Network attack detection method and system based on convolutional neural network

Abstract

The invention provides a network attack detection method based on a convolutional neural network. The method comprises the following steps: collecting network data and preprocessing the network data; extracting statistical characteristics of the preprocessed network data; and according to the statistical characteristics of the network data, obtaining the identification probability of each preset type of network attack. According to the preset type identification probability of each network attack, carrying out attack mode identification, and outputting a corresponding attack identification signal; and executing preset network isolation and attack defense measures according to the attack identification signal. According to the network attack detection method based on the convolutional neural network, the convolutional neural network is utilized to comprehensively analyze the nonlinear relationship of the statistical characteristics of the network data, highly hidden network attack behaviors are accurately identified, the phenomena of false alarm and missing alarm can be effectively avoided, and the network security is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network attack detection method and system based on convolutional neural networks. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of the internet, businesses, governments, and individuals are increasingly reliant on networks, making cybersecurity a critical issue that urgently needs to be addressed globally. Cybersecurity refers to the process of protecting computer networks and the data they transmit from unauthorized access, attacks, modification, or damage. In cybersecurity protection, different network attacks require corresponding network protection measures; mismatches will lead to defense failure.

[0003] While existing network security systems can defend against known network attack patterns to a certain extent, they are prone to misjudging the type of unknown attacks when defending against unknown attacks, leading to false alarms or failure to identify unknown attacks and thus missing detections. This reduces network security and brings serious security risks. Summary of the Invention

[0004] Based on this, the purpose of this invention is to provide a network attack detection method and system based on convolutional neural networks. This method can extract statistical features from network traffic data, system log data, user behavior data, and transmission protocol data, and input these features into a convolutional neural network for calculation. By comprehensively considering the complex nonlinear relationships between various statistical features, it can accurately identify highly concealed network attack behaviors. Simultaneously, by utilizing the deep learning mechanism of convolutional neural networks, it can effectively extract key features from network data and accurately classify different types of attacks, thereby quickly identifying various network attacks and triggering corresponding automated defense measures, effectively achieving network security protection.

[0005] This invention provides a network attack detection system based on a convolutional neural network, comprising: The data acquisition and preprocessing module is used to collect network traffic data, system log data, user behavior data and transmission protocol data of each data packet on the network in real time, and to clean and preprocess the collected network data. The feature extraction module is used to extract statistical features of the preprocessed data packets, including effective size features, time series features, latency features, and traffic fluctuation features. The preset attack type probability calculation module is used to establish preset types of network attacks based on information on the network, and input the statistical features into a convolutional neural network to calculate the recognition probability of each preset type of network attack. The attack pattern recognition and classification module is used to identify attack patterns based on the preset recognition probability of each network attack type and output the corresponding attack recognition signal. The automatic response and execution module is used to execute preset network isolation and attack defense measures based on attack identification signals.

[0006] Furthermore, the preset attack type probability calculation module includes: The network attack preset submodule is used to establish preset types of network attacks based on information on the network. The local correlation feature submodule includes a convolutional layer used to convolve the statistical features to obtain the local correlation features of the statistical features; The linear activation submodule includes an activation layer for performing nonlinear transformation on the local correlation features of the statistical features, introducing nonlinear characteristics, and outputting a nonlinear feature map. The compression submodule includes a pooling layer for downsampling and compressing the nonlinear feature map to obtain a compressed feature map; The feature integration submodule includes a fully connected layer for dimensionality reduction and integration of the compressed feature map to obtain a global feature vector; The overall output submodule includes an output layer, which is used to calculate the recognition probability of each preset type of network attack based on the global feature vector.

[0007] Furthermore, the feature extraction module includes: The effective size feature submodule is used to calculate the effective size Size(i) of each data packet; The time series feature submodule is used to obtain the same-source access time series U1(i) and the same-target access time series U2(i); The delay feature submodule is used to calculate the error response delay Delay(i) corresponding to each data packet; The traffic fluctuation feature submodule is used to calculate the mean network traffic size μ[x1(i)] and the standard deviation of network traffic size σ[x1(i)] of the data packets.

[0008] A network attack detection method based on convolutional neural networks includes the following steps: S1. Collect network data and preprocess it; S2. Extract statistical features from the preprocessed network data; S3. Based on the statistical characteristics of network data, obtain the identification probability of each preset type of network attack.

[0009] S4. Identify attack patterns based on the preset probability of each network attack type and output the corresponding attack identification signal. S5. Execute preset network isolation and attack defense measures based on attack identification signals.

[0010] Furthermore, the steps for extracting statistical features from the preprocessed network data include: S21. Calculate the effective size Size(i) of each data packet; S22. Obtain the same-source access time series U1(i) and the same-target access time series U2(i); S23. Calculate the error response delay Delay(i) corresponding to each data packet; S24. Calculate the mean network traffic size μ[x1(i)] and the standard deviation of network traffic size σ[x1(i)] of the data packets.

