Network attack detection method and device and firewall system

Abstract

The invention discloses a network attack detection method and device and a firewall system, and belongs to the field of network security. The method comprises the following steps: after a to-be-detected data set is obtained, obtaining an HTTP request load, a session sequence and a user behavior of the to-be-detected data set, then inputting the HTTP request load into a pre-trained CNN model to obtain a spatial feature, inputting the session sequence into a pre-trained LTSM model to obtain a time feature, inputting the user behavior into a pre-trained Transform model to obtain a semantic feature, and then fusing the spatial feature, the time feature and the semantic feature to obtain a target feature; finally, the type of the to-be-detected data set is determined based on the target feature, the different features of the to-be-detected data set are obtained through multiple models, whether attack exists in the to-be-detected data set or not can be accurately detected, the problems of wrong detection and missing detection are avoided, and the detection accuracy is greatly improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular, to a network attack detection method, apparatus, and firewall system. Background Technology

[0002] Web technology has only been around for a little over two decades, but it has already become the most popular application architecture on the internet. At the same time, the security of web application systems has always been a key focus of information security and network security. With the rapid development of web technology, traditional web application system security detection technologies can no longer fully meet current detection needs. This is mainly because traditional detection technologies are relatively limited, only able to accurately detect one type of attack, while suffering from missed or false detections for other types of attacks. Summary of the Invention

[0003] To overcome the shortcomings of existing technologies, this application provides a network attack detection method, device, and firewall system to address the problem that traditional detection technologies are relatively limited and can only accurately detect a certain type of attack, while missing or falsely detecting other types of attacks.

[0004] The technical solution adopted by this application to solve its technical problem is: Firstly, a network attack detection method is provided, including: Obtain the dataset to be detected, and based on the dataset, obtain the HTTP request payload, session sequence, and user behavior; The HTTP request payload is input into a pre-trained CNN model to obtain spatial features, the session sequence is input into a pre-trained LTSM model to obtain temporal features, and the user behavior is input into a pre-trained Transformer model to obtain semantic features. The target feature is obtained by fusing the spatial features, the temporal features, and the semantic features; The type of the dataset to be detected is determined based on the target features.

[0005] As an optional implementation of this application, the step of inputting the HTTP request payload into a pre-trained CNN model to obtain spatial features includes: The CNN model encodes and transforms the HTTP request payload; The transformed data is then reorganized to obtain a two-dimensional matrix; The grayscale image is obtained by normalizing the two-dimensional matrix. Spatial features are obtained by extracting features from the grayscale image.

[0006] As an optional implementation of this application, the step of inputting the session sequence into a pre-trained LTSM model to obtain temporal features includes: The session sequence is assigned to an independent session based on preset parameters, which include at least one of the following: source IP, source port, destination IP, destination port, and protocol; The length values ​​of the first preset number of data packets in each independent session are used as the packet length sequence; and the time difference between adjacent data packets is calculated as the time interval sequence. The packet length sequence and the time interval sequence are normalized and mapped to the [0,1] interval to obtain the time features.

[0007] As an optional implementation of this application, it also includes: The hidden state of the LSTM model at each time step t Calculate attention score : Attention scores are converted into weights using the softmax function. : Calculate the context vector based on the weights. : in, Let b represent the trainable weight matrix, and b represent the bias vector. Let T represent the hidden state at time step t, and let T represent the total length of the sequence.

[0008] As an optional implementation of this application, the step of inputting the user behavior into a pre-trained Transformer model to obtain semantic features includes: The Transformer model maps user behavior to a unified embedding space; Add positional information so that the model can perceive the positional relationships of elements in the sequence; We use h attention heads to compute attention representations for different subspaces in parallel; 𝑀𝑀 l in: Q is the query matrix, K is the key matrix, and V is the value matrix. , They are respectively The learnable parameter matrix corresponding to the attention head. For the output of the i-th attention head, For the final learnable parameter matrix, Used to concatenate the output features of h attention heads; A feedforward neural network is used, which consists of two fully connected layers with the ReLU activation function in between; each sub-layer is followed by a normalization layer and a residual connection. Average pooling compresses sequence features into vectors of fixed dimensions; The pooling output is mapped to a 128-dimensional feature vector to obtain semantic features.

[0009] As an optional implementation of this application, the step of fusing the spatial features, the temporal features, and the semantic features to obtain the target features includes: The spatial features, temporal features, and semantic features are normalized by feature dimension unification and layer normalization, respectively. Attention scores for the spatial features, temporal features, and semantic features are calculated using an attention network and then converted into weights. The spatial features, temporal features, and semantic features are weighted and summed according to their respective weights to obtain the weighted features. The weighted features are used as target features.

[0010] As an optional implementation of this application, it also includes: Intermediate layer feature maps of the spatial features, temporal features, and semantic features are obtained respectively. The intermediate layer feature maps are aligned and fused to obtain a fused feature map. By employing a shared network layer to learn the shared information of the fused feature map, the common features of the spatial features, the temporal features, and the semantic features are captured; Shared and private encoders are used to extract shared and specific information respectively, and the independence of the two is ensured by reconstructing decoder and orthogonal constraints to obtain target features.

