Intelligent detection method for network information security
By combining quantum hashing, generative adversarial networks, deep reinforcement learning, and cross-modal knowledge graphs, the inefficiency of identifying unknown threats and processing massive amounts of data in network information security detection is solved, achieving efficient and accurate network security detection.
Patent Information
- Application Number
- CN202511220837.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-28
- Publication Date
- 2025-12-12
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing network information security detection methods are inadequate to cope with unknown new types of attacks, traditional data processing technologies are inefficient when faced with massive network traffic, and intelligent detection methods are insufficient in terms of accuracy, timeliness, and comprehensiveness.
Quantum hashing technology is used for multi-source data preprocessing and fusion. Generative adversarial networks and capsule networks are combined for abnormal behavior detection. A dynamic risk assessment system based on deep reinforcement learning is established, and threat intelligence collaborative detection is driven by cross-modal knowledge graphs.
It enables efficient identification and rapid response to unknown threats, improves the accuracy and timeliness of detection, reduces false positives and false negatives, enhances the ability to identify complex anomalies and variant threats, and dynamically adjusts detection strategies to deal with new types of attacks.
Smart Images
Figure CN121125205A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network information security detection technology, and more specifically, to an intelligent method for network information security detection. Background Technology
[0002] In today's digital age, the internet has become an indispensable infrastructure for social operation, economic development, and personal life. However, the openness and complexity of cyberspace have also bred a constant stream of security threats, posing unprecedented challenges to information security protection. Network information security issues are becoming increasingly serious, and traditional network information security detection methods include rule-based detection and signature-based detection.
[0003] Current rule-based network security detection methods require the pre-definition of a large number of rules, making it difficult to cope with unknown new attacks. Signature-based detection methods often fail to accurately identify modified and encrypted malware. In addition, network traffic data is growing exponentially, with millions of data packets generated per second. Traditional data processing technologies are inadequate when faced with such massive amounts of data, making it difficult to complete feature extraction and analysis within a limited time, leading to the omission of critical security information. Most existing intelligent detection methods rely on a single data source or simple machine learning algorithms, which are insufficient in terms of accuracy, timeliness, and comprehensiveness. Therefore, developing an intelligent network security detection method is of great practical significance. Summary of the Invention
[0004] In order to overcome the above-mentioned defects of the prior art, the present invention provides an intelligent detection method for network information security to solve the problems mentioned in the background art.
[0005] To achieve the above objectives, the present invention provides the following technical solution: an intelligent detection method for network information security, specifically comprising the following steps:
[0006] Step 1: Preprocessing and fusion of multi-source data using quantum hash encoding. Quantum hash encoding technology is used to quickly compress and extract features from collected network traffic data, system log data, user behavior data, and device status data. Through the parallelism of quantum computing, the characteristics of data packets in network traffic, key event identifiers in system logs, operation sequence patterns of user behavior, and performance index parameters of device status are encoded into quantum hash values. A heterogeneous data fusion network is constructed. Using an attention mechanism, fusion weights are dynamically allocated according to the different data sources and types. The quantum hash values are fused into a high-dimensional feature vector to generate multi-source fused data.
[0007] Step 2: Abnormal Behavior Detection and Deep Modeling. A composite deep learning model consisting of a Generative Adversarial Network (GAN) and a Capsule Network (CN) is constructed. The generator in the GAN generates simulated normal behavior data based on a large amount of normal network behavior data. The discriminator is used to distinguish between real data and generated data. Through adversarial training, the generator can learn the complex distribution of normal behavior data. The generated normal data and the multi-source fusion data collected in reality are input into the Capsule Network. The Capsule Network models the entities and their spatial relationships in the data through a dynamic routing mechanism, identifies abnormal features in the data, and outputs the probability distribution and type prediction of abnormal behavior.
