Network security situation awareness prediction method and device, medium and equipment
By extracting features and determining importance weights from network traffic data, and combining this with a long short-term memory network model, the problem of low prediction accuracy in complex network environments using traditional methods is solved, achieving more accurate network security situation prediction and effective threat identification.
Patent Information
- Application Number
- CN202511379063.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-25
- Publication Date
- 2026-01-20
AI Technical Summary
Traditional network security situational awareness and prediction methods struggle to accurately capture dynamic changes in network traffic and potential security threats in complex and ever-changing network environments, resulting in low prediction accuracy.
By collecting network traffic data, preprocessing it, extracting feature data, determining the importance weights of the feature data based on their impact on the current network security situation, generating weighted feature data, and then using a network security situation prediction model based on long short-term memory networks for prediction.
It improves the accuracy of network security situation prediction, reduces false alarm and false negative rates, provides timely early warning information, helps formulate scientific security protection strategies, and ensures the safe and stable operation of network systems.
Smart Images
Figure CN121367595A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and in particular to a network security situation awareness prediction method and device, medium and equipment. BACKGROUND
[0002] With the rapid development of Internet technology, the network scale is continuously expanding, the network structure is increasingly complex, and network security threats are increasingly diversified and concealed. Network security situation awareness prediction, as an important means to ensure network security, aims to discover potential security threats in advance and provide decision support for network security protection.
[0003] Traditional network security situation awareness prediction methods, such as methods based on statistical models or simple machine learning models, often rely on artificially defined features and fixed model structures. These methods are difficult to accurately capture the dynamic changes of network traffic and potential security threats when facing complex and variable network environments, and have the problem of low prediction accuracy. SUMMARY
[0004] To solve at least one of the above technical problems, the present application provides a network security situation awareness prediction method and device, medium and equipment.
[0005] According to a first aspect, the present application provides a network security situation awareness prediction method, which includes:
[0006] Collecting network traffic data and preprocessing the network traffic data;
[0007] Extracting features from the preprocessed network traffic data to obtain feature data;
[0008] Determining the importance weight of each feature data according to the influence degree of the current network security situation of each feature data;
[0009] Generating corresponding weighted feature data according to each feature data and the importance weight of the feature data;
[0010] Predicting the network security situation according to the weighted feature data.
[0011] In one embodiment, the generating of the corresponding weighted feature data according to each feature data and the importance weight of the feature data includes multiplying each feature data with the importance weight of the feature data to obtain the corresponding weighted feature data.
[0012] In an embodiment, the network security posture prediction according to the weighted feature data comprises: inputting the weighted feature data into a pre-trained network security posture prediction model to obtain network security posture prediction data in a preset future time period; and the network security posture prediction model is trained based on a long short-term memory network.
[0013] In an embodiment, the importance weight of each feature data is determined according to the influence degree of the feature data on the current network security posture, which comprises: determining the importance weight of each feature data according to the influence degree of the feature data on the current network security posture based on an attention mechanism.
[0014] In an embodiment, the importance weight of each feature data is calculated by the following calculation formula:
[0015]
[0016] wherein, b is a learnable bias parameter, x t is the feature data, W x is a learnable weight matrix corresponding to the feature data, h t-1 is a hidden state vector at a previous moment, W h is a learnable weight matrix corresponding to the hidden state vector, v is a preset learnable parameter, e t is an intermediate variable, α t is the importance weight of x t , n is a total number of features, e tj is the jth feature data in the n feature data.
[0017] In an embodiment, the preprocessing of the network traffic data comprises: removing noise data and invalid data in the network traffic data.
[0018] In an embodiment, the type of the data feature comprises at least one of the following types: a traffic statistical feature type, a connection feature type and a host behavior feature type.
[0019] According to a second aspect, an embodiment of the network security posture perception prediction device comprises:
[0020] a data collection module, configured to collect network traffic data and preprocess the network traffic data;
[0021] a feature extraction module, configured to extract features from the preprocessed network traffic data to obtain feature data;
[0022] a weight determination module, configured to determine an importance weight of each feature data according to an influence degree of the feature data on a current network security posture.
[0023] a feature generation module configured to generate corresponding weighted feature data according to each feature data and the importance weight of the feature data;
[0024] a situation prediction module configured to perform network security situation prediction according to the weighted feature data.
[0025] According to a third aspect, an embodiment of the present application provides a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method according to the first aspect.
[0026] According to a fourth aspect, an embodiment of the present application provides a computing device including a memory and a processor, the memory having stored therein executable code, and the processor, when executing the executable code, implements the method according to the first aspect.
[0027] The network security situation awareness prediction method and device, medium and equipment provided by the embodiments of the present application can extract features from preprocessed network traffic data to obtain feature data, determine the importance weight of each feature data according to the influence degree of the feature data on the current network security situation, generate corresponding weighted feature data according to each feature data and the importance weight of the feature data, and perform network security situation prediction according to the weighted feature data. It can be seen that the embodiments of the present application can automatically adjust the importance weight of different feature data according to the influence degree of the feature data on the current network security situation, and can pay more attention to the features that have important influence on network security situation prediction when performing prediction, thereby improving the accuracy of prediction. Moreover, the embodiments of the present application are suitable for complex and changeable network environment, have stronger recognition and prediction ability for different types of network attack modes and security threats, and effectively reduce the false positive rate and the false negative rate. Moreover, accurate network security situation awareness prediction can provide timely early warning information for network security management personnel, help them to develop scientific and reasonable security protection strategies, effectively prevent and cope with various network security threats, and ensure the safe and stable operation of network systems. BRIEF DESCRIPTION OF DRAWINGS
[0028] Figure 1 FIG. 1 is a flowchart of a network security situation awareness prediction method according to an embodiment of the present application;
[0029] Figure 2 FIG. 2 is a structural block diagram of a network security situation awareness prediction device according to an embodiment of the present application;
[0030] Figure 3 FIG. 3 is an internal structure diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION
[0031] In a first aspect, an embodiment of the present application provides a network security situation awareness prediction method, referring to Figure 1 The method comprises:
[0032] S110, collecting network traffic data and preprocessing the network traffic data.
[0033] Specifically, a network packet capturing tool can be used to capture the network traffic data, and the network traffic data includes at least one of source IP, source port, destination IP, destination port, protocol type, packet size, and timestamp.
[0034] In S110, the preprocessing of the network traffic data can include removing noise data and invalid data in the network traffic data. For example, repeated data packets, incorrect data packets, and data unrelated to network security situation awareness are removed.
[0035] S120, extracting features from the preprocessed network traffic data to obtain feature data.
[0036] It can be understood that feature extraction is a process of extracting features related to network security situation awareness from cleaned data.
[0037] In an optional implementation, the type of data features can include at least one of the following types: traffic statistical feature type, connection feature type, and host behavior feature type.
[0038] The feature data under the traffic statistical feature type includes at least one of the number of data packets per unit time, the number of bytes, and the proportion of data packets of different protocol types.
[0039] The feature data under the connection feature type includes at least one of connection duration, connection state (such as establishment, closure, timeout, etc.), and connection direction.
[0040] The feature data under the host behavior feature type includes at least one of the active time of the host, the number of accessed IP addresses, the amount of sent and received data.
[0041] In actual scenarios, data normalization is also performed after feature extraction. Since the dimensions and value ranges of different features can differ greatly, in order to eliminate the influence of such differences on prediction, the extracted feature data needs to be normalized. Common normalization methods include Min-Max normalization method and Z-Score normalization method.
[0042] S130, determining the importance weight of each feature data according to the influence degree of the feature data on the current network security situation.
[0043] It can be understood that at each time step, the importance weight of the feature data is determined according to the influence degree of each feature data on the current network situation.
[0044] In an optional implementation, the determining, in S130, of the importance weight of each feature data according to the influence degree of the feature data on the current network security situation can include: determining the importance weight of each feature data according to the influence degree of the feature data on the current network security situation based on an attention mechanism.
[0045] Of course, in addition to the above method based on the attention mechanism to calculate the importance weight of the feature data, a gradient-based method can also be used to calculate the importance weight of the feature data.
[0046] In an optional implementation, in the case where the network security situation prediction model is trained based on a long short-term memory network in the subsequent situation prediction process, the importance weight of each feature data can be calculated based on the attention mechanism in S130 by using the following calculation formula:
[0047]
[0048] In the formula, b is a learnable bias parameter, x t is the feature data, W x is a learnable weight matrix corresponding to the feature data, h t-1 is a hidden state vector at the previous moment, W h is a learnable weight matrix corresponding to the hidden state vector, v is a preset learnable parameter, e t is an intermediate variable, a t is the importance weight of x t , n is the total number of features, e tj is the jth feature data in the n feature data.
[0049] The long short-term memory network (LSTM) is a special recurrent neural network and has strong ability in processing sequence data, and can effectively solve the problems of gradient disappearance and gradient explosion in traditional recurrent neural networks.
[0050] As can be seen, in the above calculation process, not only the feature data and the hidden state vector are considered, but also other feature data, so that the calculation accuracy of the importance weight can be improved.
[0051] In S140, a corresponding weighted feature data is generated according to each feature data and the importance weight of the feature data.
[0052] In an optional implementation, the generating, in S140, the corresponding weighted feature data according to each feature data and the importance weight of the feature data can include: multiplying each feature data by the importance weight of the feature data to obtain the corresponding weighted feature data.
[0053] It can be seen that the importance weight calculated in S130 is fused with the feature data in the following manner: the importance weight is multiplied by the corresponding feature data to obtain the weighted feature data.
[0054] In S150, the network security posture prediction is performed according to the weighted feature data.
[0055] In an optional implementation, the performing, in S150, the network security posture prediction according to the weighted feature data can include: inputting the weighted feature data into a pre-trained network security posture prediction model to obtain network security posture prediction data in a preset future time period; and the network security posture prediction model is trained based on a long short-term memory network.
[0056] It can be seen that the network security posture prediction is performed using the network security posture prediction model and the weighted feature data, and the network security posture prediction data in the preset future time period obtained by the prediction can include at least one of a security threat level and a possible attack type.
[0057] It can be understood that, before the network security posture prediction model is used, the network security posture prediction model needs to be trained. The network security posture prediction model is trained based on a long short-term memory network, and the long short-term memory network includes an input gate, a forget gate, an output gate and a cell state. The input gate controls the input of new information, the forget gate controls the forgetting of old information, and the output gate controls the output of the cell state.
[0058] It can be understood that, in the training process of the network security posture prediction model, the historical feature data is processed by S110-S140 to obtain weighted historical feature data corresponding to the historical feature data, and then the long short-term memory network is trained using the weighted historical feature data. In the training process, cross-validation and other methods can be used to evaluate the performance of the model, and the hyperparameters of the model, such as the learning rate, the batch size, the number of hidden layer neurons, etc., are adjusted according to the evaluation results. The back propagation algorithm and the gradient descent optimization algorithm are used to update the parameters of the model to minimize the prediction error of the model. By optimizing the model structure and parameters, the training efficiency and generalization ability of the model are improved, the consumption of computing resources is reduced, and the model is more efficient and stable in practical application. After the training is completed, the model can be applied.
[0059] The embodiments of the present application have the following beneficial effects:
[0060] 1. Improve prediction accuracy: the importance weight of different feature data can be automatically adjusted according to the dynamic change of network traffic, so that the model pays more attention to the features that have important influence on network security situation prediction, thereby improving the accuracy of prediction. It is suitable for complex and variable network environment, and has stronger identification and prediction ability for different types of network attack modes and security threats, effectively reducing the false positive rate and false negative rate.
[0061] 2. Provide strong support for network security protection: accurate network security situation awareness prediction can provide timely warning information for network security management personnel, help them develop scientific and reasonable security protection strategies, effectively prevent and cope with various network security threats, and ensure the safe and stable operation of network system.
[0062] In a second aspect, the embodiments of the present application provide a network security situation awareness prediction device, see Figure 2 The device 100 comprises:
[0063] The data acquisition module 110 is configured to acquire network traffic data and pre-process the network traffic data.
[0064] The feature extraction module 120 is configured to extract features from the pre-processed network traffic data to obtain feature data.
[0065] The weight determination module 130 is configured to determine the importance weight of each feature data according to the influence degree of the feature data on the current network security situation.
[0066] The feature generation module 140 is configured to generate corresponding weighted feature data according to each feature data and the importance weight of the feature data.
[0067] The situation prediction module 150 is configured to predict the network security situation according to the weighted feature data.
[0068] In one embodiment, the feature generation module is specifically configured to multiply each feature data and the importance weight of the feature data to obtain corresponding weighted feature data.
[0069] In one embodiment, the situation prediction module is specifically configured to input the weighted feature data into a pre-trained network security situation prediction model to obtain network security situation prediction data in a preset future time period; wherein the network security situation prediction model is trained based on a long short-term memory network.
[0070] In one embodiment, the weight determination module is specifically configured to determine the importance weight of each feature data based on an attention mechanism according to the influence degree of the feature data on the current network security situation.
[0071] In one embodiment, the weight determination module is specifically configured to calculate the importance weight of each feature data by using the following calculation formula:
[0072]
[0073] wherein b is a learnable bias parameter, x t is the feature data, W x is a learnable weight matrix corresponding to the feature data, h t-1 is a hidden state vector at a previous time, W h is a learnable weight matrix corresponding to the hidden state vector, v is a preset learnable parameter, e t is an intermediate variable, a t is the importance weight of x t , n is the total number of features, e tj is the jth feature data in the n feature data.
[0074] In one embodiment, the pre-processing of the network traffic data in the data collection module includes removing noise data and invalid data in the network traffic data.
[0075] In one embodiment, the type of data feature includes at least one of the following types: a traffic statistical feature type, a connection feature type, and a host behavior feature type.
[0076] It can be understood that the explanation of the related content in the device, the specific implementation, the beneficial effects, the examples, and the like provided by the embodiments of the present application can refer to the corresponding parts in the method provided by the first aspect, which will not be repeated here.
[0077] In a third aspect, a computer device is provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in Figure 3As shown in the figure. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium during the running process. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for wired or wireless communication with the external terminal, and the wireless mode can be realized through WIFI, mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. The computer program is executed by the processor to realize a volume adjustment method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.
[0078] Those skilled in the art can understand that, Figure 3 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.
[0079] In an optional embodiment, Figure 3 The computer device shown in the figure can be the display device described above, for example, a smart television.
[0080] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.
[0081] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.
[0082] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.
[0083] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the range disclosed in the present application.
[0084] The above embodiments only express several implementation ways of the present application, and the description is specific and detailed, but it should not be understood as a limitation to the patent scope of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.
Claims
1. A method for predicting network security situation awareness, characterized in that, include: Collect network traffic data and preprocess the network traffic data; Feature extraction is performed on the preprocessed network traffic data to obtain feature data; The importance weight of each feature data is determined based on its impact on the current cybersecurity situation. Based on each feature data and its importance weight, corresponding weighted feature data is generated; Based on the weighted feature data described above, network security situation prediction is performed.
2. The method according to claim 1, characterized in that, The step of generating corresponding weighted feature data based on each feature data and its importance weight includes: Each feature data point is multiplied by its importance weight to obtain the corresponding weighted feature data.
3. The method according to claim 1, characterized in that, The step of predicting network security situation based on the weighted feature data includes: The weighted feature data are input into a pre-trained cybersecurity situation prediction model to obtain cybersecurity situation prediction data within a preset future time period; wherein, the cybersecurity situation prediction model is trained based on a long short-term memory network.
4. The method according to claim 3, characterized in that, The process of determining the importance weight of each feature data point based on its impact on the current cybersecurity situation includes: Based on the attention mechanism, the importance weight of each feature data is determined according to the degree of influence of each feature data on the current network security situation.
5. The method according to claim 4, characterized in that, The importance weight of each feature data is calculated using the following formula: In the formula, b is a learnable bias parameter, and x t For the feature data, W x h is the learnable weight matrix corresponding to the feature data. t-1 Let W be the hidden state vector from the previous time step. h Let v be the learnable weight matrix corresponding to the hidden state vector, and e be the preset learnable parameters. t α is an intermediate parameter. t For x t Importance weights, where n is the total number of features, e tj Let j be the j-th feature data among n feature data.
6. The method according to claim 1, characterized in that, The preprocessing of the network traffic data includes: Remove noisy and invalid data from the network traffic data.
7. The method according to claim 1, characterized in that, The data characteristics include at least one of the following types: traffic statistics characteristics, connection characteristics, and host behavior characteristics.
8. A network security situation awareness and prediction device, characterized in that, include: The data acquisition module is used to collect network traffic data and preprocess the network traffic data; The feature extraction module is used to extract features from the preprocessed network traffic data to obtain feature data; The weight determination module is used to determine the importance weight of each feature data based on its impact on the current network security situation. The feature generation module is used to generate corresponding weighted feature data based on each feature data and its importance weight. The situation prediction module is used to predict the network security situation based on the weighted feature data.
9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed in a computer, causes the computer to perform the method described in any one of claims 1 to 7.
10. A computing device, characterized in that, The method includes a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method described in any one of claims 1 to 7.