Network attack detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a network attack detection method and device, a storage medium and electronic equipment, and relates to the technical field of network attack and defense, and the method comprises the steps: obtaining network message data, extracting network attack detection features corresponding to a plurality of network attack types from the network message data, obtaining a network attack detection feature set, the network attack detection features are used for representing attack information and attack modes of network attacks. The network message data and the network attack detection feature set are input into a network attack detection model, network attack detection is carried out, a network detection result is obtained, and the network attack detection model is obtained based on training of normal network message data of multiple time periods related to the current time period. By applying the technical scheme of the invention, different network attack modes can be detected more accurately, and the accuracy of network attack detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the network attack and defense technical field, and particularly relates to a network attack detection method and device, a storage medium and an electronic device. BACKGROUND

[0002] Network attack detection refers to a process of identifying, analyzing and alarming abnormal behaviors, malicious activities or potential threats in a network through technical means. The core goal is to discover signs of network attacks in a timely manner so as to take defensive measures (such as blocking, tracing, repairing) to protect the security of network systems, data and services.

[0003] However, the network attack detection method has certain limitations, relies on network traffic monitoring, pre-set rules and thresholds, and lacks self-adaptive ability when facing complex and variable attack patterns, and cannot dynamically adjust strategies. And the detection features are single, which is difficult to adapt to multiple attack types, especially for multi-stage, distributed complex attacks, it is difficult to associate analysis and comprehensive judgment. For detection methods relying on machine learning models, they cannot be automatically updated and optimized, and cannot be dynamically adjusted and optimized according to real-time data and new attack patterns. Moreover, the model uses mixed data of normal and abnormal for training, and in the case of overlapping of abnormal points and normal points in the feature space, the features of abnormal data may be confused with the features of normal data, resulting in an increase in false positive rate. Intrusion detection system (IDS) relies on a pre-defined attack signature library, and has limited recognition ability for unknown or variant attacks. Moreover, due to the diversity of normal activities in the network environment, legal behavior may be mistakenly judged as an attack, causing false positives. SUMMARY

[0004] Therefore, the present application provides a network attack detection method, device, storage medium and electronic device, which can more accurately detect different network attack patterns and improve the accuracy of network attack detection.

[0005] In a first aspect, the present application provides a network attack detection method, comprising:

[0006] obtaining network message data;

[0007] extracting network attack detection features corresponding to multiple network attack types from the network message data to obtain a network attack detection feature set, wherein the network attack detection features are used to represent attack information and attack patterns of network attacks;

[0008] input the network message data and the network attack detection feature set into a network attack detection model to perform network attack detection, and obtain a network detection result, the network attack detection model being trained based on normal network message data of a plurality of time periods related to a current time period, and the network detection result indicating whether the network message data is normal network message data or abnormal network message data.

[0009] Optionally, the extracting the network attack detection features corresponding to the plurality of network attack types from the network message data to obtain the network attack detection feature set comprises:

[0010] extracting data related to an attack manner of the network attack type from the network message data to obtain the network attack detection features corresponding to the network attack type;

[0011] combining the network attack detection features corresponding to the same network attack type to obtain the network attack detection feature set corresponding to each network attack type.

[0012] Optionally, the method comprises:

[0013] obtaining normal network message data of a plurality of preset time periods before a current time period;

[0014] training the network attack detection model according to the normal network message data of the plurality of preset time periods before the current time period.

[0015] Optionally, after the step of obtaining the network message data, the method comprises:

[0016] filtering out, from the network message data, network message data matching a network protection rule, the network protection rule being constructed based on network message features of abnormal network message data.

[0017] Optionally, the method comprises:

[0018] in response to the network detection result indicating that the network message data is abnormal network message data, extracting a network attack message feature set of the network message data, the network attack message feature set comprising network message features highly related to network attacks;

[0019] updating the network protection rule according to the network attack message feature set.

[0020] Optionally, the extracting the network attack message feature set of the network message data comprises:

[0021] extracting network message features of the network message data using a data dimensionality reduction denoising algorithm and a data correlation feature extraction algorithm;

[0022] The network attack packet feature set is selected from the network packet features using correlation analysis or feature selection algorithms.

[0023] Optionally, before the step of inputting the network packet data and the network attack detection feature set into the network attack detection model, the following steps are included:

[0024] The network packet data is divided according to Internet Protocol address and time to obtain multiple network packet datasets, wherein the network packet datasets include network packet data with the same Internet Protocol address within the same time period;

[0025] Based on the network attack detection feature set corresponding to the network packet data, a density-based clustering algorithm is used to perform clustering analysis on the network packet dataset to obtain the initial network detection results corresponding to the network packet data.

[0026] In response to the initial network detection result indicating that the network packet data is abnormal, the network packet data is removed.

[0027] Secondly, this application provides a network attack detection device, comprising:

[0028] The data acquisition module is configured to acquire network packet data;

[0029] The detection feature extraction module is configured to extract network attack detection features corresponding to various network attack types from the network packet data to obtain a network attack detection feature set. The network attack detection features are used to characterize the attack information and attack mode of the network attack.

[0030] The network attack detection module is configured to input the network packet data and the network attack detection feature set into the network attack detection model to perform network attack detection and obtain network detection results. The network attack detection model is trained based on normal network packet data from multiple time periods related to the current time period. The network detection results indicate whether the network packet data is normal network packet data or abnormal network packet data.

[0031] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0032] Fourthly, this application provides an electronic device including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.

[0033] In a fifth aspect, the present application provides a computer program product having a computer program stored thereon, which, when executed by a processor, implements the method of the first aspect.

