A network security situation assessment method and system based on deep learning

Abstract

A deep learning-based method and system for cybersecurity situation assessment, relating to the field of deep learning technology, is proposed to improve the accuracy of cybersecurity situation assessment. In this method, the cybersecurity situation assessment system automatically learns and weights input feature vectors through a multi-head attention mechanism. This allows the system to dynamically focus on the most relevant feature dimensions for different cyberattack categories, suppressing interference from irrelevant noise data. Subsequently, a two-stage one-dimensional convolutional network is used to deeply extract and abstract the weighted feature vectors, ultimately obtaining more accurate attack category identification results. Finally, a cybersecurity situation assessment value is calculated, thus overcoming the shortcomings of traditional methods that rely on expert experience for feature selection and that indiscriminate processing of all features leads to the dilution of core information, thereby improving the accuracy of cybersecurity situation assessment.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and in particular to a method and system for assessing network security situation based on deep learning. Background Technology

[0002] As networks continue to expand in scale and become more complex, network security situation assessment has gradually become a core means of maintaining network system security and conducting proactive defense.

[0003] To automate the analysis of massive amounts of cybersecurity data, related technologies typically employ deep neural network-based methods (such as convolutional neural networks) for cybersecurity posture assessment. Specifically, real-time cybersecurity data is first used as input layer data, and multiple convolutional kernels or fully connected layers within the network are used to uniformly extract features and compress information from the input vector. During the multi-classification training phase of the model, the technology typically uses a cross-entropy loss function to guide classification learning for different network states. Backpropagation is used to continuously update the network weight matrix based on the overall error between various real samples and prediction results, ultimately constructing a non-linear mapping relationship between the input feature set and multiple cyberattack categories. This results in the output classification and identification results, and the corresponding cybersecurity posture assessment value is calculated.

[0004] However, because the related technologies use a uniform convolutional structure to map features, the model will passively apply equal computational processing to security features across all dimensions. This results in core feature variables that are highly correlated with specific local attack categories being diluted by a large amount of irrelevant network noise data, reducing the accuracy of network security situation assessment. Summary of the Invention

[0005] This application provides a deep learning-based method and system for network security situation assessment, which can improve the accuracy of network security situation assessment.

[0006] Firstly, a deep learning-based network security situation assessment method is provided, characterized by its application in a network security situation assessment system. The method includes: standardizing and normalizing network connection record data within a preset time period to obtain an input feature vector with multi-dimensional features; using a preset scaling dot product function to calculate in parallel the correlation between the multi-dimensional features of the input feature vector and each preset network attack category, obtaining a multi-head attention weight matrix, whereby the multi-head attention weight matrix characterizes the degree of influence of different dimensional features on the corresponding network attack category; weighting the input feature vector according to the multi-head attention weight matrix to obtain multiple attention-weighted feature vectors corresponding to each preset network attack category; and then combining the multiple attention... The force-weighted feature vectors are arranged row-wise to obtain a two-dimensional feature matrix. The two-dimensional feature matrix undergoes a first-stage parallel multi-kernel one-dimensional convolution and max-pooling process. While ensuring the number of rows in the convolutional two-dimensional feature matrix matches the number of network attack categories, the multiple feature sequences obtained after pooling are concatenated column-wise to form an intermediate two-dimensional vector. This intermediate two-dimensional vector undergoes a second-stage single-kernel one-dimensional convolution and max-pooling process to obtain a dimension-reduced and compressed feature vector. The feature vector is then input into a fully connected computation layer to perform normalization exponentiation, yielding the network attack category identification result corresponding to the input feature vector. Based on the preset situation quantification impact value corresponding to each preset network attack category and the network attack category identification result, a network security situation assessment value for a preset time period is calculated.

[0007] By adopting the above technical solution, the network security situation assessment system automatically learns and weights the input feature vector through a multi-head attention mechanism. This allows the system to dynamically focus on the most relevant feature dimensions for different network attack categories, suppressing interference from irrelevant noise data. Subsequently, a two-stage one-dimensional convolutional network is used to deeply extract and abstract the weighted feature vector, ultimately obtaining more accurate attack category identification results. Based on the preset situation quantification impact values ​​corresponding to each preset network attack category and the network attack category identification results, the system calculates the network security situation assessment value within a preset time period. This overcomes the shortcomings of traditional methods that rely on expert experience for feature selection and that indiscriminate processing of all features leads to the dilution of core information, thereby improving the accuracy of network security situation assessment.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the step of using a preset scaling dot product function to calculate the correlation between the multidimensional feature attributes of the input feature vector and each preset network attack category in parallel to obtain a multi-head attention weight matrix specifically includes: representing the input feature vector as feature key-value pairs consisting of feature name and feature value; constructing parallel attention pooling modules for each preset network attack category; in each attention pooling module, using a preset scaling dot product function to calculate the correlation between the multidimensional feature attributes of the input feature vector and the corresponding network attack category; normalizing the correlation to obtain the attention weight coefficients corresponding to each feature attribute; and concatenating the attention weight coefficients output by each attention pooling module according to the number of preset network attack categories to obtain a multi-head attention weight matrix.

