A network intrusion detection system based on behavior analysis
By collecting network node behavior and resource status data, and combining anomaly assessment and adaptive fusion processing, an intrusion assessment value is generated, which solves the problem of low detection accuracy in existing technologies and achieves more reliable network intrusion detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NINGBO SANRIWEI TECHNOLOGY CO LTD
- Filing Date
- 2026-04-20
- Publication Date
- 2026-06-12
Smart Images
Figure CN122204512A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network intrusion detection technology, specifically to a network intrusion detection system based on behavioral analysis. Background Technology
[0002] Intrusion detection systems are an important component of network security protection systems, used to identify and respond to malicious activities targeting network nodes or systems. Based on different detection principles, existing intrusion detection technologies are mainly divided into two categories: misuse detection and behavioral analysis. Misuse detection relies on a signature database of known attacks and can accurately identify known threats; while behavioral analysis methods establish and analyze the behaviors generated by network nodes or systems during operation to discover abnormal activities.
[0003] The limitations of existing technologies include at least the following problems: existing technologies either only collect network behavior data and perform anomaly assessment based on this data, ignoring the importance of node resource status data. However, intrusion behavior often causes both network behavior anomalies and node resource status anomalies simultaneously. Assessment based on single behavior data cannot capture abnormal signals at the resource level, and it is easy to miss intrusion behaviors that are only manifested through abnormal resource status. As a result, existing technologies are unable to fully capture the complete characteristics of intrusion behavior, making it difficult to accurately determine the intrusion status of network nodes and reducing detection accuracy. Summary of the Invention
[0004] To address the shortcomings of existing technologies, this invention provides a network intrusion detection system based on behavior analysis, which solves the problem that existing technologies fail to comprehensively collect behavior and resource data, making it difficult to capture complete intrusion characteristics and resulting in reduced detection accuracy.
[0005] To achieve the above objectives, the present invention provides the following technical solution: a network intrusion detection system based on behavior analysis, comprising: a data acquisition unit for acquiring network behavior data and resource status data of a target network node; an anomaly assessment unit for extracting behavior anomaly assessment values and resource anomaly assessment values of the target network node based on the network behavior data and resource status data, respectively; an adaptive fusion unit for adaptively fusing the behavior anomaly assessment values and resource anomaly assessment values to obtain an intrusion assessment value of the target network node; and an intrusion detection unit for performing network intrusion detection processing on the target network node based on the intrusion assessment value.
[0006] Furthermore, network behavior data includes packet arrival interval, connection duration, traffic rate, TCP retransmission count, TCP zero window duration, and small packet jitter rate; resource status data includes CPU utilization, memory utilization, CPU per core temperature change rate, memory page fault rate, and disk I / O queue depth.
[0007] Furthermore, the specific steps for extracting the behavioral anomaly evaluation value of the target network node are as follows: read the network behavior data and perform normalization processing; extract features from the normalized network behavior data to obtain the behavioral feature set of the target network node, including behavioral distortion features and behavioral protocol anomaly features; perform comprehensive processing on the behavioral feature set to obtain the behavioral anomaly evaluation value of the target network node.
[0008] Furthermore, the specific steps to obtain the behavioral feature set of the target network node are as follows: the normalized data packet arrival interval, connection duration, traffic rate, and TCP retransmission count are comprehensively processed to obtain the behavioral distortion features of the target network node; the normalized TCP zero window duration and small packet jitter rate are weighted and summed to obtain the behavioral protocol anomaly features of the target network node.
[0009] Furthermore, the specific steps for extracting the resource anomaly assessment value of the target network node are as follows: obtain the resource baseline set of the target network node, and perform comprehensive processing with the resource status data to obtain the resource difference set of the target network node; perform standardization processing on the resource difference set, and perform comprehensive processing to obtain the resource anomaly assessment value of the target network node.