[0034] By means of the technical solution, the network attack detection method, device, storage medium and electronic equipment provided by the present application are provided, wherein the method comprises: obtaining network message data, extracting network attack detection features corresponding to a plurality of network attack types in the network message data to obtain a network attack detection feature set, and the network attack detection features are used to represent attack information and attack patterns of network attacks. The network message data and the network attack detection feature set are input into a network attack detection model for network attack detection to obtain a network detection result, and the network attack detection model is trained based on normal network message data of a plurality of time periods related to a current time period. By applying the technical solution of the present application, different network attack patterns can be detected more accurately, and the accuracy of network attack detection is improved.

[0035] The above description is only a summary of the technical solutions of the present application. In order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described. BRIEF DESCRIPTION OF DRAWINGS

[0036] The accompanying drawings incorporated in and forming a part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0038] Figure 1 A flowchart of network attack detection provided by the embodiments of the present application is shown;

[0039] Figure 2 A training flowchart of a network attack detection model provided by the embodiments of the present application is shown;

[0040] Figure 3 A flowchart of filtering data based on network protection rules provided by the embodiments of the present application is shown;

[0041] Figure 4 A preliminary detection flowchart of a density-based clustering algorithm provided by the embodiments of the present application is shown;

[0042] Figure 5This paper illustrates a schematic diagram of the secondary detection process of the anomaly detection algorithm provided in an embodiment of this application;

[0043] Figure 6 A schematic diagram illustrating the network protection rule update process provided in an embodiment of this application is shown;

[0044] Figure 7 A schematic diagram of the network attack detection device provided in an embodiment of this application is shown. Detailed Implementation

[0045] The embodiments of this application will now be described in more detail with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0046] The two main methods of cyberattacks are traffic attacks and connection attacks. Traffic attacks, characterized by massive data flows, use techniques such as Denial of Service (DoS) attacks, Distributed Denial of Service (DDoS) attacks, User Datagram Protocol (UDP) flood attacks, and Domain Name System (DNS) query flood attacks to overwhelm servers with massive amounts of traffic, causing network congestion and severely hindering normal communication processes. In contrast, connection-based attacks establish a large number of Transmission Control Protocol (TCP) connections, such as Synchronize Sequence Number Flood (SYN Flood) attacks, Acknowledgment Flood (ACK Flood) attacks, Transmission Control Protocol Reset (TCP RST) attacks, and information gathering attacks. This leads to excessive consumption or even exhaustion of server resources, ultimately resulting in legitimate user requests not receiving timely responses.

[0047] Both of these attack methods aim to exhaust the target's resources, but their strategies and technical details differ. Traffic-based attacks directly target network bandwidth and computing resources, using massive amounts of data packets as weapons, while connection-based attacks exploit protocol vulnerabilities and weaknesses in connection mechanisms to continuously erode the target system's processing power, thereby achieving their destructive purpose.

[0048] Cyberattacks not only cause service interruptions and severely impact user experience, but also, in the internet age, generate abnormal traffic data during in-depth data analysis of business perception experiences, which consumes a large amount of system resources, interferes with the normal operation of network equipment, and leads to a waste of data collection resources, storage resources, and upper-layer data analysis computing resources when data acquisition equipment is attacked and collects a large amount of cyberattack data. Faced with this serious challenge, efficient and accurate cyberattack detection and protection technologies have become a key issue that urgently needs to be addressed in internet business data analysis.

[0049] There are various techniques for detecting network attacks. Traffic analysis identifies abnormal behavior by analyzing network traffic patterns, such as detecting abnormal traffic peaks and analyzing traffic characteristics. However, this method may not be able to identify complex attacks in a timely manner, especially those that mimic normal traffic patterns. Time series analysis models and analyzes network traffic over time to make preliminary judgments about attack behavior within the network. Data mining collects, analyzes, and mines large amounts of network data to discover hidden attack information and patterns. By establishing complex data models and analytical algorithms, it enables more effective detection and prediction of network attacks.

[0050] Due to the complexity and variety of network attacks, network attack protection technologies have certain limitations and lack universality. While intrusion detection systems (IDS) monitor network activity and provide network protection, IDS heavily rely on predefined attack signature databases, limiting their ability to identify unknown or variant attacks and leading to false negatives. Furthermore, frequent rule updates require significant time and resources. Additionally, the diversity of normal network activities and the lack of dynamic updates to signature databases can lead to false positives, where legitimate behavior is mistakenly identified as an attack.

[0051] In the above embodiments, the network attack detection methods mainly rely on network traffic monitoring. The preset rules and thresholds lack adaptability when facing complex and ever-changing attack patterns, failing to dynamically adjust detection strategies based on real-time data and environmental changes, thus increasing operational costs. The selection of single detection features cannot adapt to the characteristics of various types of network attacks, especially when facing multi-stage, distributed, and complex attacks, making effective correlation analysis and comprehensive judgment difficult. The application of a single detection algorithm has limitations, failing to comprehensively identify diverse attack patterns, resulting in insufficient accuracy and robustness. Using a single algorithm easily introduces the risk of single-point failure; once the algorithm fails or is bypassed by attackers, the entire detection system may lose its defensive capabilities. For detection methods relying on machine learning models, the models typically cannot automatically update and adapt, failing to dynamically adjust and optimize based on real-time data and emerging attack patterns. This limitation of fixed models causes the system's detection performance to decline when facing environmental changes, making it difficult to maintain efficient detection and defense capabilities in the long term. Furthermore, the model is trained using a mixture of normal and abnormal data; the features of abnormal data may be confused with those of normal data, especially when abnormal and normal points overlap in the feature space, making it difficult for the model to accurately distinguish between normal and abnormal data, leading to an increased false alarm rate.