[0009] By adopting the above technical solution, the complex attention weight calculation process is decomposed into steps such as building a parallel attention pooling module, calculating the correlation between each module, normalization, and splicing. This enables the network security situation assessment system to generate exclusive feature attention weights for each attack category in parallel and independently, thereby improving the efficiency and accuracy of feature selection.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, a preset scaling dot product function is included, specifically: ,in, To preset network attack categories, For feature name, The correlation between the multidimensional feature attributes of the input feature vector and the preset network attack category. Represents the dimension of the feature vector.

[0011] By adopting the above technical solution, the scaling factor in the scaling dot product function is preset. The application of this method can effectively control the variance of the dot product result, prevent gradient vanishing or exploding problems in deep network training, thereby enhancing the stability and convergence of model training and allowing the advantages of deep models to be fully utilized.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of weighting the input feature vector according to the multi-head attention weight matrix to obtain multiple attention-weighted feature vectors corresponding to each preset network attack category specifically includes: weighting and summing each feature value in the feature key-value pair with the corresponding attention weight coefficient to obtain the attention head vector corresponding to each preset network attack category; concatenating the attention head vectors corresponding to each preset network attack category and performing linear transformation processing using a linear transformation parameter vector to obtain multiple attention-weighted feature vectors.

[0013] By adopting the above technical solution, attention head vectors corresponding to each attack category are first generated, and then concatenated and linearly transformed. This allows for a better combination of different head information through learnable linear transformation, resulting in a final attention-weighted feature vector that integrates information from multiple subspaces and has stronger expressive power.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, the steps of performing a first-stage parallel multi-kernel one-dimensional convolution and max pooling processing on the two-dimensional feature matrix specifically include: configuring multiple one-dimensional convolution kernels with the same number as the preset number of network attack categories, and matching the sliding stride of each one-dimensional convolution kernel with the row vector length of the two-dimensional feature matrix; extracting local features from the corresponding row vectors in the two-dimensional feature matrix according to each one-dimensional convolution kernel to obtain multiple preliminary feature sequences; and performing downsampling on each preliminary feature sequence through max pooling to obtain multiple pooled feature sequences.

[0015] By employing the above technical solution, multiple one-dimensional convolutional kernels, the same number as the number of attack categories, are used for parallel processing. This allows each convolutional kernel to focus on extracting local patterns from the attention-weighted feature vectors of its corresponding attack category. Compared to traditional uniform convolution, this approach can capture deeper features related to specific attacks more precisely and specifically, further enhancing the model's ability to identify different attack types and improving classification accuracy.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the step of calculating the network security situation assessment value within a preset time period based on the preset situation quantification impact value corresponding to each preset network attack category and the network attack category identification result specifically includes: based on the network attack category identification result corresponding to all network connection record data within the preset time period, counting the number of sample occurrences of each preset network attack category and the total number of network connection records within the preset time period; calculating the network security situation assessment value within the preset time period based on the preset situation quantification impact value, the number of sample occurrences of each preset network attack category, the total number of network connection records, the number of normal sample occurrences within the preset time period, and the preset network security situation quantification function.

[0017] By adopting the above technical solution, statistical analysis of various attack events within a preset time period is conducted, and the statistical results are combined with preset impact values ​​for quantitative calculation. This allows the final situation assessment value to not only reflect the occurrence of the attack but also quantify its potential harm.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, a preset network security posture quantification function is included, specifically including: ,in, This is a cybersecurity posture assessment value. This represents the total number of network connection records within a preset time period. This represents the number of times a normal sample appears. To pre-determine the impact value of the situation quantification, , The number of times samples appeared for each type of network attack. , This is the preset total number of network attack categories.

