Network attack identification method and device, computer device and readable storage medium

Abstract

The application discloses a network attack identification method and device, computer equipment and a readable storage medium. The method comprises the following steps: obtaining a terminal to be identified and device information of the terminal to be identified; based on the device information, searching in a preset terminal area distribution structure to determine a behavior partition to which the terminal to be identified belongs; extracting behavior data of each terminal in the behavior partition, and calculating a credit value of the terminal to be identified based on the behavior data; based on the credit value of the terminal to be identified, determining a fusion weight of each terminal, and performing weighted processing on the behavior data based on the fusion weight to obtain aggregated behavior features of the behavior partition; inputting the aggregated behavior features and the behavior data of the terminal to be identified into a preset risk identification model to obtain a risk probability of the terminal to be identified; and based on the risk probability, determining a network attack identification result of the terminal to be identified. Even if the behavior data of the terminal to be identified is not abnormal, the aggregated behavior features can still accurately determine the network attack.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a network attack identification method, apparatus, computer device, and readable storage medium. Background Technology

[0002] With the continuous development of network technology, cyberspace has become an important carrier for information exchange and resource sharing. However, the openness and anonymity of cyberspace have also led to a significant increase in its security risks, with various cyberattacks occurring frequently. How to accurately identify potential attack sources and improve the foresight and accuracy of network security protection has become an important research direction in the field of network security.

[0003] Existing network attack identification technologies are typically based on access behavior data of a single terminal. They use machine learning or deep learning models to extract features from historical access data and train them to predict the malicious probability value of the target terminal and identify terminals that may pose security risks.

[0004] However, in practical applications, attackers often do not directly use their own devices to launch attacks. Instead, they control several "normal terminals" as proxy nodes to carry out attacks. These terminals behave normally in historical records and even lack historical access behavior data for analysis. Therefore, existing identification models based on historical behavior features cannot effectively identify these "exploited" normal terminals, resulting in a significant decrease in detection accuracy.

[0005] Therefore, how to accurately identify potential network attacks without relying on historical access behavior data of terminals has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] Therefore, it is necessary to provide a network attack identification method, apparatus, computer equipment, and readable storage medium to address the aforementioned technical problems, thereby solving the problem that traditional network attack identification methods rely on historical access behavior data, resulting in low accuracy in identifying network attacks.

[0007] A method for identifying network attacks, the method comprising:

[0008] Obtain the terminal to be identified and its device information;

[0009] Based on the device information, a search is performed in a preset terminal region distribution structure to determine the behavior partition to which the terminal to be identified belongs. The terminal region distribution structure is obtained by dividing the behavior features of multiple terminals.

[0010] Behavioral data of each terminal is extracted within the behavioral partition, and the reputation value of the terminal to be identified is calculated based on the behavioral data.

[0011] Based on the reputation value of the terminal to be identified, the fusion weight of each terminal is determined, and the behavior data is weighted based on the fusion weight to obtain the aggregated behavior features of the behavior partition.

[0012] The aggregated behavioral features and the behavioral data of the terminal to be identified are input into a preset risk identification model to obtain the risk probability of the terminal to be identified.

[0013] Based on the risk probability, the network attack identification result of the terminal to be identified is determined.

[0014] Optionally, before determining the behavior partition to which the terminal to be identified belongs by searching in a preset terminal region distribution structure based on the device information, the method further includes:

[0015] Collect behavioral data from multiple terminals within a preset time window;

[0016] From the behavioral data, the behavioral features of each terminal are extracted;

[0017] The behavioral features are standardized and weighted to obtain the target behavioral features;

[0018] Clustering is performed based on the similarity of the target behavioral features to form multiple behavioral partitions, and the terminal region distribution structure is constructed.

[0019] Optionally, the terminal region distribution structure includes a main chain and sub-chains. The step of clustering based on the similarity of the target behavior features to form multiple behavior partitions and constructing the terminal region distribution structure includes:

[0020] A corresponding sub-chain is established for each behavior partition, and the sub-chain is used to record the behavior data of the terminal within the behavior partition;

[0021] In the main chain, generate corresponding partition indexes for each row partition and store the verification information of each sub-chain;

[0022] The main chain and each sub-chain are mapped through hash association to form the terminal area distribution structure.

[0023] Optionally, calculating the reputation value of the terminal to be identified based on the behavioral data includes:

[0024] Based on the behavioral data, historical risk factors, community contribution factors, behavioral consistency factors, and group risk factors of the behavioral partition are extracted. The group risk factors are used to reflect the overall risk level of the behavioral partition.

[0025] The historical risk factors are subjected to time decay smoothing to obtain the updated historical reputation value;

[0026] The historical reputation value, community contribution factor, behavioral consistency factor, and group risk factor are calculated according to preset weights to obtain the reputation value.

[0027] Optionally, determining the fusion weight of each terminal based on the reputation value of the terminal to be identified includes:

[0028] Using the reputation value of the terminal to be identified as the reference benchmark for weight calculation, the relative reputation level of each terminal is determined based on the reputation value of the terminal to be identified and the reputation values ​​of other terminals within the behavior partition to which the terminal to be identified belongs.

[0029] Calculate the core weight of each terminal based on the relative reputation level;

[0030] The core weights are non-linearly adjusted based on the reputation scores of each terminal to obtain the adjusted weights.

[0031] The adjusted weights are normalized to obtain the fusion weights for each terminal.

[0032] Optionally, the risk identification model includes a first extraction layer, a second extraction layer, a third extraction layer, a feature fusion layer, and an inference layer. The step of inputting the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified includes:

[0033] The behavioral data of the terminal to be identified is input into the first extraction layer to extract the behavioral features of the terminal to be identified;

[0034] The aggregated behavioral features of the behavioral partitions are input into the second extraction layer to extract partition feature representations;

[0035] Metadata information related to the terminal to be identified is input into the third extraction layer to extract context-related features;

[0036] The behavioral features, partition feature representations, and context-related features are input into the feature fusion layer to obtain fused features;

[0037] The fused features are input into the inference layer to obtain the risk probability.

[0038] Optionally, after determining the network attack identification result of the terminal to be identified based on the risk probability, the method further includes:

[0039] The reputation value of the terminal to be identified is updated based on the risk probability to obtain the updated reputation value;

[0040] Based on the updated reputation value, the terminal area distribution structure is adjusted.

[0041] A network attack identification device, the device comprising:

[0042] The first acquisition module is used to acquire the terminal to be identified and the device information of the terminal to be identified.

