A Hybrid Attack Detection and Defense Method Based on Deep Learning

Abstract

This invention belongs to the technical field of network security protection and relates to a hybrid attack detection and defense method based on deep learning. The method includes the following steps: extracting multi-dimensional traffic statistical features and application layer protocol semantic features; outputting a high-dimensional behavior-related feature vector; issuing an attack trigger signal; outputting an attack context description; generating a collaborative defense command stream; outputting real defense effect feedback data; and adjusting the convolutional autoencoder model and the graph neural network. This invention solves the problem that existing network attack detection and defense technologies struggle to simultaneously meet the core protection requirements of comprehensive detection dimensions, reasonable computational resource scheduling, dynamic adaptability of defense strategies, and adaptive model iteration in hybrid attack scenarios.

Description

Technical Field

[0001] This invention belongs to the technical field of network security protection and relates to a hybrid attack detection and defense method based on deep learning. Background Technology

[0002] With the rapid development of internet technology and the continuous expansion of network application scenarios, network attack methods are becoming increasingly complex, covert, and diversified, posing a continuous challenge to network security defense systems. Network attack detection and defense, as a core component of network security protection, directly determines the overall protection effectiveness in complex network environments through its detection efficiency, identification accuracy, response adaptability, and continuous optimization capabilities. Traditional attack detection methods based on rule matching and single statistical analysis are increasingly showing shortcomings when facing hybrid network attacks, such as limited detection dimensions, delayed response, and high false positive rates, making them difficult to adapt to the current complex and ever-changing network security protection needs.

[0003] To improve the intelligence and automation of network attack detection, the industry has seen the emergence of network security situation awareness and early warning technologies based on big data analysis. For example, the network security situation awareness and early warning method based on big data analysis, with application number 202510427347.2, collects multi-source security log data and completes preprocessing and feature correlation analysis. It then uses an adaptive deep learning model to train an anomaly detection model and combines real-time data analysis to generate a security situation map and corresponding early warning information and defense strategies. At the same time, it updates the feature library and model parameters based on the attack handling results, which improves the automation level of network security situation awareness and the accuracy of anomaly detection to a certain extent.

[0004] The anomaly detection modeling and defense strategy generation of the aforementioned existing technologies mainly revolve around the traffic statistical characteristics and single-modal data of security logs. They do not construct a multi-dimensional attack identification system that integrates network layer statistical characteristics and application layer behavioral logic. When facing low-rate, long-cycle, and multi-step covert hybrid attacks, they are prone to detection blind spots. At the same time, the solution adopts a unified model detection architecture and does not design a hierarchical detection mechanism that is scheduled on demand. It is difficult to balance the real-time performance of large-scale traffic processing with the accuracy of complex attack identification. Furthermore, the generation of defense strategies does not dynamically adapt to the real-time operating status of the protected target, nor does it establish a model closed-loop optimization mechanism based on the actual defense effect. This results in a limitation on the continuous adaptation capability of the defense system to evolving and variant attacks.

[0005] Existing network attack detection and defense technologies are insufficient to simultaneously meet the core protection requirements of comprehensive detection dimensions, reasonable scheduling of computing resources, dynamic adaptability of defense strategies, and adaptive model iteration in hybrid attack scenarios. Summary of the Invention

[0006] To address the aforementioned problems, this invention provides a hybrid attack detection and defense method based on deep learning.

[0007] A hybrid attack detection and defense method based on deep learning includes the following steps:

[0008] S1. Parse the obtained raw network communication message stream and extract multi-dimensional traffic statistics features and application layer protocol semantic features;

[0009] S2. Construct a directed behavior graph based on the semantic features of the application layer protocol, call the depth graph embedding algorithm to process the directed behavior graph, and output a high-dimensional behavior association feature vector.

[0010] S3. Input the multidimensional traffic statistics features into the convolutional autoencoder model to generate a traffic reconstruction feature matrix. Calculate the reconstruction loss deviation between the multidimensional traffic statistics features and the traffic reconstruction feature matrix. If the reconstruction loss deviation is greater than the preset reconstruction loss threshold, issue an attack trigger signal.

[0011] S4. Receive the attack trigger signal, inject the high-dimensional behavior association feature vector into the graph neural network to calculate the spatiotemporal deviation. If the spatiotemporal deviation meets the preset judgment conditions, output the attack context description.

[0012] S5. Extract the set of defense actions based on the attack context description, and combine it with the obtained real-time computing resource load rate and multi-dimensional parameters to generate a collaborative defense command flow.

[0013] S6. Perform cleaning and filtering operations on the collaborative defense command stream, summarize indicator data, and output the actual defense effect feedback data.

[0014] S7. Convert the real defense effect feedback data into internal reward and punishment gradient scores, and adjust the convolutional autoencoder model and graph neural network.

[0015] A further aspect of this invention involves extracting multidimensional traffic statistical features and application layer protocol semantic features, including the following steps:

[0016] Activate the hardware acceleration acquisition module deployed at the network traffic aggregation node to intercept the original network communication packet stream;

[0017] By stripping the network layer and transport layer protocol headers from the original network communication message stream, the protocol type flag, time-to-live-time (TTL), and data packet size distribution matrix are extracted and combined to form multidimensional traffic statistical features.

[0018] The application layer connection state machine that tracks the original network communication message flow is used to extract the message request frequency sequence, resource access addressing depth, and session credential identifier value, which are then encapsulated into application layer protocol semantic features.

[0019] A further aspect of this invention outputs a high-dimensional behavior-related feature vector, comprising the following steps:

[0020] It aggregates all application layer protocol semantic features generated within a preset time window using the same source address identifier, and traces the temporal jump relationship of connection operations before and after.

[0021] A directed behavior graph reflecting the interaction trajectory between the user and the system is constructed with operation nodes as vertices and temporal jump relationships as edges;

[0022] The depth graph embedding algorithm is called to perform dimensionality reduction feature extraction on the topology of the directed behavior graph, and output a high-dimensional behavior association feature vector representing the logical continuity of multi-step hidden operations.

[0023] A further aspect of the present invention, tracing the temporal jump relationship between preceding and following join operations, includes the following steps:

[0024] Aggregate all application layer protocol semantic features generated from the same source address within a preset time window from the cache;

[0025] Based on the timestamp information recorded in each application layer protocol semantic feature, the application layer protocol semantic features are sorted in ascending order to form an ordered sequence of behavioral events;

[0026] Based on an ordered sequence of behavioral events, the temporal jump relationship between preceding and following connection operations is traced.

[0027] A further aspect of the present invention involves issuing an attack trigger signal, comprising the following steps:

[0028] Multidimensional traffic statistics features are input into a pre-trained, converged convolutional autoencoder model, and the corresponding traffic reconstruction feature matrix is ​​calculated and reconstructed through encoding and decoding.

[0029] Calculate the spatial distribution distance between the multidimensional traffic statistics feature and the traffic reconstruction feature matrix, and map the Euclidean distance value to the reconstruction loss bias for assessing the intensity of transmission anomalies;

[0030] When the reconstruction loss deviation is determined to be greater than the preset reconstruction loss threshold, it is determined that there is a risk of large-scale network layer traffic flooding in the current traffic link, and an attack trigger signal is simultaneously sent to the subsequent in-depth analysis steps.

[0031] A further aspect of the present invention outputs an attack context description, including the following steps:

[0032] After the front-end detection link captures a suspected attack trigger signal, it switches the dormant graph neural network to the highest computing priority running state.

[0033] Inject high-dimensional behavioral correlation feature vectors into the activated graph neural network and quantify the spatiotemporal deviation of the high-dimensional behavioral correlation feature vectors from the long-range dependency distribution of normal business requests.

[0034] When the system detects that the spatiotemporal deviation meets the preset judgment conditions, it outputs an attack context description that includes the network address of the malicious penetration source, the identifier of the targeted core interface, and the attack type classification result.

[0035] A further aspect of this invention involves quantifying the spatiotemporal deviation between the high-dimensional behavioral correlation feature vector and the long-range dependency distribution of normal business requests, including the following steps:

[0036] The similarity between a high-dimensional behavior-related feature vector and a set of prototype vectors representing different normal behavior patterns is evaluated through a dot product attention mechanism, and a set of attention weights is generated.

[0037] The distances from the high-dimensional behavioral association feature vectors to each prototype vector are weighted and summed using attention weights to obtain the final spatiotemporal deviation scalar value.

[0038] A further aspect of the present invention generates a collaborative defense command stream, comprising the following steps:

[0039] Poll the pre-set defense primitive action library to extract a set of prevention and control actions that specifically suppress the attack type classification results contained in the attack context description;

[0040] The real-time computing resource load rate of the server nodes associated with the targeted core interface identifier is collected, and parameters such as the layered execution validity period, rate limiting tolerance, and human-machine authentication challenge difficulty are added to the prevention and control action set as multi-dimensional parameters.

