feature vector to construct a value sequence of the target feature; obtaining a label sequence, calculating the mutual information between the value sequence and the label sequence, and using the normalized mutual information as the feature weight of the target feature; traversing to obtain the feature weight of the feature corresponding to each dimension of the compressed feature vector, constructing a feature weight vector based on all the feature weights; and weighting each compressed feature vector according to the feature weight vector.

[0008] In some embodiments, obtaining the label sequence includes: responding to the label of the compressed feature vector being 0, indicating that the network is normal; responding to the label of the compressed feature vector being 1, indicating that the network is abnormal; and constructing a label sequence using 1 and 0 as sequence elements.

[0009] In some embodiments, the method further includes: obtaining the sequence label of the subsequence obtained from the last segmentation of the target data, and using the sequence label as the sample label of the training sample.

[0010] In some embodiments, the training process of the preset model includes: the preset model is an LSTM model; taking any training sample as a target sample, calculating the loss value of the target sample based on the sample label and the binary cross-entropy loss function, weighting the loss value according to the sample weight of the target sample to obtain the optimized loss; traversing to obtain the optimized loss of each training sample, calculating the convergence degree of the LSTM model based on all the optimized losses, and completing the training when the convergence degree satisfies the convergence condition.

[0011] In some embodiments, the vector elements of the original feature vector include traffic statistics feature values, communication behavior feature values, time series feature values, and protocol content feature values.

[0012] In some embodiments, security protection based on the anomaly probability includes: triggering Level 1 security protection in response to the anomaly probability being not less than a first preset threshold; triggering Level 2 security protection in response to the anomaly probability being less than the first preset threshold and not less than a second preset threshold; and triggering Level 3 security protection in response to the anomaly probability being less than the second preset threshold.

[0013] An embodiment of the second aspect of this application proposes an intelligent network information security protection system, the system comprising: a processor and a memory, the memory storing computer program instructions, which, when executed by the processor, implement the aforementioned intelligent network information security protection method.

[0014] The beneficial effects of this invention are:

[0015] This invention first constructs training samples for each network's time-series data and uses the average compression quality of all compressed feature vectors corresponding to the training samples as the corresponding sample weights. This allows the model training process to focus more on samples with high compression quality (i.e., more complete feature retention), improving the model's learning efficiency for effective features and reducing the interference of low-quality samples on the training results. Compared to existing technologies that directly use raw time-series data to train the model, ignoring the impact of feature data heterogeneity on sample effectiveness and thus limiting model training accuracy, ultimately leading to loopholes and false positives in information security protection, this invention can improve the accuracy of information security protection. Attached Figure Description

[0016] Figure 1 This is a flowchart of steps S1-S3 in an intelligent network information security protection method according to an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0018] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0019] Reference Figure 1 A method for intelligent protection of network information security includes steps S1-S3, as detailed below:

[0020] Step S1: Segment the target data using a sliding window to obtain multiple subsequences. The target data is any network time series data collected in history.

[0021] It should be further noted that this invention is particularly designed for detecting complex attacks with temporal evolution characteristics (such as advanced persistent threats, slow penetration, lateral movement, etc.). The anomalies caused by such complex attacks are often not isolated events, but are related to the state of the preceding and following time periods. For example, a sudden surge in traffic in a short period of time may be a precursor to an attack. Therefore, it is necessary to combine the preceding and following states to judge the anomaly. Thus, the network time-series data of this invention can be a long sequence containing the complete attack process.

[0022] It should be further explained that the sliding window, by sliding a fixed-length window across the target data, divides the target data into multiple overlapping or continuous subsequences. Each subsequence represents a local data segment within a certain time period. This segmentation preserves the local correlation of the data in the time dimension, avoiding the problem of "diluting" local dynamic features (such as short-term fluctuations and abrupt changes) when directly processing the original long sequence. The length of the sliding window controls the memory span of the anomaly detection model used subsequently.

[0023] Step S2: Construct training samples corresponding to the target data based on multiple subsequences, and calculate the corresponding sample weights. Iterate through and obtain the training samples and sample weights corresponding to each network time series data. Train the preset model based on all training samples and all sample weights to obtain the anomaly detection model.

