Network security protection method and system based on deep learning

Abstract

The application discloses a network security protection method and system based on deep learning, and relates to the technical field of network security.The method comprises the following steps: acquiring a current traffic rate and an access type, inputting a feature recognition intelligent agent, and acquiring a preliminary security result; acquiring protection adaptation parameters, matching the protection parameters, acquiring an updated protection strategy, and acquiring an updated monitoring frequency; performing network security protection by using the protection strategy, and performing network behavior monitoring to acquire an updated traffic rate and an updated access type; and based on the updated traffic rate and the updated access type, performing iterative identification and matching until an updated security result reaches a security threshold standard.The technical problem that the existing network security protection strategy is statically fixed, the monitoring frequency lacks flexibility, and the security protection cannot be self-adaptively optimized, resulting in the fact that the protection effect and the dynamic change of the network environment are not matched is solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to network security protection methods and systems based on deep learning. Background Technology

[0002] With the rapid development of Internet technology and the deepening of digital transformation, network attack methods are becoming increasingly complex and intelligent. Traditional security protection methods based on rule matching and feature database comparison are no longer able to cope with new network threats.

[0003] However, static protection strategies cannot adapt to dynamically changing network attack patterns, resulting in significant protection lag. At the same time, fixed monitoring frequencies struggle to balance detection accuracy with system overhead; high-frequency monitoring wastes resources, while low-frequency monitoring creates detection blind spots.

[0004] In addition, existing network security protection methods lack adaptive iterative optimization mechanisms and cannot dynamically adjust the protection strength according to the real-time security situation, resulting in a mismatch between the protection effect and the network environment. Summary of the Invention

[0005] This application provides a network security protection method and system based on deep learning, which solves the technical problems of existing network security protection strategies being static and fixed, lacking flexibility in monitoring frequency, and unable to adaptively optimize security protection, resulting in a mismatch between protection effectiveness and dynamic changes in the network environment.

[0006] The technical solution to the above-mentioned technical problems in this application is as follows: Firstly, this application provides a network security protection method based on deep learning, the method comprising: Obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; Based on the preliminary security results, protection adaptation parameters are obtained, and protection parameters are matched to obtain updated protection strategies and updated monitoring frequencies. The aforementioned protection strategy is used for network security protection, and network behavior monitoring is performed based on the aforementioned update monitoring frequency to obtain update traffic rate and update access type; Based on the update traffic rate and the update access type, iterative identification and matching are performed until the update security result reaches the security threshold standard.

[0007] Secondly, this application provides a deep learning-based network security protection system, including: The information collection module is used to obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; The parameter configuration module is used to obtain protection adaptation parameters based on the preliminary security results, match the protection parameters to obtain updated protection strategies, and obtain updated monitoring frequencies. The network monitoring module is used to perform network security protection using the protection strategy and to perform network behavior monitoring based on the update monitoring frequency, thereby obtaining the update traffic rate and update access type. The iterative identification and matching module is used to perform iterative identification and matching based on the update traffic rate and the update access type until the update security result reaches the security threshold standard.

[0008] This application provides one or more technical solutions, which have at least the following technical effects or advantages: This application provides a network security protection method and system based on deep learning. First, by constructing a feature recognition intelligent agent, deep feature extraction and security posture assessment of network traffic rates and access types are performed, achieving intelligent perception and identification of network security risks. Second, based on preliminary security results, protection adaptation parameters are obtained and updated protection strategies and monitoring frequencies are matched and updated, enabling adaptive adjustment of protection strength and monitoring granularity, allowing security protection to be dynamically optimized according to real-time network conditions. Third, an iterative identification and matching mechanism continuously updates security results, forming a closed-loop feedback control to ensure that the security protection effect continuously approaches and reaches the security threshold standard. Finally, a deep learning technology is used to construct an intelligent agent model, which can automatically learn the potential correlations of network behaviors, enhancing the detection capability of unknown threats and mutated attacks, thereby comprehensively improving the intelligence level and overall protection effectiveness of network security protection.

[0009] Through the above technical solution, this application realizes intelligent analysis of network behavior by constructing a feature recognition intelligent agent. Combined with adaptive parameter configuration and iterative recognition and matching mechanism, it achieves dynamic optimization of protection strategy and monitoring frequency, effectively improving the real-time performance and accuracy of network security protection. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart illustrating the network security protection method based on deep learning provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a deep learning-based network security protection system provided in an embodiment of this application.

