Network security protection method and system based on deep learning

Abstract

The invention belongs to the technical field of network security, and discloses a network security protection method and system based on deep learning. The method comprises the following steps: constructing a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model in a cloud data center based on a dynamic attack pedigree library; acquiring real-time multi-dimensional monitoring data, and performing attack detection on the real-time multi-dimensional monitoring data by using the multi-dimensional fusion network attack detection model to obtain a real-time attack detection result; the real-time threat entropy of the real-time multi-dimensional monitoring data is obtained, when the real-time threat entropy exceeds a threat entropy threshold value, a strategy adjustment process is triggered, and the next step is executed; and according to a real-time attack detection result, performing strategy adjustment by using the network security protection strategy adjustment model to obtain a real-time network security protection strategy. According to the method, the problems that in the prior art, attack detection has hysteresis and limitation, the detection accuracy is low, and strategy adjustment is rigid are solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network security protection method and system based on deep learning. BACKGROUND

[0002] With the rapid development of cloud computing, big data and Internet of Things technology, cloud data centers carry more and more critical business and data, and their security faces unprecedented challenges. Network attack means is increasingly complex and changeable, how to accurately and efficiently detect and identify network attacks, and collect corresponding network security protection measures, has become an important research direction in the field.

[0003] The prior art has many defects, including: 1) Attack detection has hysteresis and limitations: the prior art relies on pre-defined attack signatures or static rule-based detection, which makes them completely ineffective against zero-day attacks, unknown variants or threats using new attack vectors, because attack patterns cannot be identified before the feature library is updated, and attackers take evolving strategies, and the detection model update of the prior art is often lagging behind, and cannot quickly adapt to such dynamic changes; 2) Low detection accuracy: modern network environment generates massive multi-dimensional data (such as traffic, logs, device status, user behavior, etc.), and traditional methods are difficult to effectively fuse these heterogeneous data, and are prone to ignore subtle attack signs hidden in complex interactions, resulting in low data utilization, and simple feature selection or splicing often loses information, resulting in decreased detection accuracy; 3) Strategy adjustment is rigid: the prior art only triggers a response after detecting an attack, which results in response delay, and the attack may have caused damage, and lacks predictive strategy adjustment capability based on real-time threat assessment; and the prior art often adopts a "one-size-fits-all" or overly conservative approach when adjusting strategies (such as firewall rules, access control lists), either failing to accurately block specific threats or causing a large number of false intercepts, affecting normal business, and it is difficult to achieve fine-grained, dynamic adjustment specific to attack scenarios. SUMMARY

[0004] In order to solve the problems of attack detection hysteresis and limitations, low detection accuracy and strategy adjustment rigidity in the prior art, the application aims to provide a network security protection method and system based on deep learning.

[0005] The technical solution adopted by the application is: A network security protection method based on deep learning, comprising the following steps: Based on the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model are constructed in the cloud data center using deep learning algorithms and reinforcement learning algorithms. Real-time multi-dimensional monitoring data of external devices transmitted to the cloud data center are collected, and the multi-dimensional fusion network attack detection model is used to detect attacks on the real-time multi-dimensional monitoring data to obtain real-time attack detection results. The real-time threat entropy of the real-time multi-dimensional monitoring data is obtained, and if the real-time threat entropy exceeds the threat entropy threshold, the strategy adjustment process is triggered and the next step is entered, otherwise, the real-time multi-dimensional monitoring data of the next time is collected. According to the real-time attack detection result, the network security protection strategy adjustment model is used to adjust the preset network security protection strategy of the cloud data center to obtain the real-time network security protection strategy.

[0006] Further, based on the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model are constructed in the cloud data center using deep learning algorithms and reinforcement learning algorithms, including the following steps: A dynamic attack pedigree library including a plurality of dynamic attack samples is constructed in the cloud data center using a dynamic attack tree and an adversarial training algorithm. According to the plurality of dynamic attack samples of the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model is constructed in the cloud data center using a deep learning algorithm, and a plurality of historical attack detection results are obtained. According to the plurality of historical attack detection results, a network security protection strategy adjustment model is constructed in the cloud data center using a reinforcement learning algorithm.

[0007] Further, a dynamic attack pedigree library including a plurality of dynamic attack samples is constructed in the cloud data center using a dynamic attack tree and an adversarial training algorithm, including the following steps: The GNN-AttackTree algorithm is used to set the dynamic attack tree structure of the dynamic attack pedigree library, and a plurality of historical attack data including historical multi-dimensional monitoring data of different historical network attack types are collected. The FGSM algorithm is used to perform adversarial training on the plurality of historical attack data, and a plurality of generated attack data including different generated network attack types and generated multi-dimensional monitoring data are obtained. The plurality of historical attack data and the plurality of generated attack data are used as dynamic attack samples, and are stored in the dynamic attack pedigree library according to the dynamic attack tree structure.

[0008] Further, according to the plurality of dynamic attack samples of the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model is constructed in the cloud data center using a deep learning algorithm, and a plurality of historical attack detection results are obtained, including the following steps: A multi-dimensional fusion feature space is constructed, and an initial multi-dimensional fusion network attack detection model is constructed in a cloud data center using a deep learning algorithm according to the multi-dimensional fusion feature space; An adjusted multi-dimensional fusion network attack detection model is obtained by adjusting the initial multi-dimensional fusion network attack detection model using an optimization algorithm and an adaptive federated learning mechanism. The final multi-dimensional fusion network attack detection model is obtained by training the adjusted multi-dimensional fusion network attack detection model with dynamic attack samples from the dynamic attack spectrum library.