[0011] As an optional implementation of this application, determining the type of the dataset to be detected based on the target features includes: Obtain the model's predicted anomaly probability, the distance from the target feature to the normal type center, and the anomaly scores related to the ups and downs. The confidence level is obtained by weighted summation of the anomaly probability, the distance, and the anomaly detection based on preset weights. If the confidence level is greater than the confidence level threshold, then it is determined that the dataset to be detected is under attack.

[0012] Secondly, a network attack detection device is provided, comprising: The data acquisition module is used to acquire the dataset to be detected, and to acquire HTTP request payload, session sequence and user behavior based on the dataset to be detected; The feature acquisition module is used to input the HTTP request payload into a pre-trained CNN model to obtain spatial features, input the session sequence into a pre-trained LTSM model to obtain temporal features, and input the user behavior into a pre-trained Transformer model to obtain semantic features. The feature fusion module is used to fuse the spatial features, the temporal features, and the semantic features to obtain the target features; An attack determination module is used to determine the type of the dataset to be detected based on the target features.

[0013] Thirdly, a firewall system is provided, including: At least one processor and at least one memory; The memory stores the executable instructions of the processor; The processor is configured to perform any of the network attack detection methods described above.

[0014] Beneficial effects: This application provides a network attack detection method, apparatus, and firewall system. After acquiring the dataset to be detected, the HTTP request payload, session sequence, and user behavior of the dataset are obtained. The HTTP request payload is then input into a pre-trained CNN model to obtain spatial features, the session sequence is input into a pre-trained LTSM model to obtain temporal features, and the user behavior is input into a pre-trained Transformer model to obtain semantic features. The spatial, temporal, and semantic features are then fused to obtain target features. Finally, the type of the dataset to be detected is determined based on the target features. This application uses multiple models to obtain different features of the dataset to be detected, enabling accurate detection of attacks within the dataset, avoiding false positives and false negatives, and significantly improving detection accuracy. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of a network attack detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a network attack detection device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] Reference Figure 1 This application provides a network attack detection method, including: S11: Obtain the dataset to be detected, and obtain the HTTP request payload, session sequence and user behavior based on the dataset to be detected.

[0019] S12: Input the HTTP request payload into a pre-trained CNN model to obtain spatial features, input the session sequence into a pre-trained LTSM model to obtain temporal features, and input the user behavior into a pre-trained Transformer model to obtain semantic features; The CNN model encodes and transforms the HTTP request payload; the transformed data is recombined to obtain a two-dimensional matrix; the two-dimensional matrix is ​​normalized to obtain a grayscale image; and the features of the grayscale image are extracted to obtain spatial features.

[0020] The LTSM model assigns session sequences to independent sessions based on preset parameters, which include at least one of the following: source IP, source port, destination IP, destination port, and protocol; the length values ​​of the first preset number of data packets in each independent session are used as the packet length sequence; and the time difference between adjacent data packets is calculated as the time interval sequence; the packet length sequence and the time interval sequence are normalized and mapped to the [0,1] interval to obtain the time features.

[0021] Furthermore, the LSTM model has hidden states at each time step t. Calculate attention score : Attention scores are converted into weights using the softmax function. : Calculate the context vector based on the weights. : in, Let b represent the trainable weight matrix, and b represent the bias vector. Let T represent the hidden state at time step t, and let T represent the total length of the sequence.

[0022] The Transformer model maps user behavior to a unified embedding space; Add positional information so that the model can perceive the positional relationships of elements in the sequence; We use h attention heads to compute attention representations for different subspaces in parallel; 𝑀𝑀 l in: Q is the query matrix, K is the key matrix, and V is the value matrix. , They are respectively The learnable parameter matrix corresponding to the attention head. For the output of the i-th attention head, For the final learnable parameter matrix, Used to concatenate the output features of h attention heads; A feedforward neural network is used, which consists of two fully connected layers with the ReLU activation function in between; each sub-layer is followed by a normalization layer and a residual connection. Average pooling compresses sequence features into vectors of fixed dimensions; The pooling output is mapped to a 128-dimensional feature vector to obtain semantic features.

[0023] S13: The spatial features, temporal features, and semantic features are fused to obtain the target features; Specifically, the spatial features, temporal features, and semantic features are normalized through feature dimension unification and layer normalization, respectively; attention scores for the spatial features, temporal features, and semantic features are calculated using an attention network and converted into weights; and the spatial features, temporal features, and semantic features are weighted and summed according to the weights to obtain weighted features. Intermediate layer feature maps of the spatial features, temporal features, and semantic features are obtained respectively. The intermediate layer feature maps are aligned and fused to obtain a fused feature map. A shared network layer is used to learn the shared information of the fused feature map to capture the general features of the spatial features, temporal features, and semantic features. A shared encoder and a private encoder are used to extract shared and specific information respectively, and the independence of the two is ensured by a reconstruction decoder and orthogonal constraints to obtain the target features.

[0024] S14: Determine the type of the dataset to be detected based on the target features.

[0025] The system obtains the anomaly probability predicted by the model, the distance from the target feature to the normal type center, and the anomaly score related to the ups and downs. Based on preset weights, it performs a weighted sum of the anomaly probability, the distance, and the anomaly score to obtain a confidence score. If the confidence score is greater than a confidence threshold, it is determined that the dataset to be detected is attacked. If the confidence score is less than or equal to the confidence threshold, it is determined that the dataset to be detected is not attacked.