[0043] The first retrieval module is used to perform a retrieval in a preset terminal region distribution structure based on the device information to determine the behavior partition to which the terminal to be identified belongs. The terminal region distribution structure is obtained by dividing the behavior features of multiple terminals.

[0044] The first extraction module is used to extract behavioral data of each terminal within the behavioral partition and calculate the reputation value of the terminal to be identified based on the behavioral data.

[0045] The first determining module is used to determine the fusion weight of each terminal based on the reputation value of the terminal to be identified, and to perform weighted processing on the behavior data based on the fusion weight to obtain the aggregated behavior features of the behavior partition.

[0046] The first input module is used to input the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified.

[0047] The second determining module is used to determine the network attack identification result of the terminal to be identified based on the risk probability.

[0048] A computer device includes a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor, wherein the processor implements the aforementioned network attack identification method when executing the computer-readable instructions.

[0049] A readable storage medium having computer-readable instructions stored thereon, which, when executed by a processor, implement the aforementioned network attack identification method.

[0050] The aforementioned network attack identification method involves: acquiring the terminal to be identified and its device information; searching within a preset terminal region distribution structure based on the device information to determine the behavioral partition to which the terminal to be identified belongs, wherein the terminal region distribution structure is derived from the behavioral features of multiple terminals; extracting behavioral data from each terminal within the behavioral partition and calculating the reputation value of the terminal to be identified based on the behavioral data; determining the fusion weight of each terminal based on the reputation value of the terminal to be identified, and weighting the behavioral data based on the fusion weight to obtain the aggregated behavioral features of the behavioral partition; inputting the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified; and determining the network attack identification result of the terminal to be identified based on the risk probability. By inputting the aggregated behavioral features and the behavioral data of the terminal to be identified into the preset risk identification model to obtain the risk probability, even if the behavioral data of the terminal to be identified does not reflect any anomalies, the partition group reference provided by the aggregated behavioral features can still be used to enhance the discrimination capability, thereby accurately determining the network attack identification result of the terminal to be identified. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a flowchart illustrating a network attack identification method according to an embodiment of the present invention;

[0053] Figure 2 This is a schematic diagram of the network attack identification device in one embodiment of the present invention;

[0054] Figure 3 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] In one embodiment, such as Figure 1 As shown, a method for identifying network attacks is provided, including the following steps:

[0057] 101. Obtain the terminal to be identified and its device information.

[0058] In this embodiment of the invention, the terminal to be identified may be various computing terminals that access the target network space, including but not limited to servers, personal computers, Internet of Things devices, mobile terminals or virtual nodes.

[0059] The aforementioned device information may include multi-dimensional parameter data used to uniquely identify and describe the characteristics of the terminal, such as the terminal's network identification information (e.g., IP address, MAC address), device fingerprint characteristics (e.g., hardware serial number, operating system type, firmware version), communication protocol type, geographical location information, access timestamp, and terminal operating status parameters.

[0060] For example, when the terminal to be identified is an IoT camera connected to the enterprise intranet, its device information may include the camera's device ID, subnet, network interface type, system firmware version number, real-time operating temperature, and bandwidth utilization. This information serves as initial input, used in subsequent steps to retrieve and determine the behavioral partition to which the terminal belongs within the terminal's regional distribution structure, providing fundamental characteristics for identifying network attack risks.

[0061] 102. Based on device information, search within the preset terminal area distribution structure to determine the behavior partition to which the terminal to be identified belongs.

[0062] In this embodiment of the invention, the terminal region distribution structure is obtained by dividing the behavioral characteristics of multiple terminals. Specifically, behavioral data of multiple terminals can be collected within a preset time window, their behavioral characteristics can be extracted, and cluster analysis can be performed based on feature similarity to form multiple sets of terminals with similar behavior, each set corresponding to a behavioral partition.

[0063] The aforementioned behavioral partitions can be understood as logical regions in cyberspace formed based on terminal behavioral characteristics, used to reflect a group of terminals with similar behavioral patterns and close interaction frequencies. Each behavioral partition has independent behavioral statistical characteristics, risk level, and reputation distribution, used to support subsequent group behavior analysis and risk assessment.

[0064] For example, when there are several types of terminal devices in a network, such as office servers, surveillance cameras and user mobile terminals, they can be divided into different behavioral partitions based on behavioral characteristics such as the terminal's access frequency, communication target, data packet characteristics and session duration.

[0065] For example, terminals with relatively fixed access patterns and stable communication cycles can be clustered into the "device management partition"; while terminals that frequently access external networks and have significantly different request patterns are classified into the "user access partition".

[0066] Once a new terminal to be identified is connected to the network, its device information can be used to search for the partition with the highest matching degree in the terminal area distribution structure, thereby determining its behavioral partition and providing a basis for subsequent reputation calculation and risk identification.

[0067] More specifically, assume that the above terminal area distribution structure is constructed using a blockchain, which includes a main chain and sub-chains.

[0068] The main chain, acting as the root chain, stores the core metadata of the entire system. Each block does not store specific terminal data, but rather stores the behavior partition identifier (Cluster_ID), the hash value of its corresponding behavior baseline profile (e.g., the hash of the center point of the partition feature vector), and the root hash pointing to the sub-chain of the partition.

[0069] Sub-Chain: Each sub-chain corresponds to a specific behavior partition. Each block on the sub-chain stores the terminal identifier (TerminalID) and the hash of its core attributes (e.g., Hash(Terminal ID + Reputation Value + Timestamp)) within the aforementioned partition. Dynamic changes in terminal behavior are recorded by appending them in chronological order, thereby ensuring the verifiability and immutability of the data within the partition.

[0070] When it is necessary to determine the behavior partition to which the terminal to be identified belongs, the matching behavior partition identifier can be retrieved in the main chain based on the terminal identifier in the device information. Then, based on the root hash information stored in the main chain, the corresponding sub-chain is accessed for verification. If the device fingerprint hash of the terminal to be identified is consistent with or has the highest similarity to the hash recorded by the terminal in a certain sub-chain, the terminal is determined to belong to the behavior partition.

[0071] By using a regional distribution design based on a blockchain structure, not only can the integrity and traceability of behavioral partition data be ensured, but also dynamic and reliable management of the terminal partition status can be achieved, providing a tamper-proof partition foundation for subsequent reputation calculation and risk identification.

[0072] 103. Extract behavioral data from each terminal within the behavioral partition, and calculate the reputation value of the terminal to be identified based on the behavioral data.