[0011] Furthermore, based on the statistical characteristics of network data, the steps for obtaining the identification probability of each preset type of network attack include: S31. Establish preset types of network attacks; S32. Perform convolution on statistical features to obtain local correlation features of statistical features. ; S33, Local correlation features of statistical characteristics A nonlinear transformation is performed to introduce nonlinear characteristics, and a nonlinear feature map is output. ; S34. Nonlinear Feature Map Perform downsampling compression to obtain compressed feature maps. ; S35, Compressing Feature Maps Perform dimensionality reduction and integration to obtain global feature vectors. ; S36. Based on global feature vectors Calculate the recognition probability of each preset type of network attack. .

[0012] Furthermore, convolution is performed on the statistical features to obtain the local correlation features of the statistical features. The specific process is as follows: Let the statistical characteristics of network data be denoted as the set E={Size(i),U1(i),U2(i),Delay(i),μ[x1(i)],σ[x1(i)]}; Input set E into the convolutional layer and perform convolution operation according to the following formula:

[0013] in, The value at position (p,q) in the local correlation feature map of the statistical features output by the convolutional layer; r1 is the layer index of the convolutional layer; r2 is the node index of the convolutional layer; R1 is the total number of convolutional layers; R2 is the total number of nodes contained in the convolutional layer; e1, e2, e3, e4, e5, e6 are input parameters, corresponding to the effective size Size(i), the same-source access time series U1(i), the same-target access time series U2(i), the error response delay Delay(i), the mean network traffic size μ[x1(i)], and the standard deviation of network traffic size σ[x1(i)].

[0014] Furthermore, the local correlation features of statistical characteristics A nonlinear transformation is performed to introduce nonlinear characteristics, and a nonlinear feature map is output. The specific process is as follows: Local correlation features Input the activation layer and perform nonlinear operations according to the following formula:

[0015] Where f2 is the activation function of the activation layer, which can be a ReLU function or a Sigmoid function; This is the activated nonlinear feature map.

[0016] Furthermore, for nonlinear feature maps Perform downsampling compression to obtain compressed feature maps. The specific process is as follows: Nonlinear feature maps Input pooling layer, set a sliding window of size k3×k3, and move the non-linear feature map with a stride of s3. Up-scanning: For each local region covered by a window, take the maximum value within the window as the compressed feature map. The corresponding position in the middle ( The value of ) is calculated, and the compressed feature map is output. :

[0017] in, The output is a compressed feature map, where k3 is the length and width of the sliding window, and s3 is the step size of the sliding window.

[0018] Furthermore, obtain the global feature vector. And calculate the recognition probability of each preset type of network attack. The specific process is as follows: Compress the feature map The input consists of three fully connected layers. The first fully connected layer compresses the feature map. Flatten it into a one-dimensional vector Y = [Y1, Y2, ..., YD], where D is the dimension after flattening; then input the one-dimensional vector Y into the second fully connected layer; The second fully connected layer has k4 nodes, where k4 = 1, 2, ..., K4, and K4 is the total number of nodes in the second fully connected layer. Calculate the output ak4 of the k4th node according to the following formula and input it into the third fully connected layer:

[0019] in, This represents the weight of the k4th node in the second fully connected layer. f1 is the bias of the k4th node in the second fully connected layer; f3 is the activation function of the pooling layer, which can be either ReLU or Sigmoid; d1 = 1, 2, ..., D; The third fully connected layer has r3 nodes, where r3 = 1, 2, ..., R3, and R3 is the total number of nodes in the third fully connected layer. The output of the r3th node is calculated using the following formula. and input / output layers:

[0020] in, This represents the weight of the r3rd node in the third fully connected layer. f is the bias of the r3rd node in the third fully connected layer; f4 is the activation function of the fully connected layer, which can be either ReLU or Sigmoid. The output layer has r4 nodes, where r4 = 1, 2, ..., R4, and R4 is the total number of nodes in the output layer. The output of the r4th node is calculated using the following formula. :

[0021] in, The output of the r4th node in the output layer represents the recognition probability of each preset type of network attack; This represents the weight of the r4th node in the output layer. The bias is set to the r4th node of the output layer; the softmax function is the activation function of the output layer.

[0022] To better understand and implement this invention, the following detailed description is provided in conjunction with the accompanying drawings. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating the steps of the network attack detection method based on convolutional neural networks of the present invention. Figure 2 This is a block diagram of the network attack detection system based on convolutional neural networks according to the present invention. Detailed Implementation

[0024] The applicant carefully analyzed the existing network security system and found that it can only defend against known network attack patterns to a certain extent. However, it is prone to false alarms or missed alarms when defending against unknown attacks. The reason is that the existing network security protection technology mainly relies on rule and signature database matching. However, many modern network attacks (such as DDoS attacks, SQL injection, XSS attacks, etc.) usually use complex means to disguise themselves. The existing network security system cannot identify them or identifies them incorrectly, resulting in network protection failure and security risks.

[0025] Based on this, the applicant provides a network attack detection method and system based on convolutional neural networks. By collecting network traffic data, system log data, user behavior data, and transmission protocol data from data packets, the method calculates multiple statistical features of the network data and analyzes the nonlinear relationships of these statistical features using convolutional neural networks. This accurately identifies highly covert network attack behaviors and precisely classifies different types of attacks, thereby quickly identifying various network attacks and triggering corresponding automated defense measures to improve network security.

[0026] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating the steps of the network attack detection method based on convolutional neural networks of the present invention. Figure 2 This is a block diagram of the network attack detection system based on convolutional neural networks according to the present invention.

[0027] This invention provides a network attack detection system based on convolutional neural networks, including a data acquisition and preprocessing module 10, a feature extraction module 20, a preset attack type probability calculation module 30, an attack pattern recognition and classification module 40, and an automatic response and execution module 50.

[0028] The data acquisition and preprocessing module 10 is used to perform step S1: acquire network data and preprocess it.

[0029] Specifically, the data acquisition and preprocessing module 10 collects network traffic data, system log data, user behavior data, and transmission protocol data of each data packet i in real time in the network, and cleans the collected network data through preprocessing. Here, i is the sequence number of the data packet, i=1, 2, ..., n; n is the total number of data packets acquired.

[0030] Correspondingly, the data acquisition and preprocessing module 10 includes: The network layer metadata acquisition submodule 11 is used to perform step S11: acquire the network layer metadata of each data packet i.

[0031] Specifically, the network layer metadata of data packet i includes: real-time network traffic size x1(i), network traffic timestamp x2(i), protocol type identifier x3(i), user source IP address x4(i), and destination IP address x5(i). The network layer metadata collection submodule 11 collects the network data of each data packet i according to the above categories and stores it in the corresponding storage location.

[0032] In this embodiment, the protocol type symbol x3(i) takes values ​​from 0 to 5, where: The protocol type identifier x3(i) = 0 indicates that the data packet i belongs to the TCP protocol; The protocol type identifier x3(i) = 1 indicates that the data packet i belongs to the UDP protocol; The protocol type identifier x3(i) = 2 indicates that the data packet i belongs to the ICMP protocol; The protocol type identifier x3(i) = 3 indicates that the data packet i belongs to the HTTP protocol; The protocol type symbol x3(i) = 4 indicates that the table data packet i belongs to the FTP protocol; The protocol type identifier x3(i) = 5 indicates that the data packet i belongs to the SMTP protocol.

[0033] Application layer metadata collection submodule 12 is used to perform step S12: collect application layer metadata of each data packet i.

[0034] Specifically, the application layer metadata of data packet i includes: request path x6(i), request method number x7(i), response code x8(i), and response time x9(i). The application layer metadata collection submodule 12 collects the network data of each data packet i according to the above categories and stores it in the corresponding storage location.

[0035] In this embodiment, the method number symbol x7 takes a value from 0 to 5, where: The method number symbol x7(i) = 0 indicates that the request method of the data packet i is GET, that is, requesting the specified resource; The method number symbol x7(i) = 1 indicates that the request method of the data packet i is POST, that is, sending data to the server; The method number symbol x7(i) = 2 indicates that the request method of the data packet i is PUT, that is, to update the specified resource; The method number symbol x7(i) = 3 indicates that the request method of the data packet i is DELETE, that is, to delete the specified resource; The method number symbol x7(i) = 4 indicates that the request method of the data packet i is OPTIONS, that is, the HTTP method supported by the specified resource is requested; The method number symbol x7(i) = 5 indicates that the request method of the data packet i is PATCH, that is, to perform a partial update on the specified resource.

[0036] In this embodiment, the response code x8(i) takes values ​​from 0 to 3, where: The response code x8(i) = 0 indicates that the response information of data packet i is of the success type; The response code x8(i) = 1 indicates that the response information of data packet i is a redirection type; The response code x8(i) = 2 indicates that the response information of data packet i is a client error class; The response code x8(i) = 3 indicates that the response information of data packet i is a server error class.

[0037] The data preprocessing submodule 13 is used to perform step S13: preprocessing each collected data packet i.

[0038] Specifically, the method by which the data preprocessing submodule 13 preprocesses each data packet includes: deleting all network data of invalid data packet i, and uniformly converting the various timestamps corresponding to the remaining valid data packet i into UNIX timestamp format.

[0039] Invalid packets i include packets i that do not contain real-time network traffic size, packets i that do not contain user source IP address, packets i that do not contain destination IP address, packets i that do not contain response code, packets i with negative timestamps or expired, and packets i without any payload.

[0040] The feature extraction module 20 is used to perform step S2: extracting statistical features of the preprocessed network data.

[0041] Specifically, the feature extraction module 20 performs statistical analysis on the network data of each data packet i and calculates and extracts the statistical features of each data packet i, including: effective size features, time series features, latency features and traffic fluctuation features.

[0042] Correspondingly, the feature extraction module 20 includes: The effective size feature submodule 21 is used to perform step S21: calculate the effective size Size(i) of each data packet i.

[0043] The effective size feature submodule 21 obtains the number of bytes in the header j portion of each packet i and the number of bytes in the payload portion PayLoad(j) in the real-time network traffic size x1(i) of each packet i, and then calculates the effective size Size(i) of each packet i according to the following formula:

[0044] In the formula, j is the part number of the package head, j=1,…,m; m is the total number of packages.

[0045] The time series feature submodule 22 is used to perform step S22: obtain the same source access time series U1(i) and the same target access time series U2(i).

[0046] The time series feature submodule 22 divides the data packet i into a same-source data packet with the same user source IP address x4(i) and a same-destination data packet with the same user source IP address x5(i) based on the user source IP address x4(i) and the destination IP address x5(i). The two are respectively denoted as the same-source data packet {x4(i)∈ADD(k1)} and the same-destination data packet {x5(i)∈ADD(k2)}. Where ADD(k1) represents all the user source IP addresses obtained from the statistics, k1 is the user source IP address number among them, k1=1,2,...,K1; K1 is the total number of user source IP addresses obtained from the statistics; ADD(k2) represents all the target IP addresses obtained from the statistics, where k2 is the target IP address number, k2=1,2,...,K2; and K2 is the total number of target IP addresses obtained from the statistics. The time series feature submodule 22 obtains the network traffic timestamp x2(i) corresponding to each data packet i in the same source data packet {x4(i)∈ADD(k1)} and the same destination data packet {x5(i)∈ADD(k2)}, and arranges them in descending order, which are respectively denoted as same source access time series U1(i) and same destination access time series U2(i).

[0047] The delay feature submodule 23 is used to perform step S23: calculate the error response delay Delay(i) corresponding to each data packet i.

[0048] The delay feature submodule 23 obtains the network traffic timestamp x2(i) and response time x9(i) of all data packets i for which the response code x8(i) is not 0, and calculates the error response delay Delay(i) corresponding to each data packet i according to the following formula:

[0049] In addition, data packet i with response code x8(i) of 0 is a successful response class, and its error response delay is 0.

[0050] Traffic fluctuation feature submodule 24 is used to perform step S24: calculate the mean network traffic size μ[x1(i)] and the standard deviation of network traffic size of the data packet i. [x1(i)].

[0051] The traffic fluctuation feature submodule 24 obtains the real-time network traffic size x1(i) of each data packet i, and calculates the mean network traffic size μ[x1(i)] and the standard deviation of the network traffic size of the data packet i according to the following formula. [x1(i)]:

[0052]

[0053] The preset attack type probability calculation module 30 is used to perform step S3: based on the statistical characteristics of network data, obtain the identification probability of each preset type of network attack.

[0054] The preset attack type probability calculation module 30 presets possible network attack types based on existing network attack methods, including distributed denial-of-service attacks, SQL injection attacks, cross-site scripting attacks, malware attacks, phishing attacks, buffer overflow attacks, identity theft attacks, man-in-the-middle attacks, DNS amplification attacks, ARP spoofing attacks, and command injection attacks. It then inputs the statistical features of each data packet i obtained by the feature extraction module 20 into a convolutional neural network and calculates the identification probability of each preset type of network attack based on the convolutional neural network.

[0055] Correspondingly, the preset attack type probability calculation module 30 includes: The network attack preset submodule 31 is used to perform step S31: establish the preset type of network attack.

[0056] The network attack preset submodule 31 collects information about existing network attacks on the Internet and establishes preset types of network attacks accordingly.

[0057] The local correlation feature submodule 32 is used to perform step S32: performing convolution on the statistical feature set of the network data provided by the feature extraction module 20 to obtain the local correlation features of the statistical features. .

[0058] The statistical feature set of each data packet i can be represented as E={Size(i), U1(i), U2(i), Delay(i), μ[x1(i)], σ[x1(i)]}. The local correlation feature submodule 32 includes a convolutional layer. The statistical feature set is input into the convolutional layer, and the local correlation between different statistical features of data packet i is automatically learned using a convolutional neural network. The local correlation features of the statistical features are extracted. The convolutional layer performs a convolution operation on the statistical feature set E according to the following formula:

[0059] In the formula, The value at position (p,q) in the local correlation feature map of the statistical features output by the convolutional layer; r1 is the layer index of the convolutional layer; r2 is the node index of the convolutional layer; R1 is the total number of convolutional layers; R2 is the total number of nodes contained in the convolutional layer; e1, e2, e3, e4, e5, e6 are input parameters, corresponding to the effective size Size(i), the same-source access time series U1(i), the same-target access time series U2(i), the error response delay Delay(i), the mean network traffic size μ[x1(i)], and the standard deviation of network traffic size σ[x1(i)].

[0060] Linear activation submodule 33 is used to perform step S33: local correlation features of statistical features. A nonlinear transformation is performed to introduce nonlinear characteristics, and a nonlinear feature map is output. .

[0061] Specifically, the convolutional layer outputs a preliminary local correlation feature map of statistical features through convolution operations. This feature map reflects the linear combination relationship between the statistical features of data packet i. However, considering that the feature differences between network attack behavior and normal network traffic are often highly complex and nonlinear, in order to improve the network attack detection system's ability to identify these network attack behaviors, it is necessary to introduce nonlinear characteristics into the system.

[0062] The linear activation submodule 33 includes an activation layer, which inputs the local correlation features of the statistical features output by the convolutional layer into the activation layer, and processes the output value of the convolutional layer according to the following formula. Perform nonlinear operations:

[0063] In the formula, f2 is the activation function of the activation layer, which can be a ReLU function or a Sigmoid function; This is the activated nonlinear feature map.

[0064] Compression submodule 34 is used to perform step S34: processing the nonlinear feature map. Perform downsampling compression to obtain compressed feature maps. .

[0065] Specifically, the nonlinear feature map output by the activation layer While containing rich feature information, the data has a high dimensionality and may contain redundant information. To reduce computational load, optimize the computational efficiency of the network attack detection system, and enhance its robustness in detecting network attack behavior, it is necessary to optimize the nonlinear feature map. Perform downsampling and compression processing.

[0066] The compression submodule 34 includes a pooling layer, which uses a sliding window of size k3×k3 with a step size s3 to move the data in the nonlinear feature map. In the up-scan, for each local region covered by the window, the pooling layer performs a local aggregation operation, taking the maximum value within the window as the corresponding position in the compressed feature map output by the pooling layer. The value of ) is calculated, and the compressed feature map is output:

[0067] Feature integration submodule 35 is used to perform step S35: compressing the feature map Perform dimensionality reduction and integration to obtain global feature vectors. .

[0068] Specifically, although the compressed feature map output by the pooling layer has a strong feature representation capability, it is still a two-dimensional structure, and each feature is a local feature, lacking global correlation. In order to integrate these two-dimensional distributed local features into global features and finally map them to specific network attack preset types, it is necessary to perform dimensionality reduction and integration processing on the compressed feature map.

[0069] The feature integration submodule 35 includes a fully connected layer. In this embodiment, the fully connected layer has three layers. The first fully connected layer first flattens the two-dimensional compressed feature map into a one-dimensional vector Y=[Y1, Y2, ..., YD], where D is the dimension after flattening. Then, the one-dimensional vector Y is input into the second fully connected layer for calculation.

[0070] Assuming there are k4 nodes in the second fully connected layer, where k4 = 1, 2, ..., K4, and K4 is the total number of nodes in the second fully connected layer, the output ak4 of the k4th node can be calculated using the following formula:

[0071] In the formula, This represents the weight of the k4th node in the second fully connected layer. f1 is the bias of the k4th node in the second fully connected layer; f3 is the activation function of the pooling layer, which can be either ReLU or Sigmoid; d1 = 1, 2, ..., D.

[0072] Assuming there are r3 nodes in the third fully connected layer, where r3 = 1, 2, ..., R3, and R3 is the total number of nodes in the third fully connected layer, the output of the r3th node can be calculated using the following formula. :

[0073] In the formula, This represents the weight of the r3rd node in the third fully connected layer. f is the bias of the r3rd node in the third fully connected layer; f4 is the activation function of the fully connected layer, which can be either ReLU or Sigmoid.

[0074] Total output submodule 36 is used to execute step S36: based on the global feature vector Calculate the recognition probability of each preset type of network attack. .

[0075] Specifically, the global feature vector output by the fully connected layer It contains in-depth comprehensive information about network traffic data in packet i, but the recognition results are not yet readily visible to the user. It requires the global feature vector... This is transformed into quantifiable identification results for preset types of network attacks.

[0076] The total output submodule 36 includes an output layer. Assuming the output layer has r4 nodes, where r4 = 1, 2, ..., R4, and R4 is the total number of nodes in the output layer, the output of the r4th node can be calculated using the following formula. :

[0077] In the formula, The output of the r4th node in the output layer represents the recognition probability of each preset type of network attack; This represents the weight of the r4th node in the output layer. The bias is set to the r4th node of the output layer; the softmax function is the activation function of the output layer.

[0078] In this embodiment, the value of r4 ranges from 0 to 10, corresponding to the preset type of network attack. When r4=0 This represents the probability of identifying a distributed denial-of-service attack. When r4=1, This represents the probability of identifying an SQL injection attack. When r4=2, This represents the probability of identifying cross-site scripting attacks; When r4=3 This represents the probability of identifying a malware attack. When r4=4 This represents the probability of identifying a phishing attack. When r4=5 This represents the probability of identifying a buffer overflow attack. When r4=6 This represents the probability of identifying an identity theft attack. When r4=7 This represents the probability of identifying a man-in-the-middle attack. When r4=8 This represents the probability of identifying a DNS amplification attack. When r4=9 This represents the probability of identifying an ARP spoofing attack. When r4=10, This represents the probability of identifying a command injection attack.

[0079] The attack pattern recognition and classification module 40 is used to perform step S4: to identify attack patterns according to the preset identification probability of each network attack type, and output the corresponding attack identification signal.

[0080] The attack pattern recognition and classification module 40 sets a maximum threshold for each preset type of network attack based on the severity of the network attack. Then, it obtains the output of the output layer and compares the recognition probability of the preset type of network attack output by the output layer with the corresponding maximum threshold. When the recognition probability of a preset type of network attack is greater than its maximum threshold, the module outputs the corresponding attack recognition signal, including: distributed denial-of-service attack recognition signal, SQL injection attack recognition signal, cross-site scripting attack recognition signal, malware attack recognition signal, phishing attack recognition signal, overflow attack recognition signal, identity theft attack recognition signal, man-in-the-middle attack recognition signal, DNS amplification attack recognition signal, ARP spoofing attack recognition signal, and command injection attack recognition signal.

[0081] In one embodiment, distributed denial-of-service attacks (0.85) and DNS amplification attacks (0.88) are given higher thresholds due to their obvious abnormal traffic characteristics; SQL injection (0.82), buffer overflow (0.82), identity theft (0.80), and man-in-the-middle attacks (0.83) are given medium to high thresholds because they involve important data and security protocols; application layer attacks such as cross-site scripting (0.78), command injection (0.76), ARP spoofing (0.80), and phishing (0.75) are given medium thresholds because their characteristics are relatively obvious; and malware attacks (0.72) are given relatively low thresholds because their detection characteristics are diverse and early warning is required.

[0082] when When a distributed denial-of-service attack is detected, a DDoS_Attack_Signal is output. when When an SQL injection attack is detected, the SQL_Injection_Signal signal is output. when When a cross-site scripting attack is detected, the XSS_Attack_Signal signal is output. when When a malware attack is detected, a Malware_Attack_Signal signal is output. when When a phishing attack is detected, a Phishing_Attack_Signal signal is output. when When a buffer overflow attack is detected, the Buffer_Overflow_Signal signal is output. when When an identity theft attack is detected, the Identity_Theft_Signal signal is output. when When a man-in-the-middle attack is detected, the MITM_Attack_Signal signal is output. when When a DNS amplification attack is detected, a DNS_Amplification_Signal signal is output. when When an ARP spoofing attack is detected, the ARP_Spoofing_Signal identification signal is output. when When a command injection attack is detected, the Command_Injection_Signal identification signal is output.

[0083] The automatic response and execution module 50 is used to execute step S5: execute preset network isolation and attack defense measures based on the attack identification signal.

[0084] When the automatic response and execution module 50 receives the attack identification signal output by the attack pattern identification and classification module 40, it selects the corresponding attack defense measures according to the corresponding attack type.

[0085] Specifically, when a DDoS_Attack_Signal identification signal is received, the DDoS defense system is activated to perform traffic cleaning, filter malicious traffic, degrade non-critical services, ensure the stability of important services, and isolate the attacked server from the internal network to prevent the attack from spreading. When the SQL_Injection_Signal recognition signal is received, the user input data is verified using a whitelist, the WAF is started, SQL injection attacks are identified and blocked, the application's database access permissions are restricted, and the use of high-privilege database accounts is avoided. When the XSS_Attack_Signal recognition signal is received, all user input is sanitized, the user input content is encoded to prevent the injected script from being executed, and the executable JavaScript sources are restricted through CSP; When a Malware_Attack_Signal is received, antivirus and malware detection programs are launched to perform a full system scan and remove malware, and the backup of the affected system is restored to remove malware; When a Phishing_Attack_Signal is received, the anti-phishing filter on the mail server is activated to block suspected phishing emails and lock account information; two-factor authentication (2FA) is enforced to increase account security. When a Buffer_Overflow_Signal signal is received, check the code in the application that may cause a buffer overflow and fix the vulnerability in time; enable ASLR to randomize memory addresses, making it difficult for attackers to predict the target address of the buffer overflow. When an Identity_Theft_Signal is received, monitor login activity, especially for multiple failed login attempts or logins from unusual IP addresses, and enforce multi-factor authentication to prevent access to accounts via brute-force attacks or credential theft. When the MITM_Attack_Signal identification signal is received, all sensitive communications are forced to use the HTTPS protocol to ensure encrypted data transmission and to ensure that all TLS connections use valid certificates to prevent malicious certificates from being inserted. When the DNS_Amplification_Signal identification signal is received, configure the DNS firewall or enable the traffic scrubbing system to block DNS amplification attack traffic and limit the maximum frequency of DNS requests sent by each IP to avoid excessive requests leading to amplification attacks. When an ARP_Spoofing_Signal is received, configure a static ARP table to ensure that the IP-MAC address binding is not tampered with; enable DHCP Snooping and dynamic ARP detection to prevent malicious devices from masquerading as legitimate devices. When the Command_Injection_Signal recognition signal is received, WAF is used to detect and block malicious requests, limiting all applications and services to the minimum privileges at runtime, and preventing the execution of system commands with high privileges.

[0086] Compared with existing technologies, the network attack detection method and system based on convolutional neural networks provided by this invention have the following advantages: (1) This invention is based on convolutional neural networks to deeply analyze various statistical features of network traffic. It extracts local correlation features of statistical features through convolutional layers, and then introduces nonlinear characteristics through activation layers, so that the system has a strong nonlinear pattern recognition capability. Then, the pooling layer downsamples the features to achieve a balance between improving detection efficiency and system robustness. Finally, the calculation of the fully connected layer realizes the accurate mapping from local features to global features, so that the system can comprehensively consider the complex nonlinear relationship between various statistical features, thereby accurately identifying highly concealed network attack behaviors, avoiding false alarms and false negatives, and improving the security of the system.

[0087] (2) This invention effectively extracts key features of network data through the deep learning mechanism of convolutional neural networks and accurately classifies different types of attacks, thereby quickly identifying various network attacks and triggering corresponding automated defense measures, effectively achieving network security protection.

[0088] The above-described embodiments are merely examples of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and the present invention also intends to include these modifications and variations.

Claims

1. A network attack detection system based on convolutional neural networks, characterized in that, include: The data acquisition and preprocessing module is used to collect network traffic data, system log data, user behavior data and transmission protocol data of each data packet on the network in real time, and to clean and preprocess the collected network data. The feature extraction module is used to extract statistical features of the preprocessed data packets, including effective size features, time series features, latency features, and traffic fluctuation features. The preset attack type probability calculation module is used to establish preset types of network attacks based on information on the network, and input the statistical features into a convolutional neural network to calculate the recognition probability of each preset type of network attack. The attack pattern recognition and classification module is used to identify attack patterns based on the preset recognition probability of each network attack type and output the corresponding attack recognition signal. The automatic response and execution module is used to execute preset network isolation and attack defense measures based on attack identification signals.

2. The network attack detection system based on convolutional neural networks according to claim 1, characterized in that: The preset attack type probability calculation module includes: The network attack preset submodule is used to establish preset types of network attacks based on information on the network. The local correlation feature submodule includes a convolutional layer used to convolve the statistical features to obtain the local correlation features of the statistical features; The linear activation submodule includes an activation layer for performing nonlinear transformation on the local correlation features of the statistical features, introducing nonlinear characteristics, and outputting a nonlinear feature map. The compression submodule includes a pooling layer for downsampling and compressing the nonlinear feature map to obtain a compressed feature map; The feature integration submodule includes a fully connected layer for dimensionality reduction and integration of the compressed feature map to obtain a global feature vector; The overall output submodule includes an output layer, which is used to calculate the recognition probability of each preset type of network attack based on the global feature vector.

3. The network attack detection system based on convolutional neural networks according to claim 1, characterized in that: The feature extraction module includes: The effective size feature submodule is used to calculate the effective size Size(i) of each data packet; The time series feature submodule is used to obtain the same-source access time series U1(i) and the same-target access time series U2(i); The delay feature submodule is used to calculate the error response delay Delay(i) corresponding to each data packet; The traffic fluctuation feature submodule is used to calculate the mean network traffic size μ[x1(i)] and the standard deviation of network traffic size σ[x1(i)] of the data packets.

4. A network attack detection method based on convolutional neural networks, characterized in that, Including the following steps: S1. Collect network data and preprocess it; S2. Extract statistical features from the preprocessed network data; S3. Based on the statistical characteristics of network data, obtain the identification probability of each preset type of network attack. S4. Identify attack patterns based on the preset probability of each network attack type and output the corresponding attack identification signal. S5. Execute preset network isolation and attack defense measures based on attack identification signals.

5. The network attack detection method based on convolutional neural networks according to claim 4, characterized in that: The steps for extracting statistical features from preprocessed network data include: S21. Calculate the effective size Size(i) of each data packet; S22. Obtain the same-source access time series U1(i) and the same-target access time series U2(i); S23. Calculate the error response delay Delay(i) corresponding to each data packet; S24. Calculate the mean network traffic size μ[x1(i)] and the standard deviation of network traffic size σ[x1(i)] of the data packets.

6. The network attack detection method based on convolutional neural networks according to claim 5, characterized in that: The steps for obtaining the identification probability of various preset types of network attacks based on the statistical characteristics of network data include: S31. Establish preset types of network attacks; S32. Perform convolution on statistical features to obtain local correlation features of statistical features. ; S33, Local correlation features of statistical characteristics A nonlinear transformation is performed to introduce nonlinear characteristics, and a nonlinear feature map is output. ; S34. Nonlinear Feature Map Perform downsampling compression to obtain compressed feature maps. ; S35, Compressing Feature Maps Perform dimensionality reduction and integration to obtain global feature vectors. ; S36. Based on global feature vectors Calculate the recognition probability of each preset type of network attack. .

7. The network attack detection method based on convolutional neural networks according to claim 6, characterized in that: Convolution is performed on statistical features to obtain local correlation features of the statistical features. The specific process is as follows: Let the statistical characteristics of network data be denoted as the set E={Size(i),U1(i),U2(i),Delay(i),μ[x1(i)],σ[x1(i)]}; Input set E into the convolutional layer and perform convolution operation according to the following formula: in, The value at position (p,q) in the local correlation feature map of the statistical features output by the convolutional layer; r1 is the layer index of the convolutional layer; r2 is the node index of the convolutional layer; R1 is the total number of convolutional layers; R2 is the total number of nodes contained in the convolutional layer; e1, e2, e3, e4, e5, e6 are input parameters, corresponding to the effective size Size(i), the same-source access time series U1(i), the same-target access time series U2(i), the error response delay Delay(i), the mean network traffic size μ[x1(i)], and the standard deviation of network traffic size σ[x1(i)].

8. The network attack detection method based on convolutional neural networks according to claim 6, characterized in that: Local correlation features of statistical features A nonlinear transformation is performed to introduce nonlinear characteristics, and a nonlinear feature map is output. The specific process is as follows: Local correlation features Input the activation layer and perform nonlinear operations according to the following formula: Where f2 is the activation function of the activation layer, which can be a ReLU function or a Sigmoid function; This is the activated nonlinear feature map.

9. The network attack detection method based on convolutional neural networks according to claim 6, characterized in that: For nonlinear feature maps Perform downsampling compression to obtain compressed feature maps. The specific process is as follows: Nonlinear feature maps Input pooling layer, set a sliding window of size k3×k3, and move the non-linear feature map with a stride of s3. Up-scanning: For each local region covered by a window, take the maximum value within the window as the compressed feature map. The corresponding position in the middle ( The value of ) is calculated, and the compressed feature map is output. : in, The output is a compressed feature map, where k3 is the length and width of the sliding window, and s3 is the step size of the sliding window.

10. The network attack detection method based on convolutional neural networks according to claim 6, characterized in that: Obtain global feature vector And calculate the recognition probability of each preset type of network attack. The specific process is as follows: Compress the feature map The input consists of three fully connected layers. The first fully connected layer compresses the feature map. Flatten it into a one-dimensional vector Y = [Y1, Y2, ..., YD], where D is the dimension after flattening; then input the one-dimensional vector Y into the second fully connected layer; The second fully connected layer has k4 nodes, where k4 = 1, 2, ..., K4, and K4 is the total number of nodes in the second fully connected layer. Calculate the output ak4 of the k4th node according to the following formula and input it into the third fully connected layer: in, This represents the weight of the k4th node in the second fully connected layer. f1 is the bias of the k4th node in the second fully connected layer; f3 is the activation function of the pooling layer, which can be either ReLU or Sigmoid; d1 = 1, 2, ..., D; The third fully connected layer has r3 nodes, where r3 = 1, 2, ..., R3, and R3 is the total number of nodes in the third fully connected layer. The output of the r3th node is calculated using the following formula. and input / output layers: in, This represents the weight of the r3rd node in the third fully connected layer. f is the bias of the r3rd node in the third fully connected layer; f4 is the activation function of the fully connected layer, which can be either ReLU or Sigmoid. The output layer has r4 nodes, where r4 = 1, 2, ..., R4, and R4 is the total number of nodes in the output layer. The output of the r4th node is calculated using the following formula. : in, The output of the r4th node in the output layer represents the recognition probability of each preset type of network attack; This represents the weight of the r4th node in the output layer. The bias is set to the r4th node of the output layer; the softmax function is the activation function of the output layer.

Images