[0019] By adopting the above technical solution, a pre-defined network security situation quantification function incorporates the proportional relationship between the number of attack samples of each category and the total number of abnormal samples, thereby overcoming the shortcomings of traditional quantification methods that only consider attack types while ignoring attack frequency and intensity. This function can more realistically reflect the actual threat composition currently faced by the network. For example, even if there is only one type of attack, if its frequency is extremely high, the situation value will increase accordingly, thus enabling the final network security situation assessment value to more accurately reflect the true impact of the attack.

[0020] Secondly, embodiments of this application provide a network security situation assessment system, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is used to store computer program code, which includes computer instructions, and the one or more processors call the computer instructions to cause the network security situation assessment system to perform the method described in the first aspect and any possible implementation thereof.

[0021] Thirdly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on a network security situation assessment system, cause the network security situation assessment system to execute the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a network security situation assessment system, cause the network security situation assessment system to perform the method described in the first aspect and any possible implementation thereof.

[0023] Understandably, the network security situation assessment system provided in the second aspect, the computer program product provided in the third aspect, and the computer storage medium provided in the fourth aspect are all used to execute the methods provided in the embodiments of this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0024] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0025] 1. The network security situation assessment system automatically learns and weights input feature vectors through a multi-head attention mechanism. This allows the system to dynamically focus on the most relevant feature dimensions for different network attack categories, suppressing interference from irrelevant noise data. Subsequently, a two-stage one-dimensional convolutional network is used to deeply extract and abstract the weighted feature vectors, ultimately obtaining more accurate attack category identification results. Based on the preset situation quantification impact values ​​corresponding to each preset network attack category and the network attack category identification results, the system calculates the network security situation assessment value within a preset time period. This overcomes the shortcomings of traditional methods that rely on expert experience for feature selection and that indiscriminate processing of all features leads to the dilution of core information, thereby improving the accuracy of network security situation assessment.

[0026] 2. Parallel processing is achieved using multiple one-dimensional convolutional kernels, the same number as the number of attack categories. This allows each kernel to focus on extracting local patterns from the attention-weighted feature vectors of its corresponding attack category. Compared to traditional uniform convolution, this approach captures deeper features related to specific attacks more precisely and specifically, further enhancing the model's ability to identify different attack types and improving classification accuracy.

[0027] 3. A pre-defined network security situation quantification function incorporates the proportional relationship between the number of attack samples of each category and the total number of abnormal samples, thereby overcoming the shortcomings of traditional quantification methods that only consider attack types while ignoring attack frequency and intensity. This function can more realistically reflect the actual threat composition currently faced by the network. For example, even if there is only one type of attack, if its frequency is extremely high, the situation value will increase accordingly, thus enabling the final network security situation assessment value to more accurately reflect the true impact of the attack. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a deep learning-based network security situation assessment method in an embodiment of this application.

[0029] Figure 2 This is a schematic diagram of feature extraction based on multi-head attention mechanism in a deep learning-based network security situation assessment method according to an embodiment of this application.

[0030] Figure 3 This is a schematic diagram of the physical device structure of a network security situation assessment system in this application embodiment. Detailed Implementation

[0031] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items.

[0032] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0033] This application provides a deep learning-based method and system for network security situation assessment, which can improve the accuracy of network security situation assessment.

[0034] Please see Figure 1 This is a flowchart illustrating a deep learning-based network security situation assessment method in an embodiment of this application.

[0035] S101. Standardize and normalize the network connection record data within the preset time period to obtain an input feature vector with multi-dimensional feature attributes.

[0036] The preset time period refers to a specific time window of a certain length set for network situation assessment, such as 5 minutes, 1 hour, or 1 day, used to define the scope of data collection. Network connection record data represents raw logs or traffic data captured from network devices (such as firewalls, routers, and intrusion detection systems), and its content may include source / destination IP addresses, ports, protocol types, connection duration, and number of bytes transmitted. Standardization refers to transforming feature attributes with different dimensions and numerical ranges through mathematical transformations (such as Z-score standardization) to make them conform to a standard normal distribution with a mean of 0 and a variance of 1, in order to eliminate the impact of feature scale differences on model training. Normalization refers to mapping the numerical values ​​of feature attributes to a specified interval, such as [0, 1] or [-1, 1], through linear transformations (such as min-max normalization), in order to accelerate model convergence and improve model performance. Multidimensional feature attributes refer to multiple quantifiable features extracted or transformed from raw network connection records. For example, in the NSL-KDD dataset, it may include 41 dimensions such as connection duration and protocol type. The input feature vector represents a numerical vector that can be processed by a deep learning model, constructed from a single network connection record data that has undergone standardization and normalization.