[0073] In this embodiment of the invention, the behavioral data of each terminal may include multi-dimensional dynamic information that reflects the terminal's access characteristics and network interaction status, such as access request frequency, communication target distribution, data transmission volume, session duration, abnormal request ratio, access time interval, protocol usage, traffic feature fingerprint, and resource access path. This behavioral data can be acquired in real time by a network traffic acquisition module, a log monitoring module, or an edge acquisition node, and is used to reflect the terminal's operating mode and interaction characteristics within its respective behavioral partition.

[0074] The aforementioned reputation score can be understood as a dynamic quantitative indicator representing the trustworthiness of a terminal within its respective behavioral zone. It comprehensively reflects the terminal's historical risk level, behavioral stability, and contribution to the overall security of the zone. Its value is obtained by weighting various risk-related factors extracted from behavioral data, including historical risk factors, community contribution factors, behavioral consistency factors, and group risk factors. A higher reputation score indicates more stable and trustworthy terminal behavior; a lower reputation score indicates potential risks of abnormal or malicious behavior.

[0075] For example, within a specific behavioral partition, if the access frequency, communication targets, and data transmission volume of the terminal to be identified are all consistent with the partition's average level, and no high-risk characteristics have appeared in its historical access behavior, then the reputation value of the aforementioned terminal can remain at a high level. Conversely, if a terminal recently exhibits frequent access to unknown external hosts, a sudden increase in transmission volume, or a behavior pattern that significantly deviates from the partition's normal state, its reputation value will be dynamically lowered, thereby providing a reliable basis for risk judgment in subsequent risk identification models.

[0076] More specifically, assuming the aforementioned terminal area distribution structure is constructed using a blockchain, the tamper-proof storage and verifiable retrieval of behavioral data can be achieved through the on-chain structure.

[0077] Specifically, based on the behavior partition information and terminal identifier, the corresponding block in the main chain is located first, and the partition metadata recorded in the block is read. The metadata includes an index pointer to the off-chain stored data (such as a primary key in a distributed database or IPFS), a partition feature digest, and a sub-chain root hash used for integrity verification.

[0078] Then, based on the aforementioned index pointer, the complete behavioral data set of the aforementioned partition is obtained from the off-chain distributed storage, and the Merkle tree construction algorithm consistent with that of the blockchain is executed in memory to calculate the root hash of the off-chain data.

[0079] Compare the root hash calculated off-chain with the root hash of the sub-chain recorded on-chain:

[0080] If the two are consistent, it indicates that the off-chain behavior data has not been tampered with since the last time it was anchored to the chain, the data is reliable, and the process continues to execute;

[0081] If the two are inconsistent, it indicates that the off-chain data may be corrupted or maliciously modified, and the data is untrustworthy. The process will be terminated immediately and a security alert will be generated.

[0082] Through the aforementioned blockchain-off-chain collaborative verification mechanism, it is possible to ensure the authenticity, integrity, and historical traceability of the data source during the extraction of behavioral data and the calculation of reputation value, thereby providing a reliable data foundation for subsequent fusion weight calculation and risk identification.

[0083] 104. Based on the reputation value of the terminal to be identified, determine the fusion weight of each terminal, and perform weighted processing on the behavioral data based on the fusion weight to obtain the aggregated behavioral features of the behavioral partition.

[0084] In this embodiment of the invention, the aforementioned fusion weight can be a dynamic coefficient used to characterize the contribution of each terminal within a behavioral partition to the overall behavioral characteristics. Its value can be jointly determined based on the reputation value of the terminal to be identified and the reputation values ​​of other terminals within the partition. Specifically, the reputation value of the terminal to be identified can be used as a reference benchmark for weight calculation. First, the relative reputation level of each terminal within the partition is calculated, and then the weight is nonlinearly adjusted in conjunction with its absolute reputation level, thereby obtaining a fusion weight that can reflect the differences in individual reputation and the balance of group structure.

[0085] Terminals with higher reputations contribute more during weighted processing, while terminals with lower reputations are given smaller weights due to the adjustment function, in order to reduce the interference of abnormal behavior on the overall features.

[0086] The aforementioned aggregated behavioral features can be understood as a comprehensive behavioral representation obtained by weighting the behavioral data of each terminal within a specific behavioral partition according to the fusion weights. This representation is used to characterize the overall access patterns and risk propensity of the aforementioned partition. The aggregated behavioral features retain the statistical regularity of group behavior while incorporating the credibility correction of individual reputation to the overall pattern, making them an important feature vector for subsequent risk identification models.

[0087] For example, within a behavioral partition containing ten terminal nodes, nine terminals have high reputation values ​​and stable behavior, while the remaining terminal has recently exhibited abnormal access frequency. The fusion weights can be determined based on the reputation values ​​of each terminal, and the behavioral data can be weighted and summed to obtain aggregated behavioral features. In this case, the data contribution from high-reputation terminals dominates, while the impact of data from abnormal terminals is weakened. The resulting aggregated behavioral features more accurately reflect the overall normal behavioral patterns of the partition, serving as a group reference input for risk analysis of the terminals to be identified, thus improving the robustness and accuracy of risk assessment.

[0088] 105. Input the aggregated behavioral features and the behavioral data of the terminal to be identified into the preset risk identification model to obtain the risk probability of the terminal to be identified.

[0089] In this embodiment of the invention, the aforementioned preset risk identification model can be a multi-branch fusion model built on a deep learning structure, used to jointly analyze the behavioral characteristics of the target terminal and the group characteristics of its partition.

[0090] Specifically, the risk identification model may include multiple input branches, a feature fusion layer, and an inference layer:

[0091] The first input branch is used to receive behavioral data of the terminal to be identified in order to extract its individual behavioral characteristics.

[0092] The second input branch is used to receive the aggregated behavioral features of the behavioral partitions obtained by weighting the fusion weights, in order to extract the group background features;

[0093] The third input branch is used to receive contextual metadata information related to the terminal to be identified (such as terminal reputation value, group risk factor, or access target sensitivity) in order to extract contextual features.

[0094] The feature vectors extracted from each branch are concatenated and nonlinearly fused in the feature fusion layer to learn the difference patterns between individual behavior and group background; the fusion result is output as a probability by the inference layer to obtain a risk probability value representing the security status of the target terminal.

[0095] The aforementioned risk probability can be understood as a quantitative indicator characterizing the degree of potential network attack risk of the terminal to be identified, with a value ranging from zero to one. When the risk probability is close to one, it indicates that the terminal's behavior is highly similar to the characteristics of known anomalies or attack samples; when the risk probability is close to zero, it indicates that its behavior pattern is consistent with that of normal groups, and it is in a low-risk state.

