An intelligent detection method for network abnormal behavior

Abstract

This invention proposes an intelligent method for detecting abnormal network behavior, including acquiring target network traffic data, constructing a multi-dimensional feature fusion model based on an attention mechanism, and building an abnormal behavior classification model based on deep learning. By automatically allocating attention to different network traffic features through the attention mechanism, it solves the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods, significantly improving the detection capability for low-frequency and covert abnormal behaviors and effectively reducing false positive and false negative rates. The classification model employs a hybrid CNN and LSTM structure, taking into account both the local spatial and temporal features of network traffic, and can accurately identify various types of abnormal network behaviors such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, adapting to diverse attack scenarios with high classification accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an intelligent method for detecting abnormal network behavior. Background Technology

[0002] With the rapid popularization of network technology and the deep penetration of digital services, network traffic is showing a trend of large data scale, multiple feature dimensions, complex transmission timing, and diversified attack forms. Traditional network anomaly detection technologies face many technical bottlenecks. Existing detection methods mostly rely on single feature extraction rules or traditional machine learning algorithms, which can only identify fixed types of network attacks and are difficult to adapt to the dynamic evolution of current network anomaly behavior. At the same time, most methods do not effectively integrate the multi-dimensional features of network traffic, and there is an unreasonable feature weight allocation problem, resulting in low detection rate for low-frequency and highly concealed anomalies, and high false positive and false negative rates. Some detection technologies lack a complete anomaly tracing and hierarchical early warning mechanism, and can only complete the preliminary identification of anomalies. They cannot provide network administrators with accurate attack location and risk handling basis, and cannot meet the real-time, accurate, and complete network security protection requirements of complex scenarios such as enterprise-level networks and cloud computing platforms. Summary of the Invention

[0003] In view of this, to address the problems existing in the technical background, this invention proposes an intelligent detection method for abnormal network behavior. Through multi-dimensional feature fusion, deep learning classification, multi-level early warning, and source tracing, it achieves accurate detection, efficient classification, and rapid source tracing of abnormal network behavior, effectively reducing the false positive rate and false negative rate, and improving the intelligent level of network security protection. Specifically, it includes the following: A method for intelligent detection of abnormal network behavior, characterized by the following steps: Step 1: Obtain target network traffic data, preprocess the network traffic data to obtain a standardized network traffic feature vector set, the standardized network traffic feature vector set contains multiple standardized network traffic feature vectors, and each standardized network traffic feature vector corresponds to a network traffic sample; Step 2: Construct a multi-dimensional feature fusion model based on an attention mechanism. Input the standardized network traffic feature vector set into the multi-dimensional feature fusion model. The attention layer in the multi-dimensional feature fusion model assigns weights to network traffic features of different dimensions to obtain a fused feature vector. The weight assignment formula for the attention layer is: ; in, Indicates the first A multi-dimensional network traffic feature vector This is the weight matrix. For bias terms, The total number of feature dimensions. For the first The attention weights corresponding to each dimension feature are summed by weighting each dimension feature according to its weight to obtain the fused feature vector; Step 3: Construct an abnormal behavior classification model based on deep learning. Input the fused feature vector into the abnormal behavior classification model, and use the abnormal behavior classification model to extract and classify the fused feature vector to obtain the classification result of network abnormal behavior. Step 4: Based on the classification results, perform abnormal behavior warning and source tracing on the target network. If the classification results show that there is abnormal behavior, trigger the warning mechanism, and perform source tracing and location based on the feature vector of the abnormal behavior, and output the source IP and attack path of the abnormal behavior. The multi-dimensional feature fusion model and the abnormal behavior classification model are optimized through joint training. The loss function of joint training is a weighted sum of classification loss and feature distribution loss. The model parameters are updated through backpropagation until the model converges.

[0004] In one embodiment of the present invention, in step 1, the network traffic data includes the source IP, destination IP, source port, destination port, data packet length, transmission protocol, connection duration, and data packet transmission frequency of the data packet. The preprocessing step includes data cleaning, data normalization, and feature encoding. The data cleaning is used to remove abnormal traffic samples with more than 30% missing values. The data normalization uses the min-max normalization method to map each feature value to the [0,1] interval. The feature encoding uses one-hot encoding to process classification features such as transmission protocol.

[0005] In one embodiment of the present invention, in step 2, the multi-dimensional feature fusion model includes an input layer, an attention layer, a feature fusion layer, and an output layer. The input layer is used to receive standardized network traffic feature vectors. The feature fusion layer is used to concatenate the weighted feature vectors to obtain a fused feature vector. The attention layer adopts a multi-head attention mechanism, which calculates the attention weights of different subspaces through multiple independent weight matrices and bias terms to improve the robustness of feature fusion.