[0010] Furthermore, the specific steps to obtain the intrusion assessment value of the target network node are as follows: read the behavior anomaly assessment value and the resource anomaly assessment value, and perform normalization processing; then input the normalized behavior anomaly assessment value and resource anomaly assessment value into the intrusion assessment model to extract the intrusion assessment value of the target network node.
[0011] Furthermore, the intrusion assessment model is as follows: ;in, The intrusion assessment value for the target network node. This is the normalized evaluation value of the target network node's behavioral anomalies. These are the behavioral adjustment coefficients stored in the database. This represents the normalized resource anomaly assessment value of the target network node. These are resource adjustment coefficients stored in the database. These are the collaborative enhancement coefficients stored in the database.
[0012] Furthermore, the specific steps for network intrusion detection processing of the target network node are as follows: determine whether the intrusion assessment value is higher than the preset intrusion assessment threshold; if it is higher than the preset intrusion assessment threshold, determine that the target network node has been intruded and execute the blocking response action; if it is not higher than the preset intrusion assessment threshold, determine that the target network node is in a normal state.
[0013] The present invention has the following beneficial effects:
[0014] This behavior-based network intrusion detection system simultaneously collects behavioral data and resource status data of network nodes through a data acquisition unit, thus comprehensively recording the node's operating status. The anomaly assessment unit processes the behavioral data and resource data separately, extracting corresponding behavioral anomaly assessment values and resource anomaly assessment values. Then, the adaptive fusion unit uses a built-in assessment model to perform fusion calculations on the two types of results to generate a comprehensive intrusion assessment value. Finally, the intrusion detection unit compares this value with a preset threshold to complete the intrusion judgment and corresponding handling. This allows for more accurate identification of anomalies when facing covert intrusions or attacks disguised as normal business operations, reducing false positives and false negatives, and making intrusion detection of the entire network node more reliable.
[0015] Of course, any product implementing this invention does not necessarily need to achieve all of the above advantages at the same time. Attached Figure Description
[0016] Figure 1 This is a block diagram of a network intrusion detection system based on behavior analysis according to the present invention. Detailed Implementation
[0017] Please see Figure 1 This invention provides a technical solution: a network intrusion detection system based on behavior analysis, comprising: a data acquisition unit, used to acquire network behavior data and resource status data of the target network node when the target network node receives or sends network data packets; an anomaly assessment unit, used to extract behavior anomaly assessment values and resource anomaly assessment values of the target network node based on the network behavior data and resource status data, respectively; an adaptive fusion unit, used to perform adaptive fusion processing on the behavior anomaly assessment values and resource anomaly assessment values to obtain an intrusion assessment value of the target network node; and an intrusion detection unit, used to perform network intrusion detection processing on the target network node based on the intrusion assessment value.
[0018] The specific steps for performing network intrusion detection on target network nodes are as follows:
[0019] Determine whether the intrusion assessment value is higher than the preset intrusion assessment threshold;
[0020] If the intrusion assessment value is higher than the preset intrusion assessment threshold, the target network node is determined to be intruded and a blocking response action is executed, which includes at least: blocking the current network connection of the target network node, adding the source IP address of the target network node to the blacklist, and generating an intrusion alarm log.
[0021] If the intrusion assessment value is not higher than the preset intrusion assessment threshold, the target network node is determined to be in a normal state.
[0022] Network behavior data includes packet arrival interval, connection duration, traffic rate, TCP retransmission count, TCP zero window duration, and small packet jitter rate. Resource status data includes CPU utilization, memory utilization, CPU per core temperature change rate, memory page fault rate, and disk I / O queue depth.
[0023] The packet arrival interval is the time difference between two adjacent packets arriving at the network card, which is calculated using packet capture timestamps.
[0024] The connection duration is the total time from the establishment of a TCP connection to its closure, obtained by tracking the TCP stream state.
[0025] Traffic rate is the number of data bits passing through the network interface per unit time, obtained by dividing the total number of bytes in the statistical window by the window duration.