[0008] Step 3: Dynamic Risk Assessment and Strategy Optimization of Abnormal Behavior. Establish a dynamic risk assessment system based on deep reinforcement learning. Model the network security environment as a Markov decision process. Use the detected abnormal behavior information, risk assessment results, current protection strategies, and network state changes as the state space. Use the operations of adjusting the detection frequency, changing protection measures, and updating model parameters as the action space. Use the reward functions of reducing security risks, reducing false positives and false negatives, and improving detection efficiency. The agent learns the optimal strategy based on reward feedback by continuously interacting with the network security environment and dynamically adjusts the parameters of the risk assessment model and the detection and protection strategy.
[0009] Step 4: Cross-modal knowledge graph-driven collaborative threat intelligence detection. Construct a cross-modal knowledge graph, integrating structured, semi-structured, and unstructured data from different threat intelligence platforms, including binary features of malware, textual descriptions of attack events, and image evidence of hacker activities. Map these multimodal data into nodes and edges in the knowledge graph. When abnormal behavior is detected, perform multi-hop reasoning in the knowledge graph through graph neural networks to uncover potential correlations between abnormal behavior and threat intelligence, and dynamically update the knowledge graph.
[0010] Preferably, in step one, the dynamic allocation of fusion weights gives higher weights to network traffic data containing sensitive information transmissions during fusion, in order to highlight the importance of this part of the data for security detection.
[0011] Preferably, in step three, when dynamically adjusting the parameters of the risk assessment model and the detection and protection strategy, when a new attack pattern is detected, the agent can quickly adjust the detection strategy through reinforcement learning to improve its ability to detect such attacks.
[0012] Preferably, in step four, multi-hop reasoning is used to, when an abnormal traffic pattern is detected, use knowledge graph reasoning to associate it with related malware families, attack organizations, and historical attack cases. At the same time, the detected new threat information is added to the knowledge graph in the form of knowledge graph nodes and edges, so as to realize dynamic updating and collaborative detection of threat intelligence.
[0013] Preferably, the quantum hash encoding process in step one utilizes the superposition and entanglement of quantum states to complete data feature extraction and encoding within a time complexity of O(logn), thereby improving data processing efficiency. The heterogeneous data fusion network adopts a multi-head attention mechanism to fuse features of different types of data from multiple perspectives, thereby enhancing the expressive power of the fused features.
[0014] Preferably, the generator of the generative adversarial network in step two adopts a variational autoencoder structure to improve the quality and diversity of the generated data. In the capsule layer of the capsule network, each capsule node represents a specific behavior pattern. By dynamically updating the connection weights between capsules, the accurate identification of abnormal behavior patterns can be achieved.
[0015] Preferably, in step three, the deep reinforcement learning employs either a dual deep Q-network or a competitive deep Q-network to reduce the bias in value function estimation, improve the stability and convergence speed of policy learning, and break the temporal correlation between data through an experience replay mechanism, thereby improving sample utilization.
[0016] Preferably, the knowledge graph in step four adopts a heterogeneous graph structure, which supports the representation of different types of entities and relationships. The graph neural network in step four adopts a graph attention network, which focuses on key threat intelligence information related to abnormal behavior by calculating the attention weights between nodes, thereby improving the accuracy and efficiency of correlation analysis.
[0017] Preferably, in step four, the newly detected threat information is converted into nodes and edges of a knowledge graph to achieve dynamic updates of the graph.
[0018] Preferably, the attention mechanism in step one is used to achieve efficient information filtering and processing by dynamically allocating weights.