[0024] The calculation of the corresponding sample weights includes: taking any subsequence as the target sequence, constructing the original feature vector of the target sequence, obtaining the compressed feature vector obtained after compressing the original feature vector, calculating the reconstruction loss between the original feature vector and the compressed feature vector, calculating the compression quality based on the reconstruction loss, traversing to obtain the compressed feature vector and the corresponding compression quality of each subsequence, concatenating all weighted compressed feature vectors to obtain the training samples corresponding to the target data, and using the average compression quality of all subsequences as the sample weight of the training samples corresponding to the target data.

[0025] It should be noted that a network time series data consists of multiple subsequences. Each subsequence corresponds to an original feature vector, and each original feature vector corresponds to a compressed feature vector. Multiple weighted compressed feature vectors are concatenated to obtain a training sample. Therefore, a network time series data corresponds to a training sample.

[0026] In some embodiments, the vector elements of the original feature vector include traffic statistics feature values, communication behavior feature values, time series feature values, and protocol content feature values.

[0027] It should be noted that the traffic statistics feature values ​​include the total number of bytes transmitted and the total number of data packets corresponding to a subsequence, while the communication behavior feature values ​​include the source data corresponding to a subsequence. Number of addresses, purpose The number of addresses and the dominant protocol type, time series features including the mean and variance of packet arrival intervals for a given subsequence, and protocol content features including the mean and variance of packet arrival intervals for a given subsequence. Package proportion and non-standard Method request percentage.

[0028] It should be noted that, based on the values ​​of the vector elements of the original feature vector, it can be seen that the original feature vector integrates multiple heterogeneous features such as statistical, behavioral, temporal, and semantic information of network traffic. Due to the complex nonlinear coupling relationship between the features, the original feature vector needs to be compressed.

[0029] It should be noted that this invention uses an autoencoder as the compression tool. The reconstruction loss is a loss function that measures the difference between the original feature vector and the reconstructed output of the autoencoder.

[0030] For example, an autoencoder includes an encoder function. and decoder function For the target data, the first... The original feature vectors corresponding to each subsequence Its reconstruction loss for and The loss function value representing the difference between them.

[0031] In some embodiments, calculating the compression quality based on the reconstruction loss includes: performing a negative correlation mapping on the reconstruction loss using an exponential function, and using the mapping result as the compression quality.

[0032] For example, the formula for calculating compression mass is as follows:

[0033]

[0034] In the formula middle, For the target data The compression quality corresponding to each subsequence It is an exponential function. The target data The reconstruction loss corresponding to each subsequence A positive real scaling factor. Used to control weights right The degree of sensitivity.

[0035] For the above formula It should be added that, usually, Setting it to 1 can also be adjusted according to specific circumstances. For example, if the original feature vector has a small dimension, the reconstruction loss is often small, in which case it can be set to 1. Set it to a smaller size.

[0036] For the above formula It should be added that, The larger the value, the higher the value of the target data. The more the original feature vector corresponding to each subsequence deviates from the general data flow learned by the autoencoder, the less reliable the compressed feature vector corresponding to that original feature vector is (possibly due to noise, data anomalies, or extreme rarity), and the lower the corresponding compression quality. It decays exponentially.

[0037] It should be further explained that, for the target data, the average compression quality of all its corresponding original feature vectors is used as the sample weight of its corresponding training sample. In the subsequent training of the anomaly detection model, the contribution of low-quality samples (with lower sample weights) to the total loss is significantly suppressed, thereby avoiding the model being misled by noise or unreliable labels. Conversely, high-quality samples with small reconstruction errors are given higher weights and dominate the direction of model optimization.

[0038] In some embodiments, an intelligent network information security protection method further includes: taking the feature corresponding to any dimension in the compressed feature vector as the target feature, obtaining the vector elements corresponding to the target feature in each compressed feature vector to construct a value sequence of the target feature; obtaining a label sequence, calculating the mutual information between the value sequence and the label sequence, and using the normalized mutual information as the feature weight of the target feature; traversing to obtain the feature weight of the feature corresponding to each dimension in the compressed feature vector, constructing a feature weight vector based on all feature weights; and weighting each compressed feature vector according to the feature weight vector.

[0039] It should be added that the first The sequence of values ​​for the features corresponding to a dimension can be used It means that, among them, For the target data The compressed feature vector corresponding to the nth subsequence vector elements, The number of subsequences of the target data.