[0026] The TCP retransmission count is the number of TCP retransmission packets detected per unit of time, obtained by parsing the TCP sequence number and acknowledgment number to identify retransmission packets.
[0027] The TCP zero window duration is the continuous duration during which the receive window remains zero, obtained by parsing the window field in the TCP header and timing it.
[0028] The small packet jitter rate is the rate of change in the proportion of data packets with a length of ≤64 bytes per unit time, which is obtained by counting the proportion of small packets per second and calculating the difference between adjacent seconds.
[0029] CPU utilization: The percentage of time the CPU is in a non-idle state per unit of time, which can be calculated from the cumulative value of process scheduling in the operating system kernel.
[0030] Memory utilization: The ratio of the currently allocated physical memory to the total physical memory capacity, obtained through the system memory management interface.
[0031] CPU per-core temperature change rate: The rate at which the temperature of each CPU core changes per unit time is obtained by differentially analyzing the original temperature values read from the temperature sensor on the motherboard through the system power management interface.
[0032] Memory page fault rate: The number of major page faults triggered by page faults when a program accesses memory per unit of time. It can be read directly from the kernel virtual memory statistics.
[0033] Disk I / O queue depth: The number of I / O requests waiting for a disk response at the current moment, which is directly provided by the request queue status of the block device driver layer.
[0034] Specifically, the steps for extracting the behavioral anomaly evaluation values of the target network nodes are as follows:
[0035] Read network behavior data and perform normalization processing (i.e. remove units and map its values to between 0 and 1).
[0036] Feature extraction is performed on the normalized network behavior data to obtain the behavior feature set of the target network node, including behavior distortion features and behavior protocol anomaly features;
[0037] The behavior feature set is comprehensively processed to obtain the behavior anomaly evaluation value of the target network node. Specifically, the behavior distortion feature and the behavior protocol anomaly feature are weighted and processed. The weight coefficients of each parameter in the weighting process can be preset as follows: the weight of behavior distortion feature is 0.6 and the weight of behavior protocol anomaly feature is 0.4.
[0038] The specific steps to obtain the behavioral feature set of the target network nodes are as follows:
[0039] The normalized packet arrival interval, connection duration, traffic rate, and TCP retransmission count are comprehensively processed to obtain the behavioral distortion characteristics of the target network node. Specifically, the normalized packet arrival interval, connection duration, traffic rate, and TCP retransmission count are compared with preset corresponding benchmark values (such as packet arrival interval benchmark value, connection duration benchmark value, traffic rate benchmark value, and TCP retransmission count benchmark value) and the results are taken as absolute values. The difference results are then weighted and summed to obtain the behavioral distortion characteristics. The weight coefficients corresponding to the difference results of each parameter in the weighted summation process can be preset to: 0.2, 0.2, 0.3, and 0.3.
[0040] It should be noted that the steps for obtaining each baseline value are as follows. Taking the data packet arrival interval baseline value as an example: obtain the data packet arrival interval of the target network node in history for several times, and take the average value as the data packet arrival interval baseline value.
[0041] The normalized TCP zero window duration and small packet jitter rate are weighted and summed to obtain the abnormal behavior protocol characteristics of the target network node, which are as follows:
[0042] The normalized TCP zero window duration and small packet jitter rate are weighted to obtain the abnormal behavior protocol characteristics of the target network node. The weight coefficients of each parameter in the weighted summation process can be preset as follows: TCP zero window duration weight 0.5, small packet jitter rate weight 0.5.