[0041] The set of prevention and control actions encapsulated with multi-dimensional parameters is serialized and assembled to generate a collaborative defense command stream designed to apply tiered countermeasures to the network addresses of malicious infiltration sources.

[0042] A further aspect of this invention involves outputting real defense effect feedback data, including the following steps:

[0043] The collaborative defense command stream is pushed concurrently to each edge distributed defense node facility deployed close to the network boundary through a security management channel;

[0044] Each edge distributed defense node facility sequentially executes source address blacklist blocking, access rate peak shaving, and cleaning and filtering operations such as injecting secondary human-machine verification procedures according to the collaborative defense command flow;

[0045] The system periodically summarizes the total number of malicious traffic dropped, the legitimate user authentication blocking rate, and the normal packet release delay reported by each edge distributed defense node facility as indicator data, and cleans and aggregates the data to output the actual defense effect back to the system.

[0046] A further aspect of this invention involves adjusting the convolutional autoencoder model and the graph neural network, including the following steps:

[0047] It collects and stores the actual defense effect feedback data reported by the underlying nodes, as well as the unmodeled new threat payloads captured through offline analysis in the bypass sandbox analysis environment;

[0048] The real defense effect feedback data is converted into internal reward and punishment gradient scores, and the classification function bias parameters of the convolutional autoencoder model and graph neural network are fine-tuned using a centralized incremental training mechanism.

[0049] We analyze the variable communication frequency domain characteristics of novel threat payloads that are not modeled, and update the corresponding punitive policy rule weights in the pre-set defense primitive action library to maintain the decision confidence of the defense system in response to evolving attacks.

[0050] In summary, the present invention has the following beneficial technical effects:

[0051] 1. By constructing a directed behavior graph and analyzing it using a graph neural network based on egocentric attention, discrete application-layer interaction events are transformed into high-dimensional behavior-related feature vectors with topological structure and logical continuity. Abnormal behavior sequences are identified by quantifying the spatiotemporal deviation of this vector from the long-range dependency distribution of normal business requests. This holistic analysis approach based on multi-step user operation logic improves the system's ability to identify low-rate, long-term complex attacks, solving the problem that traditional methods relying solely on single-point, instantaneous features struggle to detect covert attacks.

[0052] 2. A two-tier detection architecture employs a convolutional autoencoder model for coarse screening and links it to a deep analysis module. First, it performs rapid data reconstruction calculations on the network layer's traffic statistical features. Only when the reconstruction loss deviation exceeds a preset threshold is the computationally intensive graph neural network activated for deep analysis. This hierarchical filtering mechanism ensures rapid response to large-scale traffic anomalies while avoiding complex behavioral graph analysis of the entire traffic volume. This reduces the overall computational overhead and processing latency during normal system operation and enables on-demand scheduling of computing resources.

[0053] 3. By dynamically orchestrating and generating collaborative defense command flows with multi-level blocking and verification gradients, it can add parameters such as tiered execution validity periods, rate limiting tolerance, and human-machine authentication challenge difficulty to the basic defense action set based on precise attack context descriptions and the real-time computing resource load rate of the attacked target. This guides distributed defense nodes to apply tiered countermeasures against malicious sources. This dynamic strategy generation method, combined with system status, ensures that the defense response strength matches the attack intensity and system capacity. While curbing attacks, it reduces the collateral impact on legitimate users' normal access caused by excessive defense, improving the accuracy of defense and business availability.

[0054] 4. By receiving feedback data on actual defense effectiveness and novel threat payloads not yet modeled, a centralized incremental training mechanism is introduced. This quantifies the actual effect of defense actions as internal reward-penalty gradient scores, which are then used to continuously fine-tune the detection threshold of the convolutional autoencoder model and the classification function bias parameters of the graph neural network. This closed-loop feedback and model update process enables the defense system to adaptively learn from the external threat environment and internal defense effectiveness, improving the model's detection accuracy and decision confidence when facing constantly evolving attack variants, and solving the performance degradation problem caused by model solidification. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings are used to provide a further understanding of the present invention.

[0056] Figure 1 This discloses a flowchart of an embodiment of this application.

[0057] Figure 2 This discloses a schematic diagram of the framework in the embodiments of this application. Detailed Implementation

[0058] The following is in conjunction with the appendix Figures 1-2 A preferred description of the present invention is provided below.

[0059] See attached document Figure 1 This invention proposes a hybrid attack detection and defense method based on deep learning, comprising the following steps:

[0060] S1. Parse the obtained raw network communication message stream and extract multi-dimensional traffic statistics features and application layer protocol semantic features;

[0061] S2. Construct a directed behavior graph based on the semantic features of the application layer protocol, call the depth graph embedding algorithm to process the directed behavior graph, and output a high-dimensional behavior association feature vector.

[0062] S3. Input the multidimensional traffic statistics features into the convolutional autoencoder model to generate a traffic reconstruction feature matrix. Calculate the reconstruction loss deviation between the multidimensional traffic statistics features and the traffic reconstruction feature matrix. If the reconstruction loss deviation is greater than the preset reconstruction loss threshold, issue an attack trigger signal.

[0063] S4. Receive the attack trigger signal, inject the high-dimensional behavior association feature vector into the graph neural network to calculate the spatiotemporal deviation. If the spatiotemporal deviation meets the preset judgment conditions, output the attack context description.

[0064] S5. Extract the set of defense actions based on the attack context description, and combine it with the obtained real-time computing resource load rate and multi-dimensional parameters to generate a collaborative defense command flow.

[0065] S6. Perform cleaning and filtering operations on the collaborative defense command stream, summarize indicator data, and output the actual defense effect feedback data.

[0066] S7. Convert the real defense effect feedback data into internal reward and punishment gradient scores, and adjust the convolutional autoencoder model and graph neural network.

[0067] A further aspect of this invention involves extracting multidimensional traffic statistical features and application layer protocol semantic features, including the following steps:

[0068] The hardware acceleration acquisition module deployed at the network traffic aggregation node is activated to intercept the original network communication message stream; the network layer and transport layer protocol headers of the original network communication message stream are stripped, and the protocol type flag, time survival period and data packet size distribution matrix are extracted and combined to form multi-dimensional traffic statistical features; the application layer connection state machine of the original network communication message stream is tracked, and the message request frequency sequence, resource access addressing depth and session credential identifier value are extracted and encapsulated into application layer protocol semantic features.

[0069] Specifically, the hardware-accelerated acquisition module deployed in the network traffic aggregation node is activated to enter the full traffic interception mode. It should be noted that the network traffic aggregation node refers to the place in the network topology where the traffic of multiple network links converges, such as the core router, switch port mirroring (SPAN), or network splitter (TAP) output port. The hardware-accelerated acquisition module is a board or independent device that integrates application-specific integrated circuit (ASIC) logic, programmable logic units such as FPGA, and high-speed network interfaces. Its design goal is to achieve line-speed data capture and preliminary parsing, avoiding the bottleneck of packet processing involving the CPU.

[0070] The hardware-accelerated acquisition module utilizes its integrated FPGA logic units and high-performance network interfaces, such as 10 Gigabit Ethernet interfaces, to losslessly capture heterogeneous network traffic flowing through network traffic aggregation nodes at line speed, generating raw network communication message streams. It should be understood that raw network communication message streams refer to the raw bit streams or Ethernet frame sequences received by network devices from physical media, such as optical fibers or cables, without any advanced processing. This capture process uses Memory Access DMA (DMA) technology to efficiently transfer the message data received from the network interface to the FPGA's internal buffer for preliminary processing.

[0071] The raw network communication packet stream is then fed into the protocol parsing pipeline within the hardware-accelerated acquisition module. This pipeline first identifies each packet in the raw network communication packet stream and performs a stripping operation to separate the network layer (e.g., IPv4 or IPv6) and transport layer (e.g., TCP, UDP, ICMP) protocol headers. During the stripping process, the system automatically extracts the protocol type flag of the packet. It should be noted that the protocol type flag refers to the field in the IP header used to identify its upper-layer protocol, such as the IP protocol number field (e.g., 6 for TCP, 17 for UDP, 1 for ICMP). Specifically, it includes the IP protocol version (e.g., IPv4 or IPv6) and the transport layer protocol type (e.g., TCP, UDP, ICMP).

[0072] At the same time, for each IP packet, its Time To Live (TTL) field value is obtained and recorded. It should be understood that the Time To Live (TTL) refers to an 8-bit field in the IP packet header, which represents the maximum number of router hops the packet can pass through. The initial value is usually 64, 128, or 255, and it is decremented by 1 for each router it passes through. It is mainly used to prevent packets from looping indefinitely in the network.