[0019] The technical effects and advantages of this invention are as follows:
[0020] 1. By leveraging the superposition and entanglement of quantum states, data feature extraction is completed in O(logn) time complexity, significantly shortening the data compression and feature extraction time compared to traditional hashing methods. It is suitable for real-time processing of high-concurrency network traffic. Through an attention mechanism, weights are dynamically allocated to give higher priority to sensitive information transmission traffic, focusing on key security data. At the same time, it integrates heterogeneous data such as network traffic, logs, and user behavior from multiple dimensions to generate high-dimensional feature vectors, avoiding the detection blind spots of single data types. It adopts a heterogeneous graph structure to integrate cross-modal data such as binary features of malicious software, attack text descriptions, and image evidence. Through graph attention networks, it focuses on key nodes, and multi-hop reasoning is used to mine potential associations, improving the efficiency of threat tracing. Newly detected threat information is transformed into knowledge graph nodes and edges in real time. Combined with the incremental learning capability of graph neural networks, it realizes the self-evolution of threat intelligence, greatly improving the correlation detection rate of unknown threats such as 0-day vulnerabilities.
[0021] 2. By using a variational autoencoder structure in the generator, normal behavior data that is closer to the real distribution is generated. The discriminator strengthens its ability to distinguish abnormal patterns through adversarial training, reducing false alarms caused by data distribution deviations. The capsule layer models the spatial relationship of entities through a dynamic routing mechanism. Each capsule node corresponds to a specific behavior pattern, which can accurately identify complex anomalies such as multi-stage attacks and variant threats. Compared with traditional CNN, it is more suitable for network security data with hierarchical structure.
[0022] 3. The network security environment is modeled as a Markov decision process. The agent optimizes the strategy through a dual deep Q network or a competitive deep Q network. Based on the reward function, such as reducing risk and false alarms, the detection frequency and protection measures are dynamically adjusted. The response speed to new attack patterns is faster, breaking the data time correlation and avoiding the overfitting problem in reinforcement learning. Even in small sample scenarios, the optimal protection strategy can be learned quickly, reducing the cost of manual parameter tuning. Attached Figure Description
[0023] Figure 1 This is a schematic diagram of the overall structure of the present invention. Detailed Implementation
[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0025] Example:
[0026] A network information security intelligent detection method specifically includes the following steps:
[0027] Step 1: Preprocessing and Fusion of Multi-Source Data Using Quantum Hash Encoding. Quantum hash encoding technology is employed to rapidly compress and extract features from collected network traffic data, system log data, user behavior data, and device status data. Leveraging the parallelism of quantum computing, packet features in network traffic, key event identifiers in system logs, operation sequence patterns in user behavior, and performance parameters of device status are encoded into quantum hash values. The quantum hash encoding process utilizes the superposition and entanglement of quantum states to complete data feature extraction and encoding within O(logn) time complexity, improving data processing efficiency. The heterogeneous data fusion network employs a multi-head attention mechanism to fuse features from different data types from multiple perspectives, enhancing the expressive power of the fused features. A heterogeneous data fusion network is constructed, and using the attention mechanism, fusion weights are dynamically allocated based on the data source and type, fusing quantum hash values into a high-dimensional feature vector to generate multi-source fused data.
[0028] In step one, the dynamic allocation of fusion weights assigns higher weights to network traffic data containing sensitive information transmissions during fusion, highlighting the importance of this part of the data for security detection. The attention mechanism in step one is used to achieve efficient information filtering and processing through dynamic weight allocation.
[0029] Step 2: Abnormal Behavior Detection and Deep Modeling. A composite deep learning model consisting of a Generative Adversarial Network (GAN) and a Capsule Network (CN) is constructed. The generator in the GAN generates simulated normal behavior data based on a large amount of normal network behavior data. The discriminator is used to distinguish between real data and generated data. Through adversarial training, the generator can learn the complex distribution of normal behavior data. The generated normal data and the multi-source fusion data collected in reality are input into the Capsule Network. The Capsule Network models the entities and their spatial relationships in the data through a dynamic routing mechanism, identifies abnormal features in the data, and outputs the probability distribution and type prediction of abnormal behavior.
[0030] In step two, the generator of the generative adversarial network adopts a variational autoencoder structure to improve the quality and diversity of the generated data. In the capsule layer of the capsule network, each capsule node represents a specific behavior pattern. By dynamically updating the connection weights between capsules, the accurate identification of abnormal behavior patterns can be achieved.