[0052] Using IDS for network tool protection requires a predefined attack signature database. However, it cannot detect unknown network attacks whose signatures are not stored in the IDS database. Its ability to identify unknown or variant attacks is limited, leading to false negatives. Furthermore, frequent rule updates require significant manpower and resources. Additionally, the diversity of normal activities in the network environment may mistakenly classify legitimate behavior as an attack, resulting in false positives.

[0053] Therefore, in order to solve the above problems, this application proposes a network attack detection method, such as... Figure 1 As shown, the method includes:

[0054] S101, Obtain network packet data.

[0055] S102, extract network attack detection features corresponding to various network attack types from network packet data to obtain a network attack detection feature set.

[0056] Among them, network attack detection features are used to characterize the attack information and attack patterns of network attacks.

[0057] In some embodiments, different network attack detection features are extracted based on the attack methods of different network attack types. Data related to the attack methods of different network attack types can be extracted from network packet data to obtain network attack detection features corresponding to the network attack type. Network attack detection features corresponding to the same network attack type are combined to obtain a network attack detection feature set corresponding to each network attack type.

[0058] In some embodiments, network attacks include traffic attacks and connection attacks. For the extraction of network attack detection features for traffic attacks, which include DoS / DDoS attacks, UDP Flood attacks, and DNS Query Flood attacks, network attack detection features can be extracted according to their attack methods.

[0059] DoS attacks are network attacks that exploit legitimate service requests to consume excessive service resources, preventing legitimate users from receiving service responses. DDoS attacks utilize multiple computers to launch distributed DoS attacks against one or more targets simultaneously. Based on the principles of DoS / DDoS attacks, the sum and standard deviation of the target IP's uplink traffic, the sum and standard deviation of the number of TCP connection requests, the total number and standard deviation of source IPs, and the uplink packet rate are extracted as network attack detection features for DoS / DDoS attacks.

[0060] UDP Flood attacks utilize a large number of small UDP packets to overwhelm DNS servers, RADIUS authentication servers, or streaming video servers. Because UDP is a connectionless service, attackers can send numerous small UDP packets with spoofed source IP addresses in a UDP Flood attack. Based on the principles of UDP Flood attacks, the proportion of uplink UDP packets to the total network traffic packets, the frequency of source IP addresses, and the rate of change in uplink UDP packet size are extracted as network attack detection features for UDP Flood attacks.

[0061] A DNS Query Flood attack involves sending a large number of domain name resolution requests to the attacked server. Typically, the requested domain names are randomly generated or do not exist on the internet. The attacked DNS server recursively queries its upstream DNS servers for domain name information. This domain name resolution process places a heavy load on the server; if the number of domain name resolution requests per second exceeds a certain threshold, the DNS server will time out. Based on the principle of DNS Query Flood attacks, the number of DNS requests, DNS query types, DNS response time, and query failure rate are extracted as network attack detection characteristics for DNS Query Flood attacks.

[0062] For network attack detection feature extraction of connection-based attacks, which include SYN Flood attacks, ACK Flood attacks, TCP RST attacks, and information gathering attacks, network attack detection features can be extracted according to their attack methods.

[0063] Among them, SYN Flood attacks mainly occupy server connection resources by sending a large number of SYN request packets that have not completed the three-way handshake, causing legitimate user requests to be unable to be processed. Based on the principle of SYN Flood attacks, the number of SYN packets, the SYN / ACK count of the server response, the count of received ACKs, and the ratio of ACKs to SYN / ACKs are extracted as network attack detection features of SYN Flood attacks.

[0064] An ACK Flood attack occurs after a TCP connection is established. The attacker sends a large number of forged ACK packets to the target host. The host operating system expends significant effort receiving packets, determining status, and actively responding to RST packets. This can prevent normal data packets from being processed in a timely manner, leading to a degraded user experience for other users. Based on the principle of ACK Flood attacks, the number of ACK packets sent per unit time, the proportion of ACK packets in all TCP packets, and the proportion of invalid ACK packets are extracted as network attack detection characteristics for SYN Flood attacks.

[0065] A TCP RST attack sends a large number of forged TCP RST packets, causing the target server or client to mistakenly believe that the connection needs to be terminated immediately. This leads to the target system frequently establishing and terminating connections, consuming system resources. Based on the principle of a TCP RST attack, the client will actively initiate RST requests, and the number of RST packets and the number of TCP connections reset can be extracted as network attack detection characteristics of a TCP RST attack.

[0066] Address scanning attacks in information gathering attacks use the ping program to probe target addresses; a response indicates the target's presence. Port scanning attacks in information gathering attacks use software to connect to a series of TCP ports on a large number of hosts, and the scanning software reports the ports opened by the hosts it successfully connected to. Based on the principles of information gathering attacks, the number of destination servers accessed by each source IP and the number of ports accessed by each destination server within a statistical time granularity are extracted as network attack detection features for information gathering attacks.

[0067] In the above embodiments, the collected network attack detection features are combined into a network attack detection feature set according to different network attack types. The network attack detection feature set customized for each type of network attack can more accurately capture its network attack behavior characteristics and improve the accuracy of detection.

[0068] S103: Input network packet data and network attack detection feature set into the network attack detection model to perform network attack detection and obtain network detection results.

