Wireless local area network security method and system based on machine learning

Abstract

The invention discloses a wireless local area network security method and system based on machine learning, and the method comprises the steps: carrying out the preprocessing of multi-source data, extracting a core feature vector, determining an abnormal behavior through the combination of statistical analysis and sequence modeling, and carrying out the precise recognition of a known attack type and an unknown attack mode through integrated learning and an anomaly detection algorithm. Then, encryption comparison and blocking instruction generation are realized by fusing a threat assessment data set and dynamically adjusting a key sequence in combination with edge computing resources, and finally, an attack feature library is updated through incremental learning to form a self-adaptive defense mechanism. According to the method, multi-source data analysis, dynamic key distribution and real-time defense response are seamlessly integrated, so that the security and the anti-attack capability of a wireless network are remarkably improved, and an efficient and flexible protection means is provided for a complex network environment.

Description

Technical Field

[0001] This invention relates to the field of wireless local area network (WLAN) technology, and in particular discloses a WLAN security method and system based on machine learning. Background Technology

[0002] As a fundamental infrastructure of modern communications, wireless local area networks (WLANs) play a crucial role in fields such as smart homes and the Industrial Internet of Things (IIoT), and their security is directly related to user privacy and data protection. However, with the increasing complexity of network environments, traditional security measures are gradually proving inadequate and struggling to cope with increasingly diverse threats. This importance makes the research into smarter and more flexible security methods an urgent need.

[0003] Current security solutions often fall short in dealing with complex attacks, especially when facing unknown threats and dynamically changing network environments, lacking sufficient adaptability. Many methods rely on pre-set rules or known attack signatures, and their effectiveness diminishes significantly when encountering new attacks or camouflaged behaviors. This limitation often leaves network security protection in a reactive state in practical applications, unable to promptly detect and block potential risks.

[0004] A deeper technical challenge lies in accurately capturing and analyzing abnormal patterns of network behavior in a dynamic environment. This is particularly true in wireless LANs, where network data comes from a wide range of sources, including packet characteristics, signal strength variations, and channel state fluctuations. The complexity and dynamism of this information make identifying abnormal behavior exceptionally difficult. Due to the failure to effectively integrate this multi-source information and extract key features, security systems often experience misjudgments or missed detections when facing complex attacks. For example, in smart home scenarios, attackers may impersonate legitimate devices to access the network, and the system, unable to accurately distinguish device identity and changes in behavior patterns, fails to detect anomalies in time, leading to the theft of user privacy data.

[0005] Therefore, how to integrate multi-source information and accurately identify abnormal behavior in a dynamic and ever-changing network environment has become a key issue in wireless LAN security. Summary of the Invention

[0006] This invention provides a wireless local area network security method and system based on machine learning, aiming to solve at least one of the defects existing in the prior art.

[0007] One aspect of the present invention relates to a machine learning-based wireless local area network security method, comprising the following steps: S100. Wireless signal indicator data is captured by distributed probes deployed in the wireless communication network environment. The captured wireless signal indicator data is preprocessed to obtain a standardized multi-source data set. S200. Based on the standardized multi-source dataset, feature engineering methods are applied to extract dimensional features. Dimensional features are then fused through statistical analysis and sequence modeling to determine the core feature vector. S300. If the behavioral deviation in the core feature vector exceeds the threshold, anomaly labeling is triggered. The labeled core feature vector is then classified using an ensemble learning model to determine the known attack type. S400: An anomaly detection algorithm is used to perform clustering operations on unlabeled core feature vectors, and pattern matching is performed on isolated points in the clustering results to obtain unknown attack pattern recognition results. S500: Obtain the identification results of known attack types and unknown attack patterns, and form a comprehensive threat assessment dataset through fusion; Based on the comprehensive threat assessment dataset, adjust the device authentication parameters through a dynamic key allocation mechanism to obtain the updated key sequence; S600 combines the updated key sequence and edge computing resources to achieve distributed distribution and real-time verification operations, encrypts and compares network access requests, and determines the blocking instruction sequence; S700 uses an incremental learning mechanism to iteratively train and update the attack feature library on the blocking instruction sequence and historical evaluation dataset. It then applies the updated attack feature library to newly captured multi-source data to obtain an adaptive defense response strategy.

[0008] Further, step S100 includes: S110. By deploying distributed probes at nodes in the wireless communication network environment, wireless signal indicator data is captured. The wireless signal indicator data includes signal strength, signal-to-noise ratio, delay, jitter, and packet loss rate, thus obtaining raw signal indicator data. S120. Noise filtering is performed on the original signal index data according to the preset threshold. If the signal-to-noise ratio is lower than the preset threshold, interference samples are removed. The filtered signal index data is obtained by synchronizing the position coordinates and probe identifiers through the timestamp. S130. Use a normalization tool to process the frequency band, bandwidth, and data rate indicators of the filtered signal indicator data. If the value range of the frequency band, bandwidth, and data rate indicators exceeds the unified range, scale and adjust to obtain preliminary standardized signal indicator data. S140. By integrating preliminary standardized signal indicator data and interference levels, and grouping multi-source indicators through K-means clustering, a standardized multi-source data set is obtained.

[0009] Further, step S200 includes: S210. Based on the standardized multi-source dataset, statistical tools are used to calculate the peak values ​​of network coverage quality and user access density indicators. If the peak value exceeds the preset threshold, the high load feature is marked to obtain a preliminary dimensional feature set. S220. Based on the preliminary dimensional feature set, a sliding window tool is used to extract sequence trends for spectrum utilization and link stability indicators to obtain a time-series dimensional feature set. S230. Based on the temporal dimension feature set and the preliminary dimension feature set, the correlation between the motion trajectory prediction and interference source localization indicators is determined by the correlation coefficient matrix. If the correlation coefficient between the temporal dimension feature set and the preliminary dimension feature set is higher than the preset threshold, similar dimensions are aggregated to obtain the fused dimension feature set. S240. Based on the fusion dimension feature set, principal component analysis is used to reduce the dimensionality of the load balancing factor and QoS parameter indicators to determine the core feature vector.

[0010] Further, step S300 includes: S310. Based on the core feature vector, use statistical tools to calculate the behavior deviation value for the behavior deviation. If the behavior deviation value exceeds the preset threshold, trigger an anomaly labeling and obtain the label feature set. S320. Based on the tag feature set, use the correlation coefficient tool to determine the correlation between abnormal network traffic and user access behavior. If the correlation coefficient is higher than the preset threshold, aggregate similar attributes to obtain a fused tag set. S330. Based on the fusion tag set, extract the sequence pattern using the sliding window tool for the spectral interference signal and load peak deviation to obtain the sequence tag set; S340. Based on the sequence label set, classify the label features using an ensemble learning model to determine the known attack types.

[0011] Further, step S400 includes: S410. Based on the unlabeled core feature vectors, perform clustering operations using density clustering tools to obtain an initial cluster set for network traffic density; S420. Based on the initial cluster set, calculate the Euclidean distance between points within the cluster. If the distance exceeds a preset threshold, it is judged as an isolated outlier, and a set of isolated outliers is obtained. S430. Based on the set of isolated anomalies, a preliminary matching trajectory set is obtained by comparing the user's behavior trajectory with a preset pattern library using a string matching tool. S440. Based on the preliminary matching trajectory set, the isolated forest algorithm is used to determine the unknown attack signature and obtain the unknown attack pattern recognition result.

[0012] Further, step S500 includes: S510. Obtain the recognition results of known attack types and unknown attack patterns, and use a feature splicing tool to merge the attack type vector and the unknown attack pattern vector to obtain a fused feature vector set. S520. Based on the fused feature vector set, calculate the vector magnitude using a threshold comparison tool, and determine whether the vector magnitude exceeds a preset threshold. If the vector magnitude exceeds the preset threshold, it is judged as a high threat, and a high threat labeled dataset is obtained. S530. Based on the high-threat labeled dataset, an initial key seed is generated using a hash function to obtain the key seed sequence; S540. Based on the key seed sequence, adjust the device authentication parameters using the key derivation tool to obtain the updated key sequence.

[0013] Further, step S600 includes: S610. Obtain the updated key sequence and edge computing resources, and use a distributed distribution tool to copy the updated key sequence to multiple edge nodes to obtain a distribution key set; S620. Based on the distribution key set, a real-time verification tool is used to verify the signature of the network access request. If the signature verification passes, it is determined to be a valid request, and a list of valid requests is obtained. S630. Based on the list of valid requests, the request features of the list of valid requests are matched with the distribution key set using an encryption comparison tool. If the matching degree is lower than a preset threshold, it is judged as an abnormal access and an abnormal access record is obtained. S640. Based on the abnormal access record, use the instruction generation tool to generate blocking instructions and obtain the blocking instruction sequence.

[0014] Further, step S700 includes: S710. Based on the blocking instruction sequence and historical evaluation dataset, feature vectors are merged using a data fusion tool to obtain a fused training set; S720. Based on the fused training set, the incremental learning algorithm is used to iteratively train the preset attack feature library. If the training convergence is higher than the preset threshold, the preliminary attack feature library is obtained. S730. Based on the preliminary attack feature library, compare the historical verification samples with the feature verification tool. If the matching degree between the preliminary attack feature library and the historical verification samples is higher than the preset threshold, then determine to update the attack feature library. S740. Based on the updated attack signature database, a response generation tool is used to perform pattern matching on the newly captured multi-source data to obtain an adaptive defense response strategy.