[0012] The components represented by each number in the attached diagram are explained below: Information acquisition module 11, parameter configuration module 12, network monitoring module 13, iterative identification and matching module 14. Detailed Implementation

[0013] This application provides a network security protection method and system based on deep learning to address the technical problems of existing network security protection strategies being static and fixed, lacking flexibility in monitoring frequency, and being unable to adaptively optimize security protection, resulting in a mismatch between protection effectiveness and dynamic changes in the network environment.

[0014] Example 1, as Figure 1 As shown in the embodiments of this application, a network security protection method based on deep learning is provided, including: S10: Obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; In this embodiment of the application, traffic probes deployed at key network nodes collect data packets of the network to be monitored in real time, parse and obtain the amount of data transmission per unit time as the current traffic rate, and extract the access type in the network access request.

[0015] Secondly, the current traffic rate and access type are combined into a feature vector, which is then input into a feature recognition agent. This agent is built based on a deep learning model and can capture the spatial correlation between traffic temporal features and access patterns, outputting preliminary security results.

[0016] Specifically, step S10 in the method includes: Obtain the current traffic rate and access type, wherein the current traffic rate is the amount of data transmitted in the network to be monitored per unit time, and the access type is the request method and request target of network access; A smoothed flow rate is obtained by performing a moving average calculation on the current flow rate; The frequency of each access type is counted within a preset time window, and the frequency distribution of each access type is obtained. The smooth traffic rate and the access type frequency distribution are input into the feature recognition agent to obtain preliminary security results, wherein the preliminary security results include security risk parameters and risk categories.

[0017] In this embodiment of the application, firstly, the current traffic rate and access type are obtained. The current traffic rate is the amount of data transmitted in the network to be monitored per unit time, reflecting the real-time load status of network transmission; the access type is the request method and request target of network access, characterizing the behavioral pattern characteristics of network access.

[0018] Secondly, applying a moving average to the current flow rate can effectively eliminate noise interference caused by instantaneous flow fluctuations, making the flow characteristics more stable and reliable. The moving average calculation uses a preset window length to perform a weighted average of continuous time series data. The selection of the window length needs to balance the smoothing effect and the response sensitivity, and is usually set to 5 to 10 sampling periods.

[0019] Furthermore, by maintaining a type counter within a sliding time window, the frequency distribution of access types is statistically analyzed, i.e., the frequency of occurrence of each access type. Whenever a new access request arrives, the corresponding type count is updated, and historical records exceeding the time window are removed, thereby dynamically reflecting the evolution trend of access patterns.

[0020] Furthermore, the input layer of the feature recognition agent receives the preprocessed smooth traffic rate and access type frequency distribution, maps the discrete type features into continuous vector representations through the embedding layer, extracts local spatiotemporal features through a multi-layer convolutional neural network, and finally outputs the regression estimate of security risk parameters and the classification probability distribution of risk categories through a fully connected layer.

[0021] Among them, the security risk parameters are represented by normalized values, ranging from 0 to 1. The closer the value is to 1, the higher the security risk faced by the network. The risk categories include a variety of preset types such as normal access, abnormal scanning, and malicious attacks.

[0022] Furthermore, the construction of the feature recognition agent includes: Acquire historical network behavior data, including historical traffic rates and historical access types, and obtain the raw dataset; The historical network behavior data is security-labeled to obtain corresponding security risk parameters and risk categories as labels, and a training label set is constructed. The historical flow rates in the original dataset are processed by a moving average to obtain the historical smoothed flow rates. The frequency of historical access types within a preset time window is statistically analyzed to obtain the frequency distribution of historical access types. The historical smooth traffic rate and the frequency distribution of historical access types are used as training feature sets. A feature recognition intelligent agent framework is constructed based on deep learning. The model is trained using the training feature set and the training label set until convergence, thereby obtaining the feature recognition intelligent agent.

[0023] In this embodiment of the application, firstly, historical traffic rates and historical access types are extracted from historical network traffic logs and access records to form an original dataset. This original data covers a variety of network conditions, including normal business peaks, abnormal traffic fluctuations, and known attack samples, in order to ensure the generalization ability of the model training.