[0037] Specifically, network connection record data is fundamental for assessing network security posture, but the raw data is often inconsistent in format and scale, and may contain non-numerical features (such as text tags like "http"). Therefore, this data must first be cleaned and transformed. First, the temporally continuous network traffic data is segmented into evaluation batches according to preset time periods. Then, for each network connection record within each time period, its multi-dimensional feature attributes are extracted. For numerical attributes (such as connection duration and number of bytes transmitted), standardization and normalization are performed. For example, Z-score standardization can prevent features with large numerical ranges from dominating model training. Min-max normalization can constrain all feature values ​​to the [0, 1] interval, which is beneficial for activation functions and gradient descent processes in neural networks. For non-numerical categorical attributes (such as protocol type), they need to be converted into numerical representations using methods such as one-hot encoding. After these processes, a single network connection record is transformed into a purely numerical, scaled, and fixed-dimensional input feature vector.

[0038] S102. The correlation between the multidimensional feature attributes of the input feature vector and each preset network attack category is calculated in parallel using a preset scaling dot product function to obtain the multi-head attention weight matrix.

[0039] The pre-defined scaling dot product function is a specific mathematical function used to calculate relevance. It measures similarity by calculating the dot product of the query vector and the key vector and scaling it. Parallel computation refers to executing multiple computational tasks simultaneously and independently. In this step, it is reflected in simultaneously initiating the relevance calculation process for each pre-defined network attack category, which is the embodiment of multi-head parallelism in the multi-head attention mechanism. Multi-dimensional feature attributes refer to the various dimensions in the input feature vector, which can be regarded as the basis for constructing keys and values ​​in the attention model. Pre-defined network attack categories refer to the types of attacks that the model needs to identify and distinguish, such as DoS and Probe. In the attention model, each type of attack can be regarded as an independent query, used to explore the relevant parts of the input features. Relevance is used to represent the importance or correlation strength of a certain feature attribute of the input feature vector in judging a specific network attack category. The multi-head attention weight matrix is ​​a composite matrix, which is composed of weight matrices generated by multiple parallel attention heads. Each head focuses on calculating the relevance of features to a specific attack category from different perspectives.

[0040] Specifically, current research on situation assessment often involves complex feature selection mechanisms that heavily rely on expert experience. This invention employs deep learning, applying the principles of multi-head attention to establish a feature selection model that weights the input data. This step is performed after obtaining standardized input feature vectors, in a scenario involving multi-class network attack identification, where the importance of input features needs to be evaluated for each possible attack category. This invention extends the traditional attention mechanism, which is only applicable to binary classification, to multi-head models to meet the needs of multi-class network attack identification. The process first conceptualizes the input feature vector as feature key-value pairs. ,in For feature name, These are eigenvalues. Then, as... Figure 2 As shown, based on the number of preset network attack categories (e.g. (class), create There are three parallel attention pooling modules, each corresponding to an attention head, responsible for calculating the input features and a specific attack category (e.g., as a query). The correlation between the attention pooling modules is calculated using a pre-defined scaling dot product function. , To preset network attack categories, For feature name, The correlation between the multidimensional feature attributes of the input feature vector and the preset network attack category. This represents the dimension of the feature vector. The scaling factor here. This effectively controls the variance of the dot product result, preventing gradient vanishing due to excessively large values, thus making model training more stable. The relevance scores calculated in parallel by all attention pooling modules are normalized (e.g., using Softmax) to form multiple independent attention weight vectors. Aggregating these weight vectors, each corresponding to a different attack category, constitutes the final multi-head attention weight matrix, which quantifies the degree of influence of each feature dimension on each attack category.

[0041] S103. The input feature vector is weighted according to the multi-head attention weight matrix to obtain multiple attention-weighted feature vectors that correspond to each preset network attack category.

[0042] Weighted processing refers to a mathematical operation that applies attention. Specifically, it involves using the weights obtained from S102 to reshape the original input features, highlighting key information and suppressing irrelevant noise. The attention-weighted feature vector refers to the final output generated after the input feature vector has been processed by the complete multi-head attention module. This output is not a simple weighted sum, but rather a concatenation and linear transformation that integrates multiple high-level feature representations that can be input into subsequent convolutional layers and are associated with each attack category.