[0069] The network attack detection model is trained based on normal network packet data from multiple time periods related to the current time period. The network detection results characterize whether the network packet data is normal or abnormal.

[0070] In some embodiments, such as Figure 2 The diagram illustrates the training process of the network attack detection model provided in this application embodiment. It involves obtaining normal network packet data from multiple preset time periods prior to the current time period (S201), and training the network attack detection model based on this data (S202). For example, it obtains normal network packet data from the same time period 7 days prior to the current detection time period, normal network packet data from the hour before and the hour after the same time period 7 days prior, and normal network packet data from the hour before the current detection time period.

[0071] In some embodiments, network attack detection can be based on anomaly detection algorithms. Anomaly detection algorithms can be unsupervised detection algorithms, such as the Isolation Forest anomaly detection algorithm.

[0072] In some embodiments, the anomaly detection algorithm can also be a supervised detection algorithm, such as decision trees or random forests. It should be noted that if a supervised detection algorithm is chosen, the data needs to be labeled with normal and abnormal tags for model training after the previous network attack detection is completed and before removing abnormal network packet data. That is, the network attack detection model is trained based on normal and abnormal network packet data from multiple time periods related to the current time period.

[0073] In some embodiments, a multi-layered network attack detection method can be set up, which can first perform initial detection based on density-based clustering algorithms, and then perform secondary detection based on anomaly detection algorithms. That is, after obtaining network packet data, the network packet data is divided according to Internet Protocol address (IP address) and time to obtain multiple network packet datasets. The network packet datasets include network packet data of the same Internet Protocol address within the same time period.

[0074] Next, based on the network attack detection feature set corresponding to the network packet data, a density-based clustering algorithm is used to perform clustering analysis on the network packet dataset to obtain the initial network detection results corresponding to the network packet data. If the initial network detection results indicate that the network packet data is abnormal, the network packet data is removed. If the initial network detection results indicate that the network packet data is normal, the network packet data is retained and subjected to secondary detection.

[0075] In some embodiments, in response to network detection results indicating that network packet data is abnormal, the network packet data is discarded. In response to network detection results indicating that network packet data is normal, the network packet data is retained for subsequent network experience data analysis.

[0076] In some embodiments, for abnormal network packet data identified by network attack detection, network packet features of the abnormal network packet data can be extracted, and network protection rules can be constructed based on the network packet features of the abnormal network packet data. These rules are used to filter subsequently collected network packet data, thereby avoiding the system from collecting a large amount of redundant network attack data and wasting system bandwidth and storage resources.

[0077] In this regard, such as Figure 3 The diagram illustrates a process for filtering data based on network protection rules, as provided in this embodiment. After obtaining network packet data, the data can be matched against network protection rules. If the network packet data matches the network packet characteristics in the rules, it is filtered out. If the network packet data does not match the network packet characteristics, it is retained for subsequent network attack detection.

[0078] In some embodiments, network protection rules can be dynamically updated. After the network attack detection process is completed, in response to the network detection results indicating that the network packet data is abnormal, the network attack packet feature set of the network packet data can be extracted, and the network protection rules can be updated according to the network attack packet feature set.

[0079] The network attack message signature set includes network message features that are highly related to network attacks.

[0080] In some embodiments, data dimensionality reduction and noise reduction algorithms and data association feature extraction algorithms can be used to extract network packet features from network packet data, and correlation analysis or feature selection algorithms can be used to filter out network attack packet feature sets from network packet features.

[0081] Network packet feature mining is performed using data dimensionality reduction and noise reduction algorithms (such as Principal Component Analysis (PCA)) and data association feature extraction algorithms (such as the Frequent Pattern Growth Algorithm, FP-Growth). To ensure the quality of the feature set, correlation analysis (such as chi-square test, Pearson correlation coefficient) or feature selection algorithms (such as Recursive Feature Elimination, RFE) are used to filter out network attack packet feature sets that are highly correlated with network attack detection from the mined network packet feature set, forming the final network attack packet feature set. Then, network protection rules are dynamically updated based on the obtained network attack packet feature set.

[0082] In some embodiments, network packet data can be collected through a DPI (Deep Packet Inspection) system. The DPI system uses deep packet inspection technology to collect and parse user plane signaling data to identify and extract key service quality information as network packet data. For example, probes can be deployed between the wireless base station and core network elements (such as the Serving Gateway (SGW) in 4G and the User Plane Function (UPF) in 5G) to collect user plane (such as the S1-U interface in 4G and the N3 interface in 5G) data.

[0083] After the DPI system collects user signaling data, it integrates the collected user signaling data into a structured signaling and service detailed record (X Data Recording, XDR), and transmits the XDR data to this system in real time based on a common transmission interface.

[0084] To fully utilize computing resources and improve processing efficiency, the system receives and processes transmitted XDR data packets in real time based on network transmission protocols. Each packet encapsulates multiple XDR records of the same service type and consistent length. The XDR data packets are parsed, and each record is converted into a fast-processing in-memory format. Data preprocessing, such as default backfilling, content conversion, and anomaly verification, is performed to generate in-memory records that the system can process efficiently.

[0085] To improve efficiency, these cleaning logics are dynamically compiled into directly executable binary dynamic libraries, and a calling interface is provided. Each business type corresponds to a dynamic library, which transmits the original XDR record memory block and context state information, returns the cleaning results as memory block pointers, assembles them into fast-transmitting XDR messages, with each message supporting multiple XDR records, and finally places them into the message queue MQ1. To support the real-time processing of massive amounts of mobile internet data, multiple threads can be started on the processing nodes to concurrently execute preprocessing tasks, fully utilizing computing resources and improving preprocessing efficiency.