[0024] Secondly, the original dataset was manually labeled. Based on the attack signature database and security incident response records, each piece of historical network behavior data was labeled with corresponding security risk parameters and risk categories. Security risk parameters were determined using an expert scoring method, comprehensively considering factors such as attack severity, concealment, and propagation. Risk categories were labeled according to a pre-defined classification system, including types such as normal traffic, port scanning, brute-force attacks, denial-of-service attacks, and malware communication.

[0025] Secondly, the historical traffic rates in the original dataset are processed using the same moving average method as in the real-time monitoring phase, with the same window length and weighting coefficients, to ensure consistency between the distribution of training and inference data, thus obtaining smooth historical traffic rates. Simultaneously, the frequency of historical access types is statistically analyzed according to the same time window to construct a historical access type frequency distribution, forming a training feature set aligned with the real-time processing workflow.

[0026] Furthermore, the feature recognition intelligent agent framework adopts an encoder-decoder structure. The encoder part consists of a stack of one-dimensional convolutional neural networks and bidirectional long short-term memory networks. The one-dimensional convolutional neural network is used to extract local temporal features of traffic rate, and the bidirectional long short-term memory network is used to model the long-term dependency of access type frequency distribution. The decoder part fuses the implicit representations of the two types of features through an attention mechanism, and outputs the regression value of security risk parameters and the probability distribution of risk categories through two independent fully connected branches.

[0027] During model training, the mean squared error loss function is used to optimize the regression accuracy of safety risk parameters, and the cross-entropy loss function is used to optimize the classification accuracy of risk categories. The total loss function is a weighted combination of the two. Parameters are updated using the Adam optimizer, and the learning rate is dynamically adjusted using a cosine annealing strategy. An early stopping mechanism is introduced to prevent overfitting. Training iterations continue until the validation set loss no longer decreases for several consecutive epochs. After the model converges, the optimal weight parameters are saved, thus obtaining a feature recognition agent that can be used for real-time inference.

[0028] For example, the steps for training a feature recognition agent based on deep learning are as follows: First, the traffic rate sequence is smoothed using a moving average kernel with a window length of 8 and Gaussian weighting coefficients to eliminate instantaneous peaks caused by network jitter. Access type frequency statistics are then processed using a 5-minute sliding window, sliding every 30 seconds to generate time-series type distribution features. The processed historical smoothed traffic rates and historical access type frequency distributions are then concatenated time-aligned to form a 256-dimensional feature vector. Simultaneously, security risk parameters and risk category labels for the corresponding time points are extracted and divided into training, validation, and test sets in an 8:1:1 ratio.

[0029] Secondly, a network architecture for the feature recognition agent is constructed. The input layer receives a 256-dimensional feature vector, which is then reduced in dimensionality by two layers of one-dimensional convolutions with kernel sizes of 7 and 3, and the number of channels increases from 64 to 128. Each layer is followed by batch normalization and ReLU activation. The convolutional output is connected to a bidirectional long short-term memory network with 256 hidden units and a dropout ratio of 0.3 to suppress overfitting. The memory network output captures the feature associations at key time steps by combining a scaled dot product attention mechanism with positional encoding. Finally, the output is passed through two parallel fully connected layers. The regression branch output layer uses Sigmoid activation to obtain the safety risk parameters, and the classification branch output layer uses Softmax activation to obtain a 12-dimensional risk category probability distribution.

[0030] Furthermore, the batch size was set to 512, and the total loss function was a linear combination of mean squared error loss and weighted cross-entropy loss, with a weight ratio of 3:7. The AdamW optimizer was used with an initial learning rate of 1e-3, which decayed to 1e-5 over 100 epochs using a cosine annealing strategy. The warm-up phase comprised 10% of the iteration cycle. A label smoothing coefficient of 0.1 and mixed-precision training were introduced to accelerate convergence. The early stopping patience value was set to 15 training epochs; stopping was triggered when the overall F1 score on the validation set failed to improve continuously, resulting in a trained feature recognition agent.