[0096] For example, in a certain behavior partition, if the frequency of recent access requests of the terminal to be identified is significantly higher than the partition average, and the access target includes highly sensitive resources, while its reputation value is at a low level in the partition, then the risk identification model will output a high risk probability value after fusing the input features, thereby identifying the above terminal as a potential attack source; conversely, when the behavior pattern of the terminal to be identified is consistent with the partition aggregated behavior features and its reputation is stable, its risk probability value is low and it is judged as a normal terminal.

[0097] 106. Based on risk probability, determine the network attack identification result of the terminal to be identified.

[0098] In this embodiment of the invention, the network attack identification result of the terminal to be identified can be determined based on the comparison result between the risk probability output by the risk identification model and the preset risk threshold.

[0099] When the risk probability exceeds the aforementioned risk threshold, the terminal is determined to exhibit abnormal behavior or potential attack risk and is identified as a suspicious terminal; when the risk probability is below the aforementioned risk threshold, the terminal is determined to be in a normal state. This risk probability-based quantitative judgment mechanism enables accurate identification of network attack behavior from both individual behavioral characteristics and group aggregation characteristics.

[0100] In practice, the risk threshold can be dynamically adjusted according to different network environments or security policies. For example, a lower threshold can be used for core business systems or highly sensitive data nodes to improve detection sensitivity, while a relatively higher threshold can be used in general network environments to reduce false alarm rates.

[0101] At the same time, the identification results can be linked with the terminal's reputation value for updates. That is, when a terminal is judged to be high-risk, its reputation value will automatically decrease; if the risk probability is within the safe range for several consecutive periods, the reputation value can be gradually restored.

[0102] For example, if a terminal is detected to have made multiple abnormal accesses to external ports recently and the risk probability is consistently higher than 0.8, it will be marked as a "high-risk terminal" and corresponding protection policies (such as blocking access and isolating monitoring) will be triggered. Conversely, if the terminal's behavior returns to normal in subsequent periods and the risk probability remains below 0.2, its reputation level will be automatically restored and the alarm status will be lifted.

[0103] In this embodiment of the invention, the following steps are taken: A terminal to be identified and its device information are acquired; based on the device information, a search is performed in a preset terminal region distribution structure to determine the behavioral partition to which the terminal to be identified belongs. The terminal region distribution structure is obtained by dividing the behavioral features of multiple terminals; behavioral data of each terminal is extracted within the behavioral partition, and a reputation value of the terminal to be identified is calculated based on the behavioral data; based on the reputation value of the terminal to be identified, a fusion weight is determined for each terminal, and the behavioral data is weighted based on the fusion weight to obtain the aggregated behavioral features of the behavioral partition; the aggregated behavioral features and the behavioral data of the terminal to be identified are input into a preset risk identification model to obtain the risk probability of the terminal to be identified; based on the risk probability, the network attack identification result of the terminal to be identified is determined. Inputting the aggregated behavioral features and the behavioral data of the terminal to be identified into the preset risk identification model to obtain the risk probability; even if the behavioral data of the terminal to be identified does not reflect anomalies, the partition group reference provided by the aggregated behavioral features can still be used to enhance the discrimination capability, thereby accurately determining the network attack identification result of the terminal to be identified.

[0104] It is understood that in the specific implementation of this application, data related to device information, behavioral data, terminal area distribution structure, etc. are involved. When the embodiments in this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0105] Optionally, before the step of searching within a preset terminal region distribution structure based on device information to determine the behavior partition to which the terminal to be identified belongs, behavior data of multiple terminals can be collected within a preset time window; behavior features of each terminal can be extracted from the behavior data; the behavior features can be standardized and weighted to obtain target behavior features; clustering can be performed based on the similarity of the target behavior features to form multiple behavior partitions, and a terminal region distribution structure can be constructed.

[0106] In this embodiment of the invention, the above-mentioned "collecting behavioral data of multiple terminals within a preset time window" can be achieved by a network traffic monitoring module, a log collection system or an edge node monitoring device, which is used to continuously record multi-dimensional behavioral information such as the terminal's communication requests, protocol type, target address, session duration and data transmission characteristics.

[0107] After the collected behavioral data is cleaned and features are extracted, feature vectors that can represent the terminal behavior pattern can be extracted, such as request frequency vector, traffic distribution vector, communication relationship matrix and protocol usage probability distribution, etc.

[0108] During the standardization and weighting of behavioral features, normalization and weighted combinations can be performed based on the importance coefficients of the features (such as those calculated from information gain or mutual information) to generate target behavioral features for each terminal. Target behavioral features can effectively eliminate the influence of dimensional differences and behavioral fluctuations between different terminals, making the clustering process more stable and comparable.

[0109] Subsequently, based on the similarity of target behavioral characteristics (e.g., using metrics such as cosine similarity, Euclidean distance, or Mahalanobis distance), cluster analysis is performed on all terminals to form multiple behavioral partitions. Each partition represents a group of terminals with similar behavioral patterns in terms of communication frequency, access objects, and traffic patterns.

[0110] Through the above steps, a terminal region distribution structure that dynamically reflects the distribution of terminal behavior characteristics in the network can be autonomously constructed without relying on manual rules. This not only provides a partitioning basis for subsequent reputation value calculation and fusion weight determination, but also enables real-time adaptive modeling of network security posture by continuously updating partition feature centers.

[0111] Optionally, the terminal region distribution structure includes a main chain and sub-chains. In the step of clustering based on the similarity of target behavior features to form multiple behavior partitions and constructing the terminal region distribution structure, a corresponding sub-chain can also be established for each behavior partition. The sub-chain is used to record the behavior data of the terminal within the behavior partition. A corresponding partition index is generated for each behavior partition in the main chain, and the verification information of each sub-chain is stored. A mapping relationship is established between the main chain and each sub-chain through hash association to form the terminal region distribution structure.

[0112] In this embodiment of the invention, assuming that the terminal area distribution structure is constructed using a blockchain, its initial construction process can be divided into the following stages:

[0113] First, within a preset time window T, feature vectors that characterize the access behavior of each terminal i are extracted. Feature vectors can include access pattern features (such as the distribution entropy of accessed APIs, request frequency, and activity time patterns), access content features (such as the distribution of data sensitivity levels and the read / write ratio), security context features (such as historical verification failure rate and session duration), and geographical similarity features (such as the similarity of access destinations).