[0009] Further, the initial multi-dimensional fusion network attack detection model is adjusted using an optimization algorithm and an adaptive federated learning mechanism to obtain an adjusted multi-dimensional fusion network attack detection model, including the following steps: The initial model parameters of the initial multi-dimensional fusion network attack detection model are optimized using an optimization algorithm to obtain an optimized multi-dimensional fusion network attack detection model. A coordination server is deployed in the cloud data center, the coordination server is connected to the federated learning servers of several domains, and the optimized multi-dimensional fusion network attack detection model is deployed to each federated learning server. In each federated learning server, the corresponding optimized multi-dimensional fusion network attack detection model is trained according to the collected training attack data to obtain a trained multi-dimensional fusion network attack detection model. The trained multi-dimensional fusion network attack detection model is compressed / distilled to obtain a lightweight multi-dimensional fusion network attack detection model, the corresponding model parameters are extracted, and sent to the coordination server. In the coordination server, the model parameters uploaded by all federated learning servers are integrated to obtain comprehensive model parameters. The initial multi-dimensional fusion network attack detection model of the cloud data center is compressed / distilled and enhanced with differential privacy, and the initial multi-dimensional fusion network attack detection model is adjusted according to the comprehensive model parameters to obtain an adjusted multi-dimensional fusion network attack detection model.

[0010] Further, the multi-dimensional fusion feature space includes a protocol feature extraction layer, a relationship feature extraction layer, a time sequence feature extraction layer, a causal feature extraction layer, and a multi-dimensional feature fusion analysis layer. The multi-dimensional fusion network attack detection model comprises a protocol feature extraction module constructed based on a BERT-ProtoPNet algorithm, a relation feature extraction module constructed based on a GraphSAGE++ algorithm, a time sequence feature extraction module constructed based on an LSTM-Transformer algorithm, a causal feature extraction module constructed based on a GNN-based causal algorithm, and a multi-dimensional feature fusion analysis module constructed based on an Attention-MLP algorithm.

[0011] Further, according to a plurality of historical attack detection results, a network security protection strategy adjustment model is constructed in the cloud data center using a reinforcement learning algorithm, comprising the following steps: An initial network security protection strategy adjustment model is constructed in the cloud data center using a reinforcement learning algorithm, and a plurality of intelligent agents in cascade are constructed according to security components participating in network security protection of the cloud data center; A plurality of objective function sets are set for the initial network security protection strategy adjustment model according to different network security protection targets, and an experience replay pool is set according to an experience replay mechanism; A preset network security protection strategy is divided into preset network security protection decisions of a plurality of intelligent agents, and the preset network security protection decisions are abstracted into decision differential equations; According to equation parameters of the decision differential equations, a reward function and an action space of the intelligent agents are defined, and a state space of the corresponding intelligent agents is defined according to historical attack detection results and an output of a previous intelligent agent; The initial network security protection strategy adjustment model is trained using a plurality of historical attack detection results to obtain a final network security protection strategy adjustment model.

[0012] Further, the network security protection strategy adjustment model is constructed based on a MACGRPO algorithm, and the network security protection strategy adjustment model comprises a plurality of objective function sets, an experience replay pool and a plurality of intelligent agents in cascade, and each intelligent agent is provided with a corresponding strategy network and a reward function.

[0013] Further, the real-time threat entropy comprises real-time network flow entropy, device state entropy and attack path entropy.

[0014] A network security protection system based on deep learning is used to implement a network security protection method, and the system comprises a model construction unit, an attack detection unit, a trigger judgment unit and a strategy adjustment unit connected in sequence.

[0015] The network security protection system based on deep learning has the following beneficial effects: This invention provides a network security protection method and system based on deep learning. By combining a dynamic attack genealogy library with deep learning for multi-dimensional data fusion analysis, it can more quickly identify variants of known attacks and some unknown attacks, reducing reliance on static feature libraries and overcoming the shortcomings of traditional methods in detecting new attacks. The multi-dimensional fusion network attack detection model can comprehensively analyze information such as traffic, device status, and behavior. Compared with single-dimensional or simple splicing methods, it can better capture the subtle features of complex attacks, reduce false positives and false negatives, and improve detection accuracy. A network security protection strategy adjustment model constructed using reinforcement learning algorithms is also included. This system can proactively and in real-time adjust protection strategies based on changes in real-time threat entropy (a comprehensive threat assessment indicator), rather than passively responding only after an attack is detected. This significantly shortens response time and improves protection efficiency. The calculation of real-time threat entropy integrates network traffic entropy, device state entropy, and attack path entropy, achieving effective fusion and correlation analysis of multi-dimensional information. It can assess the complexity and potential risks of current threats from a more macro and systematic perspective, rather than simply viewing a single attack event in isolation. This allows for a better understanding of the attack's progress and potential targets, indirectly helping to determine the attacker's intent and threat level, and providing a basis for more precise strategy adjustments.