[0015] Another aspect of the present invention relates to a machine learning-based wireless local area network (WLAN) security system for performing the aforementioned machine learning-based WLAN security method, comprising: The standardized multi-source data set acquisition module is used to capture wireless signal indicator data through distributed probes deployed in the wireless communication network environment, and to preprocess the captured wireless signal indicator data to obtain a standardized multi-source data set. The core feature vector determination module is used to extract dimensional features based on a standardized multi-source dataset using feature engineering methods, and then fuse these dimensional features through statistical analysis and sequence modeling to determine the core feature vector. The known attack type determination module is used to trigger anomaly labeling if the behavioral deviation in the core feature vector exceeds a threshold. The labeled core feature vector is then classified using an ensemble learning model to determine the known attack type. The unknown attack pattern recognition result acquisition module is used to perform clustering operations on unlabeled core feature vectors using anomaly detection algorithms, perform pattern matching on isolated points in the clustering results, and obtain the unknown attack pattern recognition result. The key sequence acquisition module is updated to obtain the identification results of known attack types and unknown attack patterns, and forms a comprehensive threat assessment dataset through fusion. Based on the comprehensive threat assessment dataset, the device authentication parameters are adjusted through a dynamic key allocation mechanism to obtain the updated key sequence. The blocking instruction sequence determination module is used to combine the updated key sequence and edge computing resources to realize distributed distribution and real-time verification operations, and to perform encrypted comparison of network access requests to determine the blocking instruction sequence. The adaptive defense response strategy acquisition module is used to iteratively train and update the attack feature library on the blocking instruction sequence and historical evaluation dataset through an incremental learning mechanism. The updated attack feature library is then applied to newly captured multi-source data to obtain an adaptive defense response strategy.

[0016] The beneficial effects achieved by this invention are as follows: This invention provides a machine learning-based wireless LAN security method and system, offering a complete solution to the challenges of multi-source data capture, attack pattern identification, and dynamic defense in wireless networks. The core issue lies in identifying known and unknown attack patterns from wireless signal data captured by distributed probes and implementing real-time defense responses. This invention preprocesses multi-source data, extracts core feature vectors, combines statistical analysis and sequence modeling to determine anomalous behavior, and utilizes ensemble learning and anomaly detection algorithms to accurately identify known attack types and unknown attack patterns. Subsequently, by fusing threat assessment datasets, the key sequence is dynamically adjusted, and edge computing resources are used to achieve encryption comparison and blocking command generation. Finally, the attack feature library is updated through incremental learning, forming an adaptive defense mechanism. The most significant innovation of this invention lies in the seamless integration of multi-source data analysis, dynamic key allocation, and real-time defense responses, significantly improving the security and anti-attack capabilities of wireless networks and providing efficient and flexible protection for complex network environments. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of a machine learning-based wireless local area network security method according to the present invention. Figure 2 This is a functional block diagram of an embodiment of a machine learning-based wireless local area network security system according to the present invention.

[0018] Explanation of icon numbers: 10. Standardized multi-source data set acquisition module; 20. Core feature vector determination module; 30. Known attack type judgment module; 40. Unknown attack pattern identification result acquisition module; 50. Update key sequence acquisition module; 60. Blocking instruction sequence determination module; 70. Adaptive defense response strategy acquisition module. Detailed Implementation

[0019] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0020] like Figure 1 As shown, the first embodiment of the present invention proposes a wireless local area network security method based on machine learning, including the following steps: Step S100: Capture wireless signal indicator data by deploying distributed probes in the wireless communication network environment, and perform preprocessing operations on the captured wireless signal indicator data to obtain a standardized multi-source data set.

[0021] Using the wireless local area network (WLAN) communication environment as the monitoring object, distributed probes deployed within the network coverage area (such as probes built into wireless access points (APs), independently deployed spectrum analyzers, terminal access monitoring nodes, etc.) comprehensively capture wireless signal indicator data—covering multi-dimensional parameters of the physical layer, data link layer, and network layer: physical layer indicators (signal strength RSSI, channel occupancy, transmission rate, signal-to-noise ratio SNR, signal jitter amplitude); data link layer indicators (MAC (Media Access Control) address, frame type, frame length distribution, retransmission rate, number of collisions); and network layer indicators (access request frequency, data transmission packet size, session duration, protocol type distribution).

[0022] Standardized preprocessing operations are performed on the captured raw wireless signal indicator data to eliminate data defects and format heterogeneity issues: ① Data cleaning: Noise data caused by signal interference and equipment false alarms (such as signal strength values ​​exceeding reasonable range and frame data with disordered formats) are removed, and redundant records collected repeatedly are deleted (duplicates are removed using "timestamp + MAC address + indicator type" as the joint primary key); ② Format standardization: Unify the data encoding format (UTF-8), timestamp format (ISO8601, precision to milliseconds), and field naming rules (such as uniformly naming signal strength as "signal_strength_rssi"); ③ Normalization processing: Standardize indicator data of different magnitudes (such as transmission rate unit Mbps, signal strength unit dBm) to the [0, 1] interval or Z-score standard distribution to ensure data dimensionality consistency; ④ Data completion: Missing values ​​of key indicators are supplemented using statistical interpolation methods (such as mean and median filling), and finally a "standardized multi-source dataset" with a regular structure, clean data, and unified dimensions is formed, providing high-quality input for subsequent feature extraction.

[0023] Step S200: Based on the standardized multi-source dataset, feature engineering methods are applied to extract dimensional features. The dimensional features are then fused through statistical analysis and sequence modeling to determine the core feature vector.

[0024] Based on the standardized multi-source dataset generated in step S100, feature engineering methods are first applied to extract dimensional features. Differentiated extraction strategies are adopted for different types of signal indicators: ① Statistical feature extraction (such as mean, variance, maximum, minimum, quantile) to reflect the overall distribution characteristics of the indicators (such as the average transmission rate of a MAC address, the variance of frame length); ② Temporal feature extraction (such as sliding window statistics, trend slope, periodic features) to capture the changing patterns of indicators over time (such as the temporal fluctuation of access request frequency, the changing trend of signal strength); ③ Correlational feature extraction (such as the binding relationship between MAC address and access point, the correlation coefficient between frame type and transmission rate) to explore the intrinsic relationships between multiple indicators. The extracted high-dimensional features (avoiding the curse of dimensionality and redundant information interference) are fused through statistical analysis and sequence modeling: ① Statistical analysis (such as correlation analysis, principal component analysis (PCA), and factor analysis) removes highly correlated redundant features and selects key dimensions sensitive to attack behavior; ② Sequence modeling (such as recurrent neural networks (RNN) and temporal convolutional networks (TCN)) captures the temporal dependencies of features (such as the temporal feature patterns of attack behavior), transforming high-dimensional discrete features into low-dimensional, compact, structured feature representations. Finally, a "core feature vector" is output through feature fusion algorithms (such as weighted fusion, feature concatenation, and attention-based weighting). This core feature vector contains key feature dimensions of wireless communication behavior (such as access behavior features, signal transmission features, and session interaction features), accurately characterizing the differences between normal communication patterns and abnormal attack behavior, providing core feature support for subsequent attack identification.

[0025] Step S300: If the behavioral deviation in the core feature vector exceeds the threshold, anomaly labeling is triggered. The labeled core feature vector is then classified using an ensemble learning model to determine the known attack type.

[0026] First, a behavior deviation threshold is preset (based on the distribution range of feature vectors statistically analyzed from historical normal communication data, which can be dynamically adjusted according to the network environment, such as setting 3 times the standard deviation as the threshold boundary). Deviation detection is performed on the core feature vectors generated in step S200. If the behavior features in the feature vector (such as access frequency, frame length distribution, retransmission rate) exceed the preset threshold, it is determined to be a suspected abnormal behavior, and an abnormal marker is triggered (marking the abnormal feature dimension, deviation value, and occurrence timestamp). The labeled core feature vectors are input into a trained ensemble learning model (such as an ensemble model combining Random Forest, XGBoost, or LightGBM, or a hybrid ensemble model combining SVM (Support Vector Machine) and neural networks) for classification. This ensemble learning model is trained on a historical attack sample dataset (covering common WLAN attack types, such as brute-force attacks, man-in-the-middle attacks, ARP (Address Resolution Protocol) spoofing, DOS (Denial of Service) / DDOS (Distributed Denial of Service) attacks, and spoofed AP (Attack Power) attacks), and has the ability to accurately classify different attack types. The model outputs a "Known Attack Type Judgment Result" by matching the core feature vectors with a known attack feature library. This result includes core information such as attack type (labeled using a unified security attack coding system), attack confidence score (0-100 points, reflecting the reliability of the judgment), attacker's MAC address, attack behavior details, and attack occurrence time, enabling rapid identification and accurate classification of known attacks.

[0027] Step S400: Use an anomaly detection algorithm to perform clustering on the unlabeled core feature vectors, and perform pattern matching on isolated points in the clustering results to obtain the unknown attack pattern recognition result.

[0028] For the core feature vectors that were not marked as anomalies in step S300 (or did not match any known attack types after being marked), unsupervised anomaly detection algorithms (such as Isolation Forest, DBSCAN (Density-Based Spatial Clustering of Applications with Noise), Local Outlier Factor (LOF), Autoencoder (AE), etc.) are used to perform clustering operations. The unsupervised anomaly detection algorithm is based on the core logic that "normal communication behavior features are clustered, while attack behavior features are isolated." It clusters the feature vectors into multiple normal behavior clusters according to similarity and identifies isolated points in the clustering results (i.e., feature vectors that are significantly different from normal behavior patterns). Deep pattern matching is performed on the identified isolated points: ① Extract the feature patterns of the isolated points (such as unique access sequences, abnormal frame structures, and unconventional protocol interaction logic); ② Compare and correlate them with historical unknown attack sample libraries and network security vulnerability libraries to uncover the behavioral logic and potential attack intentions of the isolated points; ③ Verify the stability of the feature patterns (e.g., the same isolated point feature pattern appearing multiple times is judged as a potential attack pattern), and finally obtain the "unknown attack pattern identification result", which includes the feature pattern description of the unknown attack, the frequency of occurrence, the scope of impact, the risk level (low / medium / high), and the inference of the suspected attack principle, so as to realize the active detection and pattern capture of new unknown attacks.