[0043] Specifically, for each attention head (corresponding to a network attack category), the network security situation assessment system performs a weighted sum of the attention weight vector generated by that head and the input feature vector to obtain multiple attention-weighted feature vectors associated with each preset network attack category. For example, ... Figure 2 As shown, suppose the input feature vector contains 3D features There are categories , establish containing This model employs a parallel attention pooling module for its attention mechanism. All pooling modules are normalized to obtain feature vectors for a given feature. Weighting coefficients Then, by weighted summation with the corresponding eigenvalues, we obtain... , Each This is a single attention head; concatenating these attention heads and using a linear transformation parameter vector... After a linear transformation, we obtain multiple attention-weighted feature vectors that correspond to each preset network attack category, as shown in the following formula: .

[0044] S104. Arrange the multiple attention-weighted feature vectors in rows to obtain a two-dimensional feature matrix.

[0045] Here, multiple attention-weighted feature vectors refer to the set of attention-weighted feature vectors generated in S103 for each preset network attack category. Row-based arrangement is a matrix construction operation, where multiple one-dimensional vectors are stacked as independent rows into a two-dimensional array structure. Each row represents the attention-weighted feature vector corresponding to a specific type of output. The two-dimensional feature matrix is ​​a structured data representation; its rows represent specialized feature representations for different network attack categories, and its columns correspond to the dimensions of the feature vectors. This matrix provides correctly formatted input for subsequent convolution operations.

[0046] Specifically, this step is performed after feature weighting and before convolution processing. Step S103 generates multiple independent attention-weighted feature vectors, each associated with a different attack category. These vectors are logically parallel. However, to utilize convolutional neural networks for more efficient parallel feature extraction, these independent data need to be integrated into a unified structured input. Therefore, this step organizes these multiple one-dimensional attention-weighted feature vectors. Assuming there are H preset network attack categories, S103 will generate H attention-weighted feature vectors. This step operates by using the first vector as the first row, the second vector as the second row, and so on, up to the Hth vector as the Hth row, thus constructing an H-row, N-column two-dimensional feature matrix, where N is the dimension of each attention-weighted feature vector. This two-dimensional feature matrix integrates the category dimension (represented in the rows) and the feature dimension (represented in the columns) into the same data structure.

[0047] S105. Perform the first stage of parallel multi-kernel one-dimensional convolution and max pooling on the two-dimensional feature matrix. While ensuring that the number of rows in the two-dimensional feature matrix after convolution is consistent with the number of network attack categories, concatenate the multiple feature sequences obtained after pooling into an intermediate two-dimensional vector column by column.

[0048] The first stage of parallel multi-core one-dimensional convolution processing represents the use of multiple (e.g.) (Number) different one-dimensional convolutional kernels are used to independently perform convolution operations on each row of the two-dimensional feature matrix to extract local correlation patterns within the feature vector from different perspectives. Max pooling is a downsampling operation that selects the maximum value in a local region of the convolutional feature sequence as the representative of that region, aiming to reduce feature dimensionality, retain the most significant features, and provide some translation invariance. Ensuring that the number of rows in the convolutional two-dimensional feature matrix matches the number of network attack categories means that the convolution operation uses padding techniques to ensure that the number of rows in the output feature map is the same as the number of rows in the input matrix, thus maintaining the row-by-row correspondence between features and attack categories. The feature sequence refers to the output sequence generated after the one-dimensional convolution slides across a single row vector. The intermediate two-dimensional vector is a temporary data structure, formed by concatenating multiple feature sequences after the first pooling step column-wise. It integrates the feature information extracted by all convolutional kernels and is used for the next stage of processing.

[0049] Specifically, this step involves further processing the two-dimensional feature matrix, which contains category-specific information, after its construction to capture local correlations between features. First, the network security situation assessment system is configured. One-dimensional convolutional kernels work in parallel. To predetermine the total number of network attack categories, each convolutional kernel performs a one-dimensional convolution operation on each row of the two-dimensional feature matrix. Padding is used to ensure that the feature sequences output by the convolution have consistent lengths, and that the output feature map maintains the same number of rows as the input matrix. .go through Processing each convolutional kernel yields... Groups, each group contains Each feature sequence is then processed by max pooling, which shortens the sequence length while retaining the strongest signal. Finally, the key integration operation in this step is column-wise concatenation, which combines the pooled signals... The feature sequence groups are concatenated column by column according to the order of the convolution kernels to form a new two-dimensional vector, namely the intermediate two-dimensional vector. The number of rows in this new vector remains the same. But the number of columns is The pooling of sequence lengths after pooling integrates features extracted from different angles by multiple convolutional kernels.

[0050] S106. Perform a second-stage single-kernel one-dimensional convolution and max pooling process on the intermediate two-dimensional vector to obtain the dimension-reduced and compressed feature vector.