[0031] S20: Based on the preliminary security results, obtain the protection adaptation parameters, match the protection parameters to obtain the updated protection strategy, and obtain the updated monitoring frequency; In this embodiment, based on the security risk parameters and risk categories in the preliminary security results, the current protection parameters are calculated. This index comprehensively considers the magnitude of the security risk parameters and the hazard level of the risk category, and is determined using a weighted mapping method. When the security risk parameters exceed a preset warning threshold or the risk category belongs to a high-risk attack type, the protection strength requirement index is increased accordingly. Specifically, the normalized value of the security risk parameter is multiplied by the hazard coefficient of the risk category, and then processed by a nonlinear activation function to obtain a protection strength requirement index ranging from 0 to 1. The closer the value is to 1, the higher the required protection strength.

[0032] Secondly, the protection policy mapping table is queried based on the protection strength requirement index to obtain protection adaptation parameters. The protection policy mapping table pre-stores combinations of protection rules corresponding to different protection strength requirement index ranges, including parameter configurations such as access control granularity, intrusion detection sensitivity, traffic scrubbing threshold, and session authentication strength. Then, the monitoring frequency is calculated and updated based on the protection adaptation parameters. The monitoring frequency is positively correlated with the protection strength requirement index; that is, the higher the protection strength requirement index, the higher the monitoring frequency, in order to achieve awareness of high-risk network situations.

[0033] Specifically, step S20 in the method includes: Based on the security risk parameters and current protection parameters in the preliminary security results, protection adaptation parameters are obtained, wherein the protection adaptation parameters include protection parameter adaptation values ​​and protection type adaptation values; Based on the protection adaptation parameters, match the protection parameters and obtain the updated protection strategy; The updated monitoring frequency is obtained based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency.

[0034] In this embodiment, firstly, based on the security risk parameters and current protection parameters in the preliminary security results, protection adaptation parameters are obtained, including protection parameter adaptation values ​​and protection type adaptation values. The protection parameter adaptation value is obtained by calculating the difference between the security risk parameter and the current protection strength level. If the security risk parameter is significantly higher than the current protection strength level, a positive adaptation instruction is generated, indicating an increase in protection strength; otherwise, a negative adaptation instruction or a maintenance instruction is generated. The protection type adaptation value is determined based on the matching degree between the risk category and the current access control rule set and intrusion detection signature database version. When a new attack type or a mutated attack pattern is detected, a rule set update instruction or a signature database upgrade instruction is triggered.

[0035] Secondly, based on the protection adaptation parameters, protection parameters are matched to obtain updated protection strategies. Specifically, the protection parameter adaptation values ​​are mapped to preset protection strength level ranges, and the protection strength level configuration table is queried to obtain the corresponding access control policies, intrusion detection rule sets, and traffic cleaning parameter combinations. The protection type adaptation values ​​trigger the activation of specific types of protection modules or rule base update operations, such as enabling a deep packet inspection engine for SQL injection attacks and initiating a traffic redirection and cleaning center linkage mechanism for distributed denial-of-service attacks.

[0036] Furthermore, based on the ratio of safety risk parameters to safety thresholds and the current monitoring frequency, the monitoring frequency is calculated and updated. A safety threshold is set as a baseline reference value. When the safety risk parameter equals the safety threshold, the monitoring frequency remains at the current level. When the safety risk parameter is higher than the safety threshold, the monitoring frequency increases linearly according to the ratio coefficient to achieve high-frequency perception of high-risk situations. When the safety risk parameter is lower than the safety threshold, the monitoring frequency is appropriately reduced to avoid resource waste caused by over-monitoring.

[0037] Specifically, based on the protection adaptation parameters, matching protection parameters and obtaining updated protection strategies include: Based on the mapping relationship between the security risk parameters and the preset risk level, the protection strength adjustment coefficient is determined; Multiply the current protection parameter by the protection strength adjustment coefficient to obtain the protection parameter adaptation value; Based on the risk categories in the preliminary security results, a preset protection type mapping table is matched to obtain the protection type adaptation value; The protection parameter adaptation value and the protection type adaptation value are integrated into an updated protection strategy.