[0086] To facilitate subsequent multi-layered network attack detection methods, network packet data can be pre-aggregated using time series analysis. Based on the pre-processed XDR data, network metrics can be clustered according to server IP and time dimensions.

[0087] Read XDR messages from message queue MQ1, and for each XDR record, summarize the network behavior indicators of the same server IP within the same time interval according to the destination server IP dimension and time granularity, and aggregate network indicator data to lay the data foundation for subsequent feature extraction of various network attack detection.

[0088] The aggregation time granularity can be dynamically adjusted based on system load and timeliness requirements. For example, during peak periods, a smaller time granularity can be set to ensure data real-time performance and fine granularity, such as setting a 30-second time window and aggregating network metric data every 10 milliseconds. During off-peak periods, a larger time granularity can be used to reduce computational pressure, such as setting a 5-minute time window for network metric aggregation.

[0089] The following section elaborates on the multi-level network attack detection method and network protection rule update based on density-based clustering and anomaly detection algorithms.

[0090] Density-based clustering algorithms in network attack detection offer advantages such as not requiring pre-specified cluster numbers, handling noise and outliers, discovering clusters of arbitrary shapes, automatically determining cluster density, efficiently processing large-scale data, and lower data standardization requirements. These advantages enable density-based clustering algorithms to detect network attacks more accurately and efficiently in complex and dynamic network environments.

[0091] like Figure 4 As shown, Figure 4 This is a schematic diagram of the initial detection process of a density-based clustering algorithm. Specifically, it includes the following steps:

[0092] S401: Handling Missing Data. Acquire time-series aggregated data, convert timestamps to time types, and set the time data as a data index. During data collection, some network metric data for a destination IP may not be collected due to various faults. For example, TCP connection request counts may be collected, but uplink traffic values ​​may not be, resulting in missing values. The presence of missing values ​​will affect the clustering effect. To ensure data integrity and consistency, improve the robustness and accuracy of detection, and enhance anomaly detection and clustering effects, this section addresses this issue.

[0093] Handle missing values ​​in the data. Since the input data is time series data, linear interpolation, forward or backward imputation, or a combination of both methods can be used to fill in missing values.

[0094] In this embodiment, taking filling in missing values ​​for TCP connection request counts as an example, the missing values ​​are first estimated using the known linear relationship between adjacent data points, i.e., linear interpolation. The formula for linear interpolation is:

[0095]

[0096] Where y represents the missing value to be filled, i.e., the number of missing TCP connection requests. y1 and y2 represent the number of TCP connection requests for two known adjacent data points, corresponding to timestamps t1 and t2 respectively. t represents the timestamp of the missing value to be filled. t1 and t2 represent the timestamps of two known adjacent data points, where t1 is the time point before t and t2 is the time point after t.

[0097] After processing using linear interpolation, the data is checked again for any unprocessed missing values. If missing values ​​still exist, they are filled using forward or backward interpolation. This means replacing the missing values ​​with known values ​​from the previous time point. If there is no previous time point or the value from the previous time point is empty, the missing values ​​are filled with known values ​​from the next time point. This completes the missing value processing.

[0098] S402: Construct a feature matrix by extracting network attack detection feature sets corresponding to various network attack types from network packet data.

[0099] S403: Perform feature standardization on the feature matrix, scaling all features in the matrix to the same scale. Different features may have different dimensions and ranges. For example, data traffic is measured in bytes and may have very large values, while the number of TCP connection requests and the number of source IPs may be relatively small. Without standardization, large-scale features will dominate distance calculations, affecting clustering results. Standardization scales all features to the same scale, giving each feature an equal weight in distance calculations.

[0100] In this embodiment, the feature data of each destination IP can be standardized using the following formula to ensure that all features have the same scale:

[0101]

[0102] Where z is the standardized value, x is the original feature data value, μ is the mean of the original feature data, and σ is the standard deviation of the original data.

[0103] S404: Set a distance metric. In step S403, the selected multidimensional features were standardized. After standardization, the features have similar scales and distributions, allowing a distance metric to reflect the distance relationships between them. In some embodiments, Euclidean distance can be used as the distance metric, effectively reflecting the distance relationships between features. Furthermore, Euclidean distance performs well in multidimensional feature spaces, accurately capturing the relative positional relationships of data points across multiple feature dimensions.

[0104] S405: Density-based clustering algorithms perform clustering analysis. In some embodiments, the Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN) algorithm is used to perform clustering analysis on the standardized feature data of each destination IP, automatically identifying the optimal number of clusters, and appending the clustering anomaly labels generated by the HDBSCAN algorithm to the original feature data. For example, suspected abnormal network packet data detected by the density-based clustering algorithm is marked as -1 so that subsequent anomaly detection algorithms can be used for secondary detection.

[0105] like Figure 5 As shown, Figure 5 This is a schematic diagram of the secondary detection process of an anomaly detection algorithm. Taking the Isolation Forest algorithm as an example, the specific steps include:

[0106] S501: Obtain training data. Considering the similarity and periodicity of time series data, the following data are selected as training data for the Isolation Forest model: normal network packet data after removing abnormal network packet data from the same time period 7 days ago, normal network packet data after removing abnormal network packet data from the hour before and the hour after the same time period 7 days ago, and normal network packet data after removing abnormal network packet data from the hour before the current detection time period.

[0107] In some embodiments, the selection of training data time periods can be dynamically adjusted based on the subsequent implementation effect of model detection, so as to further improve the detection performance of the model.