[0051] In this context, the intermediate two-dimensional vector refers to the two-dimensional data structure obtained in S105 after the first stage of parallel multi-kernel convolution, pooling, and column concatenation. The second stage, single-kernel one-dimensional convolution, involves using a single one-dimensional convolution kernel to further convolve the intermediate two-dimensional vector generated in the previous stage, aiming to integrate and abstract features at a higher level. Max pooling is also a downsampling operation used to reduce dimensionality and preserve salient features. The dimensionality-reduced and compressed feature vector is the final highly abstract one-dimensional vector with significantly reduced dimensionality, obtained after two stages of convolution and pooling. It condenses all the information in the original input most relevant to the attack category classification.

[0052] Specifically, this step is performed after the first-stage feature extraction and before the classification layer. Its purpose is to further process and deeply compress the features that have already been initially refined. Although the intermediate two-dimensional vector generated by S105 contains rich multi-angle features, its dimensionality may still be high and there may be redundancy between features, requiring further integration. The operation process of this step is similar to that of S105, but more simplified. A single-kernel one-dimensional convolutional layer is used to process the intermediate two-dimensional vector. This single-kernel convolution operation can be seen as the feature extracted in the first stage. The algorithm seeks higher-level combination patterns among different feature perspectives. After convolution, max pooling is performed again to further compress the data dimensionality and extract the most essential feature responses. Since there is only one convolution kernel and significant dimensionality reduction is achieved through two max pooling operations, the output is a one-dimensional vector with significantly reduced dimensions. This vector is the dimensionality-reduced and compressed feature vector, considered to be the most essential feature representation of the original network connections in the current model.

[0053] S107. Input the feature vector into the fully connected computation layer to perform normalization exponent operation, and obtain the network attack category identification result corresponding to the input feature vector.

[0054] In this context, the feature vector specifically refers to the dimension-reduced and compressed feature vector obtained after two stages of convolutional pooling in S106. A fully connected computational layer is a basic layer in a neural network, where each neuron is connected to all neurons in the previous layer, used for final comprehensive analysis and nonlinear transformation of the extracted features. Normalization exponentiation is a specific mathematical function, typically referring to the Softmax function in classification tasks, which transforms a vector containing arbitrary real numbers into a probability distribution vector. The network attack category identification result refers to the model's final classification judgment of the input network connection record data, i.e., the probability of determining which preset network attack category (or normal category) the record belongs to.

[0055] Specifically, the dimensionality-reduced and compressed feature vector obtained in S106 is input into a fully connected computation layer. This layer typically contains multiple neurons, the number of which matches the total number of preset network attack categories to be classified. The fully connected layer performs a linear transformation (matrix multiplication) and optional non-linear activation, mapping the input feature vector to a new vector, where each dimension can be viewed as a score indicating that the input belongs to a certain preset network attack category. Subsequently, to convert these scores into easily understandable probability values, a normalized exponential operation (Softmax function) is performed on the output vector of the fully connected layer. The Softmax function amplifies the preset network attack category with the highest score while suppressing other preset network attack categories, ensuring that the sum of the output probabilities of all preset network attack categories is 1. Finally, this probability distribution vector, or the index of the category with the largest probability value, constitutes the network attack category identification result corresponding to the current input feature vector.

[0056] In some embodiments, network security datasets often suffer from severe class imbalance (e.g., DoS attack samples far outnumber U2R attack samples). This causes models trained using standard methods to tend to predict the majority class, thus reducing the accuracy of identifying minority class attacks. To address this issue, a multidimensional focal loss (Multi-FL) method can be used during the training phase of a network security situation assessment system. Focal Loss is an improved method based on the cross-entropy function in training neural network models for classification problems. The Focal Loss function adds a focus coefficient γ and a balance factor α to the cross-entropy function, as shown in the following equation:

[0057] .

[0058] In small sample data, the loss function value and focus coefficient are negatively correlated for positive samples, and positively correlated for negative samples. α is a balancing factor that addresses the imbalance problem of training samples. Then negative samples will obtain larger function values. Then, positive samples will obtain larger function values. In multi-class classification problems, this invention proposes to further utilize... The function modifies the Focal Loss function to suit multi-dimensional scenarios. First, in multi-class classification problems, the Focal Loss function simplifies to the following formula: Where c is the actual class of the sample. The Multi-FL calculation formula is then obtained, as shown in the following equation: When the result contains fewer negative samples than the training samples, the loss function will increase, and vice versa, in order to address the data imbalance problem in multi-class classification.