[0006] In one embodiment of the present invention, in step 3, the abnormal behavior classification model adopts a hybrid structure of convolutional neural network (CNN) and long short-term memory network (LSTM). The CNN is used to extract local spatial features from the fused feature vector, and the LSTM is used to capture temporal features from the fused feature vector. The features from the CNN and LSTM are concatenated and input to a fully connected layer. The multi-class probability distribution is output through the softmax activation function. The multi-class includes five types of abnormal behaviors: normal traffic, DDoS attack, port scanning, SQL injection, and malicious code propagation.

[0007] In one embodiment of the present invention, in step 4, the early warning mechanism adopts a multi-level early warning strategy. When the probability of abnormal behavior in the classification result is greater than 0.8, a first-level early warning is triggered and pushed to the network administrator; when the probability is in the range of [0.6, 0.8], a second-level early warning is triggered and the transmission rate of abnormal traffic is automatically limited; the source tracing and positioning is based on the construction of an attack path topology map by graph neural network, and by fusing IP address and port information in feature vectors, matching known attack feature databases, the source of abnormal behavior is located.

[0008] The above technical solution has the following beneficial effects: This invention automatically allocates attention to different network traffic features through an attention mechanism, solving the problems of unreasonable feature weight allocation and insufficient feature fusion in traditional methods. This significantly improves the detection capability for low-frequency, covert anomalies, effectively reducing false positive and false negative rates. Employing a classification model with a hybrid CNN and LSTM structure, it considers both the local spatial and temporal features of network traffic, accurately identifying various types of network anomalies such as DDoS attacks, port scanning, SQL injection, and malicious code propagation. Adaptable to diverse attack scenarios, it boasts high classification accuracy and implements tiered responses based on the probability of anomaly occurrence. First-level alerts provide network administrators with timely risk management information, while second-level alerts automatically restrict abnormal traffic for proactive protection. Furthermore, by constructing an attack path topology map based on a graph neural network, it can quickly locate the source IP and attack path of anomalies, providing comprehensive support for emergency response and accountability for network security incidents. The multi-dimensional feature fusion model and the abnormal behavior classification model are optimized through joint training. By weighting the classification loss and feature distribution loss to guide the model parameter update, the model can simultaneously take into account the classification accuracy and the rationality of feature representation, thereby improving the model's generalization ability and robustness. It is suitable for complex and diverse network environments such as enterprise intranets, cloud computing platforms, and IoT networks. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating an intelligent detection method for abnormal network behavior according to the present invention. Detailed Implementation

[0010] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] Example 1, see Figure 1 The method for intelligent detection of abnormal network behavior shown includes the following steps: Step 1: Obtain target network traffic data, preprocess the network traffic data to obtain a standardized network traffic feature vector set, the standardized network traffic feature vector set contains multiple standardized network traffic feature vectors, and each standardized network traffic feature vector corresponds to a network traffic sample; Step 2: Construct a multi-dimensional feature fusion model based on an attention mechanism. Input the standardized network traffic feature vector set into the multi-dimensional feature fusion model. The attention layer in the multi-dimensional feature fusion model assigns weights to network traffic features of different dimensions to obtain a fused feature vector. The weight assignment formula for the attention layer is: ; in, Indicates the first A multi-dimensional network traffic feature vector This is the weight matrix. For bias terms, The total number of feature dimensions. For the first The attention weights corresponding to each dimension feature are summed by weighting each dimension feature according to its weight to obtain the fused feature vector; Step 3: Construct an abnormal behavior classification model based on deep learning. Input the fused feature vector into the abnormal behavior classification model, and use the abnormal behavior classification model to extract and classify the fused feature vector to obtain the classification result of network abnormal behavior. Step 4: Based on the classification results, perform abnormal behavior warning and source tracing on the target network. If the classification results show that there is abnormal behavior, trigger the warning mechanism, and perform source tracing and location based on the feature vector of the abnormal behavior, and output the source IP and attack path of the abnormal behavior. The multi-dimensional feature fusion model and the abnormal behavior classification model are optimized through joint training. The loss function of joint training is a weighted sum of classification loss and feature distribution loss. The model parameters are updated through backpropagation until the model converges.

[0012] Example 2, based on Example 1, in this example, network traffic data acquisition and preprocessing are achieved by building a network traffic data acquisition module. Real-time traffic data of the target network is collected using a network traffic probe. The collected traffic data fields include source IP, destination IP, source port, destination port, packet length, transmission protocol (TCP, UDP, ICMP, etc.), connection duration, and packet sending frequency. The collected raw traffic data is preprocessed, and the specific process is as follows: First, data cleaning is performed, iterating through all traffic samples and removing samples with a missing value ratio exceeding 30% to avoid interference from missing values ​​in model training. Then, min-max normalization is used to normalize numerical features such as packet length, connection duration, and packet transmission frequency, linearly mapping each feature value to the [0,1] interval to eliminate the impact of differences in feature dimensions on the model. Finally, one-hot encoding is used to encode classification features such as transmission protocols, converting discrete classification features into multi-dimensional binary vectors, completing the feature standardization process, and obtaining a feature vector set containing multiple standardized network traffic feature vectors, with each standardized network traffic feature vector corresponding to a network traffic sample.