[0043] In this implementation scheme, the collected network behavior data is normalized to unify the data range before subsequent calculations, allowing different types of parameters to participate in the analysis under the same standard. This avoids judgment bias caused by numerical differences. Behavioral distortion features and behavioral protocol anomaly features are separated and weighted according to set weights. This allows for the characterization of node behavior from two perspectives: traffic interaction changes and protocol operation status, making anomaly identification more hierarchical. Finally, each parameter is combined with historical data to determine a baseline value. The difference between the current data and the baseline value is then calculated to reflect the degree of anomaly. At the same time, reasonable weights are assigned to different parameters to highlight the role of key indicators in anomaly judgment. This enables the stable extraction of behavioral anomaly evaluation values that can truly reflect the abnormal situation of nodes, thereby improving detection accuracy.
[0044] Specifically, the steps for extracting the resource anomaly assessment value of the target network node are as follows:
[0045] Obtain the resource baseline set of the target network node (including CPU utilization baseline value, memory utilization baseline value, CPU per core temperature change rate baseline value, memory page fault rate baseline value, and disk I / O queue depth baseline value), and perform comprehensive processing with resource status data to obtain the resource difference set of the target network node. Specifically, the CPU utilization baseline value, memory utilization baseline value, CPU per core temperature change rate baseline value, memory page fault rate baseline value, and disk I / O queue depth baseline value are respectively compared with CPU utilization, memory utilization, CPU per core temperature change rate, memory page fault rate, and disk I / O queue depth, and the absolute value is taken to obtain the CPU utilization difference value, memory utilization difference value, CPU per core temperature change rate difference value, memory page fault rate difference value, and disk I / O queue depth difference value.
[0046] It should be noted that the steps for obtaining the resource benchmark set are as follows: taking the CPU utilization benchmark value as an example, obtain the CPU utilization of the target network node in several historical times, take the average value, and use it as the CPU utilization benchmark value.
[0047] The resource discrepancy set is standardized and then comprehensively processed to obtain the resource anomaly assessment value of the target network node. The CPU utilization difference value, memory utilization difference value, CPU per-core temperature change rate difference value, memory page fault rate difference value, and disk I / O queue depth difference value are standardized, and the standardization results are weighted to obtain the resource anomaly assessment value of the target network node. The weight coefficients corresponding to each parameter in the weighted summation process can be preset as follows: CPU utilization deviation weight 0.2, memory utilization deviation weight 0.2, CPU temperature change rate deviation weight 0.2, memory page fault rate deviation weight 0.2, and disk queue depth deviation weight 0.2.
[0048] In this implementation plan, historical operational data is used to establish corresponding benchmarks for various resource indicators of the node, which can accurately reflect the normal operating status of the equipment. By calculating the difference between the current data and the corresponding benchmark, the deviation of resource operation can be intuitively reflected. The obtained resource difference data is standardized, which allows resource indicators of different dimensions to participate in the calculation under a unified standard, thereby avoiding calculation bias caused by differences in data volume. Furthermore, the standardized difference results are weighted and integrated according to a set ratio, which can balance the impact of various resource operation anomalies. This allows for a stable resource anomaly assessment value that closely matches the actual operating conditions of the node, thereby improving the reliability of the overall judgment.
[0049] Specifically, the steps to obtain the intrusion assessment value of the target network node are as follows: Read the behavioral anomaly assessment value and the resource anomaly assessment value, and normalize them (mapping their values between 0 and 1); then input the normalized behavioral anomaly assessment value and resource anomaly assessment value into the intrusion assessment model to extract the intrusion assessment value of the target network node.
[0050] The intrusion assessment model is as follows: ;
[0051] in, The intrusion assessment value for the target network node. This is the normalized evaluation value of the target network node's behavioral anomalies. The behavior adjustment coefficient stored in the database (taken as 0.45 in this implementation example) The normalized resource anomaly assessment value of the target network node (taken as 0.3 in this implementation example). These are resource adjustment coefficients stored in the database. The collaboration enhancement coefficient is stored in the database (in this implementation example, the value is 0.25).