[0026] The network attack detection method provided in this application, after acquiring the dataset to be detected, obtains the HTTP request payload, session sequence, and user behavior of the dataset. Then, the HTTP request payload is input into a pre-trained CNN model to obtain spatial features, the session sequence is input into a pre-trained LTSM model to obtain temporal features, and the user behavior is input into a pre-trained Transformer model to obtain semantic features. The spatial features, temporal features, and semantic features are then fused to obtain target features. Finally, the type of the dataset to be detected is determined based on the target features. This application's solution obtains different features of the dataset to be detected through multiple models, accurately detecting whether an attack exists in the dataset, avoiding false positives and false negatives, and greatly improving detection accuracy.

[0027] Based on the same inventive concept, such as Figure 2 As shown, a network attack detection device 20 is provided. Applying the network attack detection method provided in the above embodiments, the network attack detection device 20 includes: The data acquisition module 21 is used to acquire the dataset to be detected, and to acquire the HTTP request payload, session sequence and user behavior based on the dataset to be detected; The feature acquisition module 22 is used to input the HTTP request payload into a pre-trained CNN model to obtain spatial features, input the session sequence into a pre-trained LTSM model to obtain temporal features, and input the user behavior into a pre-trained Transformer model to obtain semantic features. Feature fusion module 23 is used to fuse the spatial features, the temporal features and the semantic features to obtain the target features; Attack determination module 24 is used to determine the type of the dataset to be detected based on the target features.

[0028] Based on the same inventive concept, this application also provides a firewall system, including: At least one processor and at least one memory; The memory stores the executable instructions of the processor; The processor is configured to execute the network attack detection method provided in the above embodiments.

[0029] To more clearly illustrate the proposed solution, a specific approach is provided below. The firewall (WAF) system mainly consists of four core modules: a feature extraction module responsible for extracting multi-dimensional features from HTTP request payloads, traffic timing, and user behavior; a multimodal feature fusion module integrating feature information from different sources through attention mechanisms and cross-modal interactions; a detection and classification module making attack judgments based on the fused features; and an adversarial defense module enhancing model robustness through adversarial training to resist adversarial attacks.

[0030] The feature extraction module includes three parallel feature extraction branches: the CNN branch processes the spatial features of HTTP request payloads, the LSTM branch processes the temporal features of long sequences of traffic packets and time intervals, and the Transformer branch processes the semantic features of user session behavior sequences.

[0031] The main advantage of the above approach lies in its ability to simultaneously capture different dimensions of attack characteristics. For example, SQL injection and XSS attacks have obvious characteristics in their payload content, and the CNN branch can effectively extract spatial features. DDoS and scanning attacks, on the other hand, exhibit abnormal traffic temporal patterns, and the LSTM branch can capture these temporal dependencies. For complex attacks such as session hijacking and privilege escalation, which often manifest as abnormal changes in user behavior, the Transformer branch can model these complex behavioral sequences.

[0032] It should be noted that network traffic data is high in dimensionality and noise, and directly using the original features for model training can lead to problems such as high computational complexity and overfitting. To improve feature quality and model efficiency, this application proposes a feature selection strategy based on Information Gain (IG).

[0033] Information gain measures the contribution of a feature to a classification task, and is defined as the reduction in information entropy before and after using feature A for partitioning. : in, Let represent the information entropy of dataset D. Let represent the conditional entropy given feature A. The information entropy of a dataset is defined as: Where m is the total number of categories, This represents the proportion of class i samples in the dataset.

[0034] The definition of conditional entropy is: Where v represents the number of possible values ​​for feature A. This represents a subset of feature A with respect to the j-th value.

[0035] This embodiment applies information gain calculation to the original feature set of network traffic data and employs the following feature selection strategy: information gain ranking, threshold filtering, correlation analysis, and feature combination. This strategy selects the most effective feature subset from the original features. Experimental results show that training the model using the selected feature subset reduces computational complexity by 60% while decreasing detection accuracy by only 1.2%, validating the effectiveness of the feature selection strategy.

[0036] Feature selection not only improves model efficiency but also enhances its interpretability. By analyzing the key features of different attack types, we can better understand attack behavior patterns and provide a basis for developing defense strategies.

[0037] Model branch design The spatial feature branch of the CNN is responsible for processing the HTTP request payload, extracting spatial feature patterns from the attack payload through a two-dimensional convolutional network. This study converts the HTTP request parameters into grayscale images and uses an improved ResNet-18 model for feature extraction.

[0038] To adapt to CNN processing, the HTTP request payload is first converted into an image format: request parameters are extracted, Hex encoding is performed, the data is reconstructed into a two-dimensional matrix, and then normalized to a grayscale image. Malicious requests exhibit distinctly different texture and structural features in the image, providing a foundation for CNN to extract spatial features.

[0039] This embodiment is based on the ResNet-18 architecture and features improvements including adapting to grayscale input, optimizing convolutional layer configuration, improving residual block structure, using skip connections, and optimizing pooling strategies. To improve CNN branch performance, optimization strategies such as small convolutional kernel stacking, residual connections, CBAM attention mechanism, regularization techniques, and data augmentation are employed.

[0040] Through the above design, the CNN branch can effectively capture abnormal patterns in HTTP request payloads, such as malformed requests, SQL injection, XSS scripts, and other attack characteristics.

[0041] The LSTM temporal feature branch is responsible for analyzing the temporal patterns of network traffic. It models the traffic sequence features through a long short-term memory network to capture the characteristic patterns of attack behavior in the time dimension.