[0059] S108. Calculate the network security situation assessment value within a preset time period based on the preset situation quantification impact value corresponding to each preset network attack category and the network attack category identification result.

[0060] The preset situation quantification impact value is a predefined numerical value used to represent the degree of harm caused to network system security by different types of network attacks. For example, as shown in Table 1 below, according to the CIC-IDS2017 assessment method, the preset situation quantification impact value of DDoS attacks (0.6) is higher than that of Scan attacks (0.1). The network attack category identification result refers to the set of classification results obtained through S107 for all network connection records within a preset time period. The network security situation assessment value is a comprehensive indicator that integrates the number, frequency, and inherent harmfulness of various attacks detected over a period of time using a specific calculation method, resulting in a value that macroscopically reflects the overall security status of the current network.

[0061] Table 1. CIC-IDS 2017 Partial Attack Classification Status Values

[0062]

[0063] Specifically, the network security situation assessment system statistically analyzes all identification results output by S107 within a preset time period. This includes: the number of occurrences of samples for each preset network attack category, the number of occurrences of normal samples within the preset time period, and the total number of network connection records within the preset time period. Then, based on these statistical data and a preset network security situation quantification function, combined with the preset situation quantification impact values ​​for each attack category, the system calculates the network security situation assessment value for the preset time period. For example, the preset network security situation quantification function could be: ,in, This is a cybersecurity posture assessment value. This represents the total number of network connection records within a preset time period. This represents the number of times a normal sample appears. To pre-determine the impact value of the situation quantification, , The number of times samples appeared for each type of network attack. , This is the preset total number of network attack categories.

[0064] The derivation process of the preset network security posture quantification function is as follows:

[0065] In the CIC-IDS 2017 assessment quantification method, assuming the number of evaluation samples in the current time period is n, it can be classified as follows: Each category has a situational quantification impact value of [value]. Let the proportion of abnormal samples be . , The number of times a sample appears for each category, where the number of times a normal sample appears is denoted as . For normal samples, the impact of situational quantification is 0, and it will not affect the assessment results, therefore it is not considered. Network security situational quantification results. See equations (1) and (2).

[0066] (1)

[0067] (2)

[0068] Substituting equation (2) into equation (1), we obtain the actual CIC-IDS2017 evaluation quantification method, as shown in equation (3):

[0069] (3)

[0070] According to equation (3), the network security situation quantification result is only inversely proportional to the number of samples and directly proportional to the types of abnormal samples, without reflecting the relationship between the proportion of attack samples and the result. Therefore, this invention improves the method by proposing equation (4), which introduces the proportional relationship between the number of samples of each category and the total number of samples in the time period. The final output of the network security situation assessment quantification result for that time period further reflects the relationship between attack samples and situation quantification results.

[0071] (4)

[0072] In the above embodiments, the network security situation assessment system automatically learns and weights the input feature vector through a multi-head attention mechanism. This enables the system to dynamically focus on the most relevant feature dimensions for different network attack categories, suppressing interference from irrelevant noise data. Subsequently, a two-stage one-dimensional convolutional network is used to deeply extract and abstract the weighted feature vector, ultimately obtaining a more accurate attack category identification result. Based on the preset situation quantification impact value corresponding to each preset network attack category and the network attack category identification result, the system calculates the network security situation assessment value within a preset time period. This overcomes the shortcomings of traditional methods that rely on expert experience for feature selection and that indiscriminate processing of all features leads to the dilution of core information, thereby improving the accuracy of network security situation assessment.

[0073] The above describes a deep learning-based network security situation assessment method in the embodiments of this application. The following describes an exemplary network security situation assessment system 300 provided in the embodiments of this application.

[0074] Figure 3This is an exemplary hardware structure diagram of the network security situation assessment system 300 provided in this application embodiment. In some embodiments, the network security situation assessment system 300 is a computer device. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores data. The network interface of the computer device is used to communicate with other external terminals or servers via a network connection. In some embodiments, the network interface can be a wired network interface; in some embodiments, the network interface can also be a wireless network interface. When the computer program is executed by the processor, it implements a deep learning-based network security situation assessment method according to this application embodiment.

[0075] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0076] In some embodiments of this application, a computer-readable storage medium is also provided, including instructions that, when executed on the network security situation assessment system 300, enable the network security situation assessment system 300 to execute a deep learning-based network security situation assessment method according to an embodiment of this application.