[0029] Step S500: Obtain the identification results of known attack types and unknown attack patterns, and form a comprehensive threat assessment dataset through fusion; based on the comprehensive threat assessment dataset, adjust the device authentication parameters through a dynamic key allocation mechanism to obtain the updated key sequence.

[0030] First, the known attack type judgment results from step S300 and the unknown attack pattern identification results from step S400 are integrated, and a data fusion algorithm (such as weighted fusion, evidence theory DS fusion) is used to form a "comprehensive threat assessment dataset". This comprehensive threat assessment dataset contains full threat information: threat type (known / unknown), threat level (quantified based on attack severity, scope of impact, and destructive potential, such as level 1-5), threat occurrence time and duration, attack initiator information, threat feature vector, affected network nodes / terminals, etc., comprehensively reflecting the security status of the wireless LAN. Based on the comprehensive threat assessment dataset, a dynamic key allocation mechanism is initiated to adjust device authentication parameters: ① The key complexity is dynamically adjusted according to the threat level (e.g., a 256-bit AES key is used for high threat levels, and a 128-bit AES key is used for medium and low threat levels); ② The key update cycle is adjusted based on the access characteristics of the attacker (e.g., access point, access time period) (e.g., shortening the key update interval to the minute level for high-frequency attack periods); ③ The device authentication process is optimized (e.g., adding multi-factor authentication and dynamic access permission restrictions), generating an "updated key sequence"—this updated key sequence contains information such as key value, key validity period, applicable terminal range, and authentication verification rules to ensure the timeliness and security of the key.

[0031] Step S600: Combining the updated key sequence and edge computing resources, distributed distribution and real-time verification operations are implemented to encrypt and compare network access requests and determine the blocking instruction sequence.

[0032] By combining the updated key sequence from step S500 with network edge computing resources (such as edge gateways and distributed access point computing modules), distributed key distribution and real-time verification operations are achieved: ① The updated key sequence is quickly distributed to legitimate terminals and access devices within the network through edge computing nodes, avoiding delays and security risks caused by centralized distribution in the cloud; ② When a terminal initiates a network access request, the edge nodes verify the key legitimacy and authentication parameter matching degree of the access device in real time, and simultaneously perform encrypted comparison on the data packets of the access request (such as verifying the encrypted signature and data integrity check code of the data packets). Based on the verification and encryption comparison results, a "blocking instruction sequence" is generated: ① If the access device key is valid and the request data packet is normal, access to the network is allowed; ② If the key does not match, authentication fails, or the data packet shows signs of tampering or attack, a blocking instruction is triggered, which includes information such as the blocking target (MAC address and IP address of the attacker), the blocking method (temporary / permanent blocking, port blocking / full-link blocking), the blocking duration, and the alarm notification method. The blocking operation is executed in real time through the edge node to quickly intercept the attack.

[0033] Step S700: Iteratively train and update the attack feature library by using an incremental learning mechanism to train the blocking instruction sequence and historical evaluation dataset. Apply the updated attack feature library to the newly captured multi-source data to obtain an adaptive defense response strategy.

[0034] Incremental learning mechanism is initiated, and the blocking instruction sequence (including attack behavior characteristics and defense effect data) from step S600 and the historical threat assessment dataset are used as new training samples to iteratively train and update the attack feature library—① supplement the feature dimensions of known attack types and optimize the classification accuracy of the ensemble learning model; ② incorporate newly identified unknown attack patterns into the attack feature library and generate corresponding defense rules; ③ adjust the behavior bias threshold, clustering algorithm parameters, etc., to improve the model's sensitivity to new attacks. The updated attack signature database and optimized machine learning model are applied to newly captured multi-source wireless signal data (the standardized multi-source data set in step S100). Through a closed-loop process of "real-time monitoring - feature extraction - attack identification - threat assessment - defense execution", an "adaptive defense response strategy" is generated. This adaptive defense response strategy has the ability to dynamically adjust: it optimizes defense rules according to changes in network security situation (such as attack type upgrades and threat level changes), adjusts edge computing resource allocation according to terminal access scale, and updates key distribution mechanism according to attack mode evolution, so as to realize continuous self-optimization of the security defense system and always adapt to the dynamic security environment of wireless local area networks.

[0035] Furthermore, in the machine learning-based wireless local area network security method provided in this embodiment, step S100 includes: S110. By deploying distributed probes at nodes in the wireless communication network environment, wireless signal indicator data is captured. The wireless signal indicator data includes signal strength, signal-to-noise ratio, delay, jitter, and packet loss rate, thus obtaining raw signal indicator data.

[0036] When deploying distributed probes in wireless communication networks, these probes are installed on multiple base station nodes in a city to capture signal indicator data in real time. Assuming a 5G (5th Generation Mobile Networks) network environment, the probes are distributed in high-density user areas, such as around shopping malls. Each probe is equipped with a sensor to monitor signal strength, typically measured in dBm, for example, in the range of -50dBm to -100dBm; signal-to-noise ratio (SNR) is calculated by comparing the ratio of useful signal to background noise, typically above 10dB; latency represents the time difference between sending and receiving data packets, possibly in milliseconds; jitter is the variability of latency; and packet loss rate is the proportion of lost data packets. These indicators are collected by the probes' wireless receiving modules, forming a raw signal indicator data set for subsequent network optimization.

[0037] S120. Noise filtering is performed on the original signal index data according to the preset threshold. If the signal-to-noise ratio is lower than the preset threshold, interference samples are removed. The filtered signal index data is obtained by synchronizing the position coordinates and probe identifiers through the timestamp.

[0038] The signal-to-noise ratio (SNR) of the original signal is calculated using the following formula. If the calculated result is lower than a preset threshold, the interfering sample needs to be removed: (1) In formula (1), Indicates the signal-to-noise ratio. Indicates signal power. Indicates noise power.

[0039] The logic for noise filtering is described by the following formula: (2) In formula (2), This represents the filtered signal data. Represents the original signal data. Indicates time, This indicates the preset signal-to-noise ratio threshold.

[0040] The process of synchronizing location coordinates and probe identifiers via timestamps is described by the following formula: (3) In formula (3), This represents the synchronized data set. and Indicates position coordinates, Indicates probe identification. Represents a timestamp. Indicates a reference time.

[0041] When performing noise filtering, a preset threshold is first set, such as a signal-to-noise ratio (SNR) threshold of 5dB. If the collected samples are lower than this value, they are considered interfering samples and are removed to ensure data quality. Specifically, this process involves comparing the SNR value of each sample. If the SNR of a sample is 3dB, it will be filtered out. At the same time, the data is synchronized with the probe's location coordinates using timestamps. For example, the coordinates are in GPS (Global Positioning System) format such as (latitude, longitude), and are associated with the probe's unique identifier such as the device ID. This results in more spatiotemporal consistency in the filtered signal indicator data, which is helpful for analyzing network coverage blind spots.

[0042] S130. Use a normalization tool to process the frequency band, bandwidth, and data rate indicators of the filtered signal indicator data. If the value range of the frequency band, bandwidth, and data rate indicators exceeds the unified range, scale and adjust to obtain preliminary standardized signal indicator data.

[0043] The frequency band index is scaled to a uniform range of 0 to 1 using the following formula: (4) In formula (4), This represents the normalized frequency band index value. This represents the original frequency band index value. This represents the minimum value of the frequency band index. This indicates the maximum value of the frequency band index.

[0044] The bandwidth metric is processed using the Z-score standardization method according to the following formula: (5) In formula (5), This represents the standardized bandwidth value. This represents the original bandwidth index value. This represents the mean of the bandwidth metric. This represents the standard deviation of the bandwidth metric.

[0045] The data rate metric can be linearly scaled using the following formula: (6) In formula (6), This represents the data rate metric value after scaling adjustments. This represents the original data rate index value. A reference value indicating the data rate. Indicates the range of values ​​for the data rate. Indicates the scaling factor. This indicates the offset.

[0046] When using normalization tools, the Min-Max normalization method is employed to scale frequency band indicators, such as the range from 2.4 GHz to 5 GHz, to a uniform interval of 0 to 1; bandwidth values, such as those from 20 MHz to 100 MHz, are adjusted to standardized values ​​using a formula if they exceed a preset range; data rates, such as those from 100 Mbps to 1 Gbps, are also scaled. This processing ensures the comparability of different indicators, yielding preliminary standardized signal indicator data, thus facilitating multi-dimensional analysis.

[0047] S140. By integrating preliminary standardized signal indicator data and interference levels, and grouping multi-source indicators through K-means clustering, a standardized multi-source data set is obtained.

[0048] The following formula was used to achieve the fusion of preliminary standardized signal index data and interference levels: (7) In formula (7), Indicates the first The first sample The standardized signal value of each indicator, This represents the original multi-source indicator data. Indicates the first The average of the indicators, Indicates the first The standard deviation of each indicator Indicates the first The interference level coefficient of each indicator.

[0049] The following formula is used to achieve clustering of multi-source indicators by minimizing the sum of squared intra-cluster distances: (8) In formula (8), This represents the objective function of K-means clustering. Indicates the number of clusters. This represents the total number of data samples. Indicates the first The sample belongs to the first Indicator variables for each cluster, i represents the first A multi-source indicator vector, Indicates the first Cluster centers.

[0050] The following formula describes the structure of the standardized multi-source dataset formed after clustering: (9) In formula (9), This represents the final standardized multi-source dataset. Indicates the first A subset of data grouped into clusters, This represents the total number of cluster groups. This represents the standardized indicator data. This indicates the sample allocation indicator variable.

[0051] When integrating preliminary standardized signal index data with interference levels, the interference level is first quantified, for example, by interference power density. Then, the K-means clustering algorithm is applied to group the multi-source indicators. Specifically, K-means clustering involves selecting K initial centers, such as K=3 representing low, medium, and high interference groups; calculating the Euclidean distance from each data point to the center; and iteratively assigning the data until convergence. For example, after integrating signal strength and interference levels, clustering may divide the data into stable and fluctuating groups, resulting in a standardized multi-source data set. This can improve accuracy in network fault diagnosis and provide a more reliable basis for decision-making.