[0013] Step 2 involves constructing and fusing a multi-dimensional feature fusion model based on an attention mechanism. This model includes an input layer, a multi-head attention layer, a feature fusion layer, and an output layer. The standardized network traffic feature vector set obtained in Step 1 is input into the input layer of the multi-dimensional feature fusion model, which smoothly transmits the feature vectors to the multi-head attention layer. The multi-head attention layer assigns weights to network traffic features of different dimensions using multiple independent weight matrices W and bias terms b, calculating the attention weights for each dimension. The weight assignment formula is as follows: The weight allocation formula for the attention layer is: ; in, Indicates the first A multi-dimensional network traffic feature vector This is the weight matrix. For bias terms, The total number of feature dimensions. For the first The attention weights corresponding to each dimension feature are obtained by summing the weights of each dimension feature according to their weights, resulting in a fused feature vector. This fused feature vector has completed the intelligent weight allocation and effective fusion of features of different dimensions, highlighting the expression of key features and weakening the influence of redundant features.

[0014] Step 3: Construction and Classification of Abnormal Behavior Classification Model. An abnormal behavior classification model based on a hybrid CNN and LSTM structure is constructed, inputting the fused feature vector obtained in Step 2 into the model. First, the CNN layer performs convolution and pooling operations on the fused feature vector to extract local spatial features, capturing key spatial information such as packet length and IP address association in the traffic data. Then, the LSTM layer performs temporal modeling on the fused feature vector, capturing temporal features such as connection duration and packet sending frequency in the traffic data, uncovering the dynamic evolution of network traffic. The spatial features extracted by CNN and the temporal features extracted by LSTM are concatenated to obtain the fused deep features. This feature is input into a fully connected layer for dimensional mapping, and finally, the softmax activation function is used to output the classification probability distribution, achieving the classification of five types of network behaviors: normal traffic, DDoS attacks, port scanning, SQL injection, and malicious code propagation, outputting the probability value for each type of behavior.

[0015] Example 3, based on Example 1, triggers a multi-level early warning mechanism based on the classification probability distribution obtained in step 3: when the probability of a certain type of abnormal behavior is greater than 0.8, it is judged as a high-risk abnormal behavior, triggering a level 1 early warning, and the early warning information is pushed to the network administrator via SMS, email, etc., while recording the detailed characteristics of the abnormal behavior; when the probability of the abnormal behavior is in the range of [0.6, 0.8], it is judged as a medium-risk abnormal behavior, triggering a level 2 early warning, automatically limiting the transmission rate of abnormal traffic, blocking the further spread of abnormal behavior, and reducing the impact of network risks.

[0016] In the source tracing and localization phase, an attack path topology map is constructed based on a graph neural network. Key information such as source IP, destination IP, source port, and destination port are extracted from the fused feature vectors. Feature matching is then performed in conjunction with a known attack feature database to quickly locate the source IP of the abnormal behavior. Simultaneously, based on the transmission links and interaction relationships of traffic data, the transmission path of abnormal traffic is reconstructed, a complete attack path topology map is constructed, and the source IP of the abnormal behavior and detailed attack path are output, providing precise support for network administrators' emergency response and security hardening.

[0017] Model joint training optimization In this embodiment, the multi-dimensional feature fusion model and the abnormal behavior classification model are optimized through joint training. A joint training loss function is constructed, which is a weighted sum of the classification loss and the feature distribution loss. The classification loss uses the cross-entropy loss function to measure the classification accuracy of the classification model, while the feature distribution loss uses the maximum mean difference (MMD) loss function to measure the reasonableness of the distribution of the fused features. The joint loss function is solved using the backpropagation algorithm to update the parameters of the multi-dimensional feature fusion model and the abnormal behavior classification model. Iterative training continues until the model loss converges, completing the optimized training of the model and improving its generalization ability and detection accuracy.

[0018] Example 4: Based on Example 1, this example refines the multi-head attention mechanism of the multi-dimensional feature fusion model and optimizes the attack feature library construction method for source tracing and localization, further improving the performance of the detection method.

[0019] In the multi-head attention layer of the multi-dimensional feature fusion model, three independent weight matrices and bias terms are set to calculate subspace attention weights for the basic attribute features, transmission state features, and behavioral pattern features of network traffic, respectively. Then, the attention weights of the three subspaces are fused to obtain the final feature weights, which further improves the robustness and specificity of feature fusion and strengthens the ability to capture key features of different types of abnormal behavior.