[0042] 1. Temporal Feature Extraction The temporal characteristics of network traffic mainly include two key dimensions: packet length sequence and inter-packet time interval. The feature extraction process is as follows: (1) Session segmentation: Network traffic is segmented into independent sessions based on the five-tuple (source IP, source port, destination IP, destination port, protocol).

[0043] (2) Sequence construction: Packet length sequence: Extracts the length values ​​of the first 100 packets in each session.

[0044] Time interval sequence: Calculates the time difference between adjacent data packets.

[0045] (3) Sequence normalization: Min-Max normalization is used to map the feature values ​​to the interval [0,1].

[0046] (4) Sequence padding: For sessions with fewer than 100 packets, use zero padding to a fixed length.

[0047] The attack traffic exhibits clear regularity in packet length distribution and time intervals, providing an effective basis for LSTM detection.

[0048] This embodiment employs a bidirectional LSTM (Bi-LSTM) structure to simultaneously capture the forward and backward dependencies of the sequence. The network structure mainly includes: (1) Input layer: Receives two-dimensional sequence features of length 100 [100×2].

[0049] (2) Embedding layer: Maps the input features to a high-dimensional embedding space to enhance expressive power.

[0050] (3) Bi-LSTM layer: bidirectional LSTM structure with 128 hidden units in each direction.

[0051] (4) Peephole connection: An improved gating mechanism that introduces a memory state Ct-1 in the input gate, forget gate and output gate to enhance the ability to model long-term dependencies.

[0052] (5) Temporal attention layer: calculate attention weights for the hidden states at different time steps to enhance the feature representation of key time points.

[0053] (6) Fully connected layer: The LSTM output is flattened and then mapped to a 128-dimensional feature vector through a fully connected layer.

[0054] 1. Time attention mechanism To enhance the LSTM's ability to perceive key time points, this application's embodiments design a time attention mechanism, specifically implemented as follows: Hidden state at each time step t Calculate attention score : Attention scores are converted into weights using the softmax function. : Calculate the context vector based on the weights. : in, Let b represent the trainable weight matrix, and b represent the bias vector. Let T represent the hidden state at time step t, and let T represent the total length of the sequence.

[0055] The Transformer Behavior Feature branch is responsible for analyzing user session behavior sequences, modeling user access patterns through a self-attention mechanism, and identifying abnormal behavior characteristics. This branch is particularly suitable for detecting complex attack behaviors such as session hijacking, privilege escalation, and lateral movement.

[0056] User behavior characteristics mainly include access path sequences, request methods, response status codes, and access time intervals. The feature encoding process includes session identification, behavior sequence construction, feature encoding, and sequence merging. Observation reveals that attackers' access patterns often exhibit characteristics different from normal users, such as abnormal access paths and disordered status code changes.

[0057] This embodiment uses a Transformer encoder architecture to process user behavior sequences. The network structure mainly includes: (1) Input embedding layer: Maps multidimensional feature sequences to a unified embedding space.

[0058] (2) Position encoding: Add position information to enable the model to perceive the positional relationship of elements in the sequence.

[0059] (3) Multi-head self-attention layer: h attention heads are used to compute the attention representation of different subspaces in parallel; 𝑀𝑀 l in: Q is the query matrix, K is the key matrix, and V is the value matrix. , They are respectively The learnable parameter matrix corresponding to the attention head. For the output of the i-th attention head, For the final learnable parameter matrix, Used to concatenate the output features of h attention heads; (4) Feedforward Neural Network: It consists of two fully connected layers with the ReLU activation function in between.

[0060] (5) Layer normalization and residual connection: Add layer normalization and residual connection after each sub-layer to stabilize the training process.

[0061] (6) Pooling layer: Compresses sequence features into a fixed-dimensional vector through average pooling.

[0062] (7) Fully connected layer: maps the pooling output to a 128-dimensional feature vector.

[0063] The core advantage of Transformer lies in its self-attention mechanism, which can capture long-distance dependencies between elements in a sequence. In normal user behavior sequences, attention is relatively evenly distributed, while in attack sequences, attention is often focused on specific anomalous behaviors, such as access to sensitive resources or unauthorized operations. This difference provides strong evidence for the detection of anomalous behavior.

[0064] The Transformer behavior feature branch effectively captures long-distance dependencies and key patterns in user behavior sequences through the parallel computing capabilities of the self-attention mechanism, and has a strong ability to identify complex attack behaviors.

[0065] Feature fusion mechanism 1. Attention-weighted fusion method To effectively integrate complementary information from multimodal features, this study designs a weighted fusion method based on an attention mechanism. This method can adaptively adjust the importance weights of different feature branches, enhancing the model's ability to detect various attack types.

[0066] Multimodal features often have different scales and distributions, and direct fusion may lead to a single modality dominating the fusion result. To address this issue, we first normalize the features of each branch by unifying the feature dimensions and layer normalization. Then, we use a soft attention mechanism to calculate the weight coefficients of different modal features, concatenate the normalized feature vectors, calculate attention scores through an attention network and convert them into weights, and finally perform a weighted summation of the feature vectors based on the weights.

[0067] Different types of attacks behave differently across the feature branches. Analysis of the attention weights reveals the model's emphasis on different attack types: for web application attacks such as SQL injection and XSS, the CNN branch has significantly higher weights than other branches. For DDoS and scanning attacks involving abnormal traffic, the LSTM branch receives the highest weights. For complex attacks such as session hijacking and privilege escalation, the Transformer branch dominates. This dynamic weight adjustment mechanism allows the model to adaptively focus on the most relevant features based on the attack characteristics.