[0052] Furthermore, in the machine learning-based wireless local area network security method provided in this embodiment, step S200 includes: S210. Based on the standardized multi-source data set, statistical tools are used to calculate the peak values ​​for network coverage quality and user access density indicators. If the peak value exceeds the preset threshold, the high load feature is marked, and a preliminary dimensional feature set is obtained.

[0053] The peak value is determined by calculating the maximum of the mean coverage quality at all time points using the following formula: (10) In formula (10), The peak value representing network coverage quality. Represents a set of time windows. Indicates the number of covered areas. Indicates the first Each region at time The coverage quality indicators.

[0054] (11) In formula (11), Indicates the peak value of user access density. Indicates the total number of monitored areas. Indicates the first Number of users accessing each region Indicates the first The coverage area of ​​each region.

[0055] The high-load feature labeling results are obtained using the following formula: (12) In formula (12), This indicates the results of high-load feature labeling. This represents the peak value of the calculated index. This represents a preset threshold parameter. When the peak value exceeds the threshold, it is marked as 1 to indicate a high load characteristic; otherwise, it is marked as 0 to indicate a normal load.

[0056] When processing network coverage quality and user access density metrics using standardized multi-source datasets, statistical tools such as average and maximum value calculations are employed to identify peak values. Specifically, network coverage quality metrics, such as signal coverage, are first extracted from the dataset, typically ranging from 0 to 100%. Peak values ​​over a period are calculated using statistical tools, for example, coverage reaching 95% during peak hours. User access density is measured in users per square kilometer, such as 500 users / square kilometer during peak periods. Then, preset thresholds are set, such as a coverage quality threshold of 90% and an access density threshold of 400 users / square kilometer. If the calculated peak values ​​exceed these thresholds, they are marked as high-load characteristics. For example, if the coverage peak in a city center reaches 98% and exceeds the threshold, that area is marked as high-load, thus forming a preliminary dimensional feature set. This preliminary dimensional feature set is used in subsequent analyses to identify potential network bottleneck areas. Through this labeling, the preliminary dimensional feature set can integrate these high-load points, providing fundamental data support for network optimization.

[0057] S220. Based on the preliminary dimensional feature set, a sliding window tool is used to extract sequence trends for spectrum utilization and link stability indicators to obtain the time-series dimensional feature set.

[0058] The average trend of spectral efficiency is calculated using the following formula through a sliding window: (13) In formula (13), Indicates time The trend characteristics of spectrum utilization Indicates the size of the sliding window. Indicates the first The spectrum bandwidth already used at any given time Indicates the first The available spectrum bandwidth is always available.

[0059] Link stability is quantified by calculating the complement of the coefficient of variation using the following formula: (14) In formula (14), Indicates time Link stability metrics Indicates the timing window length. Indicates the first Link quality measurement at time 10:00 This represents the average link quality within the window.

[0060] The following formula, combining weighted average and exponential smoothing, is used to extract the trend features of the sequence: (15) In formula (15), Indicates time The temporal dimension feature values, Indicates the size of the feature extraction window. Indicates the first Weighting coefficients at time points, Indicates the first The original feature values ​​at time 1. This represents the smoothing factor.

[0061] When extracting the sequential trends of spectrum utilization and link stability indicators based on the initial dimensional feature set, a sliding window tool is used to process time series data. Specifically, the sliding window tool is a time series analysis method that captures trend changes by defining a fixed-size window, such as 30 minutes, and sliding it across the data stream. For example, spectrum utilization is expressed as a percentage. Data is selected from the initial dimensional feature set, and the average utilization within each window is calculated as the window slides. If it increases from 50% to 80%, an upward trend is extracted. Link stability indicators are evaluated through packet loss rate and retransmission rate. The window tool is also applied to these indicators to extract the sequential trend of decreasing stability. For example, a continuous window shows that the packet loss rate increases from 2% to 5%, thus obtaining a time-series dimensional feature set. This feature set captures dynamic changes and helps to understand the temporal patterns of network behavior.

[0062] S230. Based on the temporal dimension feature set and the preliminary dimension feature set, the correlation between the motion trajectory prediction and interference source localization indicators is determined by the correlation coefficient matrix. If the correlation coefficient between the temporal dimension feature set and the preliminary dimension feature set is higher than a preset threshold, similar dimensions are aggregated to obtain the fused dimension feature set.

[0063] The correlation coefficient between the time-series feature set and the initial feature set is obtained using the following formula: (16) In formula (16), This represents the correlation coefficient between the time-series feature set and the initial feature set. Represents the first time-series feature set The first feature One observation value, Represents the first dimension in the initial feature set. The first feature One observation value, Representing time series features The mean, Indicates preliminary characteristics The mean, This represents the total number of observed samples.

[0064] The fusion feature set is obtained through the following formula: (17) In formula (17), Represents the fusion dimension feature set, Represents the first feature in the time-series dimension feature set. One characteristic, Represents the first dimension in the initial feature set. One characteristic, Indicates the correlation coefficient between features. Indicates the preset threshold. Represents the time-series feature set. This represents the initial dimensional feature set.

[0065] When determining the correlation between motion trajectory prediction and interference source location indicators by combining the temporal dimension feature set and the preliminary dimension feature set, a correlation coefficient matrix is ​​used for calculation. Specifically, the correlation coefficient matrix is ​​a statistical tool used to quantify the linear relationship between variables. The calculation process involves standardizing variables, calculating the covariance, and dividing by the product of the standard deviations. For example, for motion trajectory prediction indicators such as user location sequences, the coefficient is calculated with high-load features in the preliminary dimension feature set. If the coefficient is 0.8, which is higher than the preset threshold of 0.7, it indicates a strong correlation. Similarly, for interference source location indicators such as interference coordinate points, the coefficient is calculated with trend data in the temporal dimension feature set. If the coefficient reaches 0.75, which is also higher than the threshold, these similar dimensions are aggregated to form a fused dimension feature set. This aggregation ensures the comprehensiveness of the features.

[0066] S240. Based on the fusion dimension feature set, principal component analysis is used to reduce the dimensionality of the load balancing factor and QoS parameter indicators to determine the core feature vector. The following formula describes the process of mapping high-dimensional features to a low-dimensional principal component space through linear transformation: (18) In formula (18), This represents the core feature vector after dimensionality reduction. Represents the principal component transformation matrix. Indicates transpose. Represents the original fused dimensional feature set. Represents the original feature dimension. Indicates the first The first original feature is related to the second The contribution weight of each principal component, Indicates the first One original feature value.

[0067] When processing load balancing factors and QoS (Quality of Service) parameters based on the fused dimensionality feature set, principal component analysis (PCA) is used for dimensionality reduction. Specifically, PCA is a dimensionality reduction technique that preserves key variations by calculating the covariance matrix of features and extracting principal component vectors. For example, load balancing factors such as resource allocation ratios and QoS parameters such as latency thresholds are input from the fused dimensionality feature set. The analysis tool calculates the first few principal component vectors, which represent core features. For instance, the first vector captures 80% of the variation, thus identifying the core feature vectors to simplify the data structure and support efficient network management decisions.

[0068] Preferably, the machine learning-based wireless local area network security method provided in this embodiment includes step S300 as follows: S310. Based on the core feature vector, use statistical tools to calculate the behavior deviation value. If the behavior deviation value exceeds the preset threshold, trigger an anomaly labeling and obtain the label feature set.

[0069] The following formula is used to quantify the degree of behavioral bias by calculating the Euclidean distance between the sample feature vector and the benchmark mean: (19) In formula (19), Indicates the first behavioral bias value for each sample This represents the number of dimensions of the core feature vector. Indicates the first The sample at the th The values ​​in each feature dimension Indicates the first The mean benchmark for each feature dimension.

[0070] The labeled feature set is obtained by the following formula: (20) In formula (20), Represents the set of labeled features. Indicates the sample index. Indicates the first Standardized deviation score of each sample Indicates the first The original bias statistic for each sample This represents the population mean of the deviation statistic. The population standard deviation represents the deviation statistic. This represents the critical threshold parameter for anomaly detection.

[0071] When processing behavioral deviations based on core feature vectors, statistical tools such as standard deviation calculation are used to quantify the deviation value. Specifically, core feature vectors typically contain vector representations of network performance metrics, such as average latency and data transmission rate. First, behavioral deviation metrics are extracted from the vectors. For example, the latency under normal behavior is 50 milliseconds, while the current observed value is 80 milliseconds. The deviation value is calculated using statistical tools, which is the observed value minus the mean and divided by the standard deviation. If the result is 2.5, exceeding the preset threshold of 2.0, an anomaly labeling is triggered, marking the vector as an anomaly, thus forming a labeled feature set. This labeled feature set is used in subsequent anomaly analysis to identify potential risks.

[0072] S320. Based on the tag feature set, use the correlation coefficient tool to determine the correlation between network traffic anomalies and user access behavior. If the correlation coefficient is higher than the preset threshold, aggregate similar attributes to obtain a fused tag set.

[0073] The correlation coefficient between abnormal network traffic and user access behavior is derived using the following formula: (twenty one) In formula (21), Representing network traffic characteristics and user behavior characteristics The correlation coefficient between them Indicates the first In the nth sample The value of each flow characteristic, Indicates the first In the nth sample The value of a user's behavioral characteristic Indicates the first The mean of each flow characteristic, Indicates the first The mean of each user's behavioral characteristics. This represents the total number of samples.

[0074] The aggregated set of similar attributes is obtained using the following formula: (twenty two) In formula (22), Indicates the first A set of aggregated similar attributes Indicates the first Each tag feature attribute, This indicates the correlation coefficient between this attribute and other attributes. This represents the preset correlation threshold. This represents the set of candidate attribute indices to be aggregated.

[0075] (twenty three) In formula (23), This represents the final set of fused tags. This indicates the total number of aggregate groups. Indicates the first The weighting coefficients of each aggregation group Indicates the first The number of elements in a set of similar attributes.