[0073] To construct the packet size distribution matrix, the protocol parsing pipeline performs real-time statistics within a preset time window. The lengths of all arriving packets within a preset time window are calculated and quantified into a series of predefined size ranges, such as 0-64 bytes, 65-128 bytes, etc., forming a histogram or frequency distribution table describing the statistical characteristics of packet lengths within the preset time window. It should be noted that the packet size distribution matrix refers to the data packet length distribution within the preset time window. Internally, it is a matrix formed by statistically analyzing the number or proportion of packets of different lengths in the network, such as 0-64 bytes, 65-128 bytes, 129-256 bytes, 257-512 bytes, 513-1024 bytes, 1025-1500 bytes, etc., to characterize the compositional characteristics of traffic.

[0074] In this scheme, the time window The timeout period is typically set between 100 ms and 1 second to balance real-time performance and statistical effectiveness, with 100 ms being the preferred setting. This setting is based on DDoS flood attacks and Challenge Collapsar attacks (hereinafter referred to as CC attacks), which are distributed denial-of-service attacks targeting the web application layer. They exhaust server application resources by simulating high-frequency requests from legitimate users. The minimum attack period for CC attacks is usually 100 ms. A 100 ms window can capture sudden traffic anomalies, while a 1 second window smooths out short-term burst attack characteristics. Furthermore, the 100 ms window matches the traffic statistics period of a 10 Gigabit network card, enabling line-speed processing with no latency. Protocol type flags, time-to-live (TTL) values, and packet size distribution matrices are combined into multi-dimensional traffic statistical features and stored in a cache. It should be understood that multi-dimensional traffic statistical features are a collection of multiple statistical dimensions, including TCP / UDP / ICMP protocol type counts, average TTL values, and packet size distribution matrices.

[0075] While generating multidimensional traffic statistics features, the application layer parsing unit of the hardware-accelerated acquisition module continuously tracks the application layer connection state machine of the application layer protocols identified in the original network communication message stream, such as HTTP / HTTPS, DNS, and RPC. It should be noted that the application layer connection state machine refers to the sequence of states that the application layer protocols in the network, such as HTTP / HTTPS sessions, go through from establishment and data transmission to termination, such as TCP three-way handshake, HTTP request-response, and four-way handshake.

[0076] For each application-layer session, this unit extracts the session's periodic... The message request frequency sequence within a preset time period should be understood as referring to the message request frequency sequence within a preset time period. Inside, Range 500 ms to 5 s The preferred value is 1 second, which is set based on the statistical benchmark of request frequency of Web application layer attacks. For example, the industry standard for QPS calculation is 1 second. A 500 ms window is suitable for high-frequency crawler attacks, a 5 s window is suitable for low-speed attacks, and 1 second is the preferred value that balances real-time performance and statistical validity. It is a sequence of the number of request packets initiated by the application layer session over time, in which the sequence statistics include, for example, the number of occurrences and timestamps of HTTP GET / POST requests.

[0077] The system parses the Uniform Resource Locator (URL) path or similar resource identifier contained in the application layer protocol header or message body, and calculates its resource access addressing depth. It should be noted that the resource access addressing depth refers to the number of forward slashes " / " in the URL path, which is used to measure the hierarchical complexity of the user's access to the resource, that is, the number of levels from the root path to the final resource.

[0078] Furthermore, for application layer protocols with authentication or session management mechanisms, the system extracts their session credential identifier value. It should be understood that the session credential identifier value is a unique identifier used to maintain session state between the client and server, such as the Session ID in the Cookie field of an HTTP request. This value is then hashed to protect user privacy. The message request frequency sequence, resource access addressing depth, and session credential identifier value are encapsulated into application layer protocol semantic features. It should be noted that these application layer protocol semantic features are a collection of application layer behavioral features such as message request frequency sequence, resource access addressing depth, and session credential identifier value. These features are also stored in a cache for subsequent processing.

[0079] For example, suppose a hardware-accelerated acquisition module is deployed at a network traffic aggregation node of an e-commerce platform. It intercepts the raw network communication packet stream via a 10 Gigabit Ethernet card. This module activates the DPDK acceleration engine to capture all passing packets at line speed. In the packet parsing pipeline, the system captures a series of packets. For instance, an IPv4 packet carrying the TCP protocol has an IP header TTL field value of 64 and a packet length of 1480 bytes; followed by an IPv4 packet carrying the UDP protocol, with an IP header TTL field value of 128 and a packet length of 80 bytes.

[0080] Within a 100 ms time window Within the data, the system detected a total of 100 TCP packets, 50 UDP packets, and 5 ICMP packets. Simultaneously, based on packet length, the system quantified a packet size distribution matrix within a predefined range; for example, 30 packets were found in the 65-128 byte range, and 50 packets were found in the 1025-1500 byte range. Protocol type flags, time-to-live (TTL) parameters (e.g., an average TTL of 96), and the packet size distribution matrix together form a multi-dimensional traffic statistical feature. .

[0081] The application layer parsing unit tracks the application layer connection state machine of the HTTP session within a preset time period of 5 seconds. Within that session, a total of 10 HTTP GET requests were initiated, for example, one at 0.2 seconds, two at 1.0 seconds, three at 3.5 seconds, and four at 4.8 seconds, forming a message request frequency sequence. The system resolved the URL path to " / products / category / electronics / mobile_phone / detail?id=123", and its resource access addressing depth was calculated to be 4.

[0082] The Cookie field in the HTTP request header contains "SESSIONID=XYZ789", and its session credential identifier value is extracted and hashed. Message request frequency sequence Resource access addressing depth 4 and hashed session credential identifier value Encapsulated as application layer protocol semantic features .

[0083] In one embodiment of the present invention, outputting a high-dimensional behavior-related feature vector includes the following steps:

[0084] It aggregates all application layer protocol semantic features generated within a preset time window from the same source address identifier, and traces the temporal jump relationship of the connection operations before and after; it constructs a directed behavior graph reflecting the user's interaction trajectory with the system, with the operation node as the vertex and the temporal jump relationship as the edge; it calls the depth graph embedding algorithm to perform dimensionality reduction feature extraction on the topology of the directed behavior graph, and outputs a high-dimensional behavior association feature vector representing the continuity of multi-step hidden operation logic.

[0085] Specifically, the system's data processing logic enters the application layer behavior analysis process, first gathering data from the cache within a preset time window. This includes all application layer protocol semantic features generated from the same source address identifier. It should be noted that the source address identifier can be an IP address or, when tracking user behavior, a session credential identifier value; a preset time window is also included. These are preset system parameters, set based on statistical analysis of typical user session durations. They are typically set to 180 to 600 seconds to ensure that a complete user business process can be captured. (Preset time window) The optimal window size is 300 seconds, based on statistics from over 100,000 normal user web access sessions. The average time for a single user to complete a full business operation, such as browsing, placing an order, and settling payment, is 240 seconds. A 300-second window can fully cover over 95% of normal business processes; 180 seconds would truncate long sessions; and 600 seconds would introduce excessive irrelevant behavioral noise. The system sorts these features in ascending order based on the timestamp information recorded in the semantic features of each application layer protocol, thereby tracing the temporal jump relationships between preceding and following connection operations and forming an ordered sequence of behavioral events.

[0086] The system constructs a directed behavior graph reflecting the interaction trajectory between the user and the system based on an ordered sequence of behavioral events. It should be understood that a directed behavior graph is a graph data structure. ,in It is a set of operation nodes. It is a collection of temporal jump relationships. In this graph, each independent operation is abstracted as a vertex, namely an operation node. It should be noted that the operation node is an abstract representation of the user's interaction with the system. In web application scenarios, it is usually defined by the URL path and request method of the HTTP request. For example, "GET: / login" and "POST: / login" are two different operation nodes. The operation node is defined by the core elements in the semantic features of the application layer protocol, such as the accessed resource path or the function interface called.

[0087] The temporal jump relationships are mapped to directed edges in the graph, with the direction of the edges pointing from the node where the operation occurs earlier in time to the node where the operation occurs later, representing the flow direction of user interaction behavior. The weight of the edges can be set as needed, for example, as the time interval between two operations or the frequency of occurrence, to characterize the tightness of the jump.

[0088] The system invokes a pre-trained deep graph embedding algorithm. Deep graph embedding algorithms are a class of machine learning algorithms designed to map graph-structured data to a low-dimensional vector space, aiming to preserve the structural properties of the graph in the vector space. This scheme can employ either the GraphSAGE model based on graph convolutional networks or the Node2Vec model based on random walks to extract dimensionality reduction features from the topological structure of the directed behavioral graph. The deep graph embedding algorithm learns and generates a low-dimensional vector representation for each operational node by aggregating the structural and attribute information of each node's neighborhood.

