Traffic analysis and attack detection method and device, terminal equipment and storage medium

Abstract

The invention relates to the technical field of machine learning, in particular to a traffic analysis and attack detection method and device, terminal equipment and a storage medium, and the method comprises the steps: obtaining an original network data packet from network terminal equipment in real time, carrying out the denoising of the original network data packet, extracting a key traffic feature, and forming a traffic feature vector; performing multi-modal fusion on the traffic feature vector and log data from the network terminal equipment to obtain a comprehensive network behavior feature; inputting the comprehensive network behavior characteristics into a trained network detection model to obtain attack recognition and anomaly detection results; the network detection model is obtained based on deep learning and reinforcement learning mixed training; and when an attack behavior or abnormity is detected, generating an analysis report. Therefore, network attacks can be identified and responded efficiently and accurately, and automatic defense is carried out.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, and in particular to a traffic analysis and attack detection method, apparatus, terminal device and storage medium. Background Technology

[0002] Currently, the cybersecurity field has many attack detection systems based on traditional rules. These include signature-based detection methods, traffic feature-based analysis methods, and intrusion detection systems (IDS) solutions. While these methods have achieved some success in specific environments, they generally suffer from shortcomings, especially when facing advanced persistent attacks (APAs), where accuracy and response speed are often low. With the development of artificial intelligence (AI) technology, more and more cybersecurity solutions based on deep learning and natural language processing have been implemented. The application of AI technology in attack pattern recognition, abnormal behavior detection, and traffic analysis has improved the accuracy and efficiency of detection. However, existing AI technologies still face some challenges in network traffic analysis. For example, the diversity and quality of training data have a significant impact on the model, and the traffic characteristics vary greatly across different network environments, resulting in low efficiency. Summary of the Invention

[0003] In view of this, embodiments of this application provide a traffic analysis and attack detection method that can effectively solve problems such as low efficiency.

[0004] In a first aspect, embodiments of this application provide a traffic analysis and attack detection method, including: The system acquires raw network data packets from network terminal devices in real time, performs noise reduction processing on the raw network data packets, and extracts key traffic features to obtain a traffic feature vector. The traffic feature vector is fused with log data from the network terminal device in a multimodal manner to obtain comprehensive network behavior features; The comprehensive network behavior features are input into the trained network detection model to obtain attack identification and anomaly detection results; the network detection model is obtained by training based on a hybrid deep learning and reinforcement learning model. When an attack or anomaly is detected, a resolution report is generated.

[0005] In some embodiments, the key traffic characteristics include source IP address, destination IP address, port number, protocol type, packet size, data transmission rate, and traffic direction.

[0006] In some embodiments, the multimodal fusion of the traffic feature vector with log data from the network terminal device includes: The traffic feature vector and the log data are weighted and integrated using an attention mechanism or a multilayer perceptron.

[0007] In some embodiments, the method further includes: When new attack samples, false positives / false negatives, and normal network traffic data are acquired, the network data is input into the network detection model, and the network detection model is iteratively optimized through an online learning mechanism by combining transfer learning and adaptive data augmentation techniques.

[0008] In some embodiments, the network detection model is a hybrid model composed of a convolutional neural network and a long short-term memory network.

[0009] In some embodiments, generating a parsing report when an attack or anomaly is detected includes: By using a locally interpretable model or attention weight visualization method, the attack type, judgment criteria, contribution ranking of the comprehensive network behavior features, attack path inference process, and confidence level assessment of the attack behavior are generated, thus obtaining a quantitative analysis result of the attack behavior or the anomaly.

[0010] In some embodiments, after generating the parsing report, the method further includes: The risk level is determined based on the analysis report, and the risk level includes four preset levels; When the risk level is Level 1, an alarm notification is generated and pushed to the security management platform; When the risk level is level two, rate limiting control is implemented on the target network traffic; When the risk level is level three, the connection will be interrupted and the source IP will be blocked. When the risk level is level four, the intrusion prevention system or network application firewall is invoked to perform deep interception. Secondly, embodiments of this application provide a traffic analysis and attack detection device, comprising: The data acquisition module is used to acquire raw network data packets from network terminal devices in real time, perform noise reduction processing on the raw network data packets, and extract key traffic features to form a traffic feature vector. The data fusion module is used to perform multimodal fusion of the traffic feature vector with log data from the network terminal device to obtain comprehensive network behavior features; The data recognition module is used to input the comprehensive network behavior features into the trained network detection model to obtain attack recognition and anomaly detection results; the network detection model is obtained by hybrid training based on deep learning and reinforcement learning; The parsing module is used to generate a parsing report when an attack or anomaly is detected.

[0011] Thirdly, embodiments of this application provide a terminal device, the terminal device including a processor and a memory, the memory storing a computer program, and the processor executing the computer program to implement the traffic analysis and attack detection method described above.

[0012] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed on a processor, implements the traffic analysis and attack detection method described above.

[0013] The embodiments of this application have the following beneficial effects: The method in this embodiment acquires raw network data packets and log data, fuses the data packets and log data, and inputs the fused data into a network detection model for identification. This determines whether attacks or anomalies exist in the current network, generates an analysis report, and then implements a defensive response based on the risk assessment. This approach represents a significant advancement in improving the detection capabilities for complex attacks and enhancing adaptability. Furthermore, it reduces manual intervention and improves network protection levels through intelligent and automated defense mechanisms. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This paper illustrates a flowchart of a traffic analysis and attack detection method according to an embodiment of this application. Figure 2 This diagram illustrates the operating environment for traffic analysis and attack detection according to an embodiment of this application. Figure 3 A schematic diagram of a traffic analysis and attack detection device according to an embodiment of this application is shown. Detailed Implementation

[0016] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0017] The components of the embodiments of this application described and illustrated in the accompanying drawings can be arranged and designed in a variety of different configurations. Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0018] In the following text, the terms "comprising," "having," and their cognates, which may be used in various embodiments of this application, are intended only to indicate a particular feature, number, step, operation, element, component, or combination thereof, and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations thereof, or adding the possibility of one or more combinations thereof. Furthermore, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0019] Unless otherwise specified, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the various embodiments of this application pertain. Terms (such as those defined in commonly used dictionaries) shall be interpreted as having the same meaning as in their contextual meaning in the relevant technical field and shall not be construed as having an idealized or overly formal meaning, unless clearly defined in the various embodiments of this application.

[0020] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0021] To address the shortcomings of existing network attack analysis methods, this application combines a network detection model with real-time acquisition of raw network data packets from network terminal devices. The raw network data packets are then denoised, and key traffic features are extracted to form a traffic feature vector. This traffic feature vector is then fused with log data from the network terminal devices to obtain comprehensive network behavior features for multimodal identification and analysis. This approach overcomes the bottlenecks of traditional methods in terms of accuracy, real-time performance, and adaptability, and further promotes a paradigm shift in network security from experience-driven to intelligent cognition.

[0022] The following examples illustrate this traffic analysis and attack detection method.

[0023] Figure 1A flowchart of a traffic analysis and attack detection method according to an embodiment of this application is shown. Exemplarily, the traffic analysis and attack detection method includes the following steps: Step S100: Acquire raw network data packets from network terminal devices in real time, perform noise reduction processing on the raw network data packets, and extract key traffic features to form a traffic feature vector. The technical solution of this embodiment is applied to network communication scenarios, such as network communication scenarios where a host or server is in a network. For ease of explanation, this embodiment uses a server as an example to describe the subsequent steps. The traffic analysis and attack detection method in this embodiment is a software algorithm executed on the server.

[0024] like Figure 2 The diagram shown is a schematic of an operating environment in this embodiment. In this environment, the server communicates and interacts with multiple network terminals through a network connection. The server and its corresponding network environment can be, for example, a local area network (LAN) within a company, or an external Ethernet network relative to the LAN. The network terminals can be smartphones, computers, routers, and other servers.

[0025] First, this embodiment will acquire raw network data packets from the network and terminal devices. These raw network data packets can be collected in real time from different devices, servers, terminals and network layers through traffic collectors deployed on network nodes.

[0026] A traffic collector can be a data capture device or program installed on key network nodes (such as router egress, switch mirror port, server network card, firewall bypass, etc.) that can non-intrusively monitor and copy passing network traffic to form raw data streams that can be used for analysis.

[0027] After acquiring the raw network data packets, these packets undergo noise reduction processing to extract key traffic characteristics. Because the raw network data packets contain a large amount of useless information, preprocessing and feature extraction operations are necessary to obtain useful feature data for subsequent identification of network behavior characteristics.

[0028] During preprocessing, the main processes are denoising and standardization. Denoising can be achieved through methods such as mean filtering to remove irrelevant and interfering information, thus enabling the network detection model to better identify and train.

[0029] For example, incomplete frames caused by CRC check failures, abnormal frame lengths (Ethernet frames less than 64 bytes or greater than 1518 bytes), and port mirroring errors are removed; and link layer protocol parsing is used to filter link layer broadcast packets and multicast probe packets (such as ARP request / response packets and LLDP protocol packets) that are not encapsulated with IP protocols, thus performing preliminary noise reduction.

[0030] Then, based on protocol specifications, abnormal packets are removed, including TCP half-open connection packets, UDP fragmented packets with no subsequent communication, and echo request packets (ping packets, which can be selected to be retained via a configuration switch) in the ICMP protocol. A sliding window deduplication algorithm is used to remove duplicate data packets caused by network retransmission. Then, redundant application layer data is filtered, such as blank request packets and duplicate 302 redirect response packets in the HTTP protocol. Outliers are removed based on statistical thresholds, using the 3σ principle (e.g., data exceeding the mean ± 3 standard deviations under a normal distribution is judged as outliers), filtering extreme values ​​of packet size and transmission rate, thereby completing the noise reduction operation and obtaining clean and effective data.

[0031] After denoising, standardization can be performed, such as Z-score standardization, to transform the data into data with a mean of 0 and a variance of 1. During feature extraction, several target features can be extracted as key traffic features according to a preset configuration. These key traffic features include source IP address, destination IP address, port number, protocol type, packet size, data transmission rate, and traffic direction, among others. During extraction, key fields of these features can be identified, and corresponding data can be obtained from network packets by matching these key fields, thus forming a key traffic feature vector. Alternatively, a sliding window can be used to extract temporal features, forming multi-dimensional temporal features.

[0032] Step S200: The traffic feature vector is fused with log data from the network terminal device in a multimodal manner to obtain comprehensive network behavior features.

[0033] In addition to processing real-time traffic data and obtaining key traffic characteristics, it also acquires log data from host systems. This log data includes host logs, behavior logs, user logs, and even log data from other terminal devices in the network. It's understandable that acquiring multimodal data from other sources allows for a better understanding of the overall network state changes, enabling the construction of a more complete network environment model and providing more comprehensive attack detection information.

[0034] Therefore, this embodiment also performs multimodal fusion of the traffic feature vector and log data from the host system. Exemplarily, during multimodal fusion, an attention mechanism or a multilayer perceptron can be used to weight and integrate the traffic feature vector and the log data. By weighting, the contribution of heterogeneous information from different sources is highlighted, achieving differentiated fusion operations. The different weights also provide guidance for subsequent model recognition.

[0035] During feature fusion, two fully connected layers (with a hidden layer dimension of 512) can be used to map the traffic feature vector (256 dimensions) and the log feature vector (192 dimensions) to a unified feature space of 512 dimensions respectively. Each layer adds a GELU activation function and layer normalization to perform dimensionality reduction processing on the log data.

[0036] During the fusion process, time alignment is first performed, that is, the sliding window of the traffic feature vector is strictly aligned with the time interval of the log data based on the timestamp to avoid invalid fusion across time dimensions; for time windows with missing log data, the forward padding method is used to supplement the mean vector of historical log features.

[0037] Regarding the adjustment of weights, the fusion weights are adaptively switched based on the attack scenario. The recall contribution of the two types of features under different attack types is statistically analyzed through historical data: for example, if the recall rate of traffic features accounts for 85% in a port scanning attack, the weight of traffic features is increased; if the recall rate of log features accounts for 70% in a brute-force attack, the weight of log features is increased.

[0038] The resulting comprehensive network behavior features will then be used as input to the model for identification. It can be understood that these comprehensive network behavior features are feature data that reflects the current network state, obtained by combining data from multiple sources in this embodiment.

[0039] Step S300: Input the comprehensive network behavior features into the trained network detection model to perform attack identification and anomaly detection.

[0040] This embodiment uses a network detection model to identify comprehensive network behavior characteristics in order to perform attack identification and anomaly detection in the current network environment. The network detection model is a single network detection model.

[0041] The network detection model is a hybrid model composed of convolutional neural networks and long short-term memory networks. This model can optimize inference speed through model quantization, pruning techniques, and parallel computing frameworks, ensuring that the detection time is lower than the attack response time.

[0042] As an example, the trained model can be quantized using INT8 to reduce memory usage and computation; redundant convolutional kernels and LSTM neurons can be removed through structured pruning to preserve model accuracy loss.

[0043] Network detection models determine whether network traffic contains malicious behavior or attack activities by comparing existing attack patterns with training data.

[0044] This embodiment's network detection model, after inputting comprehensive network behavior characteristics, outputs whether network attacks and anomalies exist, and the type of attack or anomaly. Because this embodiment combines the network detection model's identification capabilities, it can identify complex and covert attack behaviors, including advanced persistent threats and social engineering attacks, and track multi-stage attack processes.

[0045] As an example, the detection logic could be as follows: in the attack identification branch, when the predicted probability of a certain type of attack is ≥0.85, it is determined to be a known attack of that type; in the anomaly detection branch, when the anomaly confidence is ≥0.9 and does not match any known attack type, it is determined to be an unknown anomaly; for low confidence samples (0.7≤probability / confidence<0.85 / 0.9), they are marked as suspected events and included in subsequent key monitoring.

[0046] Step S400: When an attack or anomaly is detected, a parsing report is generated.

[0047] If no attack or anomaly is detected, no further defense response is required. Therefore, if no attack or anomaly is detected, steps S100 to S300 can be repeated.

[0048] When an attack or anomaly is detected, a response is required. To this end, this embodiment will generate an analysis report based on the model's output.

[0049] As an example, the analysis report of this embodiment can generate the attack type, judgment criteria, contribution ranking of each input feature, attack path inference process, and confidence level assessment of the attack behavior through a locally interpretable model or attention weight visualization method, thereby performing quantitative analysis and evaluation of the model output results and forming data that is easy for the program to perform quantitative analysis.

[0050] Furthermore, the system in this embodiment can perform corresponding defense operations based on the parsing report. It can automatically respond by setting predetermined defense strategies. For example, it can isolate infected terminals, block access from malicious IPs, and adjust firewall rules.

[0051] If the attack is widespread or cross-regional, the system can collaborate with other network defense systems through a cloud-based threat intelligence platform and share real-time threat intelligence.

[0052] It is understandable that the above report content is intended for network administrators, and also serves as input for the system's automatic defense mechanism, enabling the system to automatically assess the current risk level and then take corresponding defense response actions based on the risk level.

[0053] As an example, the risk level can be preset to four levels, namely Level 1, Level 2, Level 3 and Level 4, with the severity increasing as the level increases.

[0054] For example, when the risk level is Level 1, an alarm notification is generated and pushed to the security management platform. The alarm notification can be pushed via a pop-up window or an in-site message.

[0055] When the risk level is Level 2, rate limiting is applied to the target network traffic. Target network traffic refers to traffic that has been identified as problematic after analysis. For example, network traffic originating from a certain IP address may be identified as exhibiting abnormal or attacking behavior, but if it is only classified as Level 2, rate limiting can be used to control it. This can prevent false positives and also serve a protective function.

[0056] When the risk level is Level 3, the connection is interrupted and the source IP is blocked. Level 3 risk indicates a substantial attack or harmful behavior, in which case the source IP of the corresponding network traffic can be blocked, such as by adding it directly to the firewall to block all network data sent from that IP.

[0057] When the risk level is level four, the intrusion prevention system or network application firewall is invoked to perform deep interception. Level four is also the highest level of risk, at which point all available defense measures must be invoked to intervene, such as the intrusion prevention system, network application firewall, or other defense measures.

[0058] Furthermore, the model in this embodiment employs an online learning mechanism, enabling it to continuously update the model based on new traffic data and attack samples. By continuously optimizing the deep learning and reinforcement learning models, the system can cope with changes in the network environment and the challenges of new attacks.

[0059] Furthermore, this embodiment also monitors the entire system's operational status in real time, including network traffic processing speed, system load, and detection accuracy, ensuring stable operation under high concurrency. Simultaneously, the performance of the network detection model is periodically evaluated, including metrics such as detection accuracy, false positive rate, and false negative rate, ensuring continuous system optimization.

[0060] For example, each time network data and log data are acquired and identified, they are stored as training data. After a certain period of time, this stored training data is input into the model to train the model, thereby updating the model and realizing the online update operation of the model.

[0061] This embodiment's method automatically extracts precise features using a hybrid deep learning and reinforcement learning algorithm. Combined with multimodal data (traffic data + host logs + behavior logs) fusion analysis, it effectively filters data noise, significantly reducing false positive and false negative rates. It accurately distinguishes between malicious and normal traffic, achieving higher accuracy in identifying known attacks. By leveraging hybrid AI models (such as CNN and LSTM) to capture the temporal correlations and covert patterns of multi-stage attacks, it can effectively identify complex attacks such as Advanced Persistent Threats (APTs), lateral movement attacks, and botnets, tracing complete attack paths. This addresses the shortcomings of existing systems in detecting variant and unknown attacks, clearly presenting the decision-making logic, judgment criteria, feature contribution, and attack path for attack detection. It solves the "black box" problem of traditional AI models, facilitating security personnel's understanding of detection results and handling of false positives, thus improving system reliability and operational efficiency. Significant progress has been made in improving the ability to detect complex attacks and adapt, and it can also reduce manual intervention and improve network protection levels through intelligent and automated defense mechanisms.

[0062] Figure 3 A schematic diagram of a traffic analysis and attack detection apparatus according to an embodiment of this application is shown. Exemplarily, the apparatus includes: The data acquisition module 10 is used to acquire raw network data packets from network terminal devices in real time, perform noise reduction processing on the raw network data packets, and extract key traffic features to form a traffic feature vector. Data fusion module 20 is used to perform multimodal fusion of the traffic feature vector with log data from the network terminal device to obtain comprehensive network behavior features; The data recognition module 30 is used to input the comprehensive network behavior features into the trained network detection model to obtain attack recognition and anomaly detection results; the network detection model is obtained based on a hybrid training of deep learning and reinforcement learning; The parsing module 40 is used to generate a parsing report when an attack or anomaly is detected.

[0063] It is understood that the apparatus of this embodiment corresponds to the method of the above embodiments, and the options in the above embodiments are also applicable to this embodiment, so they will not be described again here.

[0064] This application also provides a terminal device, which includes a processor and a memory. The memory stores a computer program, and the processor executes the computer program to implement the traffic analysis and attack detection method described above.

[0065] As an example, the terminal device can be a computer, mobile phone, server, or other network-connected electronic device.

[0066] The processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including at least one of a Central Processing Unit (CPU), Graphics Processing Unit (GPU), Network Processor (NP), Digital Signal Processor (DSP), Application-Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application.

[0067] The memory can be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The memory is used to store computer programs, and the processor can execute the computer programs accordingly after receiving execution instructions.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that, in alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0069] In addition, the functional modules or units in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0070] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a smartphone, personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0071] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A traffic analysis and attack detection method, characterized in that, include: The system acquires raw network data packets from network terminal devices in real time, performs noise reduction processing on the raw network data packets, and extracts key traffic features to obtain a traffic feature vector. The traffic feature vector is fused with log data from the network terminal device in a multimodal manner to obtain comprehensive network behavior features; The comprehensive network behavior features are input into the trained network detection model to obtain attack identification and anomaly detection results; The network detection model is obtained by training a hybrid of deep learning and reinforcement learning. When an attack or anomaly is detected, a resolution report is generated.

2. The traffic analysis and attack detection method according to claim 1, characterized in that, The key traffic characteristics include source IP address, destination IP address, port number, protocol type, packet size, data transmission rate, and traffic direction.

3. The traffic analysis and attack detection method according to claim 1, characterized in that, The step of multimodal fusion of the traffic feature vector with log data from the network terminal device includes: The traffic feature vector and the log data are weighted and integrated using an attention mechanism or a multilayer perceptron.

4. The traffic analysis and attack detection method according to claim 1, characterized in that, Also includes: When new attack samples, false positives / false negatives, and normal network traffic data are acquired, the network data is input into the network detection model, and the network detection model is iteratively optimized through an online learning mechanism by combining transfer learning and adaptive data augmentation techniques.

5. The traffic analysis and attack detection method according to claim 1, characterized in that, The network detection model is a hybrid model composed of convolutional neural networks and long short-term memory networks.

6. The traffic analysis and attack detection method according to claim 1, characterized in that, When an attack or anomaly is detected, a parsing report is generated, including: By using a locally interpretable model or attention weight visualization method, the attack type, judgment criteria, contribution ranking of the comprehensive network behavior features, attack path inference process, and confidence level assessment of the attack behavior are generated, thus obtaining a quantitative analysis result of the attack behavior or the anomaly.

7. The traffic analysis and attack detection method according to claim 1, characterized in that, After generating the parsing report, the process also includes: The risk level is determined based on the analysis report, and the risk level includes four preset levels; When the risk level is Level 1, an alarm notification is generated and pushed to the security management platform; When the risk level is level two, rate limiting control is implemented on the target network traffic; When the risk level is level three, the connection will be interrupted and the source IP will be blocked. When the risk level is level four, the intrusion prevention system or network application firewall is invoked to perform deep interception.

8. A traffic analysis and attack detection device, characterized in that, include: The data acquisition module is used to acquire raw network data packets from network terminal devices in real time, perform noise reduction processing on the raw network data packets, and extract key traffic features to form a traffic feature vector. The data fusion module is used to perform multimodal fusion of the traffic feature vector with log data from the network terminal device to obtain comprehensive network behavior features; The data recognition module is used to input the comprehensive network behavior features into the trained network detection model to obtain attack recognition and anomaly detection results; The network detection model is obtained by training a hybrid of deep learning and reinforcement learning. The parsing module is used to generate a parsing report when an attack or anomaly is detected.

9. A terminal device, characterized in that, The terminal device includes a processor and a memory, the memory storing a computer program, and the processor executing the computer program to implement the traffic analysis and attack detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed on a processor, implements the traffic analysis and attack detection method according to any one of claims 1-7.

Images