[0076] When determining the correlation between network traffic anomalies and user access behavior based on labeled feature sets, correlation coefficient tools such as the Pearson correlation coefficient are used to assess the linear relationship. Specifically, the Pearson correlation coefficient quantifies the strength of the correlation by calculating the product of the covariance of two variables and their respective standard deviations. For example, network traffic anomaly indicators are expressed as packets per second, such as 1000 packets / second during anomalies, while user access behavior indicators are measured by login frequency, such as 10 times per hour. These data are selected from the labeled feature set to calculate the coefficient. If the value is 0.85, which is higher than the preset threshold of 0.7, similar attributes are aggregated, such as considering traffic peaks and abnormal logins as the same category, forming a fused label set. This fusion helps to integrate multi-dimensional anomaly signals.

[0077] S330. Based on the fusion tag set, extract the sequence pattern using the sliding window tool for the spectral interference signal and load peak deviation to obtain the sequence tag set.

[0078] The sequence tag set is derived using the following formula: (twenty four) In formula (24), This represents the extracted set of sequence tags. Represents a sequence index. Indicates the total number of fused tag sets. Indicates the first The weight coefficients of each label, Represents the Dirac function, Indicates the first A sequence pattern, Indicates the first A fusion marker.

[0079] When extracting spectral interference signals and load peak deviation sequence patterns from a fused marker set, the sliding window tool is a time series processing method. It captures pattern changes by defining a time window, such as 1 hour, and sliding it across the data sequence. Specifically, the spectral interference signal is expressed in decibels of interference intensity. For example, when selecting data from the fused marker set, the average interference value for each window is calculated as the window slides. If it increases from -90dB to -70dB, an interference enhancement pattern is extracted. The load peak deviation is evaluated by the difference between the peak value and the mean. The window tool is applied to these deviation sequences; for example, a continuous window displays the deviation increasing from 10% to 30%, thus obtaining a sequence marker set. This sequence marker set captures dynamic pattern changes, supporting further attack detection.

[0080] S340. Based on the sequence label set, classify the label features using an ensemble learning model to determine the known attack types.

[0081] The most likely attack type is determined by maximizing the posterior probability using the following formula: (25) In formula (25), This indicates the type of attack determined in the final assessment. Represents the set of all possible attack types. The dimension of the feature vector. Indicates the first Each feature component Indicates the attack type Features observed under certain conditions The probability, Indicates the attack type The prior probability.

[0082] When using sequence label sets for classification, ensemble learning models such as random forests are an ensemble approach that improves classification accuracy by constructing multiple decision trees and voting on decisions. Specifically, random forests first randomly sample a subset from the sequence label set. Each decision tree is trained based on this subset. For example, tree node splitting is based on information gain for label features such as interference patterns and load bias. After multiple trees output, the majority vote is taken. If the classification result points to a DDoS attack type, it is determined to be a known attack. This ensemble mechanism for DDoS attack types reduces the risk of overfitting and can effectively identify complex attack patterns in cybersecurity operations, providing timely protection support.

[0083] Furthermore, in the machine learning-based wireless local area network security method provided in this embodiment, step S400 includes: S410. Based on the unlabeled core feature vector, perform clustering operations using density clustering tools to obtain an initial cluster set for network traffic density.

[0084] The density-based clustering conditions are defined by the following formula: (26) In formula (26), Indicates the first A cluster, Represents network traffic data points. Indicates the first The core set of each cluster The distance function represents the distance between data points. Indicates the neighborhood radius threshold. The density function representing the data points, This represents the minimum density threshold.

[0085] When processing network traffic density based on unlabeled core feature vectors, density clustering tools such as the DBSCAN algorithm are used to perform clustering operations. The core principle of this density clustering tool is to evaluate the local density of data points, forming clusters of high-density areas and treating low-density points as noise. Specifically, the DBSCAN algorithm requires setting two parameters: radius ε and minimum number of points MinPts. First, it selects network traffic density indicators from the core feature vectors, such as the number of packets per minute, as vector elements. For example, if a vector contains a traffic value of 1000 packets / minute, the algorithm scans the ε neighborhood of each data point. If the number of points in the neighborhood exceeds MinPts, such as 5, then the point is a core point, and the cluster is expanded. If the neighborhood of a point is less than MinPts but is close to a core point, it is assigned to that cluster; otherwise, it is marked as noise. In this way, multiple vectors are clustered to obtain initial cluster sets. These initial cluster sets reflect the aggregation of normal traffic patterns. For example, in an enterprise network environment, normal clusters may be concentrated in a density range of 500-800 packets / minute, while abnormally high densities such as 2000 packets / minute form isolated clusters or noise points. This clustering helps to initially separate potential anomalies and supports subsequent fine-grained analysis.

[0086] S420. Based on the initial cluster set, calculate the Euclidean distance between points within the cluster. If the distance exceeds a preset threshold, it is judged as an isolated outlier, and a set of isolated outliers is obtained.

[0087] The Euclidean distance between points within the initial cluster is obtained using the following formula: (27) In formula (27), Indicates the first in the cluster The point and the first Euclidean distance between points Indicates the first The point at the th Coordinates on the dimensional feature Indicates the first The point at the th Coordinates on the dimensional feature This indicates the number of feature dimensions for a data point.

[0088] The following formula is used to define the criteria for identifying isolated outliers: (28) In formula (28), Indicates the first An anomaly flag for each data point; a value of 1 indicates that the data point is an isolated outlier. Indicates containing the first Clusters of points, This indicates the preset distance threshold.

[0089] The set of isolated outliers is derived using the following formula: (29) In formula (29), This represents the set of isolated outliers detected. Indicates candidate outliers, Represents an element. Point and cluster intra-point Distance function between This represents the distance threshold parameter used to determine anomalies.

[0090] When calculating the distance between points within a cluster based on the initial cluster set, Euclidean distance is a commonly used metric. It quantifies similarity by calculating the straight-line distance between two points in a multi-dimensional space. The formula simplifies to the square root of the sum of the squares of the differences in each dimension, but we avoid complex calculations here and focus on the application process. In one implementation, for judging the distance between points within a cluster, if the Euclidean distance exceeds a preset threshold, such as 2.0, it is determined to be an isolated outlier, forming a set of isolated outliers. For example, in network security operations, the initial cluster may include multiple traffic vectors. Calculating the Euclidean distance between two points, such as one point having a flow rate of 600 packets / minute and a latency of 20ms, and another having a flow rate of 650 packets / minute and a latency of 22ms, with a distance of approximately 30.4, is considered normal within the cluster if it is less than the threshold. However, if a point has a flow rate of 1800 packets / minute and a latency of 100ms, and its distance from the cluster center is 1200.5, exceeding the threshold, it is marked as an isolated anomaly. These points often correspond to sudden traffic peaks, such as early signals of DDoS attacks. Collecting them into a set of isolated anomalies facilitates tracing the source of the anomaly. This method can effectively isolate noise and improve detection accuracy in actual operations.

[0091] S430. Based on the set of isolated anomalies, the user behavior trajectory is compared with a preset pattern library using a string matching tool to obtain a preliminary matching trajectory set.

[0092] The initial matching trajectory set is obtained using the following formula: (30) In formula (30), This indicates a preliminary matching trajectory set. Indicates the first User behavior trajectory This indicates the total number of patterns in the preset pattern library. This represents the similarity calculation function. Indicates the first A preset mode, This represents the matching threshold parameter.

[0093] When processing user behavior trajectories for isolated anomaly sets, string matching tools such as the Knuth-Morris-Pratt (KMP) algorithm are used to compare against a pre-defined pattern library. The KMP algorithm efficiently searches substrings by constructing a partial matching table, avoiding backtracking. In one implementation, the comparison process converts the user behavior trajectory into a string sequence. For example, the trajectory might include the action sequence "login-browse-download". The pre-defined pattern library stores known anomaly patterns such as "frequent login-abnormal query". The tool matches each character sequentially, and if a match is found, it is included in the initial matching trajectory set. In a banking network system, if a user's trajectory string is "login_attempt*5_query_sensitive_data", and it matches the pattern "login_attempt>3_query_sensitive" in the library, a matching trajectory set is generated. This helps to associate anomalies with behavioral patterns, enabling a more comprehensive risk assessment.

[0094] S440. Based on the preliminary matching trajectory set, the isolated forest algorithm is used to determine the unknown attack signature and obtain the unknown attack pattern recognition result.

[0095] The following formula is used to calculate the degree of anomaly in the attack trajectory: (31) In formula (31), Indicates sample In the isolated forest Abnormal scores in Indicates sample In an isolated tree Average path length in express The average path length normalization factor for constructing a binary search tree from samples.

[0096] When using the Isolation Forest algorithm to identify signatures of unknown attacks, this algorithm is an anomaly detection model that isolates anomalous points by randomly constructing isolation trees. The principle is that anomalous points are more easily isolated by shorter paths, while normal points require deeper tree structures. In one implementation, the Isolation Forest algorithm inputs a preliminary set of matched trajectories. It first randomly selects a subset of features to construct multiple trees, such as login frequency and query type within the trajectory set. The trees are recursively split until isolation points are reached, and the average path length for each point is calculated. If the average path length is below a threshold, such as 8, it is identified as an unknown attack signature. In practical applications, if a trajectory shows abnormally high login frequency combined with unauthorized access, the Isolation Forest algorithm outputs an anomaly score of 0.6, which is higher than the 0.5 threshold, identifying it as a new type of injection attack. This result allows network protection systems to update their signature databases in a timely manner, improving their response capabilities to zero-day attacks and thus reducing potential business losses.

[0097] Preferably, the machine learning-based wireless local area network security method provided in this embodiment includes step S500: S510. Obtain the recognition results of known attack types and unknown attack patterns, and use a feature splicing tool to merge the attack type vector and the unknown attack pattern vector to obtain a fused feature vector set.