[0031] Step 3: Dynamic Risk Assessment and Strategy Optimization of Abnormal Behavior. Establish a dynamic risk assessment system based on deep reinforcement learning. Model the network security environment as a Markov decision process. Use the detected abnormal behavior information, risk assessment results, current protection strategies, and network state changes as the state space. Use the operations of adjusting the detection frequency, changing protection measures, and updating model parameters as the action space. Use the reward functions of reducing security risks, reducing false positives and false negatives, and improving detection efficiency. The agent learns the optimal strategy based on reward feedback by continuously interacting with the network security environment and dynamically adjusts the parameters of the risk assessment model and the detection and protection strategy.
[0032] In step three, deep reinforcement learning employs either a dual deep Q-network or a competitive deep Q-network to reduce the bias in value function estimation, improve the stability and convergence speed of policy learning, and break the temporal correlation between data through an experience replay mechanism to improve sample utilization. In step three, when dynamically adjusting the parameters of the risk assessment model and the detection and protection strategy, the agent can quickly adjust the detection strategy through reinforcement learning when a new attack pattern is detected, thereby improving the detection capability against this type of attack.
[0033] Step 4: Cross-modal knowledge graph-driven collaborative threat intelligence detection. A cross-modal knowledge graph is constructed, integrating structured, semi-structured, and unstructured data from different threat intelligence platforms, including binary features of malware, textual descriptions of attack events, and image evidence of hacker activities. This multimodal data is mapped to nodes and edges in the knowledge graph. When abnormal behavior is detected, multi-hop reasoning is performed in the knowledge graph using a graph neural network to uncover potential correlations between abnormal behavior and threat intelligence, and the knowledge graph is dynamically updated.
[0034] In step four, multi-hop reasoning is used to, when an abnormal traffic pattern is detected, use knowledge graph reasoning to associate it with related malware families, attack groups, and historical attack cases. At the same time, the detected new threat information is added to the knowledge graph in the form of knowledge graph nodes and edges, so as to realize dynamic updating and collaborative detection of threat intelligence.
[0035] In step four, the knowledge graph adopts a heterogeneous graph structure to support the representation of different types of entities and relationships. The graph neural network in step four adopts a graph attention network, which focuses on key threat intelligence information related to abnormal behavior by calculating the attention weights between nodes, thereby improving the accuracy and efficiency of correlation analysis. In step four, newly detected threat information is transformed into nodes and edges of the knowledge graph to realize the dynamic updating of the graph.
[0036] Finally, it should be noted that the accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other.
[0037] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for intelligent detection of network information security, characterized in that: Specifically, the following steps are included: Step 1: Preprocessing and fusion of multi-source data using quantum hash encoding. Quantum hash encoding technology is used to quickly compress and extract features from collected network traffic data, system log data, user behavior data, and device status data. Through the parallelism of quantum computing, the characteristics of data packets in network traffic, key event identifiers in system logs, operation sequence patterns of user behavior, and performance index parameters of device status are encoded into quantum hash values. A heterogeneous data fusion network is constructed. Using an attention mechanism, fusion weights are dynamically allocated according to the different data sources and types. The quantum hash values are fused into a high-dimensional feature vector to generate multi-source fused data. Step 2: Abnormal Behavior Detection and Deep Modeling. A composite deep learning model consisting of a Generative Adversarial Network (GAN) and a Capsule Network (CN) is constructed. The generator in the GAN generates simulated normal behavior data based on a large amount of normal network behavior data. The discriminator is used to distinguish between real data and generated data. Through adversarial training, the generator can learn the complex distribution of normal behavior data. The generated normal data and the multi-source fusion data collected in reality are input into the Capsule Network. The Capsule Network models the entities and their spatial relationships in the data through a dynamic routing mechanism, identifies abnormal features in the data, and outputs the probability distribution and type prediction of abnormal behavior. Step 3: Dynamic Risk Assessment and Strategy Optimization of Abnormal Behavior. Establish a dynamic risk assessment system based on deep reinforcement learning. Model the network security environment as a Markov decision process. Use the detected abnormal behavior information, risk assessment results, current protection strategies, and network state changes as the state space. Use the operations of adjusting the detection frequency, changing protection measures, and updating model parameters as the action space. Use the reward functions of reducing security risks, reducing false positives and false negatives, and improving detection efficiency. The agent learns the optimal strategy based on reward feedback by continuously interacting with the network security environment and dynamically adjusts the parameters of the risk assessment model and the detection and protection strategy. Step 4: Cross-modal knowledge graph-driven collaborative threat intelligence detection. Construct a cross-modal knowledge graph, integrating structured, semi-structured, and unstructured data from different threat intelligence platforms, including binary features of malware, textual descriptions of attack events, and image evidence of hacker activities. Map these multimodal data into nodes and edges in the knowledge graph. When abnormal behavior is detected, perform multi-hop reasoning in the knowledge graph through graph neural networks to uncover potential correlations between abnormal behavior and threat intelligence, and dynamically update the knowledge graph.