[0089] The system encodes the structure and behavioral logic of the entire graph into a fixed-dimensional high-dimensional behavioral association feature vector by performing pooling operations, such as average pooling or max pooling, on the vectors of all operation nodes in the graph. It should be understood that the high-dimensional behavioral association feature vector has a dimension of... Real vectors, for example It can be set to 128 or 256 dimensions, with 256 dimensions being preferred. The setting is based on the training and validation of the GraphSAGE / Node2Vec graph embedding model. The 256-dimensional vector can completely preserve the topological structure and behavioral logic features of the directed behavior graph. The 128-dimensional vector will lose more than 15% of the structural information, and the 512-dimensional vector will increase the model inference latency by 80%. The 256-dimensional vector is the balance point between feature integrity and computational efficiency. Its value captures the overall pattern of the user interaction behavior sequence, can represent the logical continuity between multiple hidden operations, and can be stored for subsequent deep analysis.

[0090] For example, continuing from the previous embodiment, the system sets a preset time window. The time limit is 300 seconds, and the hashed session credential identifier value is used. As the source address identifier. System aggregation and All associated application layer protocol semantic features. This excludes the application layer protocol semantic features generated in the traffic feature generation module example. Recorded as F1, the system also captured two other features within this time window: F2, whose operation was adding items to the shopping cart, with the URL "cart / add?item_id=123"; and F3, whose operation was initiating checkout, with the URL "checkout / start".

[0091] The system sorts them according to their timestamps as F1->F2->F3, which is an instantaneous jump relationship. The system constructs a directed behavior graph based on this sequence. The system creates three operation nodes: N1 corresponds to the operation "GET: / products / ... / detail", N2 corresponds to the operation "POST: / cart / add", and N3 corresponds to the operation "GET: / checkout / start".

[0092] The system creates two directed edges based on temporal transition relationships: one from N1 to N2, and the other from N2 to N3. Finally, the pre-trained GraphSAGE model is called to process the graph. This model iteratively aggregates neighbor information, generating embedding vectors for N1, N2, and N3 respectively. Then, it merges the vectors of these three nodes using average pooling, outputting a 256-dimensional high-dimensional behavioral association feature vector. For example, a vector with values ​​[0.21, -0.53, 0.09, ..., -0.18]. This vector This refers to the digital encoding of the user's behavioral logic of "browsing products - adding to cart - checkout".

[0093] In one embodiment of the present invention, issuing an attack trigger signal includes the following steps:

[0094] Multidimensional traffic statistics are input into a pre-trained, converged convolutional autoencoder model. The corresponding traffic reconstruction feature matrix is ​​reconstructed through encoding and decoding. The spatial distribution distance between the multidimensional traffic statistics and the traffic reconstruction feature matrix is ​​calculated, and the Euclidean distance value is mapped to the reconstruction loss deviation for evaluating the intensity of transmission anomalies. When the reconstruction loss deviation is greater than a preset reconstruction loss threshold, it is determined that there is a risk of large-scale network layer traffic flooding in the current traffic link, and an attack trigger signal is simultaneously sent to the subsequent deep analysis steps.

[0095] Specifically, the system's data processing flow initiates a rapid coarse screening of network layer traffic. Multidimensional traffic statistical features stored in a cache are fed into a pre-trained and converged convolutional autoencoder (CAE) model. CAEs are a special type of neural network designed to use only a small number of convolutional and fully connected layers to ensure low inference latency in high-speed traffic processing scenarios. Before deployment, this engine was trained offline using a large number of multidimensional traffic statistical feature samples containing only normal business traffic. Its training objective is to minimize reconstruction loss bias, enabling it to learn and reconstruct the statistical patterns of normal traffic.

[0096] Before feeding, the multidimensional flow statistics features are formatted into a standard-sized input matrix, and max-min normalization is performed on the various feature values ​​in the matrix to map feature values ​​of different dimensions to the [0, 1] interval, so as to eliminate the influence of feature dimension differences on Euclidean distance calculation. The normalized input matrix is ​​then fed into the convolutional autoencoder model for feature reconstruction. The formula for calculating max-min normalization is:

[0097]

[0098] in, These are the original eigenvalues. This is the minimum value of this feature dimension. This represents the maximum value of this feature dimension. The values ​​are normalized eigenvalues; the rows and columns of the matrix correspond to different statistical dimensions, such as protocol type, time-to-live segment, and packet size range. This input matrix is ​​passed through the encoder part of the convolutional autoencoder model, which consists of a series of one-dimensional convolutional and pooling layers. Its function is to extract key patterns from traffic features layer by layer and compress them into low-dimensional latent space vectors.

[0099] The latent space vector is input to the decoder, which has a structure symmetrical to the encoder. Through a series of upsampling layers and one-dimensional transposed convolutional layers, it attempts to reconstruct the traffic reconstruction feature matrix from the latent space vector, which has the same size and structure as the original input matrix. It should be understood that the traffic reconstruction feature matrix is ​​the output of the convolutional autoencoder model. Theoretically, when the input is normal traffic features, it should be highly similar to the input matrix.

[0100] After obtaining the traffic reconstruction feature matrix, the system performs a spatial distribution distance calculation to quantify the difference between the original traffic data and the reconstructed traffic data. Specifically, the system calculates the Euclidean distance between the original input matrix of multidimensional traffic statistics features and the traffic reconstruction feature matrix. This distance value is directly mapped to the reconstruction loss bias for assessing the strength of current network transmission anomalies. The calculation formula is as follows:

[0101]

[0102] in, This represents the original input matrix composed of multidimensional flow statistics features, with dimensions of... ; This represents the traffic reconstruction feature matrix generated by the convolutional autoencoder model, and its dimension is also [missing information]. ; and These two matrices represent the first two matrices in the second position. Line number The element values ​​of the column; the reconstruction loss bias is the Euclidean distance value calculated by the above formula, which is a non-negative scalar. It reflects the degree to which the current traffic pattern deviates from the normal baseline model. A smaller bias value indicates that the current traffic pattern is highly consistent with the normal pattern learned by the engine, while a larger bias value means that there is a significant anomaly in the current traffic pattern.

[0103] The system will compare the calculated reconstruction loss deviation with the preset reconstruction loss threshold baseline. In comparison, it should be noted that the preset reconstruction loss threshold baseline... The key judgment threshold is set based on the statistical distribution obtained after reconstructing the loss deviation of the historical normal flow sample library. It is usually set as the mean of the distribution plus three to five times the standard deviation, for example, at the 99.9 percentile of the historical normal deviation value, to ensure a low false alarm rate.

[0104] If the value of the reconstruction loss deviation exceeds the preset reconstruction loss threshold baseline. The system then determines that the current traffic link poses a risk of large-scale network layer traffic flooding or similar statistical anomalies. Once the determination is confirmed, the system immediately generates and sends an attack trigger signal to subsequent in-depth analysis steps. It should be understood that the suspected attack trigger signal is a Boolean flag or a control message containing a timestamp and an abnormal traffic identifier, used to notify subsequent modules to initiate refined analysis. The generation of this signal is a key link connecting the coarse screening and refined analysis stages. This signal acts as a wake-up command to activate the more accurate but computationally more demanding application layer behavior analysis process.

[0105] For example, continuing from the previous embodiment, the system acquires the multi-dimensional traffic statistical features generated in the traffic feature generation module. This feature is formatted as a 2×3 matrix. The rows represent TCP and UDP protocols, and the columns represent the total number of packets, the average TTL, and the number of packets in the 1025-1500 byte range. Assume a normal business period... The corresponding matrix is .

[0106] The system has now detected a suspected UDP flood attack, and its corresponding multidimensional traffic statistics have been formatted into a matrix. Before feeding the data into the convolutional autoencoder model, the system uses the max-min normalization method described above, combined with the globally preset maximum values ​​for each feature dimension and the maximum value of the total number of UDP packets. =10000, Average TTL Maximum Value =255, Maximum number of large packages =10000, normalize the matrix by mapping all eigenvalues ​​to the interval [0, 1]. After normalization, the normal business matrix is ​​obtained. The corresponding values ​​are [[0.01,0.376,0.005],[0.005,0.502,0]]; Attack traffic matrix The corresponding values ​​are [[0.01,0.376,0.005],[0.5,0.502,0.48]]. This normalized matrix is ​​fed into a pre-trained, converged convolutional autoencoder model. Since this model is trained using only normal traffic samples, its output traffic reconstruction feature matrix tends to fit the distribution pattern of normal traffic.

[0107] The matrix It is fed into a convolutional autoencoder model. Since this engine is trained to reconstruct normal traffic, its output is a traffic reconstruction feature matrix. It will tend to be closer to the normal pattern. The corresponding values ​​are [[0.011,0.375,0.0052],[0.006,0.501,0.005]]. The system then calculates the reconstruction loss deviation between the normalized input matrix and the reconstruction matrix. According to the Euclidean distance formula, , , In this embodiment, the number of rows and columns of the matrix is ​​given. =2, =3, calculate the squared difference in each dimension.