[0098] The following formula describes the process of horizontally merging two different types of attack vectors using a feature concatenation tool: (32) In formula (32), Represents the fused feature vector set. This represents a vector of known attack types. Represents an unknown attack pattern vector. The first known attack type represents the... Each feature component The first one represents the unknown attack mode. Each feature component This represents the feature dimension of a known attack type. This represents the characteristic dimension of an unknown attack pattern.

[0099] When obtaining the results of known attack types and unknown attack patterns, it is first necessary to extract this data from the network security system. For example, known attack types may include SQL (Structured Query Language) injection or XSS (Cross-Site Scripting) attacks. These known attack types are usually represented in vector form, such as a vector containing dimensions such as attack frequency, source IP (Internet Protocol), and payload length. The results of unknown attack patterns come from previous anomaly detection processes and may identify new zero-day vulnerability exploitation patterns. The process of merging these vectors using feature splicing tools is essentially about directly connecting the dimensions of two vectors to form a higher-dimensional fused vector. For example, if the known attack vector is (5 times / minute, 192.168.1.1, 200 bytes) and the unknown pattern vector is (abnormally high-frequency access, unauthorized port scanning), splicing them together will result in a fused feature vector set of (5 times / minute, 192.168.1.1, 200 bytes, abnormally high-frequency access, unauthorized port scanning). This merging helps to integrate multi-source information. In enterprise network protection, it can link historical knowledge with emerging threats to form a more comprehensive threat profile, thereby supporting subsequent threat assessment.

[0100] S520. Based on the fused feature vector set, calculate the vector magnitude using a threshold comparison tool, and determine whether the vector magnitude exceeds a preset threshold. If the vector magnitude exceeds the preset threshold, it is judged as a high threat, and a high threat labeled dataset is obtained.

[0101] The following formula is used to define the criteria for determining a high threat level: (33) In formula (33), Indicates the threat labeling results. This represents the feature vector to be judged. This represents the vector magnitude of the feature vector to be judged. This represents the preset threat assessment threshold. When the vector magnitude exceeds the threshold, it is marked as 1, indicating a high threat; otherwise, it is marked as 0, indicating a low threat.

[0102] When calculating the vector magnitude based on the fused feature vector set, the threshold comparison tool first calculates the Euclidean norm of the vector, which is the square root of the sum of squares of each dimension. However, the focus here is on application rather than formula details. For example, in a bank network system, the fused vector might be (10, 150, 300, 0.8, 0.2), and the calculated magnitude is approximately 350.4. Then, it is compared with a preset threshold, such as 300. If it exceeds the threshold, it is marked as a high threat. The resulting high-threat labeled dataset contains vector sets of potentially serious risks. In actual business, this step can quickly filter out attack events that need to be prioritized for response, avoiding low-level threats from consuming resources.

[0103] S530. Based on the high-threat labeled dataset, an initial key seed is generated using a hash function to obtain the key seed sequence.

[0104] The key seed is generated by XORing the threat data with a random number and then applying a hash function using the following formula: (34) In formula (34), Indicates the first One key seed, Represents a hash function. This indicates the first [item] in the high-threat labeled dataset. One data sample, Represents the first random number in a sequence. One element, Indicates the bit length of the key seed.

[0105] The following formula is used to concatenate threat samples with their identifiers and then construct a key seed set through hash operations: (35) In formula (35), This represents the complete key seed sequence. This represents the total number of samples in the threat-labeled dataset. This refers to the SHA256 hash algorithm. Indicates the first One threat-labeled sample, This indicates the corresponding threat level identifier.

[0106] When generating the initial key seed based on the high-threat labeled dataset, hash functions such as SHA-256 are used to convert the vector elements in the dataset into fixed-length hash values. For example, inputting a vector labeled as high threat into the hash function will output a 256-bit hash string as the seed. This process ensures the uniqueness and security of the seed. In IoT device authentication, this helps to derive a dynamic key base from the threat data, thereby improving the system's resistance to tampering.

[0107] S540. Based on the key seed sequence, adjust the device authentication parameters using the key derivation tool to obtain the updated key sequence.

[0108] The updated key sequence is obtained using the following formula: (36) In formula (36), This represents the updated key sequence. This represents the key derivation function. Represents the key seed sequence. Indicates a random salt value. Indicates contextual information, Indicates the output key length.

[0109] The adjusted equipment certification parameters are derived using the following formula: (37) In formula (37), Indicates the device certification parameters. This represents the authentication parameter generation function. Indicates the device identifier. Represents a timestamp. Represents a random number. This represents the base key.

[0110] When adjusting device authentication parameters based on the key seed sequence, key derivation tools such as PBKDF2 (Password-Based Key Derivation Function 2) generate extended keys from the seed through iterative hashing and salting mechanisms. For example, in a smart home network, the seed is input into the key derivation tool, and authentication parameters, such as the session key length, are adjusted from 128 bits to 256 bits to obtain an updated key sequence. This strengthens encrypted communication between devices and reduces the risk of exploitation by unknown attacks. In one implementation, the logical connection of the entire process lies in constructing a comprehensive vector from feature concatenation, threshold judgment to filter high threats, hashing to generate the seed, and finally deriving the key, forming a closed loop from threat identification to security enhancement. For example, in a cloud service provider's system, this method can fuse detected DDoS attack types with unknown patterns, quickly update the authentication key after identifying a high threat, and thus protect the data center from intrusion in real-time deployment. Specifically, this fusion and judgment mechanism is particularly useful in complex network environments because it combines statically known attacks with dynamically unknown patterns, provides quantitative evidence through modulus comparison, and then hashing and derivation steps ensure the encryption strength of the response measures. In one embodiment, for traffic monitoring of e-commerce platforms, if the fusion vector modulus exceeds a threshold, the system will automatically generate a new key sequence to update API authentication and prevent further credential theft.

[0111] Furthermore, in the machine learning-based wireless local area network security method provided in this embodiment, step S600 includes: S610. Obtain the updated key sequence and edge computing resources, and use a distributed distribution tool to copy the updated key sequence to multiple edge nodes to obtain a distribution key set.

[0112] The distribution key set is derived using the following formula: (38) In formula (38), Indicates the distribution of key sets. Indicates the total number of target edge nodes. Indicates the first Key copies on each node Indicates the source key. Indicates the first One edge node, Indicates the dispatch function, This indicates that the distribution was successful.

[0113] When acquiring updated key sequences and edge computing resources, these elements are first extracted from the security management system. For example, the key sequence might be a set of strings generated by a dynamic algorithm for encrypted verification between devices, while edge computing resources include server nodes distributed at the network edge. These server nodes have local processing capabilities to reduce latency. Specifically, in a smart city monitoring system, the updated key sequence is obtained through a previous threat assessment process, such as a list containing 128-bit keys. Edge computing resources refer to micro data centers deployed near streetlights or cameras. The process of replicating the key sequence to these nodes using a distributed distribution tool such as a message queue system like Apache Kafka essentially involves packaging the key data into a message stream and pushing it to multiple nodes, ensuring that each node holds the same copy of the key. This results in a distributed key set, which serves to unify security standards at the network edge. In practical applications, this helps to quickly synchronize authentication information in high-traffic environments, avoiding centralized bottlenecks.

[0114] S620. Based on the distribution key set, a real-time verification tool is used to verify the signature of the network access request. If the signature verification passes, it is determined to be a valid request, and a list of valid requests is obtained.

[0115] The following formula is used to define the signature verification criteria for network access requests: (39) In formula (39), Indicates the first The verification result of each network access request. Indicates the use of a public key For the request The signature verification function performed Indicates a request The hash value is used to determine the validity of a request. If the signature verification passes, the result is 1, indicating a valid request; otherwise, it is 0, indicating an invalid request.

[0116] In the subsequent processing of the distributed key set, the process of using a real-time verification tool to verify the signature of network access requests requires understanding that a real-time verification tool is a software module based on digital signatures. It uses public key infrastructure to verify the integrity and origin of the request. If the signature matches, it passes. For example, in the user login scenario of an e-commerce platform, an access request carries a user ID and timestamp signed with a private key. The real-time verification tool will decrypt and compare it with the corresponding public key. If they match, it is marked as valid, thus forming a list of valid requests. This list is essentially a filtered request queue for further analysis.

[0117] S630. Based on the list of valid requests, the request characteristics of the list of valid requests are matched with the distribution key set using an encryption comparison tool. If the matching degree is lower than a preset threshold, it is judged as an abnormal access and an abnormal access record is obtained.

[0118] The cosine similarity between the request feature and the key set is calculated using the following formula: (40) In formula (40), Indicates the vector matching score. Indicates the first The feature vector of a valid request, Indicates the first A distribution key vector, The dot product of two vectors. It is the product of the magnitudes of the two vectors.

[0119] The following formula is used to define the conditions for judging abnormal access based on vector matching degree: (41) In formula (41), This indicates an abnormal detection result. This represents the preset anomaly detection threshold, based on the vector matching score. Below the preset anomaly detection threshold Outputting 1 indicates that an abnormal connection has been detected; otherwise, outputting 0 indicates that the connection is normal.

[0120] Based on the list of valid requests, when the request features are vector-matched with the distribution key set using an encryption comparison tool, the encryption comparison tool can be viewed as a framework for feature extraction and similarity calculation. It first converts request features such as IP address and access frequency into vector form, and then calculates the cosine similarity with the reference vector in the key set. If the similarity is lower than a threshold such as 0.5, it is judged as abnormal. For example, in a financial transaction network, the feature vector of a valid request might be (transaction amount 1000, source IP 10.0.0.1, time interval 5 seconds), while the key set vector represents the normal pattern (average amount 800, common IP range 10.0.0.0 / 24, interval 3-10 seconds). If the matching degree is 0.3 after calculation, it is recorded as an abnormal access. The resulting abnormal access record is a log set containing timestamps and abnormal details, used to track potential intrusions.