[0016] Other beneficial effects of the present invention will be further explained in the specific embodiments. Attached Figure Description

[0017] Figure 1 This is a flowchart of the network security protection method based on deep learning in this invention.

[0018] Figure 2 This is a structural block diagram of the deep learning-based network security protection system in this invention. Detailed Implementation

[0019] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0020] Example 1: like Figure 1 As shown, this embodiment provides a network security protection method based on deep learning, including the following steps: S1: Based on a dynamic attack genealogy library, using deep learning and reinforcement learning algorithms, construct a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model in a cloud data center, including the following steps: S1-1: Using dynamic attack trees and adversarial training algorithms, construct a dynamic attack genealogy library containing several dynamic attack samples in a cloud data center, including the following steps: S1-1-1: using a graph neural network (GNN) - attack tree algorithm, setting a dynamic attack tree structure of a dynamic attack spectrum library, and collecting a plurality of historical attack data including historical multi-dimensional monitoring data of different types of historical network attacks; Upgrading the traditional static attack tree to a dynamically expandable graph neural network architecture, supporting real-time deduction of attack paths (such as path discovery from horizontal movement to privilege escalation); S1-1-2: using fast gradient sign method (FGSM) to perform adversarial training on a plurality of historical attack data spectrum, obtaining a plurality of generated attack data including different generated network attack types and generated multi-dimensional monitoring data, and improving the robustness of the dynamic attack spectrum library; S1-1-3: using a plurality of historical attack data and a plurality of generated attack data as dynamic attack samples, and storing them in the dynamic attack spectrum library according to the dynamic attack tree structure, the dynamic attack spectrum library can be updated continuously to reflect the latest attack trend; S1-2: according to a plurality of dynamic attack samples of the dynamic attack spectrum library, using a deep learning algorithm to construct a multi-dimensional fusion network attack detection model in a cloud data center, and obtaining a plurality of corresponding historical attack detection results, including the following steps: S1-2-1: constructing a multi-dimensional fusion feature space, and using a deep learning algorithm to construct an initial multi-dimensional fusion network attack detection model in a cloud data center according to the multi-dimensional fusion feature space; The multi-dimensional fusion feature space includes a protocol feature extraction layer, a relationship feature extraction layer, a time sequence feature extraction layer, a causal feature extraction layer, and a multi-dimensional feature fusion analysis layer; The multi-dimensional fusion network attack detection model comprises a protocol feature extraction module constructed based on a Bidirectional Encoder Representations from Transformers (BERT)-ProtoP Networks for Deep Learning (ProtoPNet) algorithm, a relationship feature extraction module constructed based on an Improved Graph Sample and Aggregate (GraphSAGE++) algorithm, a time sequence feature extraction module constructed based on a Long Short-Term Memory (LSTM)-Transformer algorithm, a causal feature extraction module constructed based on a Graph Neural Network-based causal (GNN-based causal) algorithm, and a multi-dimensional feature fusion analysis module constructed based on an Attention-Multilayer Perceptron (MLP) algorithm. The multi-dimensional fusion network attack detection model fuses protocol, relationship, traffic, causality and other multi-dimensional features, and adopts advanced deep learning algorithms (BERT-Proto, GraphSAGE++, LSTM-Transformer, GNN-based causal, Attention-MLP) to construct the multi-dimensional fusion network attack detection model, so that network behaviors can be more comprehensively and deeply understood, and the accuracy and recall rate of attack detection can be improved. S1-2-2: An initial multi-dimensional fusion network attack detection model is adjusted using an optimization algorithm and a self-adaptive federated learning mechanism to obtain an adjusted multi-dimensional fusion network attack detection model, comprising the following steps: S1-2-2-1: The initial model parameters of the initial multi-dimensional fusion network attack detection model are optimized using an optimization algorithm to obtain an optimized multi-dimensional fusion network attack detection model, comprising the following steps: S1-2-2-1-1: The initial model parameters of the initial multi-dimensional fusion network attack detection model are encoded into individual vectors of ISGA individuals of an Improved Snow Geese Algorithm (ISGA) algorithm; S1-2-2-1-2: The minimum error value is taken as an optimization target, and a fitness function of the ISGA algorithm is set; The formula is:

[0021] In the formula, is a fitness function; is an ISGA individual; is an error function; S1-2-2-1-3: using a Circle chaotic mapping sequence, initial solution generation is performed to obtain an initial ISGA population including a plurality of initial solutions; the initial solutions correspond to initial initial model parameters; The formula is:

[0022] In the formula, is an initial ISGA individual generated by a Circle chaotic mapping sequence, i.e., an initial solution; is a randomly generated ISGA individual; i is an ISGA individual indicator; compared with a randomly distributed population, the initial position distribution of the improved ISGA population is more uniform, the search range of the ISGA population in space is expanded, the diversity of the population position is increased, the defect that the algorithm is easily trapped in a local extremum is improved to some extent, and thus the optimization efficiency of the algorithm is improved; S1-2-2-1-4: using a fitness function, an initial fitness value of each initial ISGA individual in the initial ISGA population is obtained, and the initial ISGA individual with the lowest fitness value is taken as a leader goose; S1-2-2-1-5: entering an exploration stage, a leader goose rotation mechanism, a calling guidance mechanism and a dynamic reverse mechanism are introduced, the initial ISGA population is iteratively updated to obtain an updated ISGA population, and the optimal individual is retained; The leader goose rotation mechanism, in each iteration, a new leader goose is selected according to the fitness values of the ISGA individuals, and this mechanism can avoid that the leader goose is prematurely trapped in a local optimum and enhance the global search ability of the algorithm; The formula is:

[0023] In the formula, is an updated leader goose; is an initial ISGA individual with a fitness value in the initial ISGA population; is an initial ISGA individual with a fitness value in the initial ISGA population; is an initial ISGA individual with a fitness value in the initial ISGA population; is an initial ISGA individual with a fitness value in the initial ISGA population; is a current iteration number; is an optimal individual; is a first weight factor; is a random number; is the initial leader goose; The calling guiding mechanism uses the sound wave propagation attenuation model to adjust the individual position update according to the distance between the ISGA individual and the leader goose. The position update of the ISGA individual with a shorter distance is greatly affected by the leader goose, which can quickly approach the optimal solution. The position update of the ISGA individual with a longer distance is less affected by the leader goose, which can maintain a certain exploration ability. This mechanism can avoid over-concentration or dispersion of the group and improve the local search precision of the algorithm. The formula is:

[0024] In the formula, is the initial ISGA individual; is the initial ISGA individual is the initial ISGA individual is the initial ISGA individual is the received sound intensity; is the initial ISGA individual is the initial ISGA individual is the corresponding sound intensity parameter; is the initial sound intensity; is the minimum receivable sound intensity; is the convergence factor; is the initial ISGA individual is a random parameter; is a Brownian motion function; is a Brownian motion parameter; is an XOR processing symbol;

[0025] In the formula, is the convergence factor; tanh(.) is the hyperbolic tangent function; is the current iteration number; is the maximum iteration number; a max , a min are the maximum and minimum values of the convergence factor, respectively; λ is a decreasing rate parameter, is a decreasing period parameter, λ = -2 π , = π ; The dynamic reverse mechanism reverses the initial ISGA individual dynamically to improve the diversity of exploration direction and avoid falling into local optimum. The formula is:

[0026] wherein, is a once-updated reverse ISGA individual; γ is a decreasing inertia coefficient; L max 、 L min are respectively the maximum and minimum values of the vector space; S1-2-2-1-6: The leading goose, a number of once-updated ISGA individuals and a number of once-updated reverse ISGA individuals are integrated to obtain a once-updated ISGA population, and the ISGA individual with the lowest fitness value is reserved as the optimal individual; S1-2-2-1-7: Enter the development stage, introduce the abnormal boundary strategy and the Gaussian variation mechanism, and perform secondary update on the once-updated ISGA population to obtain a secondary-updated ISGA population, and reserve the optimal individual; The abnormal boundary strategy calculates the difference between the fitness value of each once-updated ISGA individual and the average fitness value of the population. For the ISGA individual whose fitness value is much higher than the average value of the population, the position updating method will be adjusted, such as using the Gaussian variation mechanism, a larger step or a smaller step. This mechanism can help the individual avoid falling into local optimum, improve the convergence speed and accuracy of the algorithm; The formula is:

[0027] wherein, is a secondary-updated ISGA individual; is a once-updated ISGA individual; is a fitness function; is the average fitness value of the population; is the ISGA individual with the highest fitness value; is the second and third weight factors; is the Gaussian variation mechanism parameter; S1-2-2-1-8: If the number of iterations is greater than or equal to the iteration threshold value or the fitness value of the optimal individual is less than the fitness threshold value, the optimal individual is output as the optimal solution, and the individual vector of the optimal solution is analyzed to obtain the optimal initial model parameter; S1-2-2-1-9: According to the optimal initial model parameter, the initial multi-dimensional fusion network attack detection model is optimized to obtain an optimized multi-dimensional fusion network attack detection model S1-2-2-2: Deploy a coordination server in the cloud data center, connect the coordination server to a number of domain federated learning servers, and deploy the optimized multi-dimensional fusion network attack detection model to each federated learning server; S1-2-2-3: At each federal learning server, train the corresponding optimized multi-dimensional fusion network attack detection model according to the collected several training attack data, and obtain the trained multi-dimensional fusion network attack detection model; S1-2-2-4: Model compression / distillation is performed on the trained multi-dimensional fusion network attack detection model to obtain a lightweight multi-dimensional fusion network attack detection model, and the corresponding model parameters are extracted and sent to the coordination server; S1-2-2-5: In the coordination server, integrate all the model parameters uploaded by the federal learning servers to obtain comprehensive model parameters; The introduction of adaptive federal learning mechanism can protect data privacy and utilize data distributed in different domains for model collaborative optimization, improve the overall performance of the model, and adapt to the data characteristics in different environments; S1-2-2-6: Model compression / distillation and differential privacy enhancement are performed on the initial multi-dimensional fusion network attack detection model of the cloud data center, and the initial multi-dimensional fusion network attack detection model is adjusted according to the comprehensive model parameters to obtain an adjusted multi-dimensional fusion network attack detection model; S1-2-3: Input several dynamic attack samples of the dynamic attack spectrum library into the adjusted multi-dimensional fusion network attack detection model for training to obtain a final multi-dimensional fusion network attack detection model; S1-3: According to several historical attack detection results, use reinforcement learning algorithm to construct network security protection strategy adjustment model in cloud data center, including the following steps: S1-3-1: Use reinforcement learning algorithm to construct initial network security protection strategy adjustment model in cloud data center, and construct several intelligent agents in cascade according to security components participating in network security protection of cloud data center; S1-3-2: Set a multi-objective function set for the initial network security protection strategy adjustment model according to different network security protection targets, and set an experience replay pool according to experience replay mechanism; S1-3-3: Divide the preset network security protection strategy into preset network security protection decisions of several intelligent agents, and abstract the preset network security protection decisions into decision differential equations; The formula is:

[0028] In the formula, is the decision strength is the partial derivative of time ; is the partial differential symbol; is the decision strength; is the time variable; is the time detection rate of the attack; is time attack intensity; is an equation parameter; S1-3-4: defining the equation parameter of the decision differential equation , defining the reward function and action space of the agent, and defining the state space of the corresponding agent according to the historical attack detection result and the output of the previous agent; by changing the equation parameter , and then realizing different network security protection decisions; S1-3-5: using a plurality of historical attack detection results to train the initial network security protection strategy adjustment model to obtain a final network security protection strategy adjustment model; The network security protection strategy adjustment model is constructed based on a Multi Agent Cascade Group Relative Policy Optimization (MACGRPO) algorithm, and the network security protection strategy adjustment model includes a multi-objective function set, an experience replay pool, and a plurality of cascaded agents. Each agent is provided with a corresponding policy network and a reward function; S2: collecting real-time multi-dimensional monitoring data of external devices transmitted to the cloud data center, using a multi-dimensional fusion network attack detection model to detect attacks on real-time multi-dimensional monitoring data, and obtaining real-time attack detection results, including the following steps: S2-1: collecting real-time multi-dimensional monitoring data of external devices transmitted to the cloud data center, and preprocessing to obtain preprocessed real-time multi-dimensional monitoring data, and inputting the preprocessed real-time multi-dimensional monitoring data into the multi-dimensional fusion network attack detection model; The real-time multi-dimensional monitoring data includes real-time network traffic data, real-time device log data, and real-time user behavior data; S2-2: using a protocol feature extraction module to convert the preprocessed real-time network traffic data in the preprocessed real-time multi-dimensional monitoring data into real-time protocol text, i.e. extracting protocol headers (transaction ID, protocol ID), function codes, register addresses, etc. Structured fields are obtained, and real-time protocol semantic features of real-time protocol text are extracted; S2-3: using a relationship feature extraction module, according to the preprocessed real-time network traffic data, the preprocessed real-time device log data, and the preprocessed real-time user behavior data in the preprocessed real-time multi-dimensional monitoring data, a real-time device-user-flow dynamic relationship graph is generated, and real-time dynamic relationship features of the real-time device-user-flow dynamic relationship graph are extracted; S2-4: using the time sequence feature extraction module, extracting real-time traffic time sequence features of the pre-processed real-time network traffic data, real-time device time sequence features of the pre-processed real-time device log data, and real-time behavior time sequence features of the pre-processed real-time user behavior data in the pre-processed real-time multi-dimensional monitoring data; S2-5: using the causal feature extraction module, generating real-time causal chains according to the real-time protocol semantic features, the real-time dynamic relationship features, the real-time traffic time sequence features, the real-time device time sequence features, and the real-time behavior time sequence features, and extracting real-time causal features of real-time causal paths in the real-time causal chains; The formula is:

[0029] In the formula, is the real-time causal chain; is a causal discovery algorithm function; is the real-time protocol semantic feature, the real-time dynamic relationship feature, the real-time traffic time sequence feature, the real-time device time sequence feature, and the real-time behavior time sequence feature; is a time variable;

[0030] In the formula, is the real-time causal feature; is a causal model function, which is a graph neural network or other model capable of processing graph structure input; S2-6: according to the dynamic attention weight value, using the multi-dimensional feature fusion analysis module, weighting and fusing the real-time protocol semantic features, the real-time dynamic relationship features, the real-time traffic time sequence features, the real-time device time sequence features, the real-time behavior time sequence features, and the real-time causal features to obtain real-time multi-dimensional fusion features, and performing attack detection according to the real-time multi-dimensional fusion features to obtain real-time attack detection results; S3: obtaining the real-time threat entropy of the real-time multi-dimensional monitoring data, if the real-time threat entropy exceeds the threat entropy threshold, triggering the strategy adjustment process and entering the next step, otherwise, collecting the real-time multi-dimensional monitoring data at the next time; The real-time threat entropy includes real-time network flow entropy, device state entropy and attack path entropy; the real-time network flow entropy, the device state entropy and the attack path entropy are obtained according to real-time protocol semantic features, real-time dynamic relationship features, real-time flow time sequence features, real-time device time sequence features, real-time behavior time sequence features and real-time causal features, wherein the real-time network flow entropy: comprehensively evaluates the abnormality degree of the current network flow, combines the real-time protocol semantic features, the real-time dynamic relationship features, the real-time flow time sequence features and other aspects of information, the device state entropy: comprehensively evaluates the abnormality degree of the current state of each device in the network, is mainly based on the real-time device time sequence features and the real-time behavior time sequence features, and the attack path entropy: evaluates the complexity of the potential attack path currently detected and the harm possibly caused, and utilizes the real-time dynamic relationship features, the real-time behavior time sequence features and the real-time causal features to understand the attack steps and potential influence; The real-time threat entropy is a comprehensive index, which is composed of the real-time network flow entropy (measuring the abnormality degree of flow), the device state entropy (measuring the abnormality degree of device state) and the attack path entropy (measuring the complexity of attack path and potential harmfulness), if exceeding the threshold value, it indicates that the threat currently faced is larger, and more active protection measures need to be taken; High entropy may mean encrypted traffic or abnormal, unpredictable communication by analyzing the randomness of flow patterns (such as packet length distribution, arrival time interval, protocol type distribution, etc.), The formula is:

[0031] In the formula, is the real-time threat entropy; is the real-time network flow entropy, the device state entropy and the attack path entropy; is the first weight coefficient, the second weight coefficient and the third weight coefficient, and is 1; S4: according to the real-time attack detection result, using the network security protection strategy adjustment model, adjusting the preset network security protection strategy of the cloud data center to obtain a real-time network security protection strategy; The security components of the cloud data center participating in network security protection include a firewall, a network upgrade tool, a data isolation tool, a cloud container and a resource scheduling tool, and the network security protection strategy adjustment model includes cascaded first, second, third, fourth and fifth intelligent agents; Each intelligent agent is provided with a corresponding policy network, a state space, an action space and a reward function; According to the real-time attack detection result, using the network security protection strategy adjustment model, adjusting the preset network security protection strategy of the cloud data center to obtain a real-time network security protection strategy, including the following steps: S4-1: According to the real-time attack detection result, update the first state space of the network security protection policy adjustment model to obtain an updated first state space, and based on the updated first state space and the corresponding first reward function, use the first agent to control the first policy network to select in the first action space to generate a first real-time network security protection decision; The content of the first real-time network security protection decision corresponding to the firewall includes: 1) Access control list rule operation: Add a new blocking rule: for example, "Block source IP X.X.X.X from accessing target port Y"; Add a new allow rule: for example, "Temporarily allow IP from a specific security vendor to access the management port"; Modify existing rules: for example, "Increase the priority of a certain rule"; Delete rules that are no longer needed; 2) Traffic filtering / rate limiting: Enable / disable specific types of traffic filtering; Rate limit traffic to specific IPs or ports; 3) Port / service operation: Open / close specific ports on the firewall; 4) Log level adjustment: Increase or decrease the firewall log level related to the current threat; S4-2: According to the real-time attack detection result and the first real-time network security protection decision, update the second state space of the network security protection policy adjustment model to obtain an updated second state space, and based on the updated second state space and the corresponding second reward function, use the second agent to control the second policy network to select in the second action space to generate a second real-time network security protection decision; The content of the second real-time network security protection decision corresponding to the network upgrade tool includes: 1) Security patch / update operation: Trigger security patch deployment for specific network devices (such as routers, switches) or network services; Select specific patches or update packages to apply; Schedule a time window for patch deployment (if the system supports it); 2) Network configuration changes: Change network configuration to isolate suspicious areas; Update routing policies to circumvent infected paths; Configure network segmentation or micro-segmentation rules; 3) Protocol / service disabling: Disable protocols known to be insecure or outdated on the network; S4-3: According to the real-time attack detection result, the first real-time network security protection decision and the second real-time network security protection decision, update the third state space of the network security protection policy adjustment model to obtain an updated third state space, and based on the updated third state space and the corresponding third reward function, use the third agent to control the third policy network to select in the third action space to generate a third real-time network security protection decision; The content of the third real-time network security protection decision corresponding to the data isolation tool includes: 1) Data isolation / encryption operation: Trigger isolation operation on specific data sets, databases or file systems; Enable / disable real-time encryption of specific data; Migrate data to a storage area with higher security level; Implement data loss prevention policies to prevent sensitive data from being exported; 2) Access permission adjustment: Temporarily revoke access permissions to sensitive data for suspicious users or services; Strengthen the access control policy of specific data storage; S4-4: According to the real-time attack detection result, the first real-time network security protection decision, the second real-time network security protection decision and the third real-time network security protection decision, update the fourth state space of the network security protection policy adjustment model to obtain an updated fourth state space, and based on the updated fourth state space and the corresponding fourth reward function, use the fourth agent to control the fourth policy network to select in the fourth action space to generate a fourth real-time network security protection decision; The content of the fourth real-time network security protection decision corresponding to the cloud container includes: 1) Container operation: Terminate / restart suspicious container instances;

[0032] Suspend the network interface of the container; Isolate infected containers to prevent them from communicating with the network; Update the security context or label of the container; 2) Image operation: Label or isolate container images containing known vulnerabilities.

[0033] Force the use of container images that have been scanned and signed for security.