[0108] The first line of the TCP data structure shows a high degree of fit with the normal business model, with the average squared difference for each single dimension being around 10. Level 6; total number of messages is (0.01) 0.011) 2 =0.000001; the average TTL is (0.376) 0.375) 2 =0.000001; the quantity of the large package is (0.005) 0.0052) 2 =0.00000004; UDP line, second line, the squared difference of the anomaly dimension is significant, and is the main contributor to the reconstruction loss. Total number of messages: (0.5) 0.006) 2 ≈0.244; Average TTL is (0.502) 0.501) 2 =0.000001; the number of large packages is (0.48) 0.005) 2 ≈0.2256. Summing the squared differences across all dimensions, the total is approximately 0.000001 + 0.000001 + 0.00000004 + 0.244 + 0.000001 + 0.2256 ≈ 0.4696. Taking the square root of this sum gives the final reconstruction loss bias. ≈0.686.

[0109] The system retrieved the preset reconstruction loss threshold baseline. The value is 0.1, set based on offline training using tens of millions of normal business traffic samples. 99.9% of the reconstruction loss deviation for normal traffic falls within 0.05. This threshold can control the false alarm rate to within 0.1%, while ensuring a detection rate of ≥99.5% for DDoS flood attacks. Since the calculated reconstruction loss deviation of 0.686 is much greater than the preset threshold of 0.1, the system determines that the current traffic link has a risk of large-scale network layer flooding and immediately generates an attack trigger signal, which is simultaneously sent to subsequent in-depth analysis steps.

[0110] In one embodiment of the present invention, outputting an attack context description includes the following steps:

[0111] After the front-end detection link captures a suspected attack trigger signal, it switches the dormant graph neural network to the highest priority running state; it injects the high-dimensional behavior association feature vector into the activated graph neural network, and quantifies the spatiotemporal deviation of the high-dimensional behavior association feature vector from the long-range dependency distribution of normal business requests; when the system detects that the spatiotemporal deviation meets the preset judgment conditions, it outputs an attack context description that includes the malicious penetration source network address, the targeted core interface identifier, and the attack type classification result.

[0112] Specifically, once the front-end detection link captures a suspected attack trigger signal generated by the coarse-screening perception module, the system immediately performs a wake-up operation. This operation uses the operating system scheduler to prioritize the execution process of the self-centered attention-based graph neural network, which is currently in a dormant state, to the highest level. The resource manager then exclusively allocates reserved high-performance computing units, such as GPUs or TPUs, to it, switching it to the highest computing priority running state. The self-centered attention-based graph neural network is a deep learning model using a graph attention network (GAT) or graph transformer architecture. Before deployment, it has been trained on the directed behavior graphs of massive amounts of normal users, enabling it to learn and abstract the long-range dependency distribution of normal business requests.

[0113] The dormant state refers to the neural network model process being in a low-priority or suspended state, not occupying core computing resources; the highest computing priority running state means that the process is given real-time priority and exclusively occupies computing resources to ensure the lowest analysis latency.

[0114] Once in operation, the data input interface of the graph neural network based on self-center attention is activated, and it receives high-dimensional behavior association feature vectors generated in the behavior graph construction module. The vector is injected into the model structure of the neural network, and the network's self-centering attention mechanism begins to quantify the spatiotemporal deviation between this input vector and the pre-learned and stored long-range dependency distribution of normal business requests. The distribution of long-range dependencies in normal business requests is represented by a set of normal behavior prototype vectors. These prototype vectors are centroid vectors obtained during the model training phase by clustering normal behavior map embedding vectors, such as through K-Means clustering; spatiotemporal deviation. It is a scalar value used to quantify the degree to which the current user behavior sequence deviates from the normal behavior pattern. The value range is usually between 0 and 2. It is set based on the spatiotemporal deviation degree being a weighted sum of "1-cosine similarity". The value range of cosine similarity is [-1,1], so the value range of 1-cosine similarity is [0,2], which is completely in line with the mathematical definition of vector space similarity. 0 represents that it is completely consistent with normal behavior, and 2 represents that it is completely opposite to normal behavior.

[0115] The calculation process first evaluates the similarity between the high-dimensional behavior-related feature vector and a set of prototype vectors representing different normal behavior patterns using a dot product attention mechanism, generating a set of attention weights. These weights are then used to sum the distances from the high-dimensional behavior-related feature vector to each prototype vector, yielding the final spatiotemporal deviation scalar value, calculated using the following formula:

[0116]

[0117]

[0118] in, It is the dimension of the vector; It is a high-dimensional behavioral correlation feature vector Compared to the first prototype vectors Attention weights, calculated by With all prototype vectors The dot product is obtained by scaling and then applying the Softmax function; the first part of the formula is calculated. and The cosine distance between them is 1 minus the cosine similarity, resulting in the final value. It is the weighted sum of the cosine distances of all prototype vectors according to their attention weights.

[0119] When the system detects that the calculated spatiotemporal deviation scalar value meets the preset application-layer logic tampering judgment condition, that is, the value exceeds a certain threshold... At that time, the application layer logic tampering judgment condition refers to the spatiotemporal deviation. Greater than a preset specific threshold that specific threshold Setting the recall rate based on the receiver operating characteristic ROC curve of the model on the validation set can maximize the recall rate while maintaining an acceptable false positive rate. For example, setting it to 0.65 is based on ROC curve analysis of thousands of normal behavior samples and thousands of attack behavior samples, with a specific threshold. At 0.65, a specific threshold represents the optimal balance between detection rate and false alarm rate. A value below 0.6 will cause the false alarm rate to rise to over 10%, while a value above 0.7 will cause the detection rate to drop to below 90%, and the system will determine that the current behavior sequence is a malicious attack.

[0120] At this point, the system immediately integrates the analysis results and outputs an attack context description containing the malicious penetration source network address, the targeted core interface identifier, and the attack type classification result. It should be understood that the attack context description is a structured data object, such as a JSON object, containing key metadata about the attack. The attack type classification result is directly generated by the classification output layer of the neural network. It should be noted that the attack type classification result is the attack category label output by the classification head at the end of the neural network, such as "credential stuffing attack," "API abuse," or "malicious crawler." The malicious penetration source network address is obtained by tracing back the original session information that generated the behavioral graph. The targeted core interface identifier is determined based on the node with the highest attention score or the node with the largest abnormal contribution in the graph.

[0121] For example, continuing from the previous embodiment, when the system receives a suspected attack trigger signal from the coarse-screening perception module, it immediately activates the graph neural network based on egocentric attention. The system then uses the high-dimensional behavior association feature vector generated in the behavior graph construction module. The values ​​[0.21, -0.53, 0.09, ..., -0.18] are injected into the network. Assume the network has learned and stored two normal behavior prototype vectors. This represents the "Normal Browsing - Shopping" mode, with values ​​of [0.75, 0.21, -0.55, ..., 0.35]. This represents the "normal account management" mode, with values ​​of [-0.11, 0.85, 0.05, ..., 0.15].

[0122] First, calculate the attention weights. and Assuming that the calculation yields... and This indicates the input behavior. It has a higher correlation with the "normal account management" mode. System calculation and and The cosine distances, assuming they are respectively and Spatiotemporal deviation The system retrieved a specific threshold for determining application-layer logic tampering. The value is 0.65. Since 0.746 is greater than 0.65, the system determines that the behavior is a malicious attack. Subsequently, the system outputs an attack context description: the malicious penetration source network address is the IP address "203.0.113.25" traced from the original packet flow; the targeted core interface is identified as the node with the highest attention, "GET: / checkout / start"; and the attack type classification result is "API resource abuse CC attack" output by the neural network classification header.

[0123] In one embodiment of the present invention, generating a collaborative defense command stream includes the following steps:

[0124] The system polls the pre-built defense primitive action library to extract a set of preventative actions specifically designed to suppress attack type classification results contained in the attack context description. It collects the real-time computing resource load rate of the server nodes associated with the targeted core interface identifier and adds parameters such as layered execution validity period, rate limiting tolerance, and human-machine authentication challenge difficulty as multi-dimensional parameters to the preventative action set. The preventative action set encapsulating multi-dimensional parameters is serialized and assembled to generate a collaborative defense command stream designed to apply tiered countermeasures to the malicious penetration source network address.

[0125] Specifically, upon receiving the attack context description generated by the deep analysis module, the system immediately initiates a dynamic orchestration process for its defense strategy. The system accesses a pre-configured defense primitive action library. It should be noted that this pre-configured defense primitive action library is a structured database or configuration file that defines parameters such as "IP..." BLOCK (IP address blocking) "RATE" LIMIT (Access rate limit) "CAPTCHA" CHALLENGE (Human-Machine Verification Challenge) "SESSION" TERMINATE This library stores atomic defense operations such as "(session termination)", and also stores various atomic defense operations and the attack types they are applicable to.