[0121] S640. Based on the abnormal access record, use the instruction generation tool to generate blocking instructions and obtain the blocking instruction sequence.

[0122] The following formula describes the process of generating a single blocking command based on an abnormal access record using a command generation tool: (42) In formula (42), Indicates the first A blocking command, This indicates a utility function for generating instructions. Indicates the first One abnormal access record, Indicates the threat level parameter, This represents the response strategy parameters.

[0123] The following formula combines all blocking instructions generated based on abnormal records into a complete instruction sequence set: (43) In formula (43), This represents the complete sequence of blocking instructions. This indicates the total number of abnormal access records.

[0124] When generating blocking commands based on abnormal access records using a command generation tool, this tool is an automated script engine that generates specific network commands based on the anomaly type in the records, such as blocking IPs or closing ports, resulting in a blocking command sequence. For example, in cloud storage services, if records show multiple abnormal matches, the command generation tool will generate a sequence like "block IP 10.0.0.1 for 24 hours." This blocking command sequence can be directly sent to firewall devices for immediate response. In one implementation, the entire process is seamlessly connected, from key distribution to verification and matching, and then to blocking, forming a continuous security protection chain. For example, in an industrial IoT environment, this method can use the distributed keys to verify sensor access requests, quickly generate blocking commands after anomaly matching, and maintain system stability.

[0125] Preferably, the machine learning-based wireless local area network security method provided in this embodiment includes step S700 as follows: S710. Based on the blocking instruction sequence and historical evaluation dataset, feature vectors are merged using a data fusion tool to obtain a fused training set.

[0126] The fused feature vector is obtained using the following formula: (44) In formula (44), This represents the fused feature vector. This represents the feature vector extracted from the blocking instruction sequence. This represents the feature vector extracted from the historical evaluation dataset. The weighting coefficient represents the characteristics of the blocking instruction and ranges from 0 to 1. The control logic of formula (44) is based on the weighting coefficient. To balance the contributions of "blocking instruction sequence characteristics" and "historical evaluation data characteristics".

[0127] The fused training set is obtained using the following formula: (45) In formula (45), Indicates the fusion of training sets, This indicates the total number of data sources participating in the integration. Indicates the first The fusion weight of each data source Indicates the first Feature transformation function of each data source Indicates the first The original feature set of multiple data sources. The control logic of formula (45) is to construct a fused training set by weighted combination of features from multiple data sources.

[0128] The process of merging feature vectors from blocking command sequences and historical evaluation datasets to obtain a fused training set can be understood as a data integration mechanism. The data fusion tool is a dedicated software module responsible for transforming data from different sources into a unified vector representation. Specifically, the blocking command sequence includes a series of network commands, such as instructions to block specific IP addresses, while the historical evaluation dataset contains records of past attack events. For example, in enterprise network security systems, these datasets record the IP addresses, timestamps, and behavioral patterns of abnormal access. The fusion tool first extracts features from these elements, such as converting IP blocking information from the command sequence into vector form (e.g., 192.168.1.1, blocking duration 24 hours), and simultaneously extracts evaluation features from the historical dataset, such as attack frequency vectors (5 times per hour). Then, these vectors are merged using weighted averaging or principal component analysis to generate the fused training set. This set serves to provide a more comprehensive training data foundation, ensuring that subsequent learning processes can capture multi-dimensional attack patterns. For example, the formation of the fused training set involves combining abnormal commands from the blocking command sequence with abnormal records from the historical evaluation dataset; the fusion tool calculates the Euclidean distance between the vectors for fusion.

[0129] S720. Based on the fused training set, the preset attack feature library is iteratively trained using an incremental learning algorithm. If the training convergence is higher than the preset threshold, a preliminary attack feature library is obtained.

[0130] The following formula describes how new features are added to a pre-defined feature library through incremental learning: (46) In formula (46), This indicates the updated attack signature database. This indicates a pre-defined attack signature database. Indicates the first [item] extracted from the fusion training set. One candidate feature, Representation of features In fused datasets Importance rating on The threshold for feature selection is indicated. The control logic of formula (46) is to filter important new features and update the feature library.

[0131] Based on the fused training set, an incremental learning algorithm is used to iteratively train a pre-defined attack feature library. If the training convergence exceeds a pre-defined threshold, a preliminary attack feature library is obtained. Incremental learning is an online learning method, such as incremental support vector machines, which allows the model to be updated progressively without retraining on all data. The pre-defined attack feature library is an initial database storing traffic peak features of common attack patterns, such as DDoS attacks. The training process involves inputting the fused training set into the algorithm and updating the model parameters in each iteration, for example, by adjusting weights through gradient descent, until convergence, i.e., the stability of the loss function, exceeds a threshold of 0.9, thus forming the preliminary attack feature library. This library contains optimized feature descriptions to improve detection accuracy. For example, in the security maintenance of financial trading platforms, the incremental learning algorithm iteratively trains the pre-defined library based on the fused training set. The initial library contains abnormal transaction amount features of fraudulent transactions. New vectors, such as abnormal transaction intervals, are gradually added during training. If the convergence reaches 0.95 after 10 iterations, a preliminary library containing more accurate fraud patterns is output.

[0132] S730. Based on the preliminary attack feature library, compare the historical verification samples with the feature verification tool. If the matching degree between the preliminary attack feature library and the historical verification samples is higher than the preset threshold, then determine to update the attack feature library.

[0133] The matching degree between the initial attack feature library and historical verification samples is obtained using the following formula: (47) In formula (47), This indicates the overall matching degree between the initial attack signature database and historical verification samples. This represents the total number of validation samples. Indicates the first A preliminary attack characteristic, Indicates the first Features of historical verification samples Indicates the size of the feature intersection. This indicates the size of the feature union. The control logic of formula (47) is to calculate the average Jaccard similarity of the "feature intersection / union" to measure the matching degree.

[0134] Based on the initial attack feature library, historical verification samples are compared using a feature verification tool. If the match between the initial attack feature library and the historical verification samples is higher than a preset threshold, the attack feature library is updated. The feature verification tool is a verification module that uses similarity calculations such as the Jaccard index for comparison. Historical verification samples are sets of known correct attack samples, such as those containing previously confirmed intrusion events. The comparison process involves calculating the match between features in the library and samples. If the average match is higher than 0.8, the update is confirmed, generating a more reliable attack feature library.

[0135] S740. Based on the updated attack signature database, a response generation tool is used to perform pattern matching on the newly captured multi-source data to obtain an adaptive defense response strategy.

[0136] The following formula describes the update mechanism of the attack feature library: only new features with a similarity lower than a threshold to the initial attack feature library will be added to the attack feature library: (48) In formula (48), This indicates the updated attack signature database. This indicates the existing attack signature database. Indicates the first extracted from the new data One attack characteristic, This represents the newly captured attack dataset. The function represents the calculation of feature similarity. This represents the similarity threshold. The control logic of formula (48) is to filter "new features with low similarity" to update the feature library.

[0137] The optimal adaptive defense response strategy is selected through multi-objective optimization using the following formula: (49) In formula (49), This indicates an adaptive defense response strategy. This represents the set of all available response strategies. Indicate response strategy The effectiveness assessment value, Indicates the implementation of a response strategy The cost, Indicates response strategy Historical success rate, , , These represent the weighting coefficients for effectiveness, cost, and historical success rate, respectively. The control logic of formula (49) selects the optimal defense strategy through a weighted multi-objective function.

[0138] Based on the updated attack signature database, a response generation tool is used to perform pattern matching on newly captured multi-source data to obtain an adaptive defense response strategy. The response generation tool is an automated engine that uses rule matching or neural networks to generate responses. For newly captured multi-source data such as real-time logs and sensor inputs, the matching process compares data features with patterns in the database, for example, calculating similarity. If a match is found, a response such as an alert or isolation command is generated, thus achieving adaptive defense.

[0139] Please see Figure 2 This embodiment provides a machine learning-based wireless LAN security system for executing the aforementioned machine learning-based wireless LAN security method. It includes a standardized multi-source data set acquisition module 10, a core feature vector determination module 20, a known attack type judgment module 30, an unknown attack pattern identification result acquisition module 40, an update key sequence acquisition module 50, a blocking instruction sequence determination module 60, and an adaptive defense response strategy acquisition module 70. The standardized multi-source data set acquisition module 10 captures wireless signal indicator data using distributed probes deployed in the wireless communication network environment, preprocesses the captured wireless signal indicator data to obtain a standardized multi-source data set. The core feature vector determination module 20 extracts dimensional features from the standardized multi-source data set using feature engineering methods, fuses the dimensional features through statistical analysis and sequence modeling, and determines the core feature vector. The known attack type judgment module 30 triggers anomaly marking if the behavioral deviation in the core feature vector exceeds a threshold, and then uses ensemble learning... The model classifies the labeled core feature vectors to determine known attack types. The unknown attack pattern identification result acquisition module 40 uses an anomaly detection algorithm to perform clustering operations on unlabeled core feature vectors, and performs pattern matching on isolated points in the clustering results to obtain unknown attack pattern identification results. The updated key sequence acquisition module 50 acquires the known attack types and unknown attack pattern identification results, and forms a comprehensive threat assessment dataset through fusion. Based on the comprehensive threat assessment dataset, the device authentication parameters are adjusted through a dynamic key allocation mechanism to obtain an updated key sequence. The blocking instruction sequence determination module 60 combines the updated key sequence and edge computing resources to achieve distributed distribution and real-time verification operations, encrypts and compares network access requests, and determines the blocking instruction sequence. The adaptive defense response strategy acquisition module 70 uses an incremental learning mechanism to iteratively train and update the attack feature library based on the blocking instruction sequence and historical assessment dataset, and applies the updated attack feature library to newly captured multi-source data to obtain an adaptive defense response strategy.