[0114] After each feature is standardized (e.g., by Z-score processing), weights are assigned based on their importance. Weighted combinations are performed to reflect the degree of influence of different features in cluster analysis, resulting in a weighted feature vector.

[0115] Subsequently, unsupervised clustering algorithms (such as streaming K-Means or Mini-Batch K-Means) are used to perform clustering analysis on the weighted feature vectors of all terminals, thereby automatically forming multiple terminal partitions with similar behaviors. Each partition corresponds to an independent "behavioral partition," for example:

[0116] Partition A: High request frequency, low entropy, access to East Asian servers → corresponding video live streaming terminals;

[0117] Partition B: Low request frequency, read-to-write ratio 1:9, access to global servers → corresponding enterprise backend synchronization terminal;

[0118] Partition C: Highly sensitive data access and activities are concentrated on the local server → corresponding to the internal management terminal.

[0119] After clustering is completed, a unique cluster identifier (Cluster_ID) is assigned to each behavioral partition, and a corresponding sub-chain is established on the blockchain for each partition. Each sub-chain records summary data such as the identifier information, behavioral characteristics, and reputation value of the terminals within the partition. The main chain serves as a global index chain, used to store the partition identifier, the root hash of the corresponding sub-chain, and its verification information.

[0120] Through a hash association mechanism, a one-to-one mapping relationship is established between the main chain and each sub-chain, thereby achieving traceability and tamper-proof evidence preservation of behavioral data. The clustering process can be re-executed periodically or when significant changes in terminal behavioral characteristics are detected to dynamically update the partition to which the terminal belongs, ensuring that the terminal regional distribution structure can reflect the behavioral evolution status of each terminal in the network in real time.

[0121] Through the above design, the terminal area distribution structure, supported by blockchain, achieves dynamic partition updates, trusted storage of behavioral data, and structured indexing, ensuring the stability and verifiability of the input data for subsequent reputation calculation and risk identification models.

[0122] Optionally, in the step of calculating the reputation value of the terminal to be identified based on behavioral data, historical risk factors, community contribution factors, behavioral consistency factors, and group risk factors of the behavioral partition to which the terminal belongs can also be extracted based on the behavioral data. The group risk factors are used to reflect the overall risk level of the behavioral partition to which the terminal belongs. The historical risk factors are subjected to time decay smoothing to obtain the updated historical reputation value. The historical reputation value, community contribution factors, behavioral consistency factors, and group risk factors are calculated according to preset weights to obtain the reputation value.

[0123] In this embodiment of the invention, the calculation of the reputation value is a dynamic, multi-factor fusion evaluation process used to comprehensively reflect the trustworthiness and behavioral stability of the terminal to be identified. The corresponding calculation model can be expressed as:

[0124] .

[0125] Among them: historical risk factors (Or it can be understood as the historical risk baseline) is used to characterize the historical risk evolution trend of the terminal, and its calculation method is as follows:

[0126]

[0127] in, The risk probability value (between 0 and 1, where 1 represents extremely high risk) is the historical output of the risk identification model. This indicates the current credibility, and 𝛼 is a smoothing factor representing the weight of the new evaluation result. This represents the historical credit baseline value of the previous period;

[0128] Community contribution factor This is used to reflect the positive role of terminals in group security. The contribution value increases when a terminal's behavioral data is used as a positive sample for verification by other terminals. These factors are calculated by statistically analyzing and normalizing the number of positive sample citations, thereby incentivizing terminals to maintain stable and compliant behavior.

[0129] Behavioral consistency factor The stability of endpoint behavior patterns is assessed by calculating the variance or entropy of recent access behavior characteristics (such as request frequency, time interval, and target distribution). Higher consistency indicates more stable behavior, and a correspondingly higher reputation score.

[0130] Time decay function This method is used to smooth historical risk factors over time, resulting in an updated historical reputation value. It's understood that reputation needs to reflect recent performance. The impact of distant historical behavior on current reputation should gradually diminish. Calculation method: Record a timestamp for each reputation update. Calculate the time difference between the current time and the last update time, and apply a decay function (such as exponential decay) to the historical reputation value.

[0131] Group risk factors Used to reflect the overall risk level of a given behavioral zone, its calculation includes:

[0132]

[0133] in, It can be determined by time decay or terminal activity to ensure that the group risk reflects the latest status of the partition.

[0134]

[0135] in, Let be the risk threshold, and k be the curve steepness coefficient. When the average risk of the population is below the threshold... A value >0.5 produces a positive gain; when the group risk exceeds the threshold, A value less than 0.5 results in a punitive effect.

[0136] Finally, The formula for calculating reputation value (i.e., reputation score) R, integrated into the reputation value calculation model, is as follows:

[0137]

[0138] Where R represents the reputation value of the terminal to be identified, which is used to quantify the trustworthiness of the terminal in its respective behavior partition;

[0139] This represents a group risk factor, used to non-linearly adjust individual reputation outcomes based on the overall risk level of the behavioral partition to which the individual belongs. It applies a decay effect when the partition's average risk is high and provides a reputation gain when it is low.

[0140] , as well as The preset weights for each risk factor reflect the proportion of influence of different factors in the credit score calculation;

[0141] The historical risk baseline (i.e., the updated historical credit value) is used to smoothly update the data by combining the current risk probability with the credit results of the previous period, reflecting the long-term risk trend of the terminal.

[0142] The community contribution factor is used to reflect the degree of positive contribution of the terminal to the maintenance of partition security;

[0143] The behavioral consistency factor is used to measure the stability and predictability of terminal behavior patterns.

[0144] Furthermore, if the aforementioned terminal area distribution structure is a blockchain structure, the reputation value calculation process can include the following steps:

[0145] (1) Input: ID of the terminal to be identified.

[0146] (2) Retrieval: Based on the terminal ID, the smart contract retrieves the partition subchain in the main chain-subchain structure, locates the specific block storing the terminal information, and reads its current reputation value R_old and other required attributes.

[0147] (3) Calculation: Combine the risk probability value P_(risk_current) of this risk assessment with the above calculation model to calculate the reputation value R.

[0148] (4) On-chain update: Generate a new terminal block with the content of Hash(Terminal ID + R + New Timestamp). Append the new block to the end of the corresponding sub-chain. Calculate the Merkle root hash of the new sub-chain and submit the root hash to the main chain for notarization and update.

[0149] Understandably, the advantages of the regional distribution structure and reputation value calculation model include: Trustworthiness and transparency: All reputation update records are permanently and immutably stored on the blockchain, making them auditable. Dynamic adaptability: Reputation values ​​can dynamically adjust according to changes in terminal behavior, both punishing malicious behavior and allowing repentant terminals to gradually restore their reputation. Incentivizing good behavior: Through... Factors incentivize terminals to maintain normal behavior and contribute to overall network security. A balance between performance and security is achieved: complex calculations are performed off-chain, with only the results hashed and uploaded to the blockchain, ensuring its efficiency.

[0150] Optionally, in the step of determining the fusion weight of each terminal based on the reputation value of the terminal to be identified, the reputation value of the terminal to be identified can also be used as the reference benchmark for weight calculation. Based on the reputation value of the terminal to be identified and the reputation values ​​of other terminals within the behavior partition to which the terminal to be identified belongs, the relative reputation level of each terminal can be determined; the core weight of each terminal can be calculated based on the relative reputation level; the core weight can be nonlinearly adjusted in combination with the reputation value of each terminal to obtain the adjusted weight result; and the adjusted weight result can be normalized to obtain the fusion weight of each terminal.

[0151] In this embodiment of the invention, relative reputation level can be understood as a percentile index reflecting the relative reputation position of a terminal within its respective behavior partition, used to characterize the relative credibility of a terminal among a group of similar terminals. By calculating the reputation value sequence of all terminals within the partition, the percentile ranking of each terminal j can be obtained. This indicates the proportion of nodes within the partition whose reputation value is lower than that of the aforementioned terminals.

[0152] The calculation process for the fusion weights specifically includes the first stage, which calculates the core weights based on relative reputation:

[0153] Because different partitions have different overall reputation levels. In an "elite partition" with a high overall reputation, one A terminal with a score of 0.8 might only be of medium quality; and in a "risk zone" with overall low reputation, A score of 0.8 might represent the top-tier level. To address this, relative reputation could be used as the basis for weighting calculations.

[0154] Specifically, the process involves first calculating the percentile rank of each terminal j's reputation value within the given sequence of all terminals (including the terminal to be identified) within the partition. , This represents the percentage of terminals with a reputation score lower than terminal j out of the total number of terminals. For example, if terminal j's reputation score ranks 90th out of 100 terminals, then... = 0.9. Ranked by percentile. Calculate core weights :

[0155]

[0156] Here, α represents the weight amplification factor, which is a hyperparameter greater than 0.

[0157] The second stage involves weight adjustment based on absolute reputation:

[0158] The first phase solved the relativity problem, but it requires an absolute reputation value. To defend against an advanced attack: the "pseudo-elite" attack—an attacker may create a partition consisting of a large number of medium-reputation nodes, in which a few malicious nodes become "relative elites" within the partition by "boosting" each other's reputation.

[0159] It needs to be based on the terminal's absolute reputation value. The core weights are adjusted non-linearly to obtain the final weights. :

[0160]

[0161] Among them, the adjustment function Defined as an improved Sigmoid function:

[0162]

[0163] in, It is a negative adjustment coefficient used to control the steepness of the adjustment function, and can be dynamically determined based on the ratio of the number of medium-reputation nodes in the partition to the average number of terminals in the entire network.

[0164] The reputation threshold is used to set a critical threshold for reputation (e.g., 0.5). At that time, adjustment value Approaching 0 strongly inhibits its weight; At that time, adjustment value Approaching 1 allows its core weights to be fully released.

[0165] The above function can be used to impose strong constraints on low-reputation nodes and relax them on high-reputation nodes, forming a smooth weight transition curve.

[0166] Finally, to ensure that the sum of the weights of each terminal is 1, the adjusted weight results need to be normalized, i.e., the fused weight vector is output:

[0167]

[0168] Through the above calculation process, the resulting fusion weight not only takes into account the differences in relative rankings within the partition, but also effectively introduces the security constraint of absolute reputation, making it difficult for malicious terminals to gain excessive influence through local manipulation, thereby ensuring that the calculation results of subsequent aggregated behavioral characteristics are more robust and credible.

[0169] Optionally, the risk identification model includes a first extraction layer, a second extraction layer, a third extraction layer, a feature fusion layer, and an inference layer. In the step of inputting aggregated behavioral features and behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified, the behavioral data of the terminal to be identified can also be input into the first extraction layer to extract the behavioral features of the terminal to be identified; the aggregated behavioral features of the behavioral partitions can be input into the second extraction layer to extract the partition feature representation; the metadata information related to the terminal to be identified can be input into the third extraction layer to extract the context-related features; the behavioral features, partition feature representation, and context-related features can be input into the feature fusion layer to obtain the fused features; and the fused features can be input into the inference layer to obtain the risk probability.

[0170] In this embodiment of the invention, the behavioral characteristics of the terminal to be identified can be understood as sequential characteristics that reflect the access behavior patterns of the terminal within a certain time window, including its request frequency, access target, data interaction volume, protocol type and time distribution, etc., which are used to describe the temporal behavior pattern of the terminal in cyberspace.

[0171] In the risk identification model, the aforementioned behavioral features can be extracted using a one-dimensional convolutional neural network or a long short-term memory network to capture the local patterns and long-term dependencies of the behavioral sequence, thereby obtaining a vector representation that reflects the terminal's own behavioral features.

[0172] Partition feature representation can be understood as the background features of group behavior at the partition level, that is, a background vector formed based on weighted aggregated behavioral data, used to reflect the overall access characteristics and risk status of the behavioral partition where the terminal to be identified is located. Nonlinear encoding can be performed through several fully connected layers to generate a high-dimensional vector representing the group characteristics of the partition, providing the model with a behavioral comparison reference with the target terminal.

[0173] Contextual features can be understood as additional information reflecting the terminal to be identified in a specific request scenario, including the terminal's absolute reputation value, the overall group risk factor of the partition, and the contextual information of the current access request (such as the sensitivity of the target server, access type, etc.). The above information is encoded by a fully connected layer to obtain a contextual feature vector, which is used to describe the external environment and security context conditions during risk identification.

[0174] The risk identification model can be a multi-branch deep learning model, in which the first extraction layer, the second extraction layer, and the third extraction layer correspond to the three types of input data mentioned above, and each branch outputs behavioral features, partition feature representations, and contextual features respectively.

[0175] Subsequently, the three elements are spliced ​​and fused in the feature fusion layer, enabling the model to simultaneously learn the interaction between the terminal's own behavior and the partition background and contextual security information.

[0176] Finally, in the inference layer, multi-layer nonlinear mapping and probabilistic inference are performed on the fused features to output the risk probability of the terminal to be identified, which reflects the possibility of abnormal behavior or potential attacks.

[0177] Through the above structural design, even if the historical behavior data of the terminal to be identified does not show any abnormalities, the risk judgment capability can still be improved by using the group reference provided by the partition background features and context information, thereby accurately determining the network attack identification result of the terminal to be identified.

[0178] Optionally, after determining the network attack identification result of the terminal to be identified based on the risk probability, the reputation value of the terminal to be identified can be updated based on the risk probability to obtain the updated reputation value; and the terminal regional distribution structure can be adjusted based on the updated reputation value.

[0179] In this embodiment of the invention, the process of updating the reputation value of the terminal to be identified based on risk probability can be understood as dynamically writing back the reputation status of the terminal after risk identification is completed to reflect its latest security performance. Specifically, when the risk probability output by the risk identification model is high, the reputation value of the terminal will be updated by attenuation; conversely, when the risk probability is low, its reputation value will be increased accordingly.

[0180] The updated reputation score can be recalculated based on the aforementioned reputation calculation model, including combining new risk probabilities, historical reputation scores, behavioral consistency factors, community contribution factors, and group risk factors to generate a new comprehensive reputation evaluation result.

[0181] After the update is completed, the terminal area distribution structure can be dynamically adjusted based on the updated reputation value.

[0182] Specifically, this can be achieved through the following two types of mechanisms:

[0183] First, there is an internal adjustment mechanism within the partition. When the reputation value of a terminal rises or falls significantly and exceeds the reputation threshold range of the current partition, its weight in the original partition can be updated, so that its influence in the calculation of aggregated behavioral features changes synchronously with the reputation.

[0184] Second, there is a partition re-division mechanism. When the change in the terminal reputation value causes the difference between its behavior pattern and the original partition to exceed a preset threshold, a re-clustering process can be triggered to recalculate its feature similarity and migrate it to a partition that is more compatible with the current behavior features.

[0185] Furthermore, terminal reputation values ​​and partition adjustment records can be stored on the blockchain for end-to-end on-chain evidence preservation. While updating subchain blocks, a new Merkle root hash is calculated and synchronized to the main chain to ensure the traceability and tamper-proof nature of all reputation updates and partition adjustments.

[0186] Through the above design, the terminal reputation value and regional distribution structure can adaptively evolve according to the risk identification results, so that the security status of the entire network space can be kept in dynamic balance, effectively improving the ability to continuously perceive and defend against potential attacks.

[0187] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0188] In one embodiment, a network attack identification device is provided, which corresponds one-to-one with the network attack identification methods described in the above embodiments. For example... Figure 2 As shown, the network attack identification device includes a first acquisition module 201, a first retrieval module 202, a first extraction module 203, a first determination module 204, a first input module 205, and a second determination module 206. Detailed descriptions of each functional module are as follows:

[0189] The first acquisition module 201 is used to acquire the terminal to be identified and the device information of the terminal to be identified;

[0190] The first retrieval module 202 is used to perform a retrieval in a preset terminal area distribution structure based on the device information to determine the behavior partition to which the terminal to be identified belongs. The terminal area distribution structure is obtained by dividing the behavior features of multiple terminals.

[0191] The first extraction module 203 is used to extract behavioral data of each terminal within the behavioral partition and calculate the reputation value of the terminal to be identified based on the behavioral data.

[0192] The first determining module 204 is used to determine the fusion weight of each terminal based on the reputation value of the terminal to be identified, and to perform weighted processing on the behavior data based on the fusion weight to obtain the aggregated behavior features of the behavior partition.

[0193] The first input module 205 is used to input the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified.

[0194] The second determining module 206 is used to determine the network attack identification result of the terminal to be identified based on the risk probability.

[0195] Optionally, the device further includes:

[0196] The first acquisition module is used to collect behavioral data from multiple terminals within a preset time window;

[0197] The second extraction module is used to extract the behavioral features of each terminal from the behavioral data;

[0198] The first processing module is used to standardize and weight the behavioral features to obtain the target behavioral features.

[0199] The first partitioning module is used to perform clustering based on the similarity of the target behavior features, forming multiple behavior partitions, and constructing the terminal region distribution structure.

[0200] Optionally, the terminal region distribution structure includes a main chain and sub-chains, and the first partitioning module is further configured to:

[0201] A corresponding sub-chain is established for each behavior partition, and the sub-chain is used to record the behavior data of the terminal within the behavior partition;

[0202] In the main chain, generate corresponding partition indexes for each row partition and store the verification information of each sub-chain;

[0203] The main chain and each sub-chain are mapped through hash association to form the terminal area distribution structure.

[0204] Optionally, the first extraction module 203 is further configured to:

[0205] Based on the behavioral data, historical risk factors, community contribution factors, behavioral consistency factors, and group risk factors of the behavioral partition are extracted. The group risk factors are used to reflect the overall risk level of the behavioral partition.

[0206] The historical risk factors are subjected to time decay smoothing to obtain the updated historical reputation value;

[0207] The historical reputation value, community contribution factor, behavioral consistency factor, and group risk factor are calculated according to preset weights to obtain the reputation value.

[0208] Optionally, the first determining module 204 is further configured to:

[0209] Using the reputation value of the terminal to be identified as the reference benchmark for weight calculation, the relative reputation level of each terminal is determined based on the reputation value of the terminal to be identified and the reputation values ​​of other terminals within the behavior partition to which the terminal to be identified belongs.

[0210] Calculate the core weight of each terminal based on the relative reputation level;

[0211] The core weights are non-linearly adjusted based on the reputation scores of each terminal to obtain the adjusted weights.

[0212] The adjusted weights are normalized to obtain the fusion weights for each terminal.

[0213] Optionally, the risk identification model includes a first extraction layer, a second extraction layer, a third extraction layer, a feature fusion layer, and an inference layer, and the first input module 205 is further used for:

[0214] The behavioral data of the terminal to be identified is input into the first extraction layer to extract the behavioral features of the terminal to be identified;

[0215] The aggregated behavioral features of the behavioral partitions are input into the second extraction layer to extract partition feature representations;

[0216] Metadata information related to the terminal to be identified is input into the third extraction layer to extract context-related features;

[0217] The behavioral features, partition feature representations, and context-related features are input into the feature fusion layer to obtain fused features;

[0218] The fused features are input into the inference layer to obtain the risk probability.

[0219] Optionally, the device further includes:

[0220] The update module is used to update the reputation value of the terminal to be identified based on the risk probability, so as to obtain the updated reputation value;

[0221] The adjustment module is used to adjust the terminal area distribution structure based on the updated reputation value.

[0222] Specific limitations regarding network attack identification devices can be found in the limitations of network attack identification methods described above, and will not be repeated here. Each module in the aforementioned network attack identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in a computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the corresponding operations of each module.

[0223] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram may be as follows: Figure 3As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium storing computer-readable instructions. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer-readable instructions implement a network attack identification method. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.

[0224] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the network attack identification method described above.

[0225] In one embodiment of the application, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the network attack identification method described above.

[0226] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0227] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0228] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for identifying network attacks, characterized in that, The method includes: Obtain the terminal to be identified and its device information; Based on the device information, a search is performed in a preset terminal region distribution structure to determine the behavior partition to which the terminal to be identified belongs. The terminal region distribution structure is obtained by dividing the behavior features of multiple terminals. Behavioral data of each terminal is extracted within the behavioral partition, and the reputation value of the terminal to be identified is calculated based on the behavioral data. Based on the reputation value of the terminal to be identified, the fusion weight of each terminal is determined, and the behavior data is weighted based on the fusion weight to obtain the aggregated behavior features of the behavior partition. The aggregated behavioral features and the behavioral data of the terminal to be identified are input into a preset risk identification model to obtain the risk probability of the terminal to be identified. Based on the risk probability, the network attack identification result of the terminal to be identified is determined; Before determining the behavior partition to which the terminal to be identified belongs by searching within a preset terminal region distribution structure based on the device information, the method further includes: Collect behavioral data from multiple terminals within a preset time window; From the behavioral data, the behavioral features of each terminal are extracted; The behavioral features are standardized and weighted to obtain the target behavioral features; Clustering is performed based on the similarity of the target behavioral features to form multiple behavioral partitions, and the terminal region distribution structure is constructed. The terminal region distribution structure includes a main chain and sub-chains. The process of clustering based on the similarity of the target behavior features to form multiple behavior partitions and constructing the terminal region distribution structure includes: A corresponding sub-chain is established for each behavior partition, and the sub-chain is used to record the behavior data of the terminal within the behavior partition; In the main chain, generate corresponding partition indexes for each row partition and store the verification information of each sub-chain; The main chain and each sub-chain are mapped through hash association to form the terminal area distribution structure.

2. The network attack identification method as described in claim 1, characterized in that, The calculation of the reputation value of the terminal to be identified based on the behavioral data includes: Based on the behavioral data, historical risk factors, community contribution factors, behavioral consistency factors, and group risk factors of the behavioral partition are extracted. The group risk factors are used to reflect the overall risk level of the behavioral partition. The historical risk factors are subjected to time decay smoothing to obtain the updated historical reputation value; The historical reputation value, community contribution factor, behavioral consistency factor, and group risk factor are calculated according to preset weights to obtain the reputation value.

3. The network attack identification method as described in claim 1, characterized in that, The determination of the fusion weight of each terminal based on the reputation value of the terminal to be identified includes: Using the reputation value of the terminal to be identified as the reference benchmark for weight calculation, the relative reputation level of each terminal is determined based on the reputation value of the terminal to be identified and the reputation values ​​of other terminals within the behavior partition to which the terminal to be identified belongs. Calculate the core weight of each terminal based on the relative reputation level; The core weights are non-linearly adjusted based on the reputation scores of each terminal to obtain the adjusted weights. The adjusted weights are normalized to obtain the fusion weights for each terminal.

4. The network attack identification method as described in claim 1, characterized in that, The risk identification model includes a first extraction layer, a second extraction layer, a third extraction layer, a feature fusion layer, and an inference layer. The step of inputting the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified includes: The behavioral data of the terminal to be identified is input into the first extraction layer to extract the behavioral features of the terminal to be identified; The aggregated behavioral features of the behavioral partitions are input into the second extraction layer to extract partition feature representations; Metadata information related to the terminal to be identified is input into the third extraction layer to extract context-related features; The behavioral features, partition feature representations, and context-related features are input into the feature fusion layer to obtain fused features; The fused features are input into the inference layer to obtain the risk probability.

5. The network attack identification method as described in claim 1, characterized in that, After determining the network attack identification result of the terminal to be identified based on the risk probability, the method further includes: The reputation value of the terminal to be identified is updated based on the risk probability to obtain the updated reputation value; Based on the updated reputation value, the terminal area distribution structure is adjusted.

6. A network attack identification device, characterized in that, The device includes: The first acquisition module is used to acquire the terminal to be identified and the device information of the terminal to be identified; The first retrieval module is used to perform a retrieval in a preset terminal region distribution structure based on the device information to determine the behavior partition to which the terminal to be identified belongs. The terminal region distribution structure is obtained by dividing the behavior features of multiple terminals. The first extraction module is used to extract behavioral data of each terminal within the behavioral partition and calculate the reputation value of the terminal to be identified based on the behavioral data. The first determining module is used to determine the fusion weight of each terminal based on the reputation value of the terminal to be identified, and to perform weighted processing on the behavior data based on the fusion weight to obtain the aggregated behavior features of the behavior partition. The first input module is used to input the aggregated behavioral features and the behavioral data of the terminal to be identified into a preset risk identification model to obtain the risk probability of the terminal to be identified. The second determining module is used to determine the network attack identification result of the terminal to be identified based on the risk probability. The device further includes: The first acquisition module is used to collect behavioral data from multiple terminals within a preset time window; The second extraction module is used to extract the behavioral features of each terminal from the behavioral data; The first processing module is used to standardize and weight the behavioral features to obtain the target behavioral features. The first partitioning module is used to perform clustering based on the similarity of the target behavior features, forming multiple behavior partitions, and constructing the terminal region distribution structure; The terminal region distribution structure includes a main chain and sub-chains, and the first partitioning module is further configured to: A corresponding sub-chain is established for each behavior partition, and the sub-chain is used to record the behavior data of the terminal within the behavior partition; In the main chain, generate corresponding partition indexes for each row partition and store the verification information of each sub-chain; The main chain and each sub-chain are mapped through hash association to form the terminal area distribution structure.

7. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and running on the processor, characterized in that, When the processor executes the computer-readable instructions, it implements the network attack identification method as described in any one of claims 1 to 5.

8. A readable storage medium having computer-readable instructions stored thereon, characterized in that, When the computer-readable instructions are executed by a processor, they implement the network attack identification method as described in any one of claims 1 to 5.

Images