[0108] S502: Handling Missing Data. To improve training effectiveness, the training data can be processed for missing data using the data processing method in step S401 of the above embodiment.

[0109] S503: Construct a feature matrix by extracting network attack detection feature sets corresponding to various network attack types from the training data and constructing a feature matrix.

[0110] S504: Perform feature standardization on the feature matrix. Refer to the standardization process in step S403 of the above embodiments to perform feature standardization on the training data.

[0111] S505: Model Training. Train the Isolation Forest algorithm model using standardized training data. Hyperparameters (such as the number of trees, subsample size, random states, etc.) can be optimized using grid search or Bayesian optimization methods to improve model performance and accuracy.

[0112] S506: Utilize the trained Isolation Forest algorithm model to perform network attack detection. Perform secondary detection and confirmation on the abnormal network packet data detected by the density-based clustering algorithm, and label the abnormal network packet data detected by the secondary confirmation as abnormal.

[0113] like Figure 6 As shown, Figure 6 This is a flowchart illustrating the process of updating network protection rules. It includes the following steps:

[0114] S601: Data dimensionality reduction processing. Principal component analysis is applied to abnormal network packet data to reduce the dimensionality of the feature space, remove redundant features, and retain key information. Principal components with a cumulative contribution rate (e.g., 80%-90%) are selected as the initial network packet feature set.

[0115] S602: Use a data association feature extraction algorithm to mine data association features in the initial network packet feature set and find network packet features that frequently appear in network attack data.

[0116] S603: Utilize correlation analysis (such as chi-square test, Pearson correlation coefficient) or feature selection algorithms (such as recursive feature elimination (RFE)) to further optimize the feature set, ensuring that the finally selected network packet features have the highest characterization ability for network attack detection, thus forming the optimal network attack packet feature set.

[0117] S604: Network protection rules are updated and optimized based on network attack packet signature sets. Continuous rule improvement ensures that the system can respond to new types of attacks in a timely manner and improve protection capabilities.

[0118] After the above network protection rule update process is completed, the data after network attack detection can be traversed, the label of each data entry can be checked, and data with abnormal labels can be removed, while normal data can be retained. This saves computing and storage resources for subsequent perception data analysis, improves the accuracy and reliability of data analysis, and provides important support for network performance optimization and user experience enhancement.

[0119] In the above embodiments, network attack detection feature sets of various network attack types are extracted based on Internet data to perform network attack detection, and network attack packet feature sets are mined to generate and update network attack protection rules.

[0120] For anomalous network attack data, principal component analysis (PCA) is used to first reduce the dimensionality and noise of the anomalous data, decreasing subsequent computational complexity. Then, a data association feature extraction algorithm is used to extract network packet feature sets. A correlation evaluation algorithm is introduced to evaluate and filter the features, ensuring that the selected features accurately reflect the behavioral patterns of network attacks. This generates the final network attack packet feature set, and network protection rules for the DPI (Data Point Injection) acquisition system are generated based on this feature set. During data acquisition, the network protection rules are compared in real time. When a network attack is detected on the DPI system, redundant network attack data can be directly filtered, effectively saving system bandwidth, acquisition, and storage / computing resources. This method dynamically updates network protection rules, abandoning the use of single, fixed protection methods, significantly improving the efficiency and response speed of the network protection system while reducing system load and ensuring network security and stability.

[0121] For different types of network attacks, and based on their implementation methods, corresponding network attack detection features are extracted to generate a flexible and comprehensive network attack detection feature set. This improves detection accuracy and reduces false positive and false negative rates. Traffic-based attack detection features are extracted according to the principles of three attack methods: DoS / DDoS attacks, UDP Flood attacks, and DNS Query Flood attacks. Connection-based attack detection features are extracted according to the principles of four attack methods: SYN Flood attacks, ACK Flood attacks, TCP RST attacks, and information gathering attacks. By meticulously classifying network attack types and extracting features accordingly, the flexibility and comprehensiveness of the detection system are ensured. This allows it to effectively cope with the ever-changing network threat environment and maintain high detection efficiency by dynamically adjusting the feature extraction methods to address diverse and evolving attack techniques.

[0122] By integrating data collection, DPI network attack protection, network attack detection, network attack packet signature generation, and network protection rule updates, a fully self-feedback and self-optimizing system has been created. The system continuously updates and improves its signature set based on newly captured attack data, ensuring it always reflects the latest attack methods and behavioral patterns. Extracted abnormal packet signature sets are automatically synchronized to the DPI collection system via a synchronization mechanism. The collection system then updates its network protection rules in real time based on the latest network attack packet signature sets. This close integration of all stages—data collection, attack detection, signature set generation, and rule updates—forms a closed-loop system, ensuring continuous monitoring, detection, and protection against network attacks. The self-feedback mechanism allows the system to continuously adjust and optimize its protection strategies based on actual detection results, while the self-optimization mechanism ensures the system can quickly adjust and respond to new types of attacks, maintaining high-efficiency protection capabilities.

[0123] By utilizing two detection sub-modules—density-based clustering and anomaly detection—a multi-layered network attack detection module can be formed, which can more effectively improve detection accuracy and reduce false positive and false negative rates.

[0124] Based on the similarity and periodicity of time series data, data within corresponding time intervals are selected for model training. The model can capture and learn the periodic characteristics of network traffic. By combining data from adjacent time periods, the model can more sensitively capture short-term changes and trends in traffic, enabling it to capture the latest network state and further improve the real-time performance and accuracy of anomaly detection. Using normal data from multiple time periods avoids the model from overfitting to traffic patterns within a specific time period, thereby improving the algorithm's ability to detect abnormal behavior across different time periods.

[0125] The aforementioned network attack detection method can be developed and deployed based on existing big data analysis systems. It can effectively detect and eliminate abnormal data from network attacks, and extract abnormal packet feature sets from the abnormal network attack data to generate network protection rules that are deployed within the DPI system to protect the DPI system. This avoids the DPI system from collecting a large amount of abnormal attack data and consuming bandwidth and data processing resources when a network attack occurs. It also plays a positive role in improving the accuracy of network perception experience data analysis and saving system storage resources.

[0126] Based on the above-described network attack detection method, this embodiment provides a network attack detection device, such as... Figure 7 As shown, the device includes: a data acquisition module 701, a network attack protection module 702, a data preprocessing module 703, a time series aggregation module 704, a detection feature extraction module 705, a network attack detection module 706, a feature mining module 707, and an abnormal data removal module 708.

[0127] The data acquisition module 701 is used to collect network data packets. It can be an external system, such as a DPI system, capable of processing mirrored or split optical data from switches, and collecting and parsing user plane signaling data through deep packet inspection technology.

[0128] The network attack protection module 702 integrates the network attack packet feature set output by the feature mining module 707. Based on this feature set, network protection rules are constructed. Real-time collected network data packets are matched against these rules. If signaling data matching the network attack packet characteristics is collected, it is filtered out, preventing the system from collecting large amounts of redundant network attack data and wasting system bandwidth and storage resources. The network protection rules of this module are continuously updated and optimized based on the network attack packet feature set output by the feature mining module 707.

[0129] The filtered network data packets can also be integrated into structured real-time call detail records (XDRs) and interact with the data acquisition module 701 based on a common transmission interface, pushing XDR data to the data acquisition module 701 in real time.

[0130] The data preprocessing module 703 is responsible for real-time preprocessing of XDR data, including receiving real-time XDR data packets based on network transmission protocols, splitting them into complete XDR records, performing field conversion, backfilling, and verification on each XDR record, generating memory records that can be processed efficiently, and sending them to the time series aggregation module 704.

[0131] The time series aggregation module 704 is used to aggregate network metrics from preprocessed XDR data according to server IP and time dimension.

[0132] The detection feature extraction module 705 is used to extract corresponding network attack detection features based on the attack principles of different network attack types. This module includes two sub-modules: the traffic-based attack detection feature extraction module 7051 and the connection-based attack detection feature extraction module 7052, which extract traffic-based attack detection features and connection-based attack detection features, respectively. In the traffic-based attack detection feature extraction stage, features for DoS / DDoS attacks, UDP Flood attacks, and DNS Query Flood attacks are extracted. In the connection-based attack detection feature extraction stage, features for SYN Flood attacks, ACK Flood attacks, TCP RST attacks, and information gathering attacks are extracted. The collected network attack detection features are combined into a network attack detection feature set, which is used in the network attack detection module 706 to construct a feature matrix.

[0133] The network attack detection module 706 is used to detect network attacks based on the aggregated data output by the time series aggregation module 704 and the network attack detection features of various network attack types extracted by the detection feature extraction module 705. This module consists of two detection algorithm sub-modules: a preliminary detection module 7061 based on a density-based clustering algorithm and a secondary detection module 7062 based on an anomaly detection algorithm. The preliminary detection module 7061 performs initial analysis and detection of network attacks on the data. Detected abnormal data is then sent to the secondary detection module 7062 for final confirmation of network attack detection, and the finally confirmed abnormal network packet data is tagged.

[0134] When faced with massive amounts of data, the detection algorithm designed in this module has high scalability and can be migrated to multiple platforms (such as the Apache Spark distributed computing platform) to run, thereby greatly improving detection efficiency.

[0135] The feature mining module 707 is used to mine network packet features based on the abnormal network packet data detected by the network attack detection module 706. It employs data dimensionality reduction and denoising algorithms (such as Principal Component Analysis (PCA)) and data association feature extraction algorithms (such as the Frequent Pattern Growth Algorithm, FP-Growth) to perform network packet feature mining. To ensure the quality of the feature set, correlation analysis (such as chi-square test, Pearson correlation coefficient) or feature selection algorithms (such as Recursive Feature Elimination, RFE) are used to filter out features highly correlated with network attack detection from the mined feature set, forming the final network attack packet feature set. The acquired network attack packet feature set is then automatically and in real-time synchronized to the network attack protection module 702 via a synchronization interface, dynamically updating the network protection rules of the network attack protection module 702.

[0136] The abnormal data removal module 708 is used to traverse the data after network attack detection, check the label of each data, remove the data with abnormal labels, and retain the normal data for subsequent network experience data analysis, so as to ensure the accuracy of data analysis.

[0137] In this embodiment, based on XDR user call detail records (CDRs) within the DPI system, key modules such as preprocessing, time-series aggregation, feature extraction for multiple network attack types, initial detection using density-based clustering algorithms, secondary detection using anomaly detection algorithms, network attack packet feature extraction, DPI network attack protection, and abnormal data removal are employed to quickly and accurately identify and remove attack anomaly data. From the detected abnormal network packet data, feature extraction algorithms and correlation analysis feature set confidence assessment are used to extract network attack packet features, generating a network attack packet feature set. This feature set is then integrated into the DPI data acquisition system to set network protection rules. Once the features of the acquired network packet data match the network protection rules, an automatic response mechanism is immediately activated, and the DPI acquisition device discards the data, releasing network resources and avoiding computational and storage consumption. Simultaneously, the network attack protection filtering rules can be automatically updated and optimized based on the network attack packet feature set, creating a closed-loop process of self-updating, self-optimizing, and self-enriching without manual intervention, thus reducing operation and maintenance costs.

[0138] Furthermore, it extracts detection features for multiple network attack types. The combination of features from multiple types can more comprehensively cover different attack patterns. Based on comprehensive network attack type detection features, it combines density-based clustering algorithms and anomaly detection algorithms to construct a comprehensive and multi-layered attack identification framework, which can more accurately detect multiple network attack types, greatly improve the accuracy of network attack detection, and also greatly enrich the network attack packet feature set, thereby improving the comprehensiveness, efficiency and accuracy of network protection.

[0139] It should be noted that the device structure provided in this embodiment does not constitute a limitation on the device, and may include more or fewer component modules, or combine certain modules, or have different module arrangements. Other corresponding descriptions of the functional units involved in the network attack detection device provided in this embodiment can be found in the corresponding descriptions in the network attack detection method, and will not be repeated here.

[0140] Based on the above-described network attack detection method, this embodiment also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described network attack detection method.

[0141] Based on the above-described network attack detection method, this embodiment also provides a computer program product on which a computer program is stored, and when the computer program product is executed by a processor, it implements the above-described network attack detection method.

[0142] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0143] Based on the above-described network attack detection method, this application also provides an electronic device, such as a terminal device, which includes a storage medium and a processor; the storage medium is used to store a computer program; and the processor is used to execute the computer program to implement the above-described network attack detection.

[0144] Optionally, the aforementioned physical devices may also include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, input units such as a keyboard, etc., and optional user interfaces may also include USB interfaces, card reader interfaces, etc. The network interface may optionally include standard wired interfaces, wireless interfaces (such as Wi-Fi interfaces), etc.

[0145] Those skilled in the art will understand that the physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or combine certain components, or have different component arrangements.

[0146] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0147] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented using software plus necessary general-purpose hardware platforms, or it can be implemented using hardware. Compared with current related technologies, by applying the technical solution of this embodiment, different network attack patterns can be detected more accurately, improving the accuracy of network attack detection.

[0148] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0149] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting network attacks, characterized in that, include: Obtain network packet data; Network attack detection features corresponding to various network attack types are extracted from the network packet data to obtain a network attack detection feature set. The network attack detection features are used to characterize the attack information and attack patterns of network attacks; The network packet data and the network attack detection feature set are input into the network attack detection model to perform network attack detection and obtain network detection results. The network attack detection model is trained based on normal network packet data from multiple time periods related to the current time period. The network detection results indicate whether the network packet data is normal network packet data or abnormal network packet data.

2. The method according to claim 1, characterized in that, The process involves extracting network attack detection features corresponding to various network attack types from the network packet data to obtain a network attack detection feature set, including: Extract data related to the attack method of the network attack type from the network packet data to obtain the network attack detection features corresponding to the network attack type. By combining network attack detection features corresponding to the same type of network attack, a network attack detection feature set corresponding to each type of network attack is obtained.

3. The method according to claim 1, characterized in that, The method includes: Retrieve normal network packet data for multiple preset time periods preceding the current time period; The network attack detection model is trained based on normal network packet data from multiple preset time periods preceding the current time period.

4. The method according to claim 1, characterized in that, After the steps of obtaining network packet data, the following are included: The network packet data that matches the network protection rules is filtered out from the network packet data. The network protection rules are constructed based on the network packet characteristics of abnormal network packet data.

5. The method according to claim 4, characterized in that, The method includes: In response to the network detection result indicating that the network packet data is abnormal network packet data, a network attack packet feature set is extracted from the network packet data, the network attack packet feature set including network packet features highly related to network attacks; The network protection rules are updated according to the network attack message signature set.

6. The method according to claim 5, characterized in that, The network attack packet feature set extracted from the network packet data includes: The network packet features of the network packet data are extracted using data dimensionality reduction and noise reduction algorithms and data association feature extraction algorithms. The network attack packet feature set is selected from the network packet features using correlation analysis or feature selection algorithms.

7. The method according to claim 1, characterized in that, Before the step of inputting the network packet data and the network attack detection feature set into the network attack detection model, the following steps are included: The network packet data is divided according to Internet Protocol address and time to obtain multiple network packet datasets, wherein the network packet datasets include network packet data with the same Internet Protocol address within the same time period; Based on the network attack detection feature set corresponding to the network packet data, a density-based clustering algorithm is used to perform clustering analysis on the network packet dataset to obtain the initial network detection results corresponding to the network packet data. In response to the initial network detection result indicating that the network packet data is abnormal, the network packet data is removed.

8. A network attack detection device, characterized in that, include: The data acquisition module is configured to acquire network packet data; The detection feature extraction module is configured to extract network attack detection features corresponding to various network attack types from the network packet data to obtain a network attack detection feature set. The network attack detection features are used to characterize the attack information and attack mode of the network attack. The network attack detection module is configured to input the network packet data and the network attack detection feature set into the network attack detection model to perform network attack detection and obtain network detection results. The network attack detection model is trained based on normal network packet data from multiple time periods related to the current time period. The network detection results indicate whether the network packet data is normal network packet data or abnormal network packet data.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. An electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

11. A computer program product having a computer program stored thereon, characterized in that, When the computer program product is executed by a processor, it implements the method of any one of claims 1 to 7.

Images