[0126] The system performs a polling query based on the attack type classification results contained in the attack context description to match and extract all sets of punitive basic defense actions that can specifically suppress the attack type. It should be understood that the set of punitive basic defense actions is a collection of one or more defense primitives selected from a pre-set defense primitive action library for a specific attack type.

[0127] After acquiring the set of basic punitive defense actions, the system does not issue them directly. Instead, it customizes them by taking into account the current system resource load status. The system collects the real-time computing resource load rate of the server nodes associated with the targeted core interface identifier specified in the attack context description through the monitoring module. The real-time computing resource load rate of the server nodes is based on performance indicator data periodically reported by the monitoring agent deployed on the server, such as CPU utilization percentage, available memory size in GB, and network interface packets sent and received per second (PPS), specifically including CPU utilization, memory usage, and network I / O throughput.

[0128] Based on the real-time computing resource load rate, the system dynamically adds tiered execution parameters to each action in the punitive basic prevention and control action set. Specifically, the system adds a tiered execution validity period to each action. It should be understood that the tiered execution validity period is a timestamp or duration used to limit the effective time of a certain defense action, for example, set to 10 seconds to 300 seconds. This validity period is set according to the computing resource load rate; the higher the computing resource load rate, the shorter the validity period, in order to quickly evaluate the effect. It also adds parameters for rate limiting tolerance and human-machine authentication challenge difficulty.

[0129] It's important to note that rate limiting tolerance is a numerical value, defining the number of requests allowed through a restricted IP address per unit of time. For example, the threshold for rate limiting tolerance is 1 to 10 requests per second, used to set the threshold for rate limiting policies. The higher the computing resource load, the lower the tolerance. Under high load, such as CPU utilization > 80%, in scenarios with high attack intensity and servers nearing overload, prioritizing service availability, the rate limiting tolerance threshold is 2 requests per second. Under medium load, such as CPU utilization 50%–80%, where attack and normal business traffic coexist, and balancing protection effectiveness and user experience, the rate limiting tolerance threshold is 5 requests per second. Under low load, such as CPU utilization 50%–80%, in scenarios with probing attacks, sufficient server redundancy, and avoiding excessive rate limiting that might harm normal users, the rate limiting tolerance threshold is 10 requests per second.

[0130] The additional human-machine authentication challenge difficulty parameter should be understood to be an enumerated value, such as "EASY", "MEDIUM", "HARD" or a specific configuration object, which determines the degree of distortion of the verification code image, the complexity of the character set, or whether interactive elements such as sliding puzzles are required. This parameter determines the complexity of the verification code or the number of interaction steps sent to a suspected malicious source. The higher the computational resource load rate, the higher the challenge difficulty.

[0131] After the parameters are attached, the system will encapsulate a set of punitive basic prevention and control actions with multi-dimensional parameters and assemble them sequentially. The assembly process follows a preset tiered countermeasure logic, that is, first arrange actions with the smallest impact and lowest verification cost, such as mild rate limiting, and then gradually upgrade to actions with a wider impact and greater punishment, such as injecting high-difficulty human-machine verification or IP blocking.

[0132] The system generates a structured, coordinated defense command stream designed to apply tiered countermeasures to the malicious infiltration source network addresses specified in the attack context description. It should be noted that the coordinated defense command stream is an ordered sequence of commands encoded in a specific format, such as JSON or XML, which includes the target address, the action to be performed, and various additional parameters.

[0133] For example, continuing from the previous embodiment, the attack context description received by the system indicates that the attack type classification result is "API resource abuse CC attack", the targeted core interface is identified as "GET: / checkout / start", and the malicious penetration source network address is "203.0.113.25". The system first polls the pre-set defense primitive action library and extracts the set of punitive basic prevention and control actions for "API resource abuse CC attack". This set includes {"RATE"} LIMIT “CAPTCHA” CHALLENGE “IP” BLOCK ”}.

[0134] The system detected that the real-time computing resource load of the server node associated with the "GET: / checkout / start" interface was 85% CPU and 70% memory. Based on this high load, the system added the parameter "RATE" to the action set. LIMIT "The action-added layer execution validity period is 60 seconds, and the rate limiting tolerance is 2 requests per second; it is 'CAPTCHA'." CHALLENGE The difficulty parameter for the action-added human-machine authentication challenge is set to "HARD," and the validity period is set to 180 seconds; it is set to "IP." BLOCK "The action has an additional validity period of 3600 seconds."

[0135] The system performs serialization and assembly to generate a collaborative defense command stream. The first command in this stream is to execute "RATE" on "203.0.113.25". LIMIT The action has the parameters {duration: 60s, limit: 2 req / s; the second command is to execute "CAPTCHA" if the attack continues after 60 seconds. CHALLENGE The action has parameters {duration: 180 s, difficulty: 'HARD'}; the third command is to execute "IP" if the attack does not stop after 240 s. BLOCK The action, with the parameter {duration:3600s}, is then dispatched.

[0136] In one embodiment of the present invention, outputting real defense effect feedback data includes the following steps:

[0137] The collaborative defense command stream is pushed concurrently to each edge distributed defense node facility deployed close to the network boundary through the security management channel; each edge distributed defense node facility performs cleaning and filtering operations in sequence according to the collaborative defense command stream, including blocking source address blacklists, access rate peak reduction, and injecting secondary human-machine verification procedures; the total number of malicious traffic dropped, legitimate user verification blocking rate, and normal packet release delay reported by each edge distributed defense node facility are periodically summarized as indicator data, and the cleaning and aggregation output data on the actual defense effect is returned.

[0138] Specifically, the system's control plane operates through a secure management channel. It's important to note that this secure management channel is an encrypted control channel independent of the normal business data channel. It's used for distributing defense strategies and retrieving telemetry data to prevent interference from attack traffic. The collaborative defense command stream generated by the defense strategy orchestration module is concurrently pushed to all edge distributed defense node facilities deployed close to the network boundary. These edge distributed defense node facilities are physical or virtualized security devices deployed in data centers or network access points (PoPs) globally, integrating DDoS mitigation, web application firewall, and intelligent traffic management functions. The secure management channel uses encrypted gRPC long connections generated based on the Transport Layer Security (TLS) protocol's traffic characteristics to ensure low latency and confidentiality in command transmission. Each edge distributed defense node facility, upon receiving the collaborative defense command stream, immediately loads and executes it sequentially.

[0139] The edge distributed defense node facilities execute specific cleaning and filtering operations sequentially according to the tiered countermeasure logic defined in the collaborative defense command flow. The node parses the first-stage command in the command flow, such as executing a source address blacklist blocking against a specific source address. Source address blacklist blocking means adding a certain IP address to the deny list; the node will drop all subsequent packets from that IP address. This operation is achieved by adding a "drop" rule to the node's data plane firewall or network access control list (ACL).

[0140] It should be noted that the attack persistence determination rule is as follows: 10 seconds before the end of each defense phase, the number of requests from the target IP and the percentage of blocked malicious traffic during that phase are counted. If the percentage of malicious traffic is ≥80%, the attack is determined to be ongoing, and the next phase of defense actions is automatically executed, such as access rate shaping. Access rate shaping is a traffic shaping technique used to limit the request rate from a specific source to below a preset rate limiting tolerance threshold. This operation is performed by configuring a token bucket algorithm-based rate limiting policy for the source address in the node's traffic scheduler. If the percentage of malicious traffic is <20%, the attack is determined to be terminated, and all defense actions are lifted to avoid over-defense.

[0141] If the attack is still not contained, the node will perform a higher-level cleaning and filtering operation to inject a secondary human verification procedure. It should be noted that the operation of injecting a secondary human verification procedure refers to verifying the authenticity of the user's identity at the application layer without interrupting the TCP connection. This operation intercepts the HTTP request from the source address through the node's application layer proxy module and responds with an HTTP 302 redirect message, redirecting it to the human verification service page.

[0142] While executing defensive actions, each edge distributed defense node continuously monitors and reports its command hit status and service flow loss. The system periodically summarizes various indicator data reported by each node, specifically including the total number of malicious traffic dropped due to matching blacklists or rate limits (note that the total number of malicious traffic dropped is an integer, quantifying the scale of attack traffic intercepted by the defensive actions within a preset time period); and the proportion of sessions that were identified as legitimate users but failed to pass authentication during human verification operations, i.e., the legitimate user authentication blocking rate. The calculation formula is as follows:

[0143]

[0144] in, It is the total number of edge distributed defense node facilities participating in the defense; It is the first Each node reports the number of sessions that were determined to be legitimate users but failed verification during the statistical period; It is the first Each node reports the number of sessions that successfully passed verification within the statistical period. By aggregating the data from all nodes, the proportion of collateral impact on normal users caused by the entire defense system is calculated. It should be noted that the legitimate user verification blocking rate is a percentage and is a key indicator for evaluating the accuracy of the defense strategy and its impact on user experience. Its value needs to be controlled within an extremely low range, such as below 0.01%. The processing latency experienced by business packets that are not hit by any defense strategy and are judged to be normal from entering the node to leaving the node is also calculated; this is the normal packet release latency. It should be understood that the normal packet release latency is an indicator for measuring the impact of the defense system on normal business performance, and is usually required to be in the millisecond range.