[0077] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0078] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0079] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0080] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A network security situation assessment method based on deep learning, characterized in that, The method, applied to a network security situation assessment system, includes: The network connection record data within a preset time period is standardized and normalized to obtain an input feature vector with multi-dimensional feature attributes; The correlation between the multidimensional feature attributes of the input feature vector and each preset network attack category is calculated in parallel using a preset scaling dot product function to obtain a multi-head attention weight matrix. The multi-head attention weight matrix represents the degree of influence of different dimensional feature attributes on the corresponding network attack category. The input feature vector is weighted according to the multi-head attention weight matrix to obtain multiple attention-weighted feature vectors that correspond to each of the preset network attack categories. Arrange the multiple attention-weighted feature vectors in rows to obtain a two-dimensional feature matrix; The two-dimensional feature matrix is ​​subjected to a first-stage parallel multi-core one-dimensional convolution and max pooling process. While ensuring that the number of rows in the two-dimensional feature matrix after convolution is consistent with the number of network attack categories, the multiple feature sequences obtained after pooling are concatenated column by column into an intermediate two-dimensional vector. The intermediate two-dimensional vector is subjected to a second stage of single-kernel one-dimensional convolution and max pooling to obtain the dimension-reduced and compressed feature vector. The feature vector is input into a fully connected computation layer to perform a normalized exponential operation, thereby obtaining the network attack category identification result corresponding to the input feature vector; Based on the network attack category identification results corresponding to all network connection record data within the preset time period, the number of times each preset network attack category appears and the total number of network connection records within the preset time period are calculated. The network security situation assessment value within the preset time period is calculated based on the preset situation quantification impact value corresponding to each preset network attack category, the number of times the samples of each preset network attack category appear, the total number of network connection records, the number of times normal samples appear within the preset time period, and the preset network security situation quantification function. The preset network security situation quantification function specifically includes: , wherein The network security situation assessment value is the value described above. The total number of network connection records within the preset time period, the The number of times a normal sample appears, the The preset situation quantification impact value, The The number of times each sample appears for each of the aforementioned network attack categories. The This represents the total number of preset network attack categories.

2. The method according to claim 1, characterized in that, The step of using a preset scaling dot product function to calculate in parallel the correlation between the multidimensional feature attributes of the input feature vector and each preset network attack category to obtain the multi-head attention weight matrix specifically includes: The input feature vector is represented as a feature key-value pair consisting of feature name and feature value; For each of the preset network attack categories, a parallel attention pooling module is constructed. In each of the attention pooling modules, the correlation between the multidimensional feature attributes of the input feature vector and the corresponding network attack category is calculated using the preset scaling dot product function; The correlation is normalized to obtain the attention weight coefficients corresponding to each feature attribute; The multi-head attention weight matrix is ​​obtained by concatenating the attention weight coefficients output by each of the attention pooling modules according to the number of preset network attack categories.

3. The method according to claim 2, characterized in that, The preset scaling dot product function specifically includes: , wherein For the preset network attack category, the The feature name, the The correlation between the multidimensional feature attributes of the input feature vector and the preset network attack category, the Represents the dimension of the feature vector.

4. The method according to claim 2, characterized in that, The step of weighting the input feature vector according to the multi-head attention weight matrix to obtain multiple attention-weighted feature vectors associated with each of the preset network attack categories specifically includes: Each feature value in the feature key-value pair is weighted and summed with the corresponding attention weight coefficient to obtain the attention head vector corresponding to each preset network attack category; The attention head vectors corresponding to each of the preset network attack categories are concatenated and linearly transformed using linear transformation parameter vectors to obtain the multiple attention-weighted feature vectors.

5. The method according to claim 1, characterized in that, The steps of performing the first-stage parallel multi-kernel one-dimensional convolution and max pooling processing on the two-dimensional feature matrix specifically include: Configure multiple one-dimensional convolutional kernels with the same number as the preset network attack categories, and match the stride of each one-dimensional convolutional kernel with the row vector length of the two-dimensional feature matrix; Based on each of the one-dimensional convolutional kernels, local feature extraction is performed on the corresponding row vectors in the two-dimensional feature matrix to obtain multiple preliminary feature sequences; Each of the initial feature sequences is downsampled by a max pooling operation to obtain multiple pooled feature sequences.

6. A network security situation assessment system, characterized in that, The network security situation assessment system includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the network security situation assessment system to perform the method as described in any one of claims 1-5.

7. A computer program product containing instructions, characterized in that, When the computer program product is run on the network security situation assessment system, the network security situation assessment system performs the method as described in any one of claims 1-5.

8. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is executed on the network security situation assessment system, it causes the network security situation assessment system to perform the method as described in any one of claims 1-5.

Images