[0052] In this implementation plan, the behavioral anomaly assessment values and resource anomaly assessment values are first normalized to unify their data range and ensure that the two types of assessment results can participate in subsequent calculations under the same standard. This avoids deviations in the fusion results due to differences in data volume. The normalized assessment values are then input into the intrusion assessment model, and calculations are performed using the adjustment coefficient and collaborative enhancement coefficient in the model. This achieves the collaborative fusion of the two types of anomaly information, resulting in an intrusion assessment value that better reflects the actual intrusion situation, enabling the system to more accurately identify network intrusion behaviors.
[0053] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.
[0054] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A network intrusion detection system based on behavior analysis, characterized in that, Includes the following steps: The data acquisition unit is used to collect network behavior data and resource status data of the target network nodes. Anomaly assessment unit is used to extract behavioral anomaly assessment values and resource anomaly assessment values of target network nodes based on network behavior data and resource status data, respectively. The adaptive fusion unit is used to adaptively fuse the behavioral anomaly assessment value and the resource anomaly assessment value to obtain the intrusion assessment value of the target network node. The intrusion detection unit is used to perform network intrusion detection processing on target network nodes based on intrusion assessment values.
2. The network intrusion detection system based on behavior analysis according to claim 1, characterized in that, Network behavior data includes packet arrival interval, connection duration, traffic rate, TCP retransmission count, TCP zero window duration, and small packet jitter rate. Resource status data includes CPU utilization, memory utilization, CPU per core temperature change rate, memory page fault rate, and disk I / O queue depth.
3. The network intrusion detection system based on behavior analysis according to claim 2, characterized in that, The specific steps for extracting the behavioral anomaly assessment values of the target network nodes are as follows: Read network behavior data and perform normalization processing; Feature extraction is performed on the normalized network behavior data to obtain the behavior feature set of the target network node, including behavior distortion features and behavior protocol anomaly features; The behavioral feature set is comprehensively processed to obtain the behavioral anomaly evaluation value of the target network node.
4. The network intrusion detection system based on behavior analysis according to claim 3, characterized in that, The specific steps to obtain the behavioral feature set of the target network nodes are as follows: The normalized packet arrival interval, connection duration, traffic rate, and TCP retransmission count are comprehensively processed to obtain the behavioral distortion characteristics of the target network node. We perform weighted summation on the normalized TCP zero window duration and small packet jitter rate to obtain the abnormal behavior protocol characteristics of the target network node.
5. The network intrusion detection system based on behavior analysis according to claim 1, characterized in that, The specific steps for extracting the resource anomaly assessment value of the target network node are as follows: Obtain the resource baseline set of the target network node and perform comprehensive processing with the resource status data to obtain the resource difference set of the target network node; The resource discrepancy set is standardized and then comprehensively processed to obtain the resource anomaly assessment value of the target network node.
6. The network intrusion detection system based on behavior analysis according to claim 1, characterized in that, The specific steps to obtain the intrusion assessment value of the target network node are as follows: Read the behavior anomaly assessment value and resource anomaly assessment value, and perform normalization processing; The normalized behavioral anomaly assessment values and resource anomaly assessment values are then input into the intrusion assessment model to extract the intrusion assessment value of the target network node.
7. The network intrusion detection system based on behavior analysis according to claim 6, characterized in that, The intrusion assessment model is as follows: ； in, The intrusion assessment value for the target network node. This is the normalized evaluation value of the target network node's behavioral anomalies. These are the behavioral adjustment coefficients stored in the database. This represents the normalized resource anomaly assessment value of the target network node. These are resource adjustment coefficients stored in the database. These are the collaborative enhancement coefficients stored in the database.
8. The network intrusion detection system based on behavior analysis according to claim 1, characterized in that, The specific steps for performing network intrusion detection on target network nodes are as follows: Determine whether the intrusion assessment value is higher than the preset intrusion assessment threshold; If the threshold for intrusion assessment is exceeded, the target network node is determined to have been compromised, and a blocking response is initiated. If the threshold is not higher than the preset intrusion assessment threshold, the target network node is determined to be in a normal state.