[0040] In some embodiments, obtaining the label sequence includes: responding to a label of 0 in the compressed feature vector, indicating that the network is normal; responding to a label of 1 in the compressed feature vector, indicating that the network is abnormal; and constructing a label sequence using 1 and 0 as sequence elements.

[0041] It should be further clarified that if a subsequence is not attacked (secure), its label is 0, and the labels of its corresponding original feature vector and compressed feature vector are both 0; if a subsequence is attacked (insecure), its label is 1, and the labels of its corresponding original feature vector and compressed feature vector are both 1. Labeled sequences can be used... It means that, among them, For the target data Labels of subsequences, The number of subsequences of the target data.

[0042] It should be added that the calculation and The mutual information, the normalized mutual information is used as the first... Feature weights corresponding to dimensions The feature weights corresponding to all dimensions constitute the feature weight vector. ,in, The total number of features. The greater the mutual information, the better the... The stronger the ability of the features corresponding to a dimension to distinguish between normal and abnormal, the higher the feature weights obtained after normalization. In the input stage of the subsequent anomaly detection model, the compressed feature vector is weighted by the feature weight vector (implemented through Hadamard product) to amplify key features and suppress redundant features, guiding the subsequent classifier to focus on the core discriminative signal and reducing the risk of overfitting.

[0043] The target data The compressed feature vectors corresponding to each subsequence are used This means that the weighted compressed feature vector is used express, ,in, The symbol for element-wise multiplication.

[0044] Training samples corresponding to the target data ,in, The number of subsequences in the target data, and the number of training samples. Sample weights This is the average of all compression qualities corresponding to the target data.

[0045] In some embodiments, the training process of the preset model includes: the preset model is an LSTM (Long Short-Term Memory) model; any training sample is used as the target sample, the loss value of the target sample is calculated based on the sample label and the binary cross-entropy loss function, the loss value is weighted according to the sample weight of the target sample to obtain the optimized loss; the optimized loss of each training sample is obtained through iteration, the convergence degree of the LSTM model is calculated based on all optimized losses, and the training is completed when the convergence degree meets the convergence condition.

[0046] For example, the formula for calculating the convergence of an LSTM model is as follows:

[0047]

[0048] In the formula middle, The degree of convergence of the LSTM model. The number of training samples. The sample weights for the training samples, As training samples, The sample labels for the training samples. The loss value is calculated based on the binary cross-entropy loss function. To optimize losses.

[0049] It should be noted that the convergence condition is that the degree of convergence is less than the preset threshold or that the system reaches stability.

[0050] Step S3: Input the real-time collected network time-series data into the anomaly detection model to obtain the anomaly probability, and perform security protection based on the anomaly probability.

[0051] In some embodiments, the method further includes: obtaining the sequence label of the subsequence obtained from the last segmentation of the target data, and using the sequence label as the sample label of the training sample.

[0052] It should be added that, for the training samples , will the The labels of each subsequence are used as training samples. The labels are used to enable the preset model to learn and predict the first... The abnormal probability of each subsequence. When the model is fully learned and used, for the sequence to be predicted (with the same length as the subsequence), the probability of the first adjacent subsequences is obtained. Given a set of historical sequences (of the same length as the subsequences), the sequence to be predicted and the historical sequences are compressed and weighted sequentially, and finally concatenated to obtain the input sequence (which is the same as the training samples). (Alignment) The input sequence is fed into the anomaly detection model to obtain the anomaly probability of the sequence to be predicted. The sequence to be predicted is aligned with its adjacent preceding sequences. The historical sequences are spliced ​​together to form the real-time network time-series data collected in this invention. The splicing method is the same as the sliding window segmentation method (overlapping or continuous) in step S1.

[0053] In some embodiments, security protection based on anomaly probability includes: triggering Level 1 security protection in response to an anomaly probability not being less than a first preset threshold; triggering Level 2 security protection in response to an anomaly probability being less than the first preset threshold and not less than a second preset threshold; and triggering Level 3 security protection in response to an anomaly probability being less than the second preset threshold.

[0054] It should be added that Level 1 security protection automatically triggers a Level 1 response, sending a message to the firewall or... The controller issues policies to block malicious connections in real time; secondary security protection generates secondary alarms and pushes them to the security operations center. ), and start traffic mirroring and deep packet inspection ( Manual review is required; Level 3 security protection is considered a sign of slow or covert attacks, and the response level is automatically upgraded to prevent missed attacks. For example, the first preset threshold is 0.9, and the second preset threshold is 0.5.