[0038] In this embodiment, firstly, the protection intensity adjustment coefficient is determined based on the mapping relationship between safety risk parameters and preset risk levels. The preset risk levels are divided into four intervals: low-risk, medium-risk, high-risk, and emergency. Each interval corresponds to a different protection intensity adjustment coefficient. The coefficient for the low-risk interval is 0.8 to 1.0, indicating that the protection intensity can be appropriately reduced or the status quo can be maintained; the coefficient for the medium-risk interval is 1.0 to 1.3, indicating that protection needs to be moderately enhanced; the coefficient for the high-risk interval is 1.3 to 1.8, indicating that the protection intensity needs to be increased; and the coefficient for the emergency interval is 1.8 to 2.5, indicating that the highest level of protection response needs to be activated. After the safety risk parameters fall into the corresponding interval, the specific adjustment coefficient value is determined by linear interpolation.

[0039] Secondly, the current protection parameters are multiplied by the protection strength adjustment factor to obtain the protection parameter adaptation value. The current protection parameters include quantitative indicators such as the number of access control list entries, intrusion detection rule trigger threshold, traffic scrubbing bandwidth limit, and session timeout time. After multiplying by the adjustment factor, a new parameter configuration is generated to ensure that the protection capability matches the current security posture.

[0040] For example, when the protection strength adjustment coefficient is 1.5 and the current protection parameter is an intrusion detection rule trigger threshold of 100 times / minute, the protection parameter adaptation value is adjusted to 150 times / minute, that is, the trigger threshold is lowered to improve detection sensitivity.

[0041] Next, based on the risk categories in the preliminary security results, a pre-defined protection type mapping table is used to obtain the protection type adaptation value. The protection type mapping table establishes a correspondence between risk categories and the activation status of protection modules, the activation of dedicated detection engines, and the linkage response mechanism. For anomaly scanning risks, a port scanning detection engine and honeypot trapping system are activated; for brute-force attack risks, an account locking mechanism and CAPTCHA challenge response are activated; for denial-of-service attack risks, traffic redirection, cleaning center linkage, and source address verification mechanisms are initiated; and for malware communication risks, deep packet inspection, domain reputation lookup, and C&C channel blocking functions are enabled.

[0042] Finally, the protection parameter adaptation values ​​and protection type adaptation values ​​are integrated into an updated protection policy. The updated protection policy is output in a structured data format, including policy identifier, effective timestamp, parameter configuration set, module activation list and linkage response plan. It is distributed to execution nodes such as network boundary firewall, intrusion prevention system, traffic scrubbing device and endpoint security agent through the policy distribution interface to realize dynamic reconstruction of protection capabilities.

[0043] Further, based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency, an updated monitoring frequency is obtained, including: The frequency update coefficient is obtained based on the ratio of the security risk parameter to the security threshold; Calculate the rate of change of the safety risk parameter relative to the previous moment, correct the frequency update coefficient, and obtain the corrected frequency update coefficient; The updated monitoring frequency is obtained by multiplying the current monitoring frequency by the corrected frequency update coefficient.

[0044] In this embodiment, the frequency update coefficient is first obtained by calculating "frequency update coefficient = current security risk parameter ÷ security threshold". When the current security risk parameter equals the security threshold, the frequency update coefficient is 1, indicating that the monitoring frequency remains at the current level. When the current security risk parameter is greater than the security threshold, the frequency update coefficient is greater than 1, and the monitoring frequency needs to be increased accordingly. When the base frequency update coefficient is less than the security threshold, the frequency update coefficient is less than 1, and the monitoring frequency can be appropriately reduced to save computing resources. To avoid excessive fluctuations in the frequency update coefficient, upper and lower limits are set, limiting the value range of the frequency update coefficient to between 0.3 and 5.0, ensuring that the monitoring frequency will not change drastically due to slight fluctuations in the security situation, nor will it lose the ability to perceive the network situation in extremely high-risk scenarios.

[0045] Secondly, the rate of change of the security risk parameters relative to the previous moment is calculated to correct the frequency update coefficients. The changing trend of the security risk parameters reflects the dynamic evolution of network threats, and adjusting the monitoring frequency solely based on the current static values ​​may lead to a response lag. Therefore, a rate of change correction mechanism is introduced, which is: "Rate of change = (Security risk parameter - Security risk parameter at the previous moment) ÷ Time interval between the current moment and the previous moment". The direction and intensity of the correction are determined based on the sign and magnitude of the rate of change.

[0046] Specifically, when the rate of change is positive and its absