Network intrusion behavior identification method and system based on attack traffic time sequence reconstruction
By employing temporal reconstruction technology and LSTM models, the detection difficulties of traditional security protection systems in complex network attacks have been resolved, enabling efficient identification and pattern mining of attack behaviors and improving the accuracy of intrusion detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAN THERMAL POWER RES INST CO LTD
- Filing Date
- 2026-02-26
- Publication Date
- 2026-04-14
AI Technical Summary
Traditional security protection systems lack macro-level monitoring of attack duration when facing complex, covert, and persistent cyberattacks, making it difficult to achieve accurate intrusion attack detection.
By using temporal reconstruction techniques, a baseline pattern of network traffic is learned using variational autoencoders. Combined with an LSTM model that incorporates an attention mechanism, an attack identification model is constructed to identify abnormal attack behaviors.
It effectively captures the evolutionary patterns of attack behavior, improving the ability to accurately identify intrusion attacks.
Smart Images
Figure CN121864480A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to a method and system for identifying network intrusion behavior based on attack traffic time sequence reconstruction. Background Technology
[0002] With the deepening of digitalization, cyberattacks have become increasingly complex, covert, and persistent. Traditional security systems, such as firewalls, intrusion detection systems, and antivirus software, rely heavily on static rules, known signature databases, or simple anomaly threshold detection. These systems are inadequate against complex attack patterns like advanced persistent threats (APTs). This is primarily because current security methods typically assess isolated events within single data packets, single connections, or short time windows, lacking macro-level monitoring of the entire attack's duration. In this context, the attack hit window becomes crucial. This window refers to the critical time period from the attacker's initial attempt to breach the defense to their eventual achievement of their attack target. It encompasses the inherent behavioral characteristics and patterns of different attack types, significantly improving the accuracy of intrusion attack detection. However, this window is often fragmented and diverse, posing challenges to the correlation analysis and pattern recognition of attack behaviors. Summary of the Invention
[0003] The present invention aims to at least solve one of the technical problems existing in the prior art, and provides a method and system for identifying network intrusion behavior based on attack traffic time sequence reconstruction.
[0004] In a first aspect, embodiments of the present invention provide a method for identifying network intrusion behavior based on attack traffic temporal reconstruction, comprising the following steps: Raw traffic datasets are collected from business systems, and key time-series features are filtered through time delay analysis and significance testing. Normal traffic samples are extracted to form a business dataset. Variational autoencoders are used to learn the baseline pattern of network traffic under business operation and capture abnormal states in real-time traffic. An intrusion attack dataset is formed by extracting attack traffic samples, calculating and evaluating the temporal hit window for different types of attacks, and reconstructing the intrusion attack dataset based on the maximum hit window. The reconstructed attack samples consist of the original attack traffic and the normal traffic that is filled in. An attack identification model is constructed using an LSTM with fused attention mechanism. Pattern mining is performed on the reconstructed intrusion attack dataset to identify attack types with abnormal attack behaviors.
[0005] In some embodiments, raw traffic datasets are collected from the business system, and key time-series features are filtered through time delay analysis and significance testing, including: Collect raw datasets containing normal traffic samples and various types of attack traffic samples from the business system network, and perform normalization preprocessing on the datasets; Time lag analysis is performed on each flow characteristic in the dataset to calculate the autocorrelation coefficient between the current value of the flow characteristic and its historical values at different lag times. Significance tests were performed on the autocorrelation coefficients of different lag orders, and key time-series features with significance indices higher than a preset threshold were selected from the dataset, while other features were removed.
[0006] In some embodiments, normal traffic samples are extracted to form a service dataset, and a variational autoencoder is used to learn the baseline pattern of network traffic under service operation to capture abnormal states in real-time traffic, including: Extract all normal traffic samples from the original dataset to form the business dataset; Unsupervised training is performed on the business dataset using a variational autoencoder to learn the baseline pattern of network traffic under business operation. The trained variational autoencoder is used to monitor real-time traffic and the deviation of the baseline pattern is judged based on the reconstruction error in order to capture abnormal traffic status.
[0007] In some embodiments, attack traffic samples are extracted to form an intrusion attack dataset, time-series hit windows for evaluating different types of attacks are calculated, and the intrusion attack dataset is reconstructed based on the maximum hit window. The reconstructed attack samples consist of the original attack traffic and normal traffic padding, including: All attack traffic samples are extracted from the original dataset to form an intrusion attack dataset; For attack traffic samples of the same type, calculate the minimum duration of a single attack based on its start and end timestamps, and use it as the timing hit window for that type of attack. Based on the maximum hit window of different types of attacks, an attack sequence sample for a single attack is constructed. The attack sequence sample consists of attack traffic samples and random normal traffic samples within the time sequence hit window of a single attack. The normal traffic samples are used to fill the empty spaces in the maximum hit window. Label the corresponding attack sequence samples according to the type of a single attack; The intrusion attack dataset is reconstructed according to the method used to construct attack sequence samples.
[0008] In some embodiments, an attack identification model is constructed using an LSTM with an attention fusion mechanism, and pattern mining is performed on a reconstructed intrusion attack dataset to identify attack types with anomalous attack behavior, including: A feature extraction module integrating LSTM and attention layers is constructed, and a fully connected neural network is added after the feature extraction module to form an attack identification model; The attack sequence samples in the reconstructed intrusion attack dataset are input into the feature extraction module. After evaluating the information weights of each time step in the LSTM layer, the hidden state features of the time step with the highest weight are output. The attack identification model was trained in a supervised manner on a reconstructed intrusion attack dataset to uncover the behavioral evolution patterns of different types of attacks within the same time window. After capturing abnormal traffic states, the trained attack identification model is used to perform sliding window detection on the real-time sequence to determine the type of attack behavior corresponding to the abnormal traffic states.
[0009] Secondly, embodiments of the present invention provide a network intrusion behavior identification system based on attack traffic temporal reconstruction, comprising: The time series feature filtering module is used to filter key time series features through time delay analysis and significance testing; The abnormal state capture module is used to learn the baseline pattern of network traffic under service operation using a variational autoencoder and capture abnormal states in real-time traffic. The attack sequence construction module is used to calculate and evaluate the temporal hit window of different types of attacks, and reconstruct the intrusion attack dataset based on the maximum hit window. The reconstructed attack sample consists of the original attack traffic and the normal traffic that is filled in. The attack type identification module is used to build an attack identification model and perform pattern mining using an LSTM with a fusion attention mechanism to identify the attack type of abnormal attack behavior.
[0010] Thirdly, embodiments of the present invention provide an electronic device, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to perform the network intrusion behavior identification method based on attack traffic timing reconstruction described above.
[0011] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network intrusion behavior identification method based on attack traffic timing reconstruction described above.
[0012] Compared with existing technologies, the network intrusion behavior identification method and system based on attack traffic time sequence reconstruction of the present invention can effectively capture the evolution pattern characteristics of different types of attack behaviors by learning the traffic sequence within the time sequence hit window, thereby improving the ability to accurately identify intrusion attack behaviors. Attached Figure Description
[0013] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0014] Figure 1 This is a flowchart of a network intrusion behavior identification method based on attack traffic temporal reconstruction according to an embodiment of the present invention; Figure 2 This is a block diagram of a network intrusion behavior identification system based on attack traffic time sequence reconstruction, according to an embodiment of the present invention. Detailed Implementation
[0015] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0016] Unless otherwise specifically stated, the technical or scientific terms used in the embodiments of this invention should be understood in their ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "comprising" or "including," as used in the embodiments of this invention, do not limit the shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof mentioned, nor do they exclude the appearance or addition of one or more other different shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof, or the inclusion of these.
[0017] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale, and techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail; however, where appropriate, the illustrated techniques, methods, and apparatus should be considered part of the specification. In all the examples shown and discussed herein, any other specific example may have different values. It should be noted that similar symbols and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.
[0018] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In the embodiments of the present invention, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of the present invention, as well as the features of different embodiments or examples.
[0019] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention; it should be understood that the present invention is not limited to the exemplary embodiments described herein.
[0020] like Figure 1 As shown in the figure, this embodiment of the invention provides a method for identifying network intrusion behavior based on attack traffic temporal reconstruction. The method specifically includes the following steps: Step S101: Collect the raw traffic dataset from the business system and filter key time-series features through time delay analysis and significance test.
[0021] In this embodiment, the business system needs to undergo application testing in an offline environment for a period of time before its official launch. Business operations personnel simulate daily usage scenarios, while the security team periodically simulates various types of intrusion attacks. During the testing period, traffic mirroring is deployed on the aggregation switch of the core production network segment of the business system, continuously collecting network traffic packets to form the original dataset. For each feature in the original dataset, its autocorrelation coefficient is calculated at different lag orders. A higher autocorrelation coefficient indicates that the feature maintains a high degree of correlation even with time lags. Next, statistical hypothesis testing is performed on the autocorrelation coefficient of each feature at each lag order. After calculating the standard error based on the total number of samples, a confidence interval is determined based on a given significance level and a white noise probability distribution function to evaluate whether the autocorrelation coefficient is significant. Finally, key time-series features with significance indicators higher than a preset threshold are selected from the dataset, and other features are removed.
[0022] Step S102: Extract normal traffic samples to form a business dataset, use variational autoencoder to learn the baseline pattern of network traffic under business operation, and capture abnormal states in real-time traffic.
[0023] In this embodiment, all normal traffic samples are extracted from the original dataset to form a business dataset. Features such as IP address, port number, and protocol type are converted into numerical features that the model can process. Simultaneously, max-min normalization is used to scale all features to the [0,1] range. A variational autoencoder is used for unsupervised training on the business dataset to learn the baseline pattern of network traffic under business operation. The variational autoencoder can compress high-dimensional traffic data into a low-dimensional "latent space" to represent the most essential and core features of normal network traffic. Its encoder part adopts a fully connected neural network structure with ReLU activation function, while the decoder part has a symmetrical structure to the encoder. Finally, the Sigmoid function is used for output reconstruction. During training, mean squared error is used to measure the reconstruction error between the decoder output and the encoder input. After the business system is officially launched, the trained variational autoencoder is used to monitor real-time traffic, and the deviation from the baseline pattern is judged based on the reconstruction error. Since the variational autoencoder cannot well understand abnormal traffic states (such as a sudden ICMP flood attack), the reconstruction error will increase significantly. Therefore, abnormal traffic states can be captured based on a preset reconstruction error threshold.
[0024] Step S103: Extract attack traffic samples to form an intrusion attack dataset, calculate and evaluate the timing hit window of different types of attacks, and reconstruct the intrusion attack dataset according to the maximum hit window. The reconstructed attack samples consist of the original attack traffic and the normal traffic that is filled in.
[0025] In this embodiment, an intrusion attack dataset is formed by extracting all attack traffic samples from the original dataset. This dataset contains various attack types such as DDoS attacks, SYN port scanning, brute-force attacks, and data injection. Features such as IP addresses, port numbers, and protocol types are converted into numerical features that the model can process. Simultaneously, max-min normalization is used to scale all features to the [0,1] numerical range. The intrusion attack dataset is grouped according to attack behavior labels. After selecting a subset of intrusion attack data, the attack duration is calculated based on the start and end timestamps of each attack activity. The minimum attack duration of this subset is calculated and used as the hit window for this type of attack behavior. The hit window represents the core time window sufficient to capture this type of attack behavior. The hit windows of different subsets of intrusion attack data are calculated, and the largest window is selected as the construction window for the attack sequence samples. When constructing the attack sequence samples corresponding to a single attack, attack traffic samples are first extracted from the single attack hit window and filled into the attack sequence window. Then, random normal traffic samples are generated and used to fill the empty spaces in the attack sequence window. Finally, the attack sequence samples are labeled according to the attack type of the single attack. Following the method for constructing attack sequence samples, all single attacks in the intrusion attack dataset are transformed into attack sequence samples, resulting in a reconstructed intrusion attack dataset composed of attack sequence samples.
[0026] Step S104: Construct an attack identification model using an LSTM with fused attention mechanism, and perform pattern mining on the reconstructed intrusion attack dataset to identify attack types with abnormal attack behavior.
[0027] In this embodiment, a feature extraction module integrating LSTM and attention layers is constructed. A fully connected neural network is added after the feature extraction module to form an attack identification model. The input stride of the LSTM layer is consistent with the length of the attack sequence samples in the reconstructed intrusion dataset, and the output is the hidden state at all time steps. An attention layer follows the LSTM layer to evaluate the importance of the temporal position at each time step and assign different information weights to the hidden states output at each time step. After inputting the attack sequence samples from the reconstructed intrusion dataset into the feature extraction module, the hidden state feature of the time step with the highest weight is obtained. This feature tensor is then input into the fully connected neural network for deeper feature identification. The attack identification model is trained in a supervised manner on the reconstructed intrusion dataset to mine the behavioral evolution patterns of different types of attacks within the same time window. After capturing abnormal traffic states, the trained attack identification model is used to perform sliding window detection on the real-time sequence to determine the attack behavior type corresponding to the abnormal traffic state.
[0028] This invention provides a network intrusion behavior identification method based on attack traffic time sequence reconstruction. By learning the traffic sequence within the time sequence hit window, it can effectively capture the evolution pattern characteristics of different types of attack behaviors and improve the accurate identification capability of intrusion attack behaviors.
[0029] Based on the same inventive concept, such as Figure 2 As shown, this embodiment of the invention provides a network intrusion behavior identification system based on attack traffic temporal reconstruction. The system includes: a temporal feature filtering module 201, used to filter key temporal features through time delay analysis and significance testing; an abnormal state capture module 202, used to capture abnormal states in real-time traffic by learning the baseline pattern of network traffic under service operation using a variational autoencoder; an attack sequence construction module 203, used to calculate and evaluate the temporal hit window of different types of attacks, and reconstruct the intrusion attack dataset according to the maximum hit window, wherein the reconstructed attack sample consists of the original attack traffic and the normal traffic filled in; and an attack type identification module 204, used to construct an attack identification model and perform pattern mining using an LSTM with a fusion attention mechanism to identify the attack type of abnormal attack behavior.
[0030] This invention provides a network intrusion behavior identification system based on attack traffic time sequence reconstruction. By learning the traffic sequence within the time sequence hit window, it can effectively capture the evolution pattern characteristics of different types of attack behaviors and improve the accurate identification capability of intrusion attack behaviors.
[0031] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to perform the network intrusion behavior identification method based on attack traffic timing reconstruction described above.
[0032] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network intrusion behavior identification method based on attack traffic timing reconstruction described above.
[0033] That is, those skilled in the art will understand that all or part of the steps in the methods described in the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0034] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.
Claims
1. A method for identifying network intrusion behavior based on attack traffic temporal reconstruction, characterized in that, Includes the following steps: Raw traffic datasets are collected from business systems, and key time-series features are filtered through time delay analysis and significance testing. Normal traffic samples are extracted to form a business dataset. Variational autoencoders are used to learn the baseline pattern of network traffic under business operation and capture abnormal states in real-time traffic. An intrusion attack dataset is formed by extracting attack traffic samples, calculating and evaluating the temporal hit window of different types of attacks, and reconstructing the intrusion attack dataset based on the maximum hit window. The reconstructed attack samples consist of the original attack traffic and the normal traffic that is filled in. An attack identification model is constructed using an LSTM with fused attention mechanism. Pattern mining is performed on the reconstructed intrusion attack dataset to identify attack types with abnormal attack behaviors.
2. The network intrusion behavior identification method based on attack traffic temporal reconstruction according to claim 1, characterized in that, Raw traffic datasets are collected from business systems, and key time-series features are filtered through time-delay analysis and significance testing, including: Collect raw datasets containing normal traffic samples and various types of attack traffic samples from the business system network, and perform normalization preprocessing on the datasets; Time lag analysis is performed on each flow characteristic in the dataset to calculate the autocorrelation coefficient between the current value of the flow characteristic and its historical values at different lag times. Significance tests were performed on the autocorrelation coefficients of different lag orders, and key time-series features with significance indices higher than a preset threshold were selected from the dataset, while other features were removed.
3. The network intrusion behavior identification method based on attack traffic temporal reconstruction according to claim 1, characterized in that, Normal traffic samples are extracted to form a business dataset. A variational autoencoder is used to learn the baseline pattern of network traffic under business operation and to capture abnormal states in real-time traffic, including: Extract all normal traffic samples from the original dataset to form the business dataset; Unsupervised training is performed on the business dataset using a variational autoencoder to learn the baseline pattern of network traffic under business operation. The trained variational autoencoder is used to monitor real-time traffic and the deviation of the baseline pattern is judged based on the reconstruction error in order to capture abnormal traffic status.
4. The network intrusion behavior identification method based on attack traffic temporal reconstruction according to claim 1, characterized in that, An intrusion attack dataset is constructed by extracting attack traffic samples. The temporal hit window for different types of attacks is calculated and evaluated. The intrusion attack dataset is reconstructed based on the maximum hit window. The reconstructed attack samples consist of the original attack traffic and normal traffic padding, including: All attack traffic samples are extracted from the original dataset to form an intrusion attack dataset; For attack traffic samples of the same type, calculate the minimum duration of a single attack based on its start and end timestamps, and use it as the timing hit window for that type of attack. A single attack sequence sample is constructed based on the maximum hit window of different types of attacks. The attack sequence sample consists of attack traffic samples and random normal traffic samples within the single attack time sequence hit window. The normal traffic samples are used to fill the empty spaces in the maximum hit window. Label the corresponding attack sequence samples according to the type of a single attack; The intrusion attack dataset is reconstructed according to the construction method of the attack sequence samples.
5. The network intrusion behavior identification method based on attack traffic temporal reconstruction according to claim 1, characterized in that, An attack identification model is constructed using an LSTM with fused attention mechanism. Pattern mining is performed on a reconstructed intrusion attack dataset to identify attack types with anomalous attack behaviors, including: A feature extraction module integrating LSTM and attention layers is constructed, and a fully connected neural network is added after the feature extraction module to form an attack identification model; The attack sequence samples in the reconstructed intrusion attack dataset are input into the feature extraction module. After evaluating the information weights of each time step in the LSTM layer, the hidden state features of the time step with the highest weight are output. The attack identification model was trained in a supervised manner on a reconstructed intrusion attack dataset to uncover the behavioral evolution patterns of different types of attacks within the same time window. After capturing abnormal traffic states, the trained attack identification model is used to perform sliding window detection on the real-time sequence to determine the type of attack behavior corresponding to the abnormal traffic states.
6. A network intrusion behavior identification system based on attack traffic temporal reconstruction, characterized in that, include: The time series feature filtering module is used to filter key time series features through time delay analysis and significance testing; The abnormal state capture module is used to learn the baseline pattern of network traffic under service operation using a variational autoencoder and capture abnormal states in real-time traffic. The attack sequence construction module is used to calculate and evaluate the temporal hit window of different types of attacks, and reconstruct the intrusion attack dataset based on the maximum hit window. The reconstructed attack sample consists of the original attack traffic and the normal traffic that is filled in. The attack type identification module is used to build an attack identification model and perform pattern mining using an LSTM with a fusion attention mechanism to identify the attack type of abnormal attack behavior.
7. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the network intrusion behavior identification method based on attack traffic temporal reconstruction as described in any one of claims 1 to 5.
8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the network intrusion behavior identification method based on attack traffic temporal reconstruction as described in any one of claims 1 to 5.