[0055] This invention also provides an intelligent network information security protection system. The system includes a processor and a memory, the memory storing computer program instructions. When the computer program instructions are executed by the processor, they implement the intelligent network information security protection method according to the first aspect of this invention. The system also includes other components well-known to those skilled in the art, such as a communication bus and a communication interface; their configuration and functions are known in the art and will not be described further here.

[0056] It should be noted that the preferred embodiments of this application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of this application. For those skilled in the art, various modifications and improvements can be made without departing from the concept of the invention, and these all fall within the protection scope of the invention. Therefore, the protection scope of this patent should be determined by the appended claims.

Claims

1. A network information security intelligent protection method, characterized in that, The method comprises: segmenting target data by a sliding window to obtain a plurality of sub-sequences, the target data being any network time series data collected historically; constructing training samples corresponding to the target data according to the plurality of sub-sequences, and calculating corresponding sample weights, traversing to obtain training samples and sample weights corresponding to each network time series data, and training a preset model according to all the training samples and all the sample weights to obtain an anomaly detection model; inputting real-time collected network time series data into the anomaly detection model to obtain an anomaly probability, and performing security protection according to the anomaly probability. The calculation of the corresponding sample weight comprises: taking any sub-sequence as a target sequence, constructing an original feature vector of the target sequence, obtaining a compressed feature vector obtained by compressing the original feature vector, calculating a reconstruction loss of the original feature vector and the compressed feature vector, calculating a compression quality according to the reconstruction loss, traversing to obtain the compressed feature vector of each sub-sequence and the corresponding compression quality, and splicing all the weighted compressed feature vectors to obtain the training sample corresponding to the target data, and taking the average value of the compression qualities of all the sub-sequences as the sample weight of the training sample corresponding to the target data. 2.The network information security intelligent protection method of claim 1, wherein, The calculation of the compression quality according to the reconstruction loss comprises: adopting an exponential function to perform a negative correlation mapping on the reconstruction loss, and taking the mapping result as the compression quality.

3. The network information security intelligent protection method of claim 1, wherein, The method further comprises: taking any dimension corresponding feature in the compressed feature vector as a target feature, obtaining a corresponding vector element of the target feature in each compressed feature vector to construct a value sequence of the target feature; obtaining a label sequence, calculating mutual information of the value sequence and the label sequence, and taking the normalized mutual information as a feature weight of the target feature; traversing to obtain a feature weight of each dimension corresponding feature in the compressed feature vector, and constructing a feature weight vector according to all the feature weights; weighting each compressed feature vector according to the feature weight vector.

4. The network information security intelligent protection method of claim 3, wherein, The obtaining of the label sequence comprises: in response to the label of the compressed feature vector being 0, the network being normal; in response to the label of the compressed feature vector being 1, the network being abnormal; taking 1 and 0 as sequence elements to construct a label sequence.

5. The network information security intelligent protection method of claim 1, wherein, The method further comprises: obtaining a sequence label of a sub-sequence obtained by segmenting the target data last time, and taking the sequence label as a sample label of the training sample.

6. The network information security intelligent protection method of claim 5, wherein, The training process of the preset model comprises: the preset model is an LSTM model; taking any training sample as a target sample, calculating a loss value of the target sample according to the sample label of the target sample and based on a binary cross-entropy loss function, weighting the loss value according to the sample weight of the target sample to obtain an optimized loss; traversing to obtain an optimized loss of each training sample, calculating a convergence degree of the LSTM model according to all the optimized losses, and in response to the convergence degree satisfying a convergence condition, completing the training.

7. The network information security intelligent protection method of claim 1, wherein, The vector elements of the original feature vector comprise flow statistical feature values, communication behavior feature values, time sequence feature values, and protocol content feature values.

8. The network information security intelligent protection method of claim 1, wherein, The security protection according to the anomaly probability comprises: In response to the abnormal probability being not less than a first preset threshold, triggering a first-level security protection; In response to the abnormal probability being less than the first preset threshold and not less than a second preset threshold, triggering a second-level security protection; In response to the abnormal probability being less than the second preset threshold, triggering a third-level security protection.

9. A network information security intelligent protection system, characterized in that, The method comprises: A processor and a memory, the memory storing computer program instructions which, when executed by the processor, implement the network information security intelligent protection method according to any one of claims 1-8.

Images