[0068] 2. Cross-modal feature interaction design Simple feature concatenation or weighted summation cannot fully utilize the interrelationships between multimodal features. To enhance the interaction between features, this study designs a cross-modal feature interaction mechanism, which includes three modules: feature map fusion, shared representation learning, and separation of modality-specific and shared information.

[0069] Feature map fusion: This is performed in the intermediate layer of feature extraction. The intermediate layer feature maps of different modalities are aligned (e.g., dimensional and semantic alignment). Through attention mechanisms / feature concatenation, etc., the interaction of different modalities at the abstract representation level is promoted, and the complementarity of features is enhanced. Shared representation learning: Based on the result of feature map fusion, shared network layers (such as shared fully connected layers and shared convolutional layers) are used to learn common information of multimodalities and capture common features between different modalities; Separation of modality-specific and shared information: Through a branching architecture (such as modality-specific subnetworks + shared subnetworks), "information common to all modalities" is separated from "information unique to a single modality", while retaining the representation of both types of information.

[0070] Feature map fusion is performed in the intermediate layer of feature extraction, facilitating the interaction of features from different modalities at the abstract representation level. Complementary enhancement of features from different modalities is achieved through extracting intermediate layer feature maps, feature map alignment, computation of cross-modal attention, and feature augmentation. Shared representation learning aims to learn a unified feature representation across modalities, capturing common information between different modalities through feature mapping, contrastive learning, and shared representation extraction. The information separation module better balances modality-specific and shared information through a shared encoder, a private encoder, a reconstruction decoder, and orthogonal constraints.

[0071] Cross-modal feature interaction mechanisms significantly improve the model's ability to detect complex attacks, especially hybrid attacks that simultaneously exhibit multiple anomalous features.

[0072] Based on the fused feature representation, this embodiment designs a multi-level classification decision mechanism to achieve accurate identification of different types of attacks. A two-level classification architecture is adopted, first distinguishing between normal and abnormal traffic, and then performing fine-grained classification on abnormal traffic. This hierarchical design reduces the difficulty of classification and improves the overall performance of the model.

[0073] To balance the detection rate and false alarm rate, a dynamic adjustment mechanism for the confidence threshold was designed. This mechanism dynamically optimizes the decision threshold through basic threshold setting, context-aware adjustment, and feedback adjustment. The anomaly score calculation comprehensively considers the model's predicted anomaly probability, the distance from the sample to the normal category center, and the context-related anomaly score, providing a quantitative assessment of the anomaly degree of traffic.

[0074] Specifically, the classification score is calculated by combining three dimensions of indicators with a weighted average (the specific weights need to be determined through experimental optimization): (1) The probability of an anomaly predicted by the model: the probability value (range 0-1) of a sample belonging to an anomaly category output by the model (such as a classifier). (2) Distance from the sample to the center of the normal category: The deviation of the sample from the "center of normal traffic characteristics" is calculated by clustering or feature space distance (such as Euclidean distance). The greater the distance, the higher the abnormal tendency. (3) Context-related anomaly score: The context anomaly correlation score is calculated by combining the context features of the session / traffic sequence in which the sample is located (such as the degree of anomaly of adjacent data packets and abrupt changes in traffic patterns).

[0075] The final classification score is a weighted sum of these three indicators with certain weights (the optimal weights need to be verified experimentally), used to determine whether a sample is abnormal.

[0076] The confidence threshold is dynamically optimized through a base threshold, context-aware adjustment, and feedback adjustment. Basic threshold setting: Initially, a baseline threshold (e.g., 0.6) is preset based on the model's detection rate and false alarm rate on the validation set. (2) Conditions for increasing: When the false alarm rate is too high in the current traffic scenario (normal traffic is mistakenly judged as abnormal), increase the threshold to reduce the sensitivity of abnormal judgment; (3) Conditions for reducing: When the false negative rate is too high in the current traffic scenario (abnormal traffic is not identified), reduce the threshold to improve the sensitivity of abnormal judgment; (4) Adjustment methods: Context-aware adjustment: Combine the context characteristics of the current traffic (such as traffic density and attack type distribution) and fine-tune according to preset rules (such as increasing the threshold by 0.05 for every 5% increase in false alarm rate); Feedback adjustment: Based on the feedback of historical judgment results (such as false alarm / missed detection cases reviewed by manual review), periodically iterate and optimize the threshold.

[0077] Furthermore, this application also conducted experimental verification, selecting three representative public datasets: UNSW-NB15 (Comprehensive Network Attack Detection), NSL-KDD (Classic Intrusion Detection Benchmark), and CSIC 2010 (Web Application Layer Attacks), which were used to train and evaluate different capabilities of the model, respectively. UNSW-NB15 is a comprehensive network attack dataset released by the Australian Cyber ​​Security Centre in 2015. It generates a mixture of real and synthetic network traffic using the IXIA PerfectStorm tool, containing 257,673 records across 49 features, covering nine major attack categories including fuzzers, backdoors, DoS, and exploits. The main advantage of this dataset lies in its modernity and comprehensiveness; this application primarily uses it to train and evaluate the LSTM branch to extract temporal dependency features.

