Computer network security protection method and system based on deep learning

Abstract

This invention discloses a computer network security protection method and system based on deep learning. It involves inputting standard multimodal data into a multi-channel collaborative deep detection model, using a TCN temporal convolutional network to extract spatial local feature vectors from network traffic, and analyzing long-range temporal dependencies in user behavior sequences using a network combining GRU gated recurrent units and a self-attention mechanism. A pre-trained DeBERTa large-scale language model is then used for deep semantic analysis to extract abnormal semantic feature vectors, resulting in multimodal feature vectors. These multimodal feature vectors are fused through cross-modal attention fusion and then input into a fully connected network for fusion analysis, outputting a threat score index. Based on the Apriori association algorithm, a computer network security protection strategy is generated according to the threat score index, and the strategy is executed accordingly. This provides efficient and rapid protection for network security.

Description

Technical Field

[0001] This invention relates to the field of computer network information security technology, and in particular to computer network security protection methods and systems based on deep learning. Background Technology

[0002] As cyberattacks become increasingly sophisticated, traditional rule-based and shallow machine learning-based cybersecurity systems are struggling to cope with new types of attacks. While deep learning technology has shown great potential in cybersecurity, its models are vulnerable to adversarial attacks, leading to a significant drop in detection accuracy. Existing defenses against adversarial examples typically employ adversarial training or model regularization, but these methods often sacrifice detection efficiency or generalization ability, failing to meet the demands of real-time cybersecurity protection. Current cybersecurity systems also suffer from significant shortcomings in data privacy protection; the difficulty in securely sharing attack signature data among organizations limits model training data and slows down the improvement of detection capabilities. This impacts the timeliness and accuracy of security responses. Summary of the Invention

[0003] The purpose of this invention is to solve the above-mentioned problems by designing a computer network security protection method and system based on deep learning.

[0004] To achieve the above objectives, the technical solution of the present invention further includes the following steps in the above-mentioned deep learning-based computer network security protection method:

[0005] Collect raw multimodal data from the network, and perform standardization, denoising, and annotation preprocessing on the collected data to obtain standard multimodal data;

[0006] Standard multimodal data is input into a multichannel collaborative deep detection model. Spatial local feature vectors in network traffic are extracted using a TCN temporal convolutional network. Long-term temporal dependencies in user behavior sequences are analyzed through a network combining GRU gated recurrent units and self-attention mechanisms. A pre-trained DeBERTa large-scale language model is used for deep semantic analysis to extract abnormal semantic feature vectors and obtain multimodal feature vectors.

[0007] Multimodal feature vectors are fused through cross-modal attention fusion and then input into a fully connected network for fusion analysis, outputting a threat score index.

[0008] Based on the Apriori correlation algorithm, a computer network security protection strategy is generated according to the threat score index, and the protection strategy is executed accordingly.

[0009] Furthermore, in the aforementioned deep learning-based computer network security protection method, the step of collecting multimodal raw data from the network and performing standardization, denoising, and annotation preprocessing on the collected data to obtain standard multimodal data includes:

[0010] Collect multimodal raw data from the network, including network traffic data, system log data, text data, and user behavior data;

[0011] Z-Score standardization is used to process numerical data in the original multimodal data, and one-hot encoding is used to convert non-numerical data into vector format to obtain standardized data.

[0012] Standardized multimodal data is obtained by filtering out sudden outliers in network traffic data in standardized data through a sliding window, deleting invalid logs by matching log data using regular expressions, removing meaningless words using a stop word list, and then performing annotation preprocessing.

[0013] Furthermore, in the aforementioned deep learning-based computer network security protection method, the step of inputting standard multimodal data into a multi-channel collaborative deep detection model and using a TCN temporal convolutional network to extract spatial local feature vectors from network traffic includes:

[0014] The standard multimodal data is segmented according to the time series to form a two-dimensional input matrix, including the number of samples, time step, and number of flow features;

[0015] The TCN network is configured with a kernel size of 3-5 and 3-5 convolutional layers. Each layer uses causal convolution and dilated convolution to expand the receptive field. The activation function is ReLU to avoid gradient vanishing. The network outputs a spatial local feature vector of the network flow through a global average pooling layer.

[0016] Furthermore, in the aforementioned deep learning-based computer network security protection method, the network analysis of long-range temporal dependencies in user behavior sequences through a combination of GRU gated recurrent units and self-attention mechanisms includes:

[0017] After converting user behavior sequence data into time-series vectors, the data is input into a GRU network. The network learns short-term dependencies of the sequence through reset and update gates and outputs time-series feature vectors.

[0018] The temporal feature vector output by GRU is used as the input of the self-attention layer. The attention weights of each time step feature and other time steps are calculated. After the weights are normalized, they are weighted and summed to obtain the behavioral feature vector containing long-range temporal dependencies.

[0019] Furthermore, in the aforementioned deep learning-based computer network security protection method, the step of using a pre-trained DeBERTa large-scale language model for deep semantic analysis to extract abnormal semantic feature vectors and obtain multimodal feature vectors includes:

[0020] The labeled text data is processed according to the DeBERTa input format. The text is converted into word embedding vectors through a pre-trained vocabulary. Position embedding and paragraph embedding are added to form a text input matrix.

[0021] Load the pre-trained DeBERTa model, freeze the parameters of the bottom 10-12 layers, and fine-tune the top 2-4 layers; capture the semantic context of the text through a bidirectional attention mechanism, add a binary classification task head to the output layer, and extract the abnormal semantic feature vector of the text data.

[0022] Furthermore, in the aforementioned deep learning-based computer network security protection method, the step of fusing multimodal feature vectors through cross-modal attention fusion and then inputting them into a fully connected network for fusion analysis to output a threat score index includes:

[0023] The multimodal feature vector is split into three submodal feature vectors: network traffic, user behavior, and text semantics. An attention calculation module is constructed, using each submodal feature vector as the query vector and the other two submodal feature vectors concatenated as the key vector and value vector. The attention weights of each submodal are calculated through multi-head attention.

[0024] The three submodal feature vectors are weighted and summed according to the attention weights to obtain the fused global feature vector.

[0025] Furthermore, in the aforementioned deep learning-based computer network security protection method, the step of generating a computer network security protection strategy based on the threat scoring index using the Apriori correlation algorithm and executing the protection strategy includes:

[0026] The Apriori association rule mining algorithm, combined with a threat knowledge base, was used to mine association rules between threat score index and threat type and protective measures, with a minimum support of 0.05 and a minimum confidence of 0.8.

[0027] A high-priority strategy is generated when the threat score index is ≥80, a medium-priority strategy is generated when the threat score index is 50-79, and a low-priority strategy is generated when the threat score index is <50.

[0028] Furthermore, in the deep learning-based computer network security protection system, the computer network security protection system includes the following modules:

[0029] The network data acquisition module is used to collect multimodal raw data from the network, and to perform standardization, noise reduction and annotation preprocessing on the collected data to obtain standard multimodal data.

[0030] The feature vector extraction module is used to input standard multimodal data into the multichannel collaborative deep detection model. It uses the TCN temporal convolutional network to extract spatial local feature vectors in network traffic, analyzes long-term temporal dependencies in user behavior sequences through a network combining GRU gated recurrent units and self-attention mechanism, and performs deep semantic analysis using a pre-trained DeBERTa large language model to extract abnormal semantic feature vectors and obtain multimodal feature vectors.

[0031] The threat index assessment module is used to fuse multimodal feature vectors through cross-modal attention fusion and then input them into a fully connected network for fusion analysis, outputting a threat score index.

[0032] The protection strategy generation module is used to generate computer network security protection strategies based on the threat score index using the Apriori correlation algorithm, and to execute the protection strategies accordingly.

[0033] Furthermore, in the deep learning-based computer network security protection system, the computer network security protection system includes the following sub-modules:

[0034] The computation submodule is used to split the multimodal feature vector into three submodal feature vectors: network traffic, user behavior, and text semantics. An attention computation module is constructed, using each submodal feature vector as a query vector and concatenating the other two submodal feature vectors as a key vector and a value vector. The attention weights of each submodal are calculated through multi-head attention.

[0035] The fusion submodule is used to perform a weighted summation of the feature vectors of the three submodalities based on the attention weights to obtain the fused global feature vector.

[0036] Furthermore, in the deep learning-based computer network security protection system, the computer network security protection system includes the following sub-modules:

[0037] The mining submodule is used to mine association rules between threat score index and threat type and protection measures by using the Apriori association rule mining algorithm combined with a threat knowledge base, with a minimum support of 0.05 and a minimum confidence of 0.8.

[0038] The generation submodule is used to trigger the generation of high-priority policies when the threat score index is ≥80, generate medium-priority policies when the threat score index is between 50 and 79, and generate low-priority policies when the threat score index is <50.

[0039] Its beneficial effects lie in significantly improving network security protection capabilities and efficiency through multi-stage collaborative optimization. At the data level, multimodal data collection covers key information such as traffic, logs, text, and behavior. Combined with standardization, targeted noise reduction, and manual + automatic annotation, it ensures data integrity and accuracy, laying a high-quality foundation for subsequent analysis and solving the problem of one-sidedness in single data dimensions. TCN accurately captures local features in the traffic space, while the combination of GRU and self-attention mechanisms effectively mines long-term temporal dependencies in user behavior. Pre-trained DeBERTa deeply analyzes text semantic anomalies, and multi-dimensional feature integration avoids information omissions, significantly improving the accuracy of anomaly identification and reducing false positives and false negatives. Cross-modal attention fusion highlights high-value modal information, and the fully connected network outputs a 0-100 quantitative threat score, making threat assessment more objective and intuitive, facilitating rapid tiered response. In the generation and execution of protection strategies, the association algorithm is combined with the knowledge base to dynamically match measures. High, medium and low priority strategies are accurately adapted to different threat levels. The strategies are issued and executed, and are optimized in real time through closed-loop monitoring. This improves the timeliness and adaptability of protection, reduces the loss of security incidents, and reduces the cost of manual operation and maintenance, providing efficient and rapid protection for network security. Attached Figure Description

[0040] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0041] Figure 1 This is a schematic diagram of the first embodiment of the computer network security protection method based on deep learning in this invention.

[0042] Figure 2 This is a schematic diagram of a second embodiment of the computer network security protection method based on deep learning in this invention.

[0043] Figure 3 This is a schematic diagram of the first embodiment of a deep learning-based computer network security protection system according to the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0045] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms "one," "an," and "this" used herein may also include the plural forms. It should be further understood that the terminology used in this specification includes the presence of features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0046] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 As shown, a deep learning-based computer network security protection method includes the following steps:

[0047] Step 101: Collect the original multimodal data from the network, and perform standardization, denoising, and annotation preprocessing on the collected data to obtain standard multimodal data;

[0048] Specifically, this embodiment collects multimodal raw data from the network, including network traffic data, system log data, text data, and user behavior data; it processes the numerical data in the multimodal raw data using Z-Score standardization, converts the non-numerical data into vector format using One-Hot encoding, and obtains standardized data; it filters out transient outliers in the network traffic data in the standardized data using a sliding window, deletes invalid logs using regular expression matching, removes meaningless words using a stop word list, and performs annotation preprocessing to obtain standard multimodal data.

[0049] In terms of multimodal raw data acquisition, data sources cover four core types: network traffic data, including TCP / UDP packets, traffic rates, and port usage, captured in real time using tools such as Wireshark and NetFlow; system log data, including server and terminal login logs, process startup logs, and file modification logs, extracted from operating system log modules or log management tools such as ELKStack; text data, such as security alert texts, vulnerability description documents, and user operation record texts, exported from security management platforms or business system databases; and behavioral data, including changes in user login IPs, operation frequency, and access resource paths, collected through user behavior monitoring plugins. The collection frequency is dynamically adjusted according to the data type: network traffic data is collected at the second level, system logs at the minute level, and text and behavioral data at the hour level, thereby ensuring the timeliness and completeness of the data.

[0050] Data preprocessing includes three aspects: In standardization, numerical data such as traffic rate and login count are standardized using Z-Score to unify the units, while non-numerical data such as port number and log level are converted to vector format using one-hot encoding to avoid the impact of data magnitude differences on model training. In denoising, network traffic data is filtered for transient outliers using a sliding window with a window size of 5-10 data points; log data is matched and deleted using regular expressions to remove invalid logs with incorrect formats or duplicate records; and text data is removed using the NLTK stop word list to remove meaningless words such as "zai" and corrected for typos using spelling correction tools. In the data labeling stage, a labeling rule base is first constructed to define normal and abnormal labels, such as marking port scanning and logins from different locations as abnormal, and routine office operations as normal. Then, a combination of manual and automatic labeling is used, with security experts labeling 10%-20% of the samples as seed data. The remaining data is then automatically labeled using a semi-supervised learning model such as LabelPropagation. Finally, the data is reviewed and corrected by experts to form a standard multimodal dataset.

[0051] Step 102: Input standard multimodal data into the multichannel collaborative deep detection model, use TCN temporal convolutional network to extract spatial local feature vectors in network traffic, analyze long-term temporal dependencies in user behavior sequences through a network combining GRU gated recurrent units and self-attention mechanism, and use a pre-trained DeBERTa large-scale language model for deep semantic analysis to extract abnormal semantic feature vectors and obtain multimodal feature vectors.

[0052] Specifically, in this embodiment, standard multimodal data is segmented according to time series to form a two-dimensional input matrix, including the number of samples, time step, and number of traffic features. The TCN network is set with a convolutional kernel size of 3-5 and 3-5 convolutional layers, each layer using causal convolution and dilated convolution to expand the receptive field. The ReLU activation function is selected to avoid gradient vanishing, and a spatial local feature vector of network traffic is output through a global average pooling layer. After converting user behavior sequence data into temporal vectors, it is input into the GRU network. Short-term dependencies of the sequence are learned through reset and update gates, and a temporal feature vector is output. The temporal feature vector output by GRU is used as the input of the self-attention layer. The attention weights of each time step feature with other time steps are calculated. After weight normalization, the weights are summed to obtain a behavior feature vector containing long-term temporal dependencies. The labeled text data is processed according to the DeBERTa input format. The text is converted into word embedding vectors through a pre-trained vocabulary, and position embedding and paragraph embedding are added to form a text input matrix. The pre-trained DeBERTa model is loaded, the parameters of the bottom 10-12 layers are frozen, and the top 2-4 layers are fine-tuned. The semantic context of the text is captured through a bidirectional attention mechanism, and a binary classification task head is added to the output layer to extract the abnormal semantic feature vectors of the text data.

[0053] In multi-channel feature extraction, the TCN temporal convolutional network and the GRU-self-attention combination mine key features from two dimensions: network traffic and user behavior. The TCN module takes network traffic data as the processing object, first dividing the standardized traffic data into temporal segments of 30-60 time steps, transforming it into a two-dimensional input matrix of [number of samples, time step size, number of traffic features], which preserves the temporal correlation of traffic data and adapts to the model input format. In terms of network structure, local traffic features are finely captured by convolutional kernels of 3-5, and 3-5 layers of convolution are stacked to deepen the feature extraction depth; each layer uses causal convolution to ensure that it does not depend on future data and fits the temporal characteristics of traffic, while introducing dilated convolution with a doubling dilation coefficient layer by layer to expand the receptive field without increasing the computational load; the ReLU activation function is used to avoid gradient vanishing, and finally, a 256-512 dimension local feature vector of network traffic space is output through a global average pooling layer. The GRU module, targeting user behavior sequences, first converts data such as login time, operation type, and access resource path into temporal vectors, which are then input into a two-layer GRU network with 128-256 hidden units. Through a reset gate, the forgetting and updating gates of historical information are controlled, adjusting the retention of current information to learn short-term behavioral dependencies, and outputting an initial temporal feature vector. To uncover long-term dependencies, the self-attention layer uses this vector as input to calculate the association weights of features at each time step. After normalization and weighted summation, a behavioral feature vector with the same feature dimensions as the TCN is output, achieving collaborative capture of short-term and long-term temporal dependencies.

[0054] For text data such as security alerts and vulnerability descriptions, the DeBERTa large-scale language model achieves accurate extraction of abnormal semantic features through preprocessing and fine-tuning. The preprocessing stage strictly adheres to the DeBERTa input specification: based on the DeBERTa-Base pre-trained vocabulary, the labeled text is segmented into tokens and converted into word embedding vectors. Position embeddings are also added to distinguish the order of tokens in the text and paragraph embeddings, dividing the text into different paragraphs. These three are concatenated to form a text input matrix of [text sequence length, embedding dimension], fully preserving the semantic, positional, and paragraph information of the text. The deep semantic analysis stage employs a pre-training + fine-tuning strategy: the DeBERTa-Base pre-trained model is loaded, freezing the parameters of the bottom 10-12 layers to retain general language features and avoid overfitting due to insufficient domain data. Only the parameters of the top 2-4 layers are fine-tuned to adapt to the semantics of the cybersecurity domain, such as identifying professional terms related to SQL injection and privilege escalation. Leveraging DeBERTa's bidirectional attention mechanism, the model can deeply capture the semantic context of text and accurately identify abnormal information hidden in the text. By adding a normal / abnormal binary classification task head to the output layer, the model can finally extract an abnormal semantic feature vector that is consistent with the dimensions of traffic and behavior features, thus supplementing key semantic dimension information for multimodal fusion.

[0055] The core objective of multimodal feature integration is to eliminate the differences between features from different modalities and construct a comprehensive and consistent feature representation. First, feature alignment is performed: the spatial local feature vector output by TCN, the behavioral feature vector output by GRU-self-attention, and the semantic feature vector output by DeBERTa are checked for dimensionality. Through linear transformation, dimensionality is increased or decreased to unify the three to the same dimension, typically 512, to avoid subsequent fusion bias caused by inconsistent dimensions. Simultaneously, L2 normalization is applied to various feature vectors to eliminate the magnitude differences between different modal features. For example, the numerical range of traffic features differs significantly from that of text features, ensuring that the three types of features have balanced weights in subsequent analysis and preventing any one type of feature from dominating the model's judgment. After alignment, the three normalized feature vectors are concatenated sequentially to finally form a multimodal feature vector with a dimension of 512 × 3 = 1536 dimensions. This vector integrates three core pieces of information: spatial local anomalies in network traffic, temporal dependency anomalies in user behavior, and semantic anomalies in text data. It not only breaks through the limitations of single-modal features, but also provides comprehensive and standardized feature inputs for subsequent cross-modal attention fusion and threat scoring index calculation, laying the foundation for accurate identification of cybersecurity threats.

[0056] Step 103: After fusing the multimodal feature vectors through cross-modal attention fusion, input them into a fully connected network for fusion analysis and output a threat score index;

[0057] Specifically, in this embodiment, the multimodal feature vector is split into three submodal feature vectors: network traffic, user behavior, and text semantics. An attention calculation module is constructed, using each submodal feature vector as a query vector, and concatenating the other two submodal feature vectors as a key vector and a value vector. The attention weights of each submodal are calculated through multi-head attention. The three submodal feature vectors are then weighted and summed according to the attention weights to obtain the fused global feature vector.

[0058] The core objective of cross-modal attention fusion is to break down the isolation of features from three submodalities: network traffic, user behavior, and text semantics. This is achieved through dynamic weight allocation, enabling the focusing and integration of key information. First, the multimodal feature vectors are split. The previously concatenated 1536-dimensional multimodal feature vector is precisely split into three submodal vectors based on their source: local feature vectors for network traffic space, long-term temporal feature vectors for user behavior, and anomaly feature vectors for text semantics. Each type of vector has 512 dimensions, ensuring the independence and integrity of each submodal feature. Then, a targeted attention calculation module is constructed, employing a design logic of alternating query vectors: any one submodal feature vector is used as the query vector Q to locate the feature dimensions that need to be focused on in that modality. The other two submodal feature vectors are concatenated in dimensional order to form the corresponding key vector K, used to establish intermodal feature associations, and the value vector V, used to provide specific information about the associated features. Weight calculation is performed using an 8-head multi-head attention mechanism. This mechanism splits Q, K, and V into 8 groups of sub-vectors and calculates attention scores in parallel. The final weights are then output through concatenation and linear transformation. This design can simultaneously capture fine-grained correlations between different modalities, avoiding the omission of correlation information by single-head attention. The final weight values ​​intuitively reflect the contribution of each sub-modality to anomaly detection. In the feature fusion stage, the feature vectors of the three sub-modalities are weighted and summed based on the calculated attention weights: the sub-modality feature with a higher weight has a larger proportion in the fusion result. This not only fully preserves the core anomaly information of each modality, but also highlights the key features of high-value modalities through weight tilting. The final output is still a 1536-dimensional global feature vector, providing comprehensive and focused feature input for subsequent threat scoring calculation.

[0059] Fully connected networks play a crucial role in transforming high-dimensional fusion features into intuitive quantitative threat scores, and their structural design and training process are both centered around accuracy and practicality. The network structure adopts a three-layer progressive design: the input layer directly receives a 1536-dimensional global fusion feature vector, ensuring lossless input of feature information; the hidden layer is divided into two levels. The first hidden layer has 1024 neurons, which is used to perform preliminary dimensionality reduction and high-order feature extraction on the high-dimensional fusion features, such as mining deep correlation patterns between traffic, behavior, and semantic features. The second hidden layer is reduced to 256 neurons to further compress the feature dimension and filter core threat-related information. Both hidden layers use LeakyReLU as the activation function. Compared with traditional ReLU, LeakyReLU retains a small gradient when the input value is negative, such as setting the slope to 0.01, which effectively avoids neuron death and ensures the stability of the network training process and the comprehensiveness of feature extraction; the output layer has only one neuron, which uses the Sigmoid activation function to constrain the network output value to the 0-1 range, and then maps it to the 0-100 range through linear scaling. This range division not only conforms to the intuitive human perception of threat level (0 represents no threat and 100 represents extremely high threat), but also provides a clear basis for subsequent protection strategy classification. The model training phase is based on a pre-labeled standard multimodal dataset, which contains a large number of samples labeled with normal / abnormal tags and corresponding real threat levels, providing a reliable learning basis for the network. The loss function used is mean squared error (MSE), which calculates the sum of the squared differences between the model's predicted score and the sample's real threat score to accurately measure prediction bias, adapting to continuous value regression tasks such as threat scoring. The optimizer used is Adam, whose adaptive learning rate mechanism effectively balances training speed and convergence accuracy. Combined with an initial learning rate of 1e-4, it avoids training oscillations caused by an excessively high initial learning rate, and also prevents prolonged training cycles due to an excessively low learning rate, ensuring the network quickly converges to its optimal state. After training, the new fused feature vector is input into the network, which outputs the corresponding threat score index: a score ≥80 indicates a high threat requiring immediate response; 50-79 indicates a medium threat requiring timely intervention; and <50 indicates a low threat requiring continuous monitoring. This grading standard aligns with the response priorities of actual network security protection, providing clear quantitative support for the generation of subsequent protection strategies.

[0060] Step 104: Generate computer network security protection strategies based on the threat score index using the Apriori correlation algorithm, and execute the protection strategies accordingly.

[0061] Specifically, in this embodiment, the Apriori association rule mining algorithm is used in conjunction with a threat knowledge base. The minimum support is set to 0.05 and the minimum confidence is set to 0.8 to mine association rules between the threat score index and the threat type and protection measures. If the threat score index is ≥80, a high-priority policy is generated. If the threat score index is between 50 and 79, a medium-priority policy is generated. If the threat score index is <50, a low-priority policy is generated.

[0062] The protection strategy generation is based on an association rule mining algorithm, combined with a threat knowledge base to achieve accurate matching of scores, threats, and measures. The Apriori association rule mining algorithm is chosen because it efficiently mines frequent itemsets in datasets, meeting the needs of association analysis between threat scores and protection measures. Simultaneously, a threat knowledge base is integrated, storing the mapping relationship between known threat types and corresponding protection measures, providing domain knowledge support for rule mining. In algorithm configuration, a minimum support of 0.05 and a minimum confidence of 0.8 are set to ensure that the confidence level of the rules is not less than 80%. For example, a threat score ≥ 80 indicates a high threat, and the confidence level must meet this threshold. These two parameters are used to filter effective association rules from massive amounts of data, establishing the correspondence between threat score indices, threat types, and protection measures. The strategy generation follows a hierarchical logic: when the threat score index is ≥80, it is judged as a high threat and a high-priority strategy is triggered, including immediately blocking abnormal IPs, isolating infected terminals, and disabling suspicious ports; when the score is in the 50-79 range, a medium-priority strategy is generated, such as sending security alerts to administrators, restricting the operation permissions of abnormal users, and initiating vulnerability scanning; when the score is <50, a low-priority strategy is executed, only recording operation logs and continuously monitoring the behavior of the target to prevent threat escalation. Furthermore, the algorithm dynamically optimizes in real time by combining the execution effects of historical protection strategies. For example, if abnormal traffic is still detected after blocking an IP, the blocking time for that IP will be extended; if a port is repeatedly threatened, protection rules for that port will be increased, such as restricting access IP ranges, to ensure that the strategy adapts to actual threat changes.

[0063] The protection strategy is executed rapidly through multiple channels, forming a closed-loop optimization mechanism based on real-time monitoring. The execution channels employ an API interface linkage mode, precisely distributing the generated protection strategy to the corresponding security devices according to device type: for IP blocking requirements, it is distributed to the firewall to execute IP blacklist configuration; for endpoint isolation requirements, it is distributed to the endpoint security software to trigger isolation mode; for port disabling requirements, it is distributed to the server to execute port closing commands. To ensure timeliness, the entire distribution and activation process is controlled within 1-3 minutes to avoid threat escalation due to delays. Execution effect monitoring constructs a closed-loop process: First, key data after policy execution is collected in real time, including traffic changes after IP blocking, process status of isolated endpoints, and access records after port disabling; this data is input into a multi-channel collaborative deep detection model to recalculate the threat score index, which serves as the basis for judging the policy's effectiveness. If the recalculated score drops to the safety threshold (<50), the strategy is deemed effective, and the strategy execution log is automatically recorded for auditing purposes. If the score does not drop or even rises, it indicates that the current strategy has not effectively contained the threat, and the strategy optimization mechanism is immediately triggered, such as changing protective measures or adding association rule dimensions, until the threat score drops to the safety threshold, forming a closed loop of execution-monitoring-optimization to ensure that the protection effect remains effective.

[0064] Its beneficial effects lie in significantly improving network security protection capabilities and efficiency through multi-stage collaborative optimization. At the data level, multimodal data collection covers key information such as traffic, logs, text, and behavior. Combined with standardization, targeted noise reduction, and manual + automatic annotation, it ensures data integrity and accuracy, laying a high-quality foundation for subsequent analysis and solving the problem of one-sidedness in single data dimensions. TCN accurately captures local features in the traffic space, while the combination of GRU and self-attention mechanisms effectively mines long-term temporal dependencies in user behavior. Pre-trained DeBERTa deeply analyzes text semantic anomalies, and multi-dimensional feature integration avoids information omissions, significantly improving the accuracy of anomaly identification and reducing false positives and false negatives. Cross-modal attention fusion highlights high-value modal information, and the fully connected network outputs a 0-100 quantitative threat score, making threat assessment more objective and intuitive, facilitating rapid tiered response. In the generation and execution of protection strategies, the association algorithm is combined with the knowledge base to dynamically match measures. High, medium and low priority strategies are accurately adapted to different threat levels. The strategies are issued and executed, and are optimized in real time through closed-loop monitoring. This improves the timeliness and adaptability of protection, reduces the loss of security incidents, and reduces the cost of manual operation and maintenance, providing efficient and rapid protection for network security.

[0065] Please see Figure 2 In deep learning-based computer network security protection methods, the process of collecting multimodal raw data from the network and performing standardization, denoising, and annotation preprocessing on the collected data to obtain standard multimodal data includes the following steps:

[0066] Step 201: Collect multimodal raw data from the network, including network traffic data, system log data, text data, and user behavior data;

[0067] Step 202: Use Z-Score standardization to process the numerical data in the original multimodal data, and use One-Hot encoding to convert the non-numerical data into vector format to obtain standardized data;

[0068] Step 203: Filter outstituent values ​​of network traffic data that occur instantaneously in the standardized data using a sliding window, delete invalid logs by matching log data using regular expressions, remove meaningless words using a stop word list, and then perform annotation preprocessing to obtain standard multimodal data.

[0069] The above describes embodiments of the deep learning-based computer network security protection method of the present invention. Please refer to [link / reference]. Figure 3 In a deep learning-based computer network security protection system, the system includes the following modules:

[0070] The network data acquisition module is used to collect multimodal raw data from the network, and to perform standardization, noise reduction and annotation preprocessing on the collected data to obtain standard multimodal data.

[0071] The feature vector extraction module is used to input standard multimodal data into the multichannel collaborative deep detection model. It uses the TCN temporal convolutional network to extract spatial local feature vectors in network traffic, analyzes long-term temporal dependencies in user behavior sequences through a network combining GRU gated recurrent units and self-attention mechanism, and performs deep semantic analysis using a pre-trained DeBERTa large language model to extract abnormal semantic feature vectors and obtain multimodal feature vectors.

[0072] The threat index assessment module is used to fuse multimodal feature vectors through cross-modal attention fusion and then input them into a fully connected network for fusion analysis, outputting a threat score index.

[0073] The protection policy generation module is used to generate computer network security protection policies based on the threat score index using the Apriori correlation algorithm, and to execute the protection policies accordingly.

[0074] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network security protection method based on deep learning, characterized in that, The computer network security protection method includes the following steps: Collect raw multimodal data from the network, and perform standardization, denoising, and annotation preprocessing on the collected data to obtain standard multimodal data; Standard multimodal data is input into a multichannel collaborative deep detection model. Spatial local feature vectors in network traffic are extracted using a TCN temporal convolutional network. Long-term temporal dependencies in user behavior sequences are analyzed through a network combining GRU gated recurrent units and self-attention mechanisms. A pre-trained DeBERTa large-scale language model is used for deep semantic analysis to extract abnormal semantic feature vectors and obtain multimodal feature vectors. Multimodal feature vectors are fused through cross-modal attention fusion and then input into a fully connected network for fusion analysis, outputting a threat score index. Based on the Apriori correlation algorithm, a computer network security protection strategy is generated according to the threat scoring index, and the protection strategy is executed accordingly. The step of inputting standard multimodal data into a multi-channel collaborative deep detection model and using a TCN temporal convolutional network to extract spatial local feature vectors from network traffic includes: The standard multimodal data is segmented according to the time series to form a two-dimensional input matrix, including the number of samples, time step, and number of flow features; The TCN network is configured with a kernel size of 3-5 and 3-5 convolutional layers. Each layer uses causal convolution and dilated convolution to expand the receptive field. The activation function is ReLU to avoid gradient vanishing. The network outputs a spatial local feature vector of the network flow through a global average pooling layer. The network analysis of long-range temporal dependencies in user behavior sequences using a combination of GRU gated recurrent units and self-attention mechanisms includes: After converting user behavior sequence data into time-series vectors, the data is input into a GRU network. The network learns short-term dependencies of the sequence through reset and update gates and outputs time-series feature vectors. The temporal feature vector output by GRU is used as the input of the self-attention layer. The attention weights of each time step feature and other time steps are calculated. After the weights are normalized, they are weighted and summed to obtain the behavioral feature vector containing long-term temporal dependencies. The method employs a pre-trained DeBERTa large-scale language model for deep semantic analysis, extracts anomalous semantic feature vectors, and obtains multimodal feature vectors, including: The labeled text data is processed according to the DeBERTa input format. The text is converted into word embedding vectors through a pre-trained vocabulary. Position embedding and paragraph embedding are added to form a text input matrix. Load the pre-trained DeBERTa model, freeze the parameters of the bottom 10-12 layers, and fine-tune the top 2-4 layers; capture the semantic context of the text through a bidirectional attention mechanism, add a binary classification task head to the output layer, and extract the abnormal semantic feature vector of the text data.

2. The computer network security protection method based on deep learning as described in claim 1, characterized in that, The multimodal raw data in the acquisition network is preprocessed by standardization, denoising, and annotation to obtain standard multimodal data, including: Collect multimodal raw data from the network, including network traffic data, system log data, text data, and user behavior data; Z-Score standardization is used to process numerical data in the original multimodal data, and one-hot encoding is used to convert non-numerical data into vector format to obtain standardized data. Standardized multimodal data is obtained by filtering out sudden outliers in network traffic data in standardized data through a sliding window, deleting invalid logs by matching log data using regular expressions, removing meaningless words using a stop word list, and then performing annotation preprocessing.

3. The computer network security protection method based on deep learning as described in claim 1, characterized in that, The multimodal feature vectors are fused through cross-modal attention fusion and then input into a fully connected network for fusion analysis, outputting a threat score index, including: The multimodal feature vector is split into three submodal feature vectors: network traffic, user behavior, and text semantics. An attention calculation module is constructed, using each submodal feature vector as the query vector and the other two submodal feature vectors concatenated as the key vector and value vector. The attention weights of each submodal are calculated through multi-head attention. The three submodal feature vectors are weighted and summed according to the attention weights to obtain the fused global feature vector.

4. The computer network security protection method based on deep learning as described in claim 1, characterized in that, The method of generating a computer network security protection strategy based on the threat scoring index using the Apriori correlation algorithm, and executing the protection strategy accordingly, includes: The Apriori association rule mining algorithm, combined with a threat knowledge base, was used to mine association rules between threat score index and threat type and protective measures, with a minimum support of 0.05 and a minimum confidence of 0.

8. A high-priority strategy is generated when the threat score index is ≥80, a medium-priority strategy is generated when the threat score index is 50-79, and a low-priority strategy is generated when the threat score index is <50.

5. A deep learning-based computer network security protection system, used to execute the deep learning-based computer network security protection method as described in claim 1, characterized in that, The computer network security protection system includes the following modules: The network data acquisition module is used to collect multimodal raw data from the network, and to perform standardization, noise reduction and annotation preprocessing on the collected data to obtain standard multimodal data. The feature vector extraction module is used to input standard multimodal data into the multichannel collaborative deep detection model. It uses the TCN temporal convolutional network to extract spatial local feature vectors in network traffic, analyzes long-term temporal dependencies in user behavior sequences through a network combining GRU gated recurrent units and self-attention mechanism, and performs deep semantic analysis using a pre-trained DeBERTa large language model to extract abnormal semantic feature vectors and obtain multimodal feature vectors. The threat index assessment module is used to fuse multimodal feature vectors through cross-modal attention fusion and then input them into a fully connected network for fusion analysis, outputting a threat score index. The protection strategy generation module is used to generate computer network security protection strategies based on the threat score index using the Apriori correlation algorithm, and to execute the protection strategies accordingly.

6. The computer network security protection system based on deep learning as described in claim 5, characterized in that, The computer network security protection system includes the following sub-modules: The computation submodule is used to split the multimodal feature vector into three submodal feature vectors: network traffic, user behavior, and text semantics. An attention computation module is constructed, using each submodal feature vector as a query vector and concatenating the other two submodal feature vectors as a key vector and a value vector. The attention weights of each submodal are calculated through multi-head attention. The fusion submodule is used to perform a weighted summation of the feature vectors of the three submodalities based on the attention weights to obtain the fused global feature vector.

7. The computer network security protection system based on deep learning as described in claim 5, characterized in that, The computer network security protection system includes the following sub-modules: The mining submodule is used to mine association rules between threat score index and threat type and protection measures by using the Apriori association rule mining algorithm combined with a threat knowledge base, with a minimum support of 0.05 and a minimum confidence of 0.

8. The generation submodule is used to trigger the generation of high-priority policies when the threat score index is ≥80, generate medium-priority policies when the threat score index is between 50 and 79, and generate low-priority policies when the threat score index is <50.

Images