[0020] In the source tracing and localization phase, a multi-dimensional attack feature library is pre-built to collect data such as traffic characteristics, attacking IP ranges, and attack path characteristics of common network attacks such as DDoS attacks, port scanning, SQL injection, and malicious code propagation, and to establish a feature index. During the localization process, in addition to matching and fusing IP address and port information in the feature vector, cross-validation is also performed using attack behavior timing characteristics and packet characteristics from the attack feature library to improve the accuracy and reliability of abnormal behavior source localization and attack path reconstruction.

[0021] The other steps in this embodiment are the same as in embodiment 1. Through the above optimization, the detection method in this embodiment improves the detection rate of highly concealed SQL injection attacks and malicious code propagation behavior by more than 15%, and improves the accuracy of attack tracing and location by 20%, which can more efficiently deal with diverse security threats in complex network environments.

[0022] The basic principles and main features of the present invention have been described above. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are only illustrative of the principles of the present invention. Various changes and modifications can be made to the present invention without departing from the spirit and scope of the present invention. All such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent detection of abnormal network behavior, characterized in that, Includes the following steps: Step 1: Obtain target network traffic data, preprocess the network traffic data to obtain a standardized network traffic feature vector set, the standardized network traffic feature vector set contains multiple standardized network traffic feature vectors, and each standardized network traffic feature vector corresponds to a network traffic sample; Step 2: Construct a multi-dimensional feature fusion model based on an attention mechanism. Input the standardized network traffic feature vector set into the multi-dimensional feature fusion model. The attention layer in the multi-dimensional feature fusion model assigns weights to network traffic features of different dimensions to obtain a fused feature vector. The weight assignment formula for the attention layer is: ； in, Indicates the first A multi-dimensional network traffic feature vector This is the weight matrix. For bias terms, The total number of feature dimensions. For the first The attention weights corresponding to each dimension feature are summed by weighting each dimension feature according to its weight to obtain the fused feature vector; Step 3: Construct an abnormal behavior classification model based on deep learning. Input the fused feature vector into the abnormal behavior classification model, and use the abnormal behavior classification model to extract and classify the fused feature vector to obtain the classification result of network abnormal behavior. Step 4: Based on the classification results, perform abnormal behavior warning and source tracing on the target network. If the classification results show that there is abnormal behavior, trigger the warning mechanism, and perform source tracing and location based on the feature vector of the abnormal behavior, and output the source IP and attack path of the abnormal behavior. The multi-dimensional feature fusion model and the abnormal behavior classification model are optimized through joint training. The loss function of joint training is a weighted sum of classification loss and feature distribution loss. The model parameters are updated through backpropagation until the model converges.

2. The intelligent detection method for abnormal network behavior according to claim 1, characterized in that, In step 1, the network traffic data includes the source IP, destination IP, source port, destination port, data packet length, transmission protocol, connection duration, and data packet transmission frequency of the data packets. The preprocessing steps include data cleaning, data normalization, and feature encoding. The data cleaning is used to remove abnormal traffic samples with more than 30% missing values. The data normalization uses the min-max normalization method to map each feature value to the [0,1] interval. The feature encoding uses one-hot encoding to process classification features such as transmission protocols.

3. The intelligent detection method for abnormal network behavior according to claim 1, characterized in that, In step 2, the multi-dimensional feature fusion model includes an input layer, an attention layer, a feature fusion layer, and an output layer. The input layer is used to receive standardized network traffic feature vectors. The feature fusion layer is used to concatenate the weighted feature vectors to obtain a fused feature vector. The attention layer adopts a multi-head attention mechanism, which calculates the attention weights of different subspaces through multiple independent weight matrices and bias terms to improve the robustness of feature fusion.

4. The intelligent detection method for abnormal network behavior according to claim 1, characterized in that... In step 3, the abnormal behavior classification model adopts a hybrid structure of convolutional neural network (CNN) and long short-term memory network (LSTM). The CNN is used to extract local spatial features from the fused feature vector, and the LSTM is used to capture temporal features from the fused feature vector. The features from the CNN and LSTM are concatenated and input into a fully connected layer. The multi-class probability distribution is output through the softmax activation function. The multi-class includes five types of abnormal behaviors: normal traffic, DDoS attack, port scanning, SQL injection, and malicious code propagation.

5. The intelligent detection method for abnormal network behavior according to claim 1, characterized in that, In step 4, the early warning mechanism adopts a multi-level early warning strategy. When the probability of abnormal behavior in the classification result is greater than 0.8, a first-level early warning is triggered and pushed to the network administrator. When the probability is in the range of [0.6, 0.8], a level 2 warning is triggered and the transmission rate of abnormal traffic is automatically limited; the source tracing and positioning is based on the construction of an attack path topology map by graph neural network, and by fusing IP address and port information in feature vectors, matching known attack feature databases, the source of abnormal behavior is located.

Images