[0034] 3) Adjustment of orchestration policy: Modify security policy rules; Adjust the security configuration of the container runtime; S4-5: According to the real-time attack detection result, the first real-time network security protection decision, the second real-time network security protection decision, the third real-time network security protection decision and the fourth real-time network security protection decision, update the fifth state space of the network security protection strategy adjustment model to obtain an updated fifth state space, and based on the updated fifth state space and the corresponding fifth reward function, use the fifth intelligent agent to control the fifth policy network to select in the fifth action space to generate a fifth real-time network security protection decision; The content of the fifth real-time network security protection decision corresponding to the resource scheduling tool includes: 1) Resource allocation / isolation operation: Migrate the attacked or infected workload to an isolated virtual private cloud or a secure area; Temporarily isolate the affected virtual machine or server instance; Adjust the policy of the auto-scaling group, for example, reduce the number of risk instances exposed to the public network, or increase the number of internal processing instances; 2) Load balancing adjustment: Remove the infected node from the load balancer pool; Modify the health check policy to more strictly detect infected servers.

[0035] 3) Computing resource limitation: Implement CPU, memory or network bandwidth limitation on suspicious processes or user sessions; S4-6: Integrate the first real-time network security protection decision, the second real-time network security protection decision, the third real-time network security protection decision, the fourth real-time network security protection decision and the fifth real-time network security protection decision to adjust the preset network security protection strategy of the cloud data center to obtain a real-time network security protection strategy.

[0036] Embodiment 2: As shown in Figure 2 The embodiment provides a network security protection system based on deep learning, which is used to implement a network security protection method. The system includes a model construction unit, an attack detection unit, a trigger judgment unit and a strategy adjustment unit connected in sequence. The model construction unit is used to construct a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model in a cloud data center based on a dynamic attack pedigree library using a deep learning algorithm and a reinforcement learning algorithm. The attack detection unit is used to collect real-time multi-dimensional monitoring data of external devices transmitted to the cloud data center, use the multi-dimensional fusion network attack detection model to detect attacks on the real-time multi-dimensional monitoring data, and obtain a real-time attack detection result. The trigger judgment unit is used for obtaining real-time threat entropy of real-time multi-dimensional monitoring data, and triggering a strategy adjustment process when the real-time threat entropy exceeds a threat entropy threshold. The strategy adjustment unit is used for adjusting a preset network security protection strategy of the cloud data center according to a real-time attack detection result, using a network security protection strategy adjustment model, to obtain a real-time network security protection strategy.

[0037] The network security protection method and system based on deep learning provided by the application can more quickly identify known attack variants and part unknown attacks by using dynamic attack spectrum library and deep learning for multi-dimensional data fusion analysis, and reduce the dependence on static feature library, thereby overcoming the defect of lag in detecting new attacks in the traditional method. The multi-dimensional fusion network attack detection model can comprehensively analyze information such as traffic, device state and behavior, and can capture subtle features of complex attacks, reduce false positives and omissions, and improve the accuracy of detection, compared with single dimension or simple splicing method. The network security protection strategy adjustment model constructed by introducing the reinforcement learning algorithm can actively and real-timely adjust the protection strategy according to the change of real-time threat entropy (a comprehensive threat evaluation index), instead of passively responding only after detecting the attack, thereby greatly shortening the response time and improving the protection efficiency. The calculation of real-time threat entropy integrates network flow entropy, device state entropy and attack path entropy, realizes effective fusion and correlation analysis of multi-dimensional information, can evaluate the complexity and potential risk of current threats from a more macro and systematic perspective, and indirectly helps to understand the progress and possible target of the attack, and indirectly helps to judge the intention and threat level of the attacker, thereby providing a basis for more accurate strategy adjustment.

[0038] The application is not limited to the above-mentioned optional embodiments, and anyone can derive other various forms of products under the inspiration of the application. The above-mentioned specific embodiments should not be understood as limiting the protection scope of the application, and the protection scope of the application should be defined by the claims, and the specification can be used to explain the claims.

Claims

1. A network security protection method based on deep learning, characterized in that: The method comprises the following steps: Based on the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model are constructed in the cloud data center using deep learning algorithms and reinforcement learning algorithms; Real-time multi-dimensional monitoring data of external devices transmitted to the cloud data center are collected, and the multi-dimensional fusion network attack detection model is used to detect attacks on the real-time multi-dimensional monitoring data to obtain real-time attack detection results; The real-time threat entropy of the real-time multi-dimensional monitoring data is obtained, and if the real-time threat entropy exceeds the threat entropy threshold, the strategy adjustment process is triggered and the next step is entered, otherwise the real-time multi-dimensional monitoring data of the next moment is collected; According to the real-time attack detection results, the network security protection strategy adjustment model is used to adjust the preset network security protection strategy of the cloud data center to obtain a real-time network security protection strategy.

2. The network security protection method based on deep learning according to claim 1, characterized in that: Based on the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model and a network security protection strategy adjustment model are constructed in the cloud data center using deep learning algorithms and reinforcement learning algorithms, comprising the following steps: A dynamic attack pedigree library including a plurality of dynamic attack samples is constructed in the cloud data center using a dynamic attack tree and an adversarial training algorithm; According to the plurality of dynamic attack samples of the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model is constructed in the cloud data center using a deep learning algorithm, and a plurality of historical attack detection results are obtained; According to the plurality of historical attack detection results, a network security protection strategy adjustment model is constructed in the cloud data center using a reinforcement learning algorithm.

3. The network security protection method based on deep learning according to claim 2, characterized in that: A dynamic attack pedigree library including a plurality of dynamic attack samples is constructed in the cloud data center using a dynamic attack tree and an adversarial training algorithm, comprising the following steps: Using the GNN-AttackTree algorithm, the dynamic attack tree structure of the dynamic attack pedigree library is set, and a plurality of historical attack data including historical multi-dimensional monitoring data of different historical network attack types are collected; Using the FGSM algorithm, adversarial training is performed on the plurality of historical attack data spectrum to obtain a plurality of generated attack data including different generated network attack types and generated multi-dimensional monitoring data; The plurality of historical attack data and the plurality of generated attack data are both used as dynamic attack samples and stored in the dynamic attack pedigree library according to the dynamic attack tree structure.

4. The network security protection method based on deep learning according to claim 3, characterized in that: According to the plurality of dynamic attack samples of the dynamic attack pedigree library, a multi-dimensional fusion network attack detection model is constructed in the cloud data center using a deep learning algorithm, and a plurality of historical attack detection results are obtained, comprising the following steps: A multi-dimensional fusion feature space is constructed, and an initial multi-dimensional fusion network attack detection model is constructed in the cloud data center using a deep learning algorithm according to the multi-dimensional fusion feature space; An optimization algorithm and a self-adaptive federated learning mechanism are used to adjust the initial multi-dimensional fusion network attack detection model to obtain an adjusted multi-dimensional fusion network attack detection model; The plurality of dynamic attack samples of the dynamic attack pedigree library are input into the adjusted multi-dimensional fusion network attack detection model for training to obtain a final multi-dimensional fusion network attack detection model.

5. The network security protection method based on deep learning according to claim 4, characterized in that: The initial multi-dimensional fusion network attack detection model is adjusted using an optimization algorithm and an adaptive federated learning mechanism to obtain an adjusted multi-dimensional fusion network attack detection model, including the following steps: The initial model parameters of the initial multi-dimensional fusion network attack detection model are optimized using an optimization algorithm to obtain an optimized multi-dimensional fusion network attack detection model; A coordination server is deployed in a cloud data center, the coordination server is connected to federated learning servers of a plurality of domains, and the optimized multi-dimensional fusion network attack detection model is deployed to each federated learning server; In each federated learning server, the corresponding optimized multi-dimensional fusion network attack detection model is trained according to the collected training attack data to obtain a trained multi-dimensional fusion network attack detection model; The trained multi-dimensional fusion network attack detection model is compressed / distilled to obtain a lightweight multi-dimensional fusion network attack detection model, the corresponding model parameters are extracted, and the model parameters are sent to the coordination server; In the coordination server, the model parameters uploaded by all federated learning servers are integrated to obtain comprehensive model parameters; The initial multi-dimensional fusion network attack detection model of the cloud data center is compressed / distilled and enhanced by differential privacy, and the initial multi-dimensional fusion network attack detection model is adjusted according to the comprehensive model parameters to obtain an adjusted multi-dimensional fusion network attack detection model.

6. The network security protection method based on deep learning according to claim 5, characterized in that: The multi-dimensional fusion feature space includes a protocol feature extraction layer, a relationship feature extraction layer, a time sequence feature extraction layer, a causal feature extraction layer, and a multi-dimensional feature fusion analysis layer. The multi-dimensional fusion network attack detection model includes a protocol feature extraction module constructed based on a BERT-ProtoPNet algorithm, a relationship feature extraction module constructed based on a GraphSAGE++ algorithm, a time sequence feature extraction module constructed based on a LSTM-Transformer algorithm, a causal feature extraction module constructed based on a GNN-based causal algorithm, and a multi-dimensional feature fusion analysis module constructed based on an Attention-MLP algorithm.

7. The network security protection method based on deep learning according to claim 6, characterized in that: According to a plurality of historical attack detection results, a network security protection strategy adjustment model is constructed in a cloud data center using a reinforcement learning algorithm, including the following steps: An initial network security protection strategy adjustment model is constructed in a cloud data center using a reinforcement learning algorithm, and a plurality of agents are constructed in cascade according to security components participating in network security protection of the cloud data center; A set of multi-objective functions is set for the initial network security protection strategy adjustment model according to different network security protection targets, and an experience replay pool is set according to an experience replay mechanism; A preset network security protection strategy is divided into preset network security protection decisions of a plurality of agents, and the preset network security protection decisions are abstracted into decision differential equations; According to equation parameters of the decision differential equations, a reward function and an action space of the agents are defined, and a state space of a corresponding agent is defined according to historical attack detection results and an output of a previous agent; The network security protection strategy adjustment model is trained using a plurality of historical attack detection results to obtain a final network security protection strategy adjustment model.

8. The network security protection method based on deep learning according to claim 7, characterized in that: The network security protection strategy adjustment model is constructed based on a MACGRPO algorithm, and includes a multi-objective function set, an experience replay pool, and a plurality of intelligent agents connected in cascade, each of which is provided with a corresponding policy network and a reward function.

9. The network security protection method based on deep learning according to claim 8, characterized in that: The real-time threat entropy includes real-time network traffic entropy, device state entropy, and attack path entropy.

10. A deep learning based network security protection system for implementing the network security protection method according to any one of claims 1-9, characterized in that: The system includes a model construction unit, an attack detection unit, a trigger judgment unit, and a strategy adjustment unit connected in sequence.

Images