[0145] These scattered raw log data undergo cleaning and aggregation processing at the central node, such as removing duplicate records, aligning timestamps, and calculating global statistics. The final output is structured feedback data on the actual defense effect. It should be noted that the feedback data on the actual defense effect is a structured dataset containing the above-mentioned aggregated indicators, providing a basis for decision-making in subsequent adaptive learning.

[0146] For example, continuing from the previous embodiment, the control plane concurrently sends the collaborative defense command stream generated by the defense strategy orchestration module to the two edge distributed defense node facilities, namely Node-A and Node-B, that are processing the service traffic through the gRPC channel.

[0147] Node-A and Node-B simultaneously execute the first-phase instructions, adding the IP address "203.0.113.25" to the blacklist and setting a 60-second rate limit. During the first 60-second period, Node-A's rate-limiting module discarded 1,500 requests from this IP address, while Node-B discarded 1,200. After 60 seconds, the attack did not stop, and both nodes automatically entered the second phase, beginning to inject a secondary human verification procedure into requests from "203.0.113.25".

[0148] During the subsequent statistical period, Node-A initiated 200 requests to this IP with HARD-level human verification, all of which failed; Node-B initiated 180 requests, all of which also failed. Meanwhile, Node-A also initiated verifications against 5 other suspicious IPs, 4 of which passed successfully and 1 failed; Node-B initiated verifications against 8 other suspicious IPs, all of which passed successfully.

[0149] Node-A measured a normal packet passage delay of 2.1 ms, and Node-B measured 2.5 ms. After a 5-minute aggregation period, the central node aggregated the data. The total number of malicious traffic dropped = 1500 + 1200 + 200 + 180 = 3080. The legitimate user authentication blocking rate is calculated using the formula based on the total number of failed attempts. Total number of successes from Node-A Therefore Average normal packet release delay = (2.1 + 2.5) / 2 = 2.3 ms. Real defense effect feedback data generated: {total_drops:3080, block_rate:0.077, avg_delay_ms:2.3}.

[0150] In one embodiment of the present invention, adjusting the convolutional autoencoder model and the graph neural network includes the following steps:

[0151] It collects and stores real defense effect feedback data reported by underlying nodes and unmodeled novel threat payloads captured through offline parsing in a bypass sandbox analysis environment; it calculates and transforms the real defense effect feedback data into internal reward and punishment gradient scores, and uses a centralized incremental training mechanism to fine-tune the classification function bias parameters of the convolutional autoencoder model and the graph neural network; it analyzes the variant communication frequency domain characteristics of unmodeled novel threat payloads, and updates the corresponding punitive policy rule weights in the pre-set defense primitive action library to maintain the decision confidence of the defense system in dealing with evolving attacks.

[0152] Specifically, the system's adaptive adjustment module runs continuously to collect and store real defense effect feedback data from underlying nodes, as well as unmodeled novel threat payloads parsed and captured offline via a bypass sandbox analysis environment. The bypass sandbox analysis environment is a virtualized environment isolated from the production network, used to securely execute and analyze suspicious traffic samples without posing a risk to online operations. Unmodeled novel threat payloads refer to traffic samples with novel attack characteristics that cannot be identified by existing models or rule bases. Real defense effect feedback data is temporarily stored in an in-memory database, while unmodeled novel threat payloads are stored in a dedicated threat intelligence database.

[0153] The system calculates and converts the actual defense performance data back into internal reward and punishment gradient scores. It should be noted that the internal reward and punishment tier scores... This is a scalar value used to quantify the overall effectiveness of a single defense cycle. This score comprehensively evaluates the benefits and costs of defense actions. For example, a high total number of malicious traffic drops generates positive points, such as rewards, while a high legitimate user authentication blocking rate or a high delay in allowing normal packets generates negative points, such as penalties. The calculation formula is as follows:

[0154]

[0155] in, This represents the total number of malicious traffic drops, processed logarithmically here. To compress the dimensional differences of high-volume values ​​and avoid excessively large values ​​in high-volume scenarios that could lead to uncontrolled threshold updates; This is the blocking rate for legitimate user verification; This is a normal message release delay; It is a preset reference delay constant, such as 10 ms, used to eliminate the influence of time units; , , These are their corresponding weighting coefficients. It should be noted that... + + =1, weighting coefficient , , This is set according to business priorities to balance the contribution of various metrics to the reward function, such as for businesses sensitive to user experience. The absolute value will be much greater than The system employs a centralized incremental training mechanism. It should be understood that the centralized incremental training mechanism here is a centralized model update paradigm. It does not directly access the original user data, but guides the model iteration based on the aggregated gradient signals extracted from the global defense effect, thus protecting data privacy. It aggregates these gradient integrals and uses them to fine-tune the key parameters in the convolutional autoencoder model and the graph neural network based on egocentric attention.

[0156] Specifically, the system uses this gradient integral to adjust the preset reconstruction loss threshold baseline of the convolutional autoencoder model and the classification function bias parameters of the graph neural network based on egocentric attention, in order to achieve adaptive adjustment of detection sensitivity. The update rules for the reconstruction loss threshold and bias parameters are as follows:

[0157]

[0158]

[0159] in, Represents the baseline of the pre-set reconstruction loss threshold. Or the threshold for application layer logic tampering judgment conditions ; This is the current threshold; It's the learning rate, the learning rate. It is a relatively small positive number, ranging from 0.0001 to 0.001. The updated reconstruction loss threshold, if If the calculation result is less than 0, it is set to the preset minimum threshold, such as 10, to prevent the reconstruction loss threshold from being negative and causing the system logic to crash. and These are the classification function bias vectors before and after the update; It is an indicator vector, which is only used when corresponding to the determined attack category. The value is 1 for the dimension and 0 for the rest.

[0160] Meanwhile, the system conducts in-depth analysis of novel threat payloads that are not modeled. The system extracts the communication time series of the payload, such as the arrival time interval of request packets, and analyzes its variable communication frequency domain characteristics using signal processing techniques such as Fast Fourier Transform (FFT). Variable communication frequency domain characteristics refer to the features obtained by performing spectral analysis on the time series data of attack traffic, such as dominant frequency and harmonic distribution, which can reveal machine-generated automated attack patterns and identify their hidden periodicity or regularity.

[0161] The analysis results are fed back to the policy management module to update the weights of the punitive policy rules corresponding to newly discovered attack characteristics in the pre-built defense primitive action library. The weights of the punitive policy rules are numerical values ​​associated with each defense action in the pre-built defense primitive action library, used for weighted selection during policy orchestration. For example, if a new type of attack is found to be extremely sensitive to rate limits, the system will increase the "RATE" threshold. LIMIT "The selection weight of the action when matching the attack features allows the defense action to be activated more preferentially and decisively when encountering similar attacks in the future, so as to maintain the decision confidence of the entire defense system in dealing with evolving attacks. Decision confidence refers to the reliability measure of the attack judgment results output by the model or system."

[0162] For example, continuing from the previous embodiment, the adaptive adjustment module receives the actual defense effect feedback data generated by S6: {total_drops:3080, block_rate:0.077, avg_delay_ms:2.3}. The system sets the weight coefficients. , , Calculate the internal reward and punishment gradient scores according to Formula 1. This is a positive reward signal, but the value is small, indicating that the defense is effective but there is room for optimization; the system sets a learning rate. Since the attack was successfully identified, the system adjusted the preset reconstruction loss threshold baseline. The original threshold for determining whether the application layer logic has been modified was 500.0. The original value was 0.65, which underwent minor adjustments. Due to... If the value is positive, the system will slightly lower the threshold to improve sensitivity, for example... , .

[0163] Simultaneously, the system uses this gradient to update the bias parameters of the classification function corresponding to the "API resource abuse CC attack" category in the self-centered attention-based graph neural network, thereby enhancing the confidence in the judgment of this type of attack. Furthermore, the bypass sandbox analysis environment captures and analyzes novel, unmodeled threat payloads, whose variant communication frequency domain characteristics show a sharp peak at 5 Hz. Based on this, the system updates the pre-built defense primitive action library to "RATE" associated with the "5 Hz frequency domain characteristics". LIMIT "The penalty policy rule weight for the action is increased by 0.5, making it the preferred choice in subsequent policy generation, and the rate limit is set to slightly less than 5 requests per second."