[0140] The machine learning-based wireless LAN security method and system provided in this embodiment, compared with existing technologies, preprocesses multi-source data, extracts core feature vectors, combines statistical analysis and sequence modeling to determine abnormal behavior, and utilizes ensemble learning and anomaly detection algorithms to accurately identify known attack types and unknown attack patterns, respectively. Subsequently, by fusing threat assessment datasets, the key sequence is dynamically adjusted, and edge computing resources are used to achieve encryption comparison and blocking command generation. Finally, the attack feature database is updated through incremental learning to form an adaptive defense mechanism. The most prominent innovation of this embodiment lies in the seamless integration of multi-source data analysis, dynamic key allocation, and real-time defense response, significantly improving the security and anti-attack capabilities of wireless networks and providing an efficient and flexible protection method for complex network environments.

[0141] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A machine learning-based wireless local area network security method, characterized in that, Includes the following steps: S100. Wireless signal indicator data is captured by distributed probes deployed in the wireless communication network environment. The captured wireless signal indicator data is preprocessed to obtain a standardized multi-source data set. S200. Based on the standardized multi-source data set, feature engineering methods are applied to extract dimensional features, and the dimensional features are fused through statistical analysis and sequence modeling to determine the core feature vector; S300. If the behavioral deviation in the core feature vector exceeds the threshold, an anomaly marking is triggered. The marked core feature vector is then classified using an ensemble learning model to determine the known attack type. S400: An anomaly detection algorithm is used to perform clustering operations on unlabeled core feature vectors, and pattern matching is performed on isolated points in the clustering results to obtain unknown attack pattern recognition results. S500: Obtain the identification results of the known attack types and the unknown attack patterns, and form a comprehensive threat assessment dataset through fusion; adjust the device authentication parameters according to the comprehensive threat assessment dataset through a dynamic key allocation mechanism to obtain an updated key sequence; S600 combines the updated key sequence and edge computing resources to achieve distributed distribution and real-time verification operations, encrypts and compares network access requests, and determines the blocking instruction sequence; S700: The attack feature library is iteratively trained and updated using an incremental learning mechanism on the blocking instruction sequence and historical evaluation dataset. The updated attack feature library is then applied to newly captured multi-source data to obtain an adaptive defense response strategy.

2. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S100 includes: S110. By deploying distributed probes at nodes in the wireless communication network environment, wireless signal indicator data is captured. The wireless signal indicator data includes signal strength, signal-to-noise ratio, delay, jitter, and packet loss rate, to obtain raw signal indicator data. S120. Noise filtering is performed on the original signal index data according to the preset threshold. If the signal-to-noise ratio is lower than the preset threshold, interference samples are removed. The filtered signal index data is obtained by synchronizing the position coordinates and probe identifiers through the timestamp. S130. The frequency band, bandwidth and data rate indicators of the filtered signal indicator data are processed using a normalization tool. If the value range of the frequency band, bandwidth and data rate indicators exceeds the unified range, they are scaled and adjusted to obtain preliminary standardized signal indicator data. S140. Integrate the preliminary standardized signal index data and interference level, and group the multi-source indexes by K-means clustering to obtain a standardized multi-source data set.

3. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S200 includes: S210. Based on the standardized multi-source data set, statistical tools are used to calculate the peak values ​​of network coverage quality and user access density indicators. If the peak value exceeds a preset threshold, high load features are marked to obtain a preliminary dimensional feature set. S220. Based on the preliminary dimensional feature set, a sliding window tool is used to extract sequence trends for spectrum utilization and link stability indicators to obtain a time-series dimensional feature set. S230. Based on the temporal dimension feature set and the preliminary dimension feature set, the correlation between the motion trajectory prediction and interference source localization indicators is determined by the correlation coefficient matrix. If the correlation coefficient between the temporal dimension feature set and the preliminary dimension feature set is higher than a preset threshold, similar dimensions are aggregated to obtain a fused dimension feature set. S240. Based on the fusion dimension feature set, principal component analysis is used to reduce the dimensionality of the load balancing factor and QoS parameter indicators to determine the core feature vector.

4. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S300 includes: S310. Based on the core feature vector, a statistical tool is used to calculate the behavior deviation value for the behavior deviation. If the behavior deviation value exceeds a preset threshold, an anomaly labeling is triggered to obtain a labeling feature set. S320. Based on the labeled feature set, a correlation coefficient tool is used to determine the correlation between abnormal network traffic and user access behavior. If the correlation coefficient is higher than a preset threshold, similar attributes are aggregated to obtain a fused label set. S330. Based on the fusion tag set, extract the sequence pattern using a sliding window tool for the spectral interference signal and load peak deviation to obtain the sequence tag set; S340. Based on the sequence tag set, the tag features are classified using an ensemble learning model to determine the known attack types.

5. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S400 includes: S410. Based on the unlabeled core feature vectors, perform clustering operations using density clustering tools to obtain an initial cluster set for network traffic density; S420. Based on the initial cluster set, calculate the Euclidean distance between points within the cluster. If the distance exceeds a preset threshold, it is determined to be an isolated outlier, and a set of isolated outliers is obtained. S430. Based on the isolated anomaly point set, a preliminary matching trajectory set is obtained by comparing the user behavior trajectory with a preset pattern library using a string matching tool. S440. Based on the preliminary matching trajectory set, the isolated forest algorithm is used to determine the unknown attack signature and obtain the unknown attack pattern identification result.

6. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S500 includes: S510. Obtain the recognition results of known attack types and unknown attack patterns, and use a feature splicing tool to merge the attack type vector and the unknown attack pattern vector to obtain a fused feature vector set. S520. Based on the fused feature vector set, the vector magnitude is calculated using a threshold comparison tool. It is determined whether the vector magnitude exceeds a preset threshold. If the vector magnitude exceeds the preset threshold, it is determined to be a high threat, and a high threat labeled dataset is obtained. S530. Based on the high-threat labeled dataset, an initial key seed is generated using a hash function to obtain a key seed sequence; S540. Based on the key seed sequence, the device authentication parameters are adjusted using a key derivation tool to obtain an updated key sequence.

7. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S600 includes: S610. Obtain the updated key sequence and edge computing resources, and use a distributed distribution tool to copy the updated key sequence to multiple edge nodes to obtain a distribution key set; S620. Based on the distribution key set, a real-time verification tool is used to perform signature verification on the network access request. If the signature verification passes, it is determined to be a valid request, and a list of valid requests is obtained. S630. Based on the valid request list, the request features of the valid request list are vector-matched with the distribution key set using an encryption comparison tool. If the matching degree is lower than a preset threshold, it is determined to be an abnormal access, and an abnormal access record is obtained. S640. Based on the abnormal access record, a blocking instruction is generated using an instruction generation tool to obtain a blocking instruction sequence.

8. The wireless local area network security method based on machine learning according to claim 1, characterized in that, Step S700 includes: S710. Based on the blocking instruction sequence and historical evaluation dataset, feature vectors are merged using a data fusion tool to obtain a fused training set; The fused feature vector is obtained using the following formula: in, This represents the fused feature vector. This represents the feature vector extracted from the blocking instruction sequence. This represents the feature vector extracted from the historical evaluation dataset. The weighting coefficient represents the characteristics of the blocking instruction, and its value ranges from 0 to 1; The fused training set is obtained using the following formula: in, Indicates the fusion of training sets, This indicates the total number of data sources participating in the integration. Indicates the first The fusion weight of each data source Indicates the first Feature transformation function of each data source Indicates the first The original feature set of each data source; S720. Based on the fused training set, the preset attack feature library is iteratively trained using an incremental learning algorithm. If the training convergence is higher than the preset threshold, a preliminary attack feature library is obtained. S730. Based on the preliminary attack feature library, compare the historical verification samples with the feature verification tool. If the matching degree between the preliminary attack feature library and the historical verification samples is higher than a preset threshold, then determine to update the attack feature library. S740. Based on the updated attack signature database, a response generation tool is used to perform pattern matching on the newly captured multi-source data to obtain an adaptive defense response strategy.

9. The wireless local area network security method based on machine learning according to claim 8, characterized in that, In step S720, the following formula describes how to add new features to the preset feature library through incremental learning: in, This indicates the updated attack signature database. This indicates a pre-defined attack signature database. Indicates the first [item] extracted from the fusion training set. One candidate feature, Representation of features In fused datasets Importance rating on This represents the threshold for feature selection.

10. A machine learning-based wireless local area network (WLAN) security system, used to execute the machine learning-based WLAN security method as described in any one of claims 1 to 9, characterized in that, include: The standardized multi-source data set acquisition module (10) is used to capture wireless signal indicator data through distributed probes deployed in the wireless communication network environment, and to perform preprocessing operations on the captured wireless signal indicator data to obtain a standardized multi-source data set. The core feature vector determination module (20) is used to extract dimensional features by applying feature engineering methods based on the standardized multi-source data set, and to determine the core feature vector by fusing the dimensional features through statistical analysis and sequence modeling. The known attack type judgment module (30) is used to trigger anomaly marking if the behavior deviation in the core feature vector exceeds the threshold, and to classify the marked core feature vector through the ensemble learning model to determine the known attack type. The unknown attack pattern recognition result acquisition module (40) is used to perform clustering operation on the unlabeled core feature vector using an anomaly detection algorithm, perform pattern matching on isolated points in the clustering result, and obtain the unknown attack pattern recognition result. The key sequence acquisition module (50) is used to acquire the identification results of the known attack type and the unknown attack pattern, and form a comprehensive threat assessment dataset through fusion; based on the comprehensive threat assessment dataset, the device authentication parameters are adjusted through a dynamic key allocation mechanism to obtain the updated key sequence; The blocking instruction sequence determination module (60) is used to combine the updated key sequence and edge computing resources to realize distributed distribution and real-time verification operations, encrypt and compare network access requests, and determine the blocking instruction sequence; The adaptive defense response strategy acquisition module (70) is used to iteratively train and update the attack feature library by using an incremental learning mechanism to train the blocking instruction sequence and historical evaluation dataset, and apply the updated attack feature library to newly captured multi-source data to obtain an adaptive defense response strategy.

Images