2. The intelligent detection method for network information security according to claim 1, characterized in that: In step one, the dynamic allocation of fusion weights assigns higher weights to network traffic data containing sensitive information transmissions during fusion, in order to highlight the importance of this part of the data for security detection.
3. The intelligent detection method for network information security according to claim 1, characterized in that: In step three, when dynamically adjusting the parameters of the risk assessment model and the detection and protection strategy, the agent can quickly adjust the detection strategy through reinforcement learning to improve its ability to detect such attacks when a new attack pattern is detected.
4. The intelligent detection method for network information security according to claim 1, characterized in that: In step four, multi-hop reasoning is used to, when an abnormal traffic pattern is detected, use knowledge graph reasoning to associate it with related malware families, attack groups, and historical attack cases. At the same time, the detected new threat information is added to the knowledge graph in the form of knowledge graph nodes and edges, so as to realize dynamic updating and collaborative detection of threat intelligence.
5. The intelligent detection method for network information security according to claim 1, characterized in that: In step one, the quantum hash encoding process utilizes the superposition and entanglement of quantum states to complete data feature extraction and encoding within a time complexity of O(logn), thereby improving data processing efficiency. The heterogeneous data fusion network adopts a multi-head attention mechanism to fuse features of different types of data from multiple perspectives, enhancing the expressive power of the fused features.
6. The intelligent detection method for network information security according to claim 1, characterized in that: In step two, the generator of the generative adversarial network adopts a variational autoencoder structure to improve the quality and diversity of the generated data. In the capsule layer of the capsule network, each capsule node represents a specific behavior pattern. By dynamically updating the connection weights between capsules, the accurate identification of abnormal behavior patterns can be achieved.
7. The intelligent detection method for network information security according to claim 1, characterized in that: In step three, deep reinforcement learning employs either a dual-deep Q-network or a competitive deep Q-network to reduce the bias in value function estimation, improve the stability and convergence speed of policy learning, and break the temporal correlation between data through an experience replay mechanism, thereby improving sample utilization.
8. The intelligent detection method for network information security according to claim 1, characterized in that: In step four, the knowledge graph adopts a heterogeneous graph structure, which supports the representation of different types of entities and relationships. In step four, the graph neural network adopts a graph attention network, which focuses on key threat intelligence information related to abnormal behavior by calculating the attention weights between nodes, thereby improving the accuracy and efficiency of correlation analysis.
9. The intelligent detection method for network information security according to claim 1, characterized in that: In step four, the newly detected threat information is transformed into nodes and edges of a knowledge graph, enabling dynamic updates to the graph.
10. The intelligent detection method for network information security according to claim 1, characterized in that: The attention mechanism in step one is used to achieve efficient information filtering and processing by dynamically allocating weights.