[0164] See appendix Figure 2 This invention also proposes a hybrid attack detection and defense method based on deep learning, comprising the following modules:

[0165] The traffic feature generation module parses the acquired raw network communication packet stream and extracts multi-dimensional traffic statistical features and application layer protocol semantic features.

[0166] The behavior graph construction module constructs a directed behavior graph based on the semantic features of the application layer protocol, calls the depth graph embedding algorithm to process the directed behavior graph, and outputs a high-dimensional behavior association feature vector.

[0167] The coarse screening perception module inputs multidimensional traffic statistics features into the convolutional autoencoder model to generate a traffic reconstruction feature matrix, calculates the reconstruction loss deviation between the multidimensional traffic statistics features and the traffic reconstruction feature matrix, and issues an attack trigger signal if the reconstruction loss deviation is greater than a preset reconstruction loss threshold.

[0168] The deep analysis module receives the attack trigger signal, injects the high-dimensional behavior association feature vector into the graph neural network to calculate the spatiotemporal deviation, and outputs the attack context description if the spatiotemporal deviation meets the preset judgment conditions.

[0169] The defense strategy orchestration module extracts a set of prevention and control actions based on the attack context description, and combines the obtained real-time computing resource load rate with multi-dimensional parameters to generate a collaborative defense command flow.

[0170] The instruction execution and effect feedback module performs cleaning and filtering operations on the collaborative defense instruction stream, summarizes indicator data, and outputs real defense effect feedback data.

[0171] The model adaptive adjustment module converts the real defense effect feedback data into internal reward and punishment gradient scores, and adjusts the convolutional autoencoder model and graph neural network.

[0172] Each of the modules can be implemented in whole or in part through software, hardware, or a combination thereof. It supports hardware embedded in or independent of the processor in the computer device, and also supports software stored in the memory of the computer device, so that the processor can call and execute the operations corresponding to each of the above modules.

[0173] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A hybrid attack detection and defense method based on deep learning, characterized in that, Includes the following steps: S1. Parse the obtained raw network communication message stream and extract multi-dimensional traffic statistics features and application layer protocol semantic features; S2. Construct a directed behavior graph based on the semantic features of the application layer protocol, call the depth graph embedding algorithm to process the directed behavior graph, and output a high-dimensional behavior association feature vector. S3. Input the multidimensional traffic statistics features into the convolutional autoencoder model to generate a traffic reconstruction feature matrix. Calculate the reconstruction loss deviation between the multidimensional traffic statistics features and the traffic reconstruction feature matrix. If the reconstruction loss deviation is greater than the preset reconstruction loss threshold, issue an attack trigger signal. Multidimensional traffic statistics features are input into a pre-trained, converged convolutional autoencoder model, and the corresponding traffic reconstruction feature matrix is ​​calculated and reconstructed through encoding and decoding. Calculate the spatial distribution distance between the multidimensional traffic statistics feature and the traffic reconstruction feature matrix, and map the Euclidean distance value to the reconstruction loss bias for assessing the intensity of transmission anomalies; When the reconstruction loss deviation is determined to be greater than the preset reconstruction loss threshold, it is determined that there is a risk of large-scale network layer traffic flooding in the current traffic link, and an attack trigger signal is sent to the subsequent deep analysis steps simultaneously. S4. Receive the attack trigger signal, inject the high-dimensional behavior association feature vector into the graph neural network to calculate the spatiotemporal deviation. If the spatiotemporal deviation meets the preset judgment conditions, output the attack context description. S5. Extract the set of defense actions based on the attack context description, and combine it with the obtained real-time computing resource load rate and multi-dimensional parameters to generate a collaborative defense command flow. Poll the pre-set defense primitive action library to extract the set of prevention and control actions based on the attack type classification results contained in the attack suppression context description; The real-time computing resource load rate of the server nodes associated with the targeted core interface identifier is collected, and parameters such as the layered execution validity period, rate limiting tolerance, and human-machine authentication challenge difficulty are added to the prevention and control action set as multi-dimensional parameters. The set of prevention and control actions encapsulated with multi-dimensional parameters is serialized and assembled to generate a collaborative defense command stream designed to apply tiered countermeasures to the network addresses of malicious infiltration sources. S6. Perform cleaning and filtering operations on the collaborative defense command stream, summarize indicator data, and output the actual defense effect feedback data. S7. Convert the real defense effect feedback data into internal reward and punishment gradient scores, and adjust the convolutional autoencoder model and graph neural network.

2. The hybrid attack detection and defense method based on deep learning according to claim 1, characterized in that, Extracting multidimensional traffic statistics features and application layer protocol semantic features includes the following steps: Activate the hardware acceleration acquisition module deployed at the network traffic aggregation node to intercept the original network communication packet stream; By stripping the network layer and transport layer protocol headers from the original network communication message stream, the protocol type flag, time-to-live-time (TTL), and data packet size distribution matrix are extracted and combined to form multidimensional traffic statistical features. The application layer connection state machine that tracks the original network communication message flow is used to extract the message request frequency sequence, resource access addressing depth, and session credential identifier value, which are then encapsulated into application layer protocol semantic features.

3. The hybrid attack detection and defense method based on deep learning according to claim 1, characterized in that, Outputting a high-dimensional behavior-related feature vector includes the following steps: It aggregates all application layer protocol semantic features generated within a preset time window using the same source address identifier, and traces the temporal jump relationship of connection operations before and after. A directed behavior graph reflecting the interaction trajectory between the user and the system is constructed with operation nodes as vertices and temporal jump relationships as edges; The depth graph embedding algorithm is called to perform dimensionality reduction feature extraction on the topology of the directed behavior graph, and output a high-dimensional behavior association feature vector representing the logical continuity of multi-step hidden operations.

4. The hybrid attack detection and defense method based on deep learning according to claim 3, characterized in that, The timing jump relationship between the preceding and following join operations is traced, including the following steps: Aggregate all application layer protocol semantic features generated from the same source address within a preset time window from the cache; Based on the timestamp information recorded in each application layer protocol semantic feature, the application layer protocol semantic features are sorted in ascending order to form an ordered sequence of behavioral events; Based on an ordered sequence of behavioral events, the temporal jump relationship between preceding and following connection operations is traced.

5. The hybrid attack detection and defense method based on deep learning according to claim 1, characterized in that, Output an attack context description, including the following steps: After the front-end detection link captures a suspected attack trigger signal, it switches the dormant graph neural network to the highest computing priority running state. Inject high-dimensional behavioral correlation feature vectors into the activated graph neural network and quantify the spatiotemporal deviation of the high-dimensional behavioral correlation feature vectors from the long-range dependency distribution of normal business requests. When the system detects that the spatiotemporal deviation meets the preset judgment conditions, it outputs an attack context description that includes the network address of the malicious penetration source, the identifier of the targeted core interface, and the attack type classification result.

6. The hybrid attack detection and defense method based on deep learning according to claim 5, characterized in that, The spatiotemporal deviation between the high-dimensional behavioral correlation feature vector and the long-range dependency distribution of normal business requests is calculated quantitatively, including the following steps: The similarity between a high-dimensional behavior-related feature vector and a set of prototype vectors representing different normal behavior patterns is evaluated through a dot product attention mechanism, and a set of attention weights is generated. The distances from the high-dimensional behavioral association feature vectors to each prototype vector are weighted and summed using attention weights to obtain the final spatiotemporal deviation scalar value.

7. The hybrid attack detection and defense method based on deep learning according to claim 1, characterized in that, Outputting real defense effect feedback data includes the following steps: The collaborative defense command stream is pushed concurrently to each edge distributed defense node facility deployed close to the network boundary through a security management channel; Each edge distributed defense node facility sequentially executes source address blacklist blocking, access rate peak shaving, and cleaning and filtering operations such as injecting secondary human-machine verification procedures according to the collaborative defense command flow; The system periodically summarizes the total number of malicious traffic dropped, the legitimate user authentication blocking rate, and the normal packet release delay reported by each edge distributed defense node facility as indicator data, and cleans and aggregates the data to output the true defense effect back to the system.

8. The hybrid attack detection and defense method based on deep learning according to claim 1, characterized in that, Adjusting the convolutional autoencoder model and the graph neural network includes the following steps: It collects and stores the actual defense effect feedback data reported by the underlying nodes, as well as the unmodeled new threat payloads captured through offline analysis in the bypass sandbox analysis environment; The real defense effect feedback data is converted into internal reward and punishment gradient scores, and the classification function bias parameters of the convolutional autoencoder model and graph neural network are fine-tuned using a centralized incremental training mechanism. We analyze the variable communication frequency domain characteristics of novel threat payloads that are not modeled, and update the corresponding punitive policy rule weights in the pre-set defense primitive action library to maintain the decision confidence of the defense system in response to evolving attacks.

Images