A network security-based firewall intercepted information clustering identification method and system, electronic device and storage medium

Abstract

The application provides a firewall interception information clustering identification method and system based on network security, relates to the technical field of firewall interception information clustering identification based on network security, and forms an original interception data set by collecting payload feature data of a real-time interception data packet of a firewall; the data set is preprocessed to obtain normalized payload data; the normalized data is subjected to fuzzy clustering by using a fuzzy C-means algorithm to obtain a clustering group and a clustering center feature set; based on the feature set, deep feature extraction is performed on each clustering group by using a convolutional neural network, the obtained deep abstract features and the corresponding clustering center feature set are fused into a feature vector, and finally a clustering identification result of the firewall interception information is generated, so that through the synergistic effect of fuzzy clustering and deep feature extraction, accurate mining and automatic identification of potential threat patterns in the firewall interception data are realized.

Description

Technical Field

[0001] This application relates to the technical field of clustering and identifying firewall interception information based on network security, and in particular to a method and system for clustering and identifying firewall interception information based on network security. Background Technology

[0002] In general network data transmission environments, firewalls, as critical security barriers, generate massive amounts of intercepted data packets daily. Effective clustering and identification of this data is fundamental to discovering potential attack patterns, identifying new threats, and optimizing security strategies. This paper presents an application of a network security-based firewall interception information clustering and identification method, aiming to achieve automated and intelligent classification and analysis of various types of intercepted information.

[0003] Currently, existing technologies for analyzing firewall-blocked data typically rely on rule-based classification methods or basic clustering algorithms. These methods group data packets based on predefined field matching or simple statistical features. Some solutions also attempt to classify known threat types by extracting explicit features from data packets and using traditional machine learning models for pattern recognition.

[0004] However, the most significant limitation of these existing technologies lies in their inability to effectively handle and identify the non-linear, deeply hidden features and ambiguous attribution relationships present at the payload level of data packets. This limits the accuracy and reliability of their identification and classification of known attacks with slight variations or entirely new threats. Summary of the Invention

[0005] The purpose of this application is to provide a method and system for clustering and identifying firewall interception information based on network security, so as to solve the problem of low accuracy and reliability of firewall interception information identification and classification in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for clustering and identifying firewall-intercepted information based on network security, comprising:

[0007] The payload feature data of the data packets intercepted by the firewall in real time is collected to obtain the original interception dataset, which includes the payload field, data encryption type and transmission rate;

[0008] All payload feature data in the original interception dataset are preprocessed to obtain the corresponding normalized payload data.

[0009] The fuzzy C-means algorithm is used to perform fuzzy clustering on the normalized payload data to obtain multiple cluster groups and corresponding cluster center feature sets.

[0010] Based on the cluster center feature set, a convolutional neural network is used to extract deep features from each cluster group to obtain deep abstract features of firewall interception information. The deep abstract features are then fused with the corresponding cluster center feature set to form a feature vector. Based on the feature vector, the clustering result of firewall interception information is generated.

[0011] Optionally, the fuzzy C-means algorithm is used to perform fuzzy clustering on the normalized payload data to obtain multiple cluster groups and corresponding cluster center feature sets, including:

[0012] The fuzzy C-means algorithm is used to perform initial membership degree assignment on the normalized payload data to obtain the initial membership set;

[0013] Cluster centers are calculated for the initial membership set to obtain initial cluster centers. The difference between the initial cluster centers and all structured data records in the normalized payload data is calculated to obtain updated membership degrees.

[0014] Cluster centers are calculated on the updated membership degrees to obtain updated cluster centers, and the difference between the updated cluster centers and the initial cluster centers is calculated.

[0015] The differences are compared with a preset tolerance, and the cluster center feature set is obtained based on the comparison results;

[0016] Based on the final membership degree of the structured data records, the cluster center feature set is clustered and assigned to form multiple cluster groups.

[0017] Optionally, the initial membership assignment of the normalized payload data using the fuzzy C-means algorithm to obtain the initial membership set includes:

[0018] The total number of structured data records and the preset number of clusters in the normalized payload data are processed to obtain the quantity parameters;

[0019] The quantity parameter is subjected to random number sequence generation processing to obtain a random numerical sequence, and the random numerical sequence is subjected to constraint adjustment processing to obtain an adjusted sequence;

[0020] The adjusted sequence is tabulated to obtain an initial allocation table. The initial allocation table is then normalized to obtain an initial membership set.

[0021] Optionally, the step of calculating cluster centers for the initial membership set to obtain initial cluster centers, and calculating the difference between the initial cluster centers and all structured data records in the normalized payload data to obtain updated membership degrees, includes:

[0022] The initial cluster centers are obtained by calculating the weighted average of the initial membership sets.

[0023] The difference between the initial cluster centers and all structured data records in the normalized payload data is calculated to obtain the difference measurement result.

[0024] The difference measurement results are subjected to similarity conversion processing to obtain similarity values;

[0025] The similarity values ​​are normalized and assigned to obtain the updated membership degree.

[0026] Optionally, the step of using a convolutional neural network to extract deep features from each cluster group based on the cluster center feature set to obtain deep abstract features of firewall interception information includes:

[0027] All structured data records and their corresponding cluster center feature sets within the same cluster group are combined to obtain a combined feature sequence.

[0028] The combined feature sequence is subjected to multi-scale feature extraction processing to obtain a multi-scale feature set;

[0029] The multi-scale feature set is subjected to feature fusion processing to obtain a fused feature representation;

[0030] The fused feature representation is subjected to feature compression processing to obtain deep abstract features of firewall interception information.

[0031] Optionally, the step of fusing the deep abstract features with the corresponding cluster center feature set to form a feature vector, and generating the clustering result of firewall interception information based on the feature vector, includes:

[0032] The deep abstract features are connected with the corresponding cluster center feature sets to obtain combined features. The combined features are then weighted to obtain weighted combined features.

[0033] The weighted combined features are fused to obtain fused features, and the fused features are then dimensionality-reduced to obtain feature vectors.

[0034] The feature vectors are classified to obtain the clustering results of firewall interception information.

[0035] Optionally, the preprocessing of all payload feature data in the original interception dataset to obtain corresponding normalized payload data includes:

[0036] All payload feature data in the original interception dataset are processed for type identification to obtain type identifiers, and the payload feature data are processed for rate range mapping to obtain rate range identifiers.

[0037] Based on the type identifier, the payload feature data is subjected to payload extraction processing to obtain a readable character sequence. The readable character sequence is then subjected to numerical conversion processing to form an initial numerical sequence.

[0038] The type identifier, the rate range identifier, and the initial numerical sequence of the same payload feature data are combined to obtain a structured data record. All the structured data records are aggregated and processed to obtain normalized payload data.

[0039] Secondly, this application provides a firewall-intercepted information clustering and identification system based on network security, comprising:

[0040] The acquisition module is used to acquire payload feature data of data packets intercepted by the firewall in real time to obtain the original interception dataset, which includes payload field, data encryption type and transmission rate;

[0041] The first processing module is used to preprocess all payload feature data in the original interception dataset to obtain the corresponding normalized payload data.

[0042] The second processing module is used to perform fuzzy clustering on the normalized payload data using the fuzzy C-means algorithm to obtain multiple cluster groups and corresponding cluster center feature sets.

[0043] The fusion module is used to extract deep features from each cluster group using a convolutional neural network based on the cluster center feature set, to obtain deep abstract features of firewall interception information, and to fuse the deep abstract features with the corresponding cluster center feature set to form a feature vector, and to generate the clustering result of firewall interception information based on the feature vector.

[0044] Thirdly, this application provides an electronic device, comprising:

[0045] Memory, used to store computer programs;

[0046] A processor, configured to execute the computer program, implement the steps of a network security-based firewall interception information clustering and identification method as described in the first aspect above.

[0047] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the network security-based firewall interception information clustering and identification method described in the first aspect above.

[0048] This application provides a method for clustering and identifying firewall interception information based on network security. The method involves collecting payload feature data from data packets intercepted by the firewall in real time to obtain an original interception dataset, which includes a payload field, data encryption type, and transmission rate. All payload feature data in the original interception dataset are preprocessed to obtain corresponding normalized payload data. A fuzzy C-means algorithm is used to perform fuzzy clustering on the normalized payload data, resulting in multiple cluster groups and corresponding cluster center feature sets. Based on the cluster center feature sets, a convolutional neural network is used to extract deep features from each cluster group to obtain deep abstract features of the firewall interception information. These deep abstract features are then fused with the corresponding cluster center feature sets to form a feature vector. The clustering result of the firewall interception information is generated based on the feature vector.

[0049] The technical solution of this application has the following beneficial effects:

[0050] This application achieves comprehensive collection of multidimensional features of network threats, providing a complete data foundation for subsequent in-depth analysis; it solves the problem of heterogeneity of raw data, realizes standardized processing of multi-source heterogeneous data, and improves the efficiency and accuracy of subsequent algorithm processing; it can effectively handle the uncertainty of data attribution, and realize the preliminary discovery and feature extraction of potential threat patterns; it breaks through the limitations of surface features, and realizes the mining and characterization of deeply hidden threat features in the data; through feature-level fusion, it combines the advantages of fuzzy clustering and deep learning, and finally achieves accurate classification and identification of intercepted information.

[0051] Furthermore, this application establishes preliminary attribution relationships for data through initial membership assignment; then, through iterative execution of the cycle process of "cluster center calculation, difference calculation, and membership update", the cluster center positions and data membership degrees are continuously optimized; when the changes in cluster center positions tend to stabilize, each data record is divided into the corresponding cluster according to the final determined membership degree, thus completing the grouping.

[0052] This application uses an iterative optimization approach to enable the algorithm to adaptively find the inherent distribution pattern of the data, effectively addressing the classification difficulties caused by the numerous variants of network attacks and ambiguous features, and providing a stable and reliable clustering foundation for subsequent deep feature extraction.

[0053] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A flowchart illustrating a firewall-intercepted information clustering and identification method based on network security, provided in an embodiment of this application;

[0056] Figure 2 A schematic diagram illustrating a specific implementation of a firewall-intercepted information clustering and identification method based on network security, provided in this application embodiment;

[0057] Figure 3 A schematic diagram of the structure of a firewall-intercepted information clustering and identification system based on network security, provided in an embodiment of this application;

[0058] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0059] Currently, firewall interception information analysis methods based on fixed rules or traditional clustering algorithms face challenges when dealing with the large amounts of ambiguous and nonlinear threat data present in real-world networks. These methods primarily rely on the surface-level explicit features of data packets, making it difficult to effectively capture and analyze deep threat patterns hidden within obfuscated, variant, or carefully crafted attack payloads. Their core limitation lies in their insufficient ability to characterize the complex internal relationships within the data, resulting in poor identification of unknown threats or attack behaviors with ambiguous attribution characteristics, and failing to meet the ever-growing demand for detecting new types of cybersecurity threats.

[0060] To overcome the aforementioned limitations, this application proposes a novel clustering and identification method for firewall interception information based on network security, integrating fuzzy clustering and deep learning. This scheme employs the following technical concept: First, the collected raw interception data undergoes standardized preprocessing. Then, the fuzzy C-means algorithm is innovatively combined with a convolutional neural network: fuzzy clustering adaptively handles the uncertainty of data attribution, forming preliminary threat groups; then, for each group, a convolutional neural network is used to mine its deep, non-linear threat features; finally, the deep features are fused with the cluster center features to generate the final classification result. This collaborative technical approach effectively solves the core problems of existing methods' insufficient mining of hidden features and difficulty in identifying fuzzy threats, improving the detection accuracy and identification reliability of complex network attack patterns.

[0061] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0062] The core of this application is to provide a method for clustering and identifying firewall-intercepted information based on network security. A flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:

[0063] S101. Collect payload feature data of data packets intercepted by the firewall in real time to obtain the original interception dataset, which includes the payload field, data encryption type and transmission rate.

[0064] In the above scheme, the payload field refers to the actual application layer content carried in the data packet, which is the core data source for analyzing potential threats; the data encryption type characterizes whether the payload field has been encrypted and the specific encryption method, which is used to distinguish different secure transmission protocols; the transmission rate reflects the amount of data packet transmitted per unit time, which is used to identify abnormal traffic patterns.

[0065] In this application example, a standardized acquisition of firewall-intercepted data is achieved by constructing a complete data acquisition pipeline. First, a dedicated acquisition device deployed on the firewall's mirror port continuously monitors network traffic. When an interception event is detected, a data capture mechanism is immediately triggered, which can completely replicate the data from each network protocol layer of the data packet. Second, in the data parsing stage, the system uses deep packet inspection (DIP) technology to peel away the packet encapsulation layer by layer, extracting the original payload content from the application layer as the payload field, analyzing the security protocol identifier in the transport layer header to determine the encryption type, and calculating the transmission rate by combining the packet timestamp sequence. Finally, in the data integration stage, the system standardizes and encapsulates the three types of features obtained from the parsing according to a predetermined format. Each data packet generates a structured record containing a payload field, an encryption type identifier, and a transmission rate value. The collection of all records constitutes the original interception dataset, providing a unified format for data input in subsequent processing stages.

[0066] In a practical application, during the operation of an enterprise network, the firewall security module detected an abnormal connection request from a specific IP address and initiated an interception mechanism. The data acquisition system captured the complete network data packet corresponding to this interception event in real time, with a total data volume of 1280 bytes and a transmission time span of 500 milliseconds. The system extracted 732 bytes of payload content from the application layer of the data packet using deep packet inspection technology. It was identified that this content used Base64 encoding but did not use a transport layer encryption protocol; therefore, the encryption type was recorded as plaintext HTTP. The transmission rate was calculated using the following formula: Transmission Rate The total data volume of 1280 bytes was converted to bits, with the transmission time converted in units of 0.5 seconds. The system integrates these features into a structured record, which contains a Base64 encoded payload field, an encryption type identifier for the plaintext HTTP, and a transmission rate value of 20480bps. This record, together with other intercepted data collected during the same period, constitutes the original intercepted dataset, which will be used as input data for subsequent preprocessing steps for standardization.

[0067] The aforementioned S101 overall solution establishes a systematic, multi-dimensional data acquisition mechanism. Through real-time capture and deep analysis technologies, it comprehensively acquires the content characteristics, security attributes, and behavioral indicators of data packets intercepted by the firewall. This process not only ensures the comprehensiveness and accuracy of the raw data but also forms a structured dataset with a unified format through standardized encapsulation, providing a reliable data foundation for subsequent data preprocessing and in-depth analysis. This standardized data acquisition method effectively solves the problems of scattered data sources and inconsistent formats in traditional security analysis, laying a solid foundation for building an end-to-end threat detection pipeline.

[0068] S102. Preprocess all payload feature data in the original interception dataset to obtain the corresponding normalized payload data.

[0069] Optionally, step S102 involves preprocessing all payload feature data in the original interception dataset to obtain corresponding normalized payload data, including:

[0070] Step 1021: Perform type identification processing on all payload feature data in the original interception dataset to obtain type identifiers, and perform rate interval mapping processing on the payload feature data to obtain rate interval identifiers.

[0071] Step 1022: Based on the type identifier, perform payload extraction processing on the payload feature data to obtain... arrive A readable character sequence is processed by numerical conversion to form an initial numerical sequence.

[0072] Step 1023: Combine the type identifier, the rate interval identifier, and the initial numerical sequence of the same payload feature data to obtain a structured data record. Collect and process all the structured data records to obtain normalized payload data.

[0073] In the above scheme, the type identifier refers to the encryption type classification identifier generated by analyzing the security protocol characteristics of the data packet; the rate interval identifier refers to the quantization result of mapping continuous transmission rate values ​​to a preset discrete interval; the readable character sequence refers to the standardized text representation extracted from the original payload field; the initial numerical sequence refers to the result of converting text data into numerical feature vectors through character encoding conversion; the structured data record refers to the unified data unit that integrates the three types of features: type, rate, and numerical sequence; and the normalized payload data refers to the collection of all structured data records, providing standardized input for subsequent analysis.

[0074] In this application example, a multi-level pipeline processing architecture is established to achieve deep preprocessing of the raw intercepted data. First, the system starts a dual-feature identification engine, which processes the protocol header information and transmission timing characteristics of each data packet in parallel. The protocol parsing module identifies transport layer security protocol signatures based on deep packet inspection technology and generates corresponding type identifiers by matching them with a predefined encryption protocol feature library. Simultaneously, the traffic analysis module calculates the transmission time window of the data packets and maps continuous rate values ​​to discrete interval identifiers according to a preset rate grading standard. These two identifiers together constitute the meta-feature description system of the data.

[0075] Subsequently, the system initiates a payload content conversion pipeline, which dynamically selects the appropriate content parsing strategy based on the type identifier generated in the previous step. For different types of payload data, the system employs differentiated processing methods: encrypted payloads are converted to an intermediate format via a specific decryption channel, while unencrypted payloads directly enter the character standardization process. The converted readable character sequence then enters the encoding mapping stage, where a unified character encoding table converts each character into its corresponding numerical representation, forming a standardized initial numerical sequence. This process ensures a unified numerical representation of heterogeneous payload data.

[0076] Finally, the system performs multi-feature integration and standardized output. The feature assembly module aligns the type identifier, rate range identifier, and initial numerical sequence according to a predefined data structure, and encapsulates them in terms of dimension and format to generate structured data records with uniform specifications. The record aggregation module collects all structured records and performs integrity verification. The final output normalized payload data has uniform feature dimensions and data format, providing standardized input data for subsequent clustering analysis algorithms.

[0077] In a practical application, within an enterprise network security monitoring system, the preprocessing module receives raw intercepted data sets from the front-end firewall. This dataset contains several data packet records. The system first performs protocol feature parsing on each data packet, identifying that some packets use the TLS 1.3 encryption protocol and marking them as type identifier 3 according to the protocol type mapping table. Simultaneously, for a specific data packet, the system monitors its transmission duration as 200 milliseconds and its total data volume as 15,000 bytes. Using the transmission rate calculation formula, its transmission rate is calculated as follows: Transmission Rate byte The data volume is 15,000 bytes, which is the actual length of the payload. The transmission time is 0.2 seconds, which is the precise timing result. According to the system's preset rate range division standard, the rate value of 75,000 bytes per second is mapped to the range identifier 2.

[0078] Subsequently, the system selects the corresponding TLS payload parsing scheme based on type identifier 3, converts the encrypted payload data into intermediate text format through a specific decryption channel, and then converts the text characters into numerical sequences through the ASCII encoding table.

[0079] Finally, the system assembles type identifier 3, rate interval identifier 2, and feature vectors containing specific numerical sequences into a structured data record. This record, together with other similar records, constitutes a normalized payload dataset, which will be directly input into the subsequent fuzzy clustering analysis module for deep pattern mining.

[0080] The S102 overall solution described above achieves deep cleaning and standardized transformation of raw intercepted data by constructing a systematic multi-level preprocessing pipeline. This process not only solves the problem of format unification for multi-source heterogeneous data, but also preserves the inherent security attributes of the data through feature identification and content transformation. The normalized data after preprocessing eliminates the differences in units and inconsistencies in format of the original data, while retaining the key feature information required for threat detection to the greatest extent, providing high-quality, standardized input data for subsequent machine learning algorithms. This standardized preprocessing mechanism improves the adaptability and processing efficiency of the entire analysis system to diverse network attack data, laying a solid data foundation for accurate threat identification.

[0081] S103. Using the fuzzy C-means algorithm, the normalized payload data is subjected to fuzzy clustering to obtain multiple cluster groups and corresponding cluster center feature sets.

[0082] Optionally, step S103 involves using a fuzzy C-means algorithm to perform fuzzy clustering on the normalized payload data to obtain multiple cluster groups and corresponding cluster center feature sets, including:

[0083] Step 1031: The fuzzy C-means algorithm is used to assign initial membership degrees to the normalized payload data to obtain an initial membership set. The initial membership degree represents the initial probability that each firewall-intercepted data packet is preliminarily considered to belong to each potential threat pattern at the beginning of the algorithm.

[0084] Step 1031 may specifically include the following steps: Parameter reading processing is performed on the total number of structured data records and the preset number of clusters in the normalized payload data to obtain quantity parameters; random number sequence generation processing is performed on the quantity parameters to obtain a random value sequence; and constraint adjustment processing is performed on the random value sequence to obtain an adjusted sequence. Specifically, firstly, the random value sequence is grouped according to the preset number of clusters to obtain multiple initial random values ​​corresponding to each data record; then, the sum of the multiple initial random values ​​corresponding to each data record is calculated; next, each initial random value is divided by the sum of the values ​​of its corresponding data record, so that the sum of the multiple adjusted values ​​corresponding to each data record equals 1; finally, the adjusted values ​​of all data records are recombine in their original order to form an adjusted sequence that satisfies probability distribution constraints; the adjusted sequence is tabulated to obtain an initial allocation table; and the initial allocation table is normalized to obtain an initial membership set.

[0085] Step 1032: Calculate the cluster centers of the initial membership set to obtain the initial cluster centers. Calculate the difference between the initial cluster centers and all structured data records in the normalized payload data to obtain the updated membership degree.

[0086] Step 1032 may specifically include the following steps: calculating a weighted average of the initial membership set to obtain initial cluster centers; calculating the difference between the initial cluster centers and all structured data records in the normalized payload data to obtain a difference measurement result, wherein there are multiple difference measurement results, essentially calculating the difference between each structured data record and each initial cluster center; performing similarity conversion processing on the difference measurement results to obtain a similarity value. Specifically, a mathematical inverse proportionality function is used to map the difference value, which represents the degree of data dispersion, to a similarity value, which represents the degree of data association. The specific operation is: substituting each difference value into a conversion function for calculation, using a typical conversion function as follows: ,in, This represents the similarity value between the i-th data record and the j-th cluster center. This corresponds to the difference measurement result. This function guarantees that when the difference... Similarity approaching 0 When the difference approaches 1, Similarity when increased The similarity values ​​are monotonically decreasing and approaching 0, and the final output is a similarity value matrix that completely corresponds to the dimension of the difference measurement result matrix. The purpose is to convert the distance dimension, which represents the degree of data dispersion, into a probabilistic dimension, which represents the degree of data association, so as to provide input data that meets the requirements of fuzzy set theory for subsequent membership updates. The similarity values ​​are then normalized and assigned to obtain updated memberships. The physical meaning of the updated memberships is the latest and more accurate probability measure of each firewall's intercepted data packet belonging to each potential threat pattern after a round of algorithm iteration and optimization.

[0087] Step 1033: Calculate the cluster centers for the updated membership degree to obtain the updated cluster centers, and calculate the difference between the updated cluster centers and the initial cluster centers.

[0088] Step 1034: Compare the differences with the preset tolerance, and obtain the cluster center feature set based on the comparison results.

[0089] Step 1035: Based on the final membership degree of the structured data records, the cluster center feature set is clustered and assigned to form multiple cluster groups. The entity generating the final membership degree originates from the iterative optimization process described in steps 1032 to 1034. When the algorithm iteration satisfies the convergence condition and the difference between the updated cluster center and the previous round's cluster center is less than a preset tolerance, the updated membership degree output in step 1032, which no longer changes, is defined as the final membership degree and used as the direct basis for the final cluster assignment.

[0090] In the above scheme, the initial membership set refers to the initial set of membership degrees of each data point to each cluster generated through random assignment and constraint adjustment; the cluster center refers to the representative feature vector of each cluster, calculated by weighted average; the difference measurement result reflects the distance relationship between the data point and the cluster center; the similarity value refers to the affinity representation obtained through difference transformation; the updated membership degree refers to the new membership degree distribution after normalization; the cluster center feature set refers to the final set of cluster centers determined after the algorithm converges; and multiple cluster groups refer to the data grouping results based on the final membership degree.

[0091] In this application example, the system first initiates a parameter initialization module. This module reads the scale characteristics of the input data and the preset clustering target number, and generates a numerical sequence that conforms to a random distribution based on these basic parameters. Then, the system enters a constraint processing stage, where the original random sequence is normalized and adjusted using mathematical transformation methods to ensure that the membership distribution of each data sample to each cluster meets the probability axiom requirements. The adjusted numerical sequence is then tabulated and reorganized to form an initial membership matrix. This matrix, after rigorous numerical range verification, serves as the starting point for cluster analysis.

[0092] Next, the system enters the iterative optimization loop phase, which includes four core processing steps. The cluster center calculation engine generates the center vector representation of each cluster based on the current membership matrix and original data features using a weighted average algorithm. The dissimilarity measurement module simultaneously calculates the feature space distance between all data samples and each cluster center, constructing a complete dissimilarity relationship matrix. The similarity converter transforms the dissimilarity measurement results into affinity representations, establishing an inverse relationship between dissimilarity and similarity through mathematical transformations. The normalization processor standardizes the transformed similarity values, ensuring that the cluster affiliation distribution of each data sample satisfies the normalization condition, and outputs an updated membership matrix.

[0093] Then, the system executes a convergence determination procedure, which calculates the change in features between the cluster centers generated in the current round and the corresponding centers in the previous round. The convergence status of the algorithm is determined by comparing the change with a preset threshold. If the convergence criterion is not met, the system uses the updated membership matrix as the new input and restarts the iterative optimization loop; if the convergence condition is met, the iteration process is terminated and the final set of cluster center features is output.

[0094] Finally, the system performs a result allocation operation, determining the dominant category of each data sample based on the membership matrix at the convergence time, aggregating data samples with the same dominant category into the same group, and finally forming multiple cluster groups with clear category characteristics, thus completing the entire fuzzy clustering process.

[0095] In a practical application, within an enterprise network security monitoring platform, the fuzzy clustering analysis module receives a normalized payload dataset from the preprocessing stage. This dataset contains 1500 structured data records, each with 256-dimensional features. The system defaults to 5 clusters, a fuzziness parameter m of 2.0, and a convergence threshold of 0.01.

[0096] First, the system reads the total number of data records N=1500 and the preset number of clusters K=5, generating an initial sequence containing 7500 uniformly distributed random numbers. Constraint adjustment ensures that the sum of the five random numbers for each data record is 1. For example, the initial random number sequence for a data record is [0.35, 0.42, 0.18, 0.27, 0.31], with a sum of 1.53. After normalization, the initial membership degrees are [0.229, 0.275, 0.118, 0.176, 0.202]. These values ​​are organized into a 1500-row, 5-column initial membership degree matrix U0. Then, based on the initial membership degree matrix and the original data features, the system calculates the feature vector of the j-th cluster center using the following formula: ,in, Let the vector represent the j-th cluster center. It represents the membership degree of the i-th data point to the j-th cluster. It is the 256-dimensional feature vector of the i-th data point. Taking the calculation of the first cluster center as an example, the system needs to calculate the weighted average of 1500 data points, where the weight of each data point is the square of its membership degree.

[0097] Next, the system calculates the dissimilarity of all data points to the cluster centers using the Euclidean distance formula: ,in, This represents the distance between the i-th data point and the j-th cluster center. It is the feature value of the i-th data in the k-th dimension. Let be the feature value of the j-th cluster center in the k-th dimension. Assuming the sum of squared differences between a data point and the first cluster center across all dimensions is 18.75, then the dissimilarity is: .

[0098] The system then converts the difference into similarity using the following formula: Taking the difference score of 4.33 as an example, the corresponding similarity score is: Then, the similarity of each data point is normalized: Suppose that the similarity scores of a certain data point to the five clusters are [0.188, 0.215, 0.192, 0.205, 0.234], and the sum of the similarity scores is 1.034. Then the normalized membership scores are [0.182, 0.208, 0.186, 0.198, 0.226], and the updated membership matrix U1 is obtained.

[0099] Then, the system calculates the new cluster centers. With the old cluster center The change between: δ represents the maximum change, which is obtained by calculating the positional changes of the five cluster centers in 256-dimensional space. After 25 iterations, the value of δ gradually decreases from the initial 12.67 to 0.008, satisfying the convergence condition δ < 0.01.

[0100] Finally, based on the membership matrix at convergence, the system assigns each data record to the cluster with the highest membership degree as its final affiliation. The resulting five clusters contain data records of [342, 285, 318, 276, 279], and their corresponding cluster center feature sets contain five 256-dimensional feature vectors. These clustering analysis results will be directly input into the subsequent deep feature extraction module, providing fundamental data support for in-depth analysis of network threat behavior patterns.

[0101] The S103 overall solution described above effectively addresses the issues of feature overlap and classification uncertainty in cybersecurity data through a systematic fuzzy clustering processing framework. This process employs an iterative optimization mechanism, adaptively discovering the inherent distribution patterns of the data and gradually improving clustering quality through multiple refinements. The algorithm preserves the soft association information between data points and multiple clusters through the concept of membership, avoiding the information loss problems of traditional hard partitioning methods. A convergence determination mechanism ensures the stability of the clustering results, while the final data grouping reflects the natural clustering characteristics of threat behaviors. This processing method provides a high-quality data foundation for subsequent deep feature extraction and threat identification, enhancing the system's ability to discover complex attack patterns and the reliability of analysis, while also improving the intelligence level and decision support capabilities of the entire security analysis process.

[0102] S104. Based on the cluster center feature set, a convolutional neural network is used to extract deep features from each cluster group to obtain deep abstract features of firewall interception information. The deep abstract features are then fused with the corresponding cluster center feature set to form a feature vector. Based on the feature vector, a clustering result of firewall interception information is generated.

[0103] Among these, firewall-intercepted information is the final output and knowledge product after layers of processing. Specifically, it refers to the structured cognitive results extracted from massive amounts of intercepted data packets through cluster analysis, possessing clear threat category attribution and pattern characteristics. Its core is valuable security intelligence after intelligent processing. On the other hand, the data packets intercepted by the firewall in real time are the starting point and original input of the method. Specifically, it refers to a single data unit containing the original network frame format that is blocked by the firewall in real time during network transmission. Its core is the unprocessed raw data carrier. The connection between the two is that data packets constitute the material basis and data source of intercepted information, while intercepted information is the mining and sublimation of the intrinsic value of data packets. The entire method process is essentially a transformation from raw "data packets" to operable "information".

[0104] Optionally, step S104, which involves using a convolutional neural network to extract deep features from each cluster group based on the cluster center feature set to obtain deep abstract features of the firewall interception information, fusing the deep abstract features with the corresponding cluster center feature set to form a feature vector, and generating the clustering result of the firewall interception information based on the feature vector, includes:

[0105] Step 1041: Combine all structured data records and corresponding cluster center feature sets within the same cluster group to obtain a combined feature sequence.

[0106] Step 1042: Perform multi-scale feature extraction processing on the combined feature sequence to obtain a multi-scale feature set. Specifically, the multi-scale feature set includes: payload byte-level micro-features extracted using small-scale convolutional kernels, used to capture specific attack signature or code fragment patterns represented by short byte sequences in the payload field; protocol interaction-level meso-level features extracted using medium-scale convolutional kernels, used to identify the communication behavior sequences and interaction patterns exhibited by data packets at the session level; and traffic behavior-level macro-features extracted using large-scale convolutional kernels, used to analyze the overall situational patterns of data packet groups in dimensions such as transmission rate and temporal distribution. These features of different granularities collectively constitute a comprehensive characterization of network threats from micro to macro levels.

[0107] Step 1043: Perform feature fusion processing on the multi-scale feature set to obtain a fused feature representation.

[0108] Step 1044: Perform feature compression processing on the fused feature representation to obtain the deep abstract features of the firewall interception information. The deep abstract features refer to the core pattern fingerprints obtained after refinement through multi-layer neural networks, capable of fundamentally distinguishing different types of network threats. By retaining the most discriminative high-dimensional nonlinear features and filtering out redundant details, it fuses and transforms the original payload content, encryption characteristics, and transmission behavior into a highly compressed expression of the threat's essence, thereby achieving a fundamental characterization and accurate identification of the inherent patterns of various attack behaviors.

[0109] Step 1045: Connect the deep abstract features with the corresponding cluster center feature sets to obtain combined features, and perform weight allocation on the combined features to obtain weighted combined features.

[0110] Step 1046: Perform fusion processing on the weighted combined features to obtain fused features, and perform dimensionality reduction processing on the fused features to obtain feature vectors.

[0111] Step 1047: Classify the feature vectors to obtain the clustering results of firewall interception information.

[0112] In the above scheme, the combined feature sequence refers to the enhanced feature sequence formed by integrating all data records within the same cluster group with the features of its cluster center; the multi-scale feature set refers to the set of local patterns captured from the combined sequence using feature extractors with different receptive fields; the fusion feature representation refers to the unified feature representation formed after integrating multi-scale features; the deep abstract feature refers to the high-level, high-discriminative feature representation obtained through feature compression; the weighted combined feature refers to the result of adjusting the importance of deep features and cluster center features through a weight allocation mechanism; and the feature vector refers to the final classification feature formed after dimensionality reduction.

[0113] In this application example, firstly, the system starts the feature enhancement preprocessing module. This module reads all structured data records in each cluster group and their corresponding cluster center feature sets, and uses vector concatenation technology to expand and fuse the individual data features with the cluster center features to construct a combined feature sequence containing local details and global distribution information, thus establishing a high-quality data foundation for subsequent in-depth analysis.

[0114] Subsequently, the system enters the multi-scale feature mining stage, which deploys a parallel convolutional neural network architecture with different receptive fields. Convolutional kernels of different scales simultaneously perform sliding window scanning on the combined feature sequences. Small-scale convolutional kernels focus on capturing subtle local patterns in the data, medium-scale convolutional kernels identify medium-range correlation features, and large-scale convolutional kernels mine macroscopic regularities in the data. The outputs of each convolutional path are processed by a non-linear activation function to generate feature maps of the corresponding scale. The set of all feature maps constitutes a multi-scale feature set that comprehensively covers feature information of different granularities.

[0115] Next, the system performs feature fusion and refinement. The feature alignment module first performs dimensionality standardization on each feature map in the multi-scale feature set, and then achieves spatial alignment of features at different scales through upsampling or downsampling techniques. The fusion engine uses a channel attention mechanism to adaptively weight and fuse the aligned features, generating a unified fused feature representation. The feature compression network performs information distillation on the fused features through a multi-layer fully connected structure and nonlinear transformation, removing redundant noise while retaining the most discriminative core patterns, and outputting a highly abstract deep feature representation.

[0116] Finally, the system completes feature optimization and classification decision-making. The feature concatenation module concatenates deeply abstract features with corresponding cluster center features to form an enhanced combined feature representation. The weight allocator scores the importance of each dimension in the combined features based on an attention mechanism or preset rules, generating weighted combined features. The fusion and dimensionality reduction module integrates the weighted features through a fully connected layer and uses principal component analysis or an autoencoder for dimensionality compression, obtaining a low-dimensional, dense feature vector. The classification decision-maker performs pattern recognition and category determination based on this feature vector, outputting the final clustering analysis result of the firewall interception information.

[0117] In a practical application, within an enterprise network security monitoring platform, the deep feature extraction and fusion module receives the processing results from the fuzzy clustering stage. This result includes three cluster groups and corresponding cluster center feature sets. The first cluster group contains 150 structured data records, each with 256-dimensional features, and the corresponding cluster centers are 256-dimensional feature vectors. These data are the output of the fuzzy C-means algorithm after iterative convergence in step S103, specifically including a data record matrix. and cluster center vector .

[0118] First, the system performs feature enhancement preprocessing, vertically concatenating the feature vector of each data record with the cluster center feature vector. For the first data record... With cluster center The splicing operation uses a formula. The square brackets [] represent a vertical vector concatenation operation, which merges the 256-dimensional record features and the 256-dimensional center features into a 512-dimensional combined feature. After the same processing is performed on 150 records, a combined feature matrix is ​​formed. The combined feature matrix is ​​then used as input for the multi-scale feature extraction stage.

[0119] Subsequently, targeting the "multi-granularity" characteristic of data threat features intercepted by firewalls, three different scale convolutional kernels were used in parallel to extract "fine-grained, medium-grained, and coarse-grained" features to avoid missing key threat information by using a single scale. Specifically, the output of step 1 was... The input to the CNN network is processed through three parallel convolutional layers, i.e., small-scale convolutional kernels: , Where 3 is the kernel length, 512 is the kernel width, and 32 is the number of output channels. Medium-scale kernel: , Where 5 is the kernel length, 512 is the kernel width, and 64 is the number of output channels. Large-scale convolution kernel: , Where 7 is the kernel length, 512 is the kernel width, and 128 is the number of output channels. It is the ReLU activation function. The convolution operation is represented by the first convolution operation. Global average pooling is then applied to the outputs of the three convolutions to obtain 32-dimensional, 64-dimensional, and 128-dimensional feature vectors, which are then concatenated to form a 224-dimensional multi-scale feature vector. .

[0120] Then, the importance weights of each channel of the multi-scale features are automatically calculated using a channel attention mechanism, highlighting threat-related channel features and suppressing interference from irrelevant channels. The specific operation consists of three parts: the first step is to use the channel attention mechanism to calculate the weights of each channel... The 224 channels, through the formula Calculate weights ,in, For learnable parameters, As a bias, exp() is an exponential function. The eigenvalues ​​of the i-th channel are used, and the denominator is used for normalization to ensure that the sum of the weights is 1; the second step is to perform weighted fusion, using the formula... The third step is to obtain the fused features; the third step is to compress the features. Input two fully connected layers. The formula for the first layer is: ,in This compresses 224 dimensions to 128 dimensions; the second-level formula is: ,in, By compressing 128 dimensions to 64 dimensions, a 64-dimensional deep abstract feature is obtained. .

[0121] Finally, the deep abstract features and cluster center features are integrated to ensure that the clustering results have both detailed and global logic. The specific operation is divided into four parts: the first step is to perform feature concatenation, combining the deep abstract features... Cluster center characteristics are obtained through formulas, The first step involves concatenating the features to obtain a final 320-dimensional combined feature set; the second step is to perform weight allocation using the formula... ) Calculate the weight vector w, and then through We obtain the weighted features, where The third step is element-wise multiplication; the second step is feature reduction, which performs element-wise multiplication. Input fully connected layer Then, principal component analysis was used to reduce the dimensionality to 32, resulting in the final eigenvectors. Finally, threats are categorized. Input the softmax classifier, and use the formula Calculate the probability of belonging to 5 threat categories, and select the type with the highest probability as the final label. The output format is "Effective interception information clustering result = {threat type: SQL injection, cluster group: first cluster group, confidence level: 0.98}", to complete the accurate identification of firewall interception information.

[0122] The aforementioned S104 overall solution, through the construction of a systematic deep feature learning and intelligent fusion framework, achieves in-depth optimization and accurate identification of preliminary clustering results. This technical solution comprehensively mines the local and global pattern features contained in the data through a multi-scale feature extraction mechanism, integrates discriminative information of different granularities using feature fusion technology, extracts core threat representations through feature compression, and finally generates high-quality identification results through feature optimization and classification decisions. This method not only improves the accuracy and robustness of threat detection but also enhances the adaptability to complex and ever-changing attack patterns, providing deep intelligent analysis capabilities for network security protection systems and effectively supporting the early detection and precise handling of potential security threats.

[0123] The following is a complete example for steps S101 to S104, such as Figure 2As shown, in a certain enterprise network environment, the firewall system intercepts abnormal data traffic from the external network in real time and triggers data collection, capturing an abnormal transmission session lasting 2 seconds, intercepting a total of 85 data packets. Each data packet contains an application layer payload field, data encryption type (identified as TLS 1.3), and transmission rate (recorded as 650kbps). These three elements together constitute the original intercepted dataset, which will serve as input data for all subsequent processing. The transmission rate is calculated by "total data packet size / session time". The total data volume of this session is 1300kb, and the session time is 2 seconds, therefore the transmission rate = 1300kb ÷ 2s = 650kbps, ensuring the traceability of the data source.

[0124] Subsequently, the original intercepted dataset enters the preprocessing step, where the system performs feature standardization on each of the 85 data packets. First, based on the encryption type mapping table, the "TLS1.3" encryption type is converted into the type identifier "4," which is used to distinguish different encryption protocols. Second, according to the preset transmission rate range division standard, 0-500kbps is the first range, 500-1000kbps is the second range, and above 1000kbps is the third range. 650kbps is mapped to the third rate range, resulting in the rate range identifier "3." Then, a readable character sequence is extracted from the payload field of each data packet and converted into a numerical sequence. For example, the payload content "GET / api / v1 / login" is converted into an ASCII numerical sequence [71, 69, 84, 32, 47, 97, 112, 105, 47, 118, 49, 47, 108, 111, 103, 105, 110] through UTF-8 encoding. Each character corresponds to a unique ASCII value; for example, "G" corresponds to 71 and "E" corresponds to 69. Finally, the "type identifier 4 + rate range identifier 3 + numerical sequence" of each data packet are combined into one structured data record. After performing the same operation on 85 data packets, a set of 85 structured data records is obtained. This set is the normalized payload data, which serves as the input for the subsequent fuzzy clustering step.

[0125] Then, the normalized payload data is input into the fuzzy clustering step, processed using the fuzzy C-means (FCM) algorithm. The preset number of clusters is 3. After 20 iterations, the algorithm converges and forms 3 cluster groups. During the iteration process, the cluster centers are updated using a weighted average formula. in, This represents the vector of the j-th cluster center, which is the core feature of the final output. This represents the membership degree of the i-th data point to the j-th cluster, used to measure the degree of association between the data point and the cluster; m is a fuzzy parameter, which is set to 2 in this embodiment to control the degree of fuzziness of the clustering. Let be the feature vector of the i-th data point, i.e., the structured data record; N is the total number of data points, i.e., 85. After iterative convergence, the specific parameters of the three cluster groups are as follows: the first cluster group contains 32 data records, corresponding to the cluster center vector. The second cluster group contains 28 data records, corresponding to cluster center vectors. The third cluster group contains 25 data records, corresponding to cluster center vectors. The three cluster center vectors mentioned above together constitute the cluster center feature set, which serves as the input for subsequent deep feature extraction steps.

[0126] Next, based on the cluster center feature set, feature concatenation processing was first performed on the 32 data records of the first cluster group. Each data record corresponds to a 256-dimensional feature vector. Compare it with the 256-dimensional cluster center vector of the cluster group. By concatenating the data vector and cluster center vector in the order of "data vector and cluster center vector", a 512-dimensional combined feature vector is obtained. After performing this concatenation operation on all 32 data records of the first cluster group, a set of 32 512-dimensional combined feature vectors is formed. This set is the combined feature sequence, which serves as the input to the multi-scale feature extraction module.

[0127] Next, the combined feature sequences are input into the multi-scale feature extraction module, which uses a three-way parallel convolutional neural network for processing. The kernel sizes of the three convolutional paths are 3, 5, and 7, and the number of output channels are 32, 64, and 128, respectively. The convolution operation formula is as follows: ,in, This represents the output feature map of the k-th convolutional layer, used to capture features at the corresponding scale; Let X be the weight matrix of the k-th convolutional kernel. In this embodiment, the number of parameters of the 3×512×32 convolutional kernel is 512×3×32=49152; X is the input combined feature sequence. This is the bias vector of the k-th convolutional layer, used to adjust the baseline of the feature output; The ReLU activation function is expressed as follows: The purpose is to introduce non-linear features and avoid gradient vanishing during model training; "*" represents convolution operation, used for sliding to capture feature associations. Global average pooling is performed on the output feature maps of the three convolutional layers. Global average pooling compresses the spatial dimensionality by calculating the average value of each feature channel. A 32-channel feature map is pooled to obtain a 32-dimensional vector, a 64-channel feature map to obtain a 64-dimensional vector, and a 128-channel feature map to obtain a 128-dimensional vector. These three vectors are concatenated sequentially to form a 224-dimensional vector, which is the multi-scale feature set. This multi-scale feature set serves as the input for the feature fusion step.

[0128] Subsequently, the multi-scale feature set enters the feature fusion step, where a channel attention mechanism is used to calculate the weights of each channel and perform weighted fusion. The formula for calculating the attention weights is as follows: ,in, This represents the attention weight of the c-th channel. The larger the weight value, the stronger the correlation between the corresponding channel features and threat identification. Here is the learnable weight vector for the c-th channel, used to capture the correlation between channels; Let be the feature value of the c-th channel, which comes from a multi-scale feature set; This is the bias term for the c-th channel, used to adjust the baseline for weight calculation; C is the total number of channels, i.e., 224. ( The function is an exponential function, which amplifies the differences between channel features; the denominator is the sum of the exponential values ​​of all channels, used to normalize the weights and ensure... Based on the calculated attention weights, a weighted fusion is performed on the multi-scale feature set, as shown in the formula: ,in, This represents the weighted fusion feature vector, i.e., the fused feature representation, which serves as the input for the feature compression step.

[0129] Then, the fused feature representation enters the feature compression step, progressively compressing its dimensionality through two fully connected layers. The first fully connected layer transforms the 224-dimensional fused feature representation into 128 dimensions, calculated using the following formula: ,in, This is the weight matrix of the first fully connected layer. For bias terms, This is the 128-dimensional vector output from the first layer. The second fully connected layer transforms the 128-dimensional vector into a 64-dimensional vector, calculated using the following formula: ,in, This is the weight matrix for the second fully connected layer. For bias terms, The ReLU activation function is still used. The 64-dimensional vector output from the second layer is the deep abstract feature, which is used to characterize the essential attributes of the threat pattern and serves as the input for the subsequent feature concatenation step.

[0130] Next, the deep abstract features are concatenated with the original cluster center feature vectors of the corresponding cluster groups in the order of "deep abstract features and cluster center features" to obtain a 320-dimensional combined feature vector, as shown in the formula. ,in, This represents the original cluster center feature vector for this cluster group. Weights are assigned to the 320-dimensional combined feature vector using the softmax function, with the following formula: ,in, This is the weight matrix. The normalization function ensures that the sum of the calculated weights is 1. Based on the calculated weight vector w, element-wise multiplication is performed with the 320-dimensional combined feature vector. This multiplication is denoted by "⊙", resulting in the weighted combined feature vector. The weighted combined features are first fed into a fully connected layer for fusion, and then dimensionality reduction is achieved through Principal Component Analysis (PCA). PCA calculates the feature covariance matrix, retains the first 32 principal components to remove redundant features, and finally obtains a 32-dimensional vector, which is the final feature vector. And it serves as input for the classification step.

[0131] Finally, the final feature vector Input the softmax classifier and calculate the probability that the cluster belongs to different threat categories. The formula for calculating the classification probability is: Where K=3 represents the three preset threat categories, and y=k represents the k-th threat category. Let be the weight vector for the k-th category. This is the bias term for the k-th category, with the denominator being the sum of the index values ​​of all categories, used to normalize the probability and ensure... Taking the first cluster group as an example, the classifier outputs a probability distribution of [0.02, 0.91, 0.07]. The category corresponding to the highest probability "0.91" is selected as the threat category (second type of threat pattern) for this cluster group. The system performs the same "feature extraction → fusion → classification" operation on the second and third cluster groups, and finally generates the threat categories of all cluster groups, which is the clustering result of firewall interception information. This clustering result is used for enterprise network security policy decisions.

[0132] Figure 3 This is a schematic diagram illustrating a specific implementation of a firewall-based information clustering and identification system for network security, as provided in this application. (Refer to...) Figure 3 The system may include:

[0133] The acquisition module 31 is used to acquire payload feature data of data packets intercepted by the firewall in real time to obtain the original interception dataset, which includes payload field, data encryption type and transmission rate.

[0134] The first processing module 32 is used to preprocess all payload feature data in the original interception dataset to obtain the corresponding normalized payload data.

[0135] The second processing module 33 is used to perform fuzzy clustering on the normalized payload data using the fuzzy C-means algorithm to obtain multiple cluster groups and corresponding cluster center feature sets.

[0136] The fusion module 34 is used to extract deep features from each cluster group based on the cluster center feature set using a convolutional neural network to obtain deep abstract features of firewall interception information, and to fuse the deep abstract features with the corresponding cluster center feature set to form a feature vector, and to generate the clustering result of firewall interception information based on the feature vector.

[0137] This application provides a network security-based firewall interception information clustering and identification system to implement the aforementioned network security-based firewall interception information clustering and identification method. Therefore, the specific implementation of the network security-based firewall interception information clustering and identification system can be found in the above-mentioned embodiment section of the network security-based firewall interception information clustering and identification method. The specific implementation can be referred to the description of the corresponding embodiments, and will not be repeated here.

[0138] like Figure 4 As shown, this application also provides an electronic device, including: a memory 41 for storing a computer program; and a processor 42 for executing the computer program to implement the steps of any of the above-described firewall interception information clustering and identification methods based on network security.

[0139] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described firewall-intercepted information clustering and identification methods based on network security.

[0140] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0141] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the embodiments of the firewall-intercepted information clustering and identification method based on network security.

[0142] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0143] The foregoing has provided a detailed description of a firewall-intercepted information clustering and identification method and system based on network security, as provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for clustering and identifying firewall-intercepted information based on network security, characterized in that, include: The payload feature data of the data packets intercepted by the firewall in real time is collected to obtain the original interception dataset, which includes the payload field, data encryption type and transmission rate; All payload feature data in the original interception dataset are preprocessed to obtain the corresponding normalized payload data. The fuzzy C-means algorithm is used to assign initial membership degrees to the normalized payload data, resulting in an initial membership set. Cluster centers are calculated on the initial membership set to obtain initial cluster centers. The difference between the initial cluster centers and all structured data records in the normalized payload data is calculated to obtain updated membership degrees. Cluster centers are then calculated on the updated membership degrees to obtain updated cluster centers. The difference between the updated cluster centers and the initial cluster centers is calculated. This difference is compared with a preset tolerance, and based on the comparison result, a cluster center feature set is obtained. According to the final membership degrees of the structured data records, the cluster center feature set is clustered and assigned to form multiple cluster groups. Based on the cluster center feature set, a convolutional neural network is used to extract deep features from each cluster group to obtain deep abstract features of firewall interception information. The deep abstract features are then fused with the corresponding cluster center feature set to form a feature vector. Based on the feature vector, the clustering result of firewall interception information is generated.

2. The method according to claim 1, characterized in that, The fuzzy C-means algorithm is used to perform initial membership assignment on the normalized payload data to obtain an initial membership set, including: The total number of structured data records and the preset number of clusters in the normalized payload data are processed to obtain the quantity parameters; The quantity parameter is subjected to random number sequence generation processing to obtain a random numerical sequence, and the random numerical sequence is subjected to constraint adjustment processing to obtain an adjusted sequence; The adjusted sequence is tabulated to obtain an initial allocation table. The initial allocation table is then normalized to obtain an initial membership set.

3. The method according to claim 2, characterized in that, The process of calculating cluster centers for the initial membership set to obtain initial cluster centers, and calculating the difference between the initial cluster centers and all structured data records in the normalized payload data to obtain updated membership degrees, includes: The initial cluster centers are obtained by calculating the weighted average of the initial membership sets. The difference between the initial cluster centers and all structured data records in the normalized payload data is calculated to obtain the difference measurement result. The difference measurement results are subjected to similarity conversion processing to obtain similarity values; The similarity values ​​are normalized and assigned to obtain the updated membership degree.

4. The method according to claim 1, characterized in that, Based on the cluster center feature set, a convolutional neural network is used to perform deep feature extraction on each cluster group to obtain deep abstract features of firewall interception information, including: All structured data records and their corresponding cluster center feature sets within the same cluster group are combined to obtain a combined feature sequence. The combined feature sequence is subjected to multi-scale feature extraction processing to obtain a multi-scale feature set; The multi-scale feature set is subjected to feature fusion processing to obtain a fused feature representation; The fused feature representation is subjected to feature compression processing to obtain deep abstract features of firewall interception information.

5. The method according to claim 1, characterized in that, The step of fusing the deep abstract features with the corresponding cluster center feature set to form a feature vector, and generating clustering results of firewall interception information based on the feature vector, includes: The deep abstract features are connected with the corresponding cluster center feature sets to obtain combined features. The combined features are then weighted to obtain weighted combined features. The weighted combined features are fused to obtain fused features, and the fused features are then dimensionality-reduced to obtain feature vectors. The feature vectors are classified to obtain the clustering results of firewall interception information.

6. The method according to claim 1, characterized in that, The preprocessing of all payload feature data in the original interception dataset to obtain corresponding normalized payload data includes: All payload feature data in the original interception dataset are processed for type identification to obtain type identifiers, and the payload feature data are processed for rate range mapping to obtain rate range identifiers. Based on the type identifier, the payload feature data is processed for payload extraction to obtain... arrive A readable character sequence is subjected to numerical conversion processing to form an initial numerical sequence; The type identifier, the rate range identifier, and the initial numerical sequence of the same payload feature data are combined to obtain a structured data record. All the structured data records are aggregated and processed to obtain normalized payload data.

7. A firewall-intercepted information clustering and identification system based on network security, characterized in that, include: The acquisition module is used to acquire payload feature data of data packets intercepted by the firewall in real time to obtain the original interception dataset, which includes payload field, data encryption type and transmission rate; The first processing module is used to preprocess all payload feature data in the original interception dataset to obtain the corresponding normalized payload data. The second processing module is used to perform initial membership assignment on the normalized payload data using a fuzzy C-means algorithm to obtain an initial membership set; calculate cluster centers on the initial membership set to obtain initial cluster centers; calculate the difference between the initial cluster centers and all structured data records in the normalized payload data to obtain updated membership degrees; calculate cluster centers on the updated membership degrees to obtain updated cluster centers; calculate the difference between the updated cluster centers and the initial cluster centers; compare the difference with a preset tolerance; obtain a cluster center feature set based on the comparison result; and perform clustering assignment on the cluster center feature set according to the final membership degrees of the structured data records to form multiple cluster groups. The fusion module is used to extract deep features from each cluster group using a convolutional neural network based on the cluster center feature set, to obtain deep abstract features of firewall interception information, and to fuse the deep abstract features with the corresponding cluster center feature set to form a feature vector, and to generate the clustering result of firewall interception information based on the feature vector.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of a network security-based firewall interception information clustering and identification method as described in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables a firewall-intercepted information clustering and identification method based on network security as described in any one of claims 1 to 6.

Images