[0078] NSL-KDD is an improved version of the classic KDD'99 dataset, addressing the redundancy and imbalance issues present in the original dataset. This dataset contains 41 features, with attack types primarily categorized into four types: DoS, Probe, R2L, and U2R. Although it was developed relatively early, it remains a crucial benchmark for intrusion detection research. This application combines this dataset with UNSW-NB15 to enhance the ability of LSTM branches to identify temporal patterns of network layer attack behaviors.

[0079] The CSIC 2010 HTTP dataset, released by the Spanish National Institute for Cyber ​​Security Research, is specifically designed for web application-layer attacks. It contains 36,000 HTTP requests, of which 7,000 are legitimate and 29,000 are attack requests, primarily including common web attacks such as SQL injection, XSS, and path traversal. This dataset focuses on web application-layer attacks and contains rich HTTP request payload information. This research primarily uses it to train a CNN branch, extracting spatial features of the attack payload by converting HTTP requests into images.

[0080] To adapt to multimodal learning frameworks, three public datasets underwent systematic processing, including data cleaning (removing invalid records, outliers, and redundant samples), feature extraction (extracting corresponding features according to the needs of different model branches), format conversion (converting traffic features into time series and HTTP requests into images), label unification (mapping attack types from different datasets to a unified classification system), and validation set partitioning (allocating 10% of the training data as a validation set). The processed datasets were then used to train different model branches: CSIC. 2010 was used for the CNN branch, UNSW-NB15 and NSL-KDD were used for the LSTM branch, and combined data were used for the Transformer branch and fusion model.

[0081] While publicly available datasets are comprehensive, they face challenges in terms of timeliness and struggle to cover the latest attack variants. To enhance the model's generalization ability to real-world attack scenarios and evaluate its robustness against adversarial attacks, this application generated multiple types of real-world web attack data in a laboratory environment. The attack environment included attack machines running the Kali Linux toolkit and target machines deploying vulnerable web applications, simulated by a hybrid host-only and NAT network connection in VMware. The attack tools are based on the Kali Linux toolkit, including... SQLMap, Hydra, XSSer, Nikto, Metasploit, and Nmap scripts are among the tools used. Custom attack data covers the OWASP Top 10 security threats, including various variants and parameter diversity, ensuring the model learns the essential characteristics of the attacks rather than their specific implementations. The generated adversarial attack samples are labeled "hard-to-detect samples" for adversarial training and validation, improving the model's robustness in real-world adversarial environments.

[0082] For multimodal deep learning models, this study designs three feature representation methods, targeting CNN, LSTM, and Transformer branches respectively. The payload feature representation employs an image-based approach, converting the HTTP request payload into a 64×64 grayscale image, enabling CNN to effectively extract spatial features. The processing flow includes payload extraction, hexadecimal encoding, numerical mapping, image matrix construction, and normalization. Different types of attacks exhibit unique visual patterns in image representation: SQL injection attacks typically show regular stripes or blocky structures. XSS attacks, with payloads containing JavaScript code, appear as dense median grayscale areas. Directory traversal attacks contain numerous path separators and dots, forming specific linear structures. Command injection attacks connect system commands and parameters to form a unique spatial distribution.

[0083] Temporal feature encoding primarily considers two key dimensions: packet length sequence and inter-packet time interval. It extracts the temporal features of network traffic through four steps: session segmentation, sequence construction, sequence normalization, and sequence completion. Different types of attacks exhibit significant differences in temporal features: DDoS attacks show a predominantly small packet distribution with extremely short and highly regular time intervals. Scanning attacks have relatively uniform packet lengths, and the time intervals exhibit a periodic pattern. Data penetration attacks have a high proportion of large packets in their packet length distribution, and the time intervals are irregular. Normal traffic shows significant variability in both packet length and time intervals, with no obvious pattern.

[0084] User behavior feature extraction reflects the patterns of interaction between visitors and web applications, and is of great significance for identifying complex attacks such as advanced persistent threats, session hijacking, and privilege escalation. The extraction process includes four steps: session identification, behavior sequence construction, feature encoding, and sequence normalization. Normal users and attackers typically exhibit significant differences in their behavior sequences: normal user behavior patterns conform to website navigation logic, involve regular resource requests, mostly use 2xx status codes, and have reasonable pauses at time intervals. Web crawler behavior is high-frequency and highly regular, with a wide but shallow range of URI accesses and very few POST requests. Scanning behavior attempts to access various potentially non-existent resources, has a high proportion of 4xx status codes, and exhibits extremely regular time intervals. Attack behavior includes requests with abnormal parameters, high-intensity attempts within a short period, and large fluctuations in parameter entropy values.

[0085] This application employs the information gain method to select the most discriminative feature subset, which includes four steps: calculating information gain, feature ranking, threshold selection, and correlation analysis. The most effective feature subset is selected from the original features of the UNSW-NB15 and NSL-KDD datasets. Traffic statistics features (such as packet length and duration) and connection pattern features (such as service count and host similarity rate) contribute the most to attack detection.

[0086] Data Preprocessing and Augmentation Accurate segmentation and labeling of network traffic are fundamental to constructing high-quality training data. This study designs a session-based traffic segmentation and labeling method, employing multi-level strategies for different protocols and application layer characteristics. These include network layer sessions based on five-tuples, application layer sessions based on cookies and session IDs, and advanced sessions based on user behavior patterns. Labeling rules include attack type mapping, multi-label processing, label propagation, and label verification to ensure the accuracy and consistency of labels.

[0087] To address common outliers, noise, and incomplete records in network data, this study designs a systematic outlier cleaning strategy, including format anomaly detection, statistical anomaly detection, temporal anomaly detection, and protocol anomaly detection. Based on the identified anomaly types, a deletion strategy (discarding records with severe format errors), a repair strategy (correcting records with minor format errors), a marking strategy (marking suspicious but uncertain outlier records), and aggregation processing (aggregating highly repetitive outlier traffic) are employed. For packet-level anomalies within a session, the Z-score method is used to detect the distribution of packet length and time interval. If the proportion of outlier packets in a session is >20%, the entire session is removed; if the proportion is <20%, only the outlier packets are removed. Through this systematic outlier cleaning, the quality and consistency of the dataset are significantly improved.

[0088] Cybersecurity datasets often suffer from severe class imbalance; for example, U2R attacks account for only 0.04% in NSL-KDD. This study employs SMOTE oversampling, class weight adjustment, hierarchical sampling, and a hybrid strategy to address class imbalance, aiming to achieve a more balanced distribution of samples across each class. To enhance the model's ability to identify attack variants, payload augmentation (random permutation, equivalent substitution, encoding transformation, annotation insertion, random noise), temporal augmentation (time stretching, packet length transformation, sequence truncation, sequence interpolation), and behavioral augmentation (session reassembly, line-of-sight enhancement) are implemented. Data augmentation techniques such as mutation, parameter perturbation, and state transformation.

[0089] Model training and optimization strategies The multimodal Web attack detection model constructed in this application integrates three branches: CNN, LSTM, and Transformer. The model uses hierarchical Dropout (CNN: 0.3, LSTM: 0.4, Transformer: 0.5) to enhance generalization ability, introduces BatchNorm in the CNN branch to accelerate convergence (improving convergence by 40%), and uses gradient clipping (norm 5.0) to prevent gradient explosion.

[0090] An innovative three-stage training approach was implemented: in the initial stage (rounds 1-10), the Transformer was frozen, and only CNN and LSTM were trained; in the middle stage (rounds 11-30), the Transformer was gradually unfrozen; and in the later stage (rounds 31-50), all modules were jointly optimized. This strategy improved the F1 score by 2.3%. The final deployment adopted a 5-fold cross-validation ensemble model, which further improved the F1 score by 1.2%.

[0091] To address the class imbalance problem, Focal Loss (γ=2.0) is used instead of traditional cross-entropy loss to enhance the learning ability for low-frequency attack types. In experiments, the F1-score improved from 0.64 to 0.78, and the low-frequency attack recognition rate increased by over 30%. The model is deployed in TorchScript format, with inference time controlled within 50ms, supporting concurrency of thousands of QPS.

[0092] Training parameters: CNN branch learning rate 1e-4, LSTM and Transformer branches 1e-3, batch size 64, AdamW optimizer (β1=0.9, β2=0.999, weight_decay=1e-2), cosine annealing learning rate scheduling (T_max=20) and warm-up (first 5 rounds), training for 50 rounds, with a patience=10 early stopping mechanism, the best model was obtained in the 46th round.

[0093] Evaluation indicator design The evaluation system covers three dimensions: detection accuracy uses basic indicators such as accuracy, precision, recall, and F1 score. Safety-specific indicators include detection rate (DR), false positive rate (FPR), false negative rate (FNR), and safety effectiveness.

[0094] Overall performance is evaluated using ROC curves, AUC values, PR curves, and AUPRC. Real-time performance is measured by inference latency, throughput (QPS), and resource consumption, and a real-time score is introduced to balance detection accuracy and real-time performance.

[0095] Multimodal model performance comparison Compared to the best single-modal approach (CNN), the multimodal fusion model improves the F1 score by 5% and the AUC score by 2%, with a particularly significant advantage in detection rate in the low false alarm rate region (FPR<0.05).

[0096] Among the dual-modal combinations, CNN+LSTM performed best (3% higher F1 score than single-modal), and complete trimodal fusion further improved performance by 2%.

[0097] Ablation experiments showed that the attention mechanism contributed the most (F1 score decreased by 1.7%). Although adversarial training had a limited improvement on the standard test set (0.9%), it significantly enhanced the detection rate of adversarial examples (by 15%). Feature selection and interactive fusion improved the F1 score by 1.1% and 1.3%, respectively, as shown in Table 1. Table 1 index F1 value AUC value (%) FPR < 0.05 detection rate Single-modal (CNN) 89.2 96.8 82.4 Bimodal (CNN+LSTM) 92.1（+3.0%） 97.5（+0.7%） 85.1 Trimodal fusion 94.3（+2.2%） 98.7（+1.2%） 89.3（+4.9%） The model achieves an F1 score exceeding 0.90 against obvious attacks such as DDoS, SQL injection, and scanning, and maintains an F1 score above 0.85 against complex attacks such as command execution, privilege escalation, and information leakage.

[0098] Confusion primarily occurred between similar attack types: unauthorized access and privilege escalation (false positive rate 7.2%), and XSS and command execution (false positive rate 5.8%). 18 The average detection rate of attack variants was 88.6% (a decrease of 6.3% compared to the original), with SQL injection variants showing the smallest decrease (3.1%) and command execution variants showing the largest decrease (9.8%).

[0099] Different branch models perform differently for specific attack types: CNN performs best in SQL injection and XSS, LSTM shows significant advantages in DDoS and scanning attacks, and Transformer excels in privilege escalation and unauthorized access detection. Multimodal fusion improves the F1 score by an average of 4.3%, with more significant improvements for complex attacks.

[0100] The fusion architecture achieves optimal detection results by dynamically adjusting the weights of each branch (the weight of the CNN for obvious attack features reaches 65%, and the weight of the Transformer for behavioral attack features exceeds 60%).

[0101] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0102] It should be noted that in the description of this application, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "a plurality of" means at least two.

[0103] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for detecting network attacks, characterized in that, include: Obtain the dataset to be detected, and based on the dataset, obtain the HTTP request payload, session sequence, and user behavior; The HTTP request payload is input into a pre-trained CNN model to obtain spatial features, the session sequence is input into a pre-trained LTSM model to obtain temporal features, and the user behavior is input into a pre-trained Transformer model to obtain semantic features. The target feature is obtained by fusing the spatial features, the temporal features, and the semantic features; The type of the dataset to be detected is determined based on the target features.

2. The method according to claim 1, characterized in that: The step of inputting the HTTP request payload into a pre-trained CNN model to obtain spatial features includes: The CNN model encodes and transforms the HTTP request payload; The transformed data is then reorganized to obtain a two-dimensional matrix; The grayscale image is obtained by normalizing the two-dimensional matrix. Spatial features are obtained by extracting features from the grayscale image.

3. The method according to claim 1, characterized in that: The step of inputting the session sequence into a pre-trained LTSM model to obtain temporal features includes: The session sequence is assigned to an independent session based on preset parameters, which include at least one of the following: source IP, source port, destination IP, destination port, and protocol; The length values ​​of the first preset number of data packets in each independent session are used as the packet length sequence; and the time difference between adjacent data packets is calculated as the time interval sequence. The packet length sequence and the time interval sequence are normalized and mapped to the [0,1] interval to obtain the time features.

4. The method according to claim 3, characterized in that, Also includes: The hidden state of the LSTM model at each time step t Calculate attention score : Attention scores are converted into weights using the softmax function. : Calculate the context vector based on the weights. : in, Let b represent the trainable weight matrix, and b represent the bias vector. Let T represent the hidden state at time step t, and let T represent the total length of the sequence.

5. The method according to claim 1, characterized in that: The step of inputting the user behavior into a pre-trained Transformer model to obtain semantic features includes: The Transformer model maps user behavior to a unified embedding space; Add positional information so that the model can perceive the positional relationships of elements in the sequence; We use h attention heads to compute attention representations for different subspaces in parallel; 𝑀𝑀 l in: Q is the query matrix, K is the key matrix, and V is the value matrix. , They are respectively The learnable parameter matrix corresponding to the attention head. For the output of the i-th attention head, For the final learnable parameter matrix, Used to concatenate the output features of h attention heads; A feedforward neural network is used, which consists of two fully connected layers with the ReLU activation function in between; each sub-layer is followed by a normalization layer and a residual connection. Average pooling compresses sequence features into vectors of fixed dimensions; The pooling output is mapped to a 128-dimensional feature vector to obtain semantic features.

6. The method according to claim 1, characterized in that: The process of fusing the spatial features, temporal features, and semantic features to obtain the target features includes: The spatial features, temporal features, and semantic features are normalized by feature dimension unification and layer normalization, respectively. Attention scores for the spatial features, temporal features, and semantic features are calculated using an attention network and then converted into weights. The spatial features, temporal features, and semantic features are weighted and summed according to their respective weights to obtain the weighted features. The weighted features are used as target features.

7. The method according to claim 6, characterized in that, Also includes: Intermediate layer feature maps of the spatial features, temporal features, and semantic features are obtained respectively. The intermediate layer feature maps are aligned and fused to obtain a fused feature map. By employing a shared network layer to learn the shared information of the fused feature map, the common features of the spatial features, the temporal features, and the semantic features are captured; Shared and private encoders are used to extract shared and specific information respectively, and the independence of the two is ensured by reconstructing decoder and orthogonal constraints to obtain target features.

8. The method according to claim 1, characterized in that: Determining the type of the dataset to be detected based on the target features includes: Obtain the model's predicted anomaly probability, the distance from the target feature to the normal type center, and the anomaly scores related to the ups and downs. The confidence level is obtained by weighted summation of the anomaly probability, the distance, and the anomaly detection based on preset weights. If the confidence level is greater than the confidence level threshold, then it is determined that the dataset to be detected is under attack.

9. A network attack detection device, characterized in that, include: The data acquisition module is used to acquire the dataset to be detected, and to acquire HTTP request payload, session sequence and user behavior based on the dataset to be detected; The feature acquisition module is used to input the HTTP request payload into a pre-trained CNN model to obtain spatial features, input the session sequence into a pre-trained LTSM model to obtain temporal features, and input the user behavior into a pre-trained Transformer model to obtain semantic features. The feature fusion module is used to fuse the spatial features, the temporal features, and the semantic features to obtain the target features; An attack determination module is used to determine the type of the dataset to be detected based on the target features.

10. A firewall system, characterized in that, include: At least one processor and at least one memory; The memory stores the executable instructions of the processor; The processor is configured to perform the method according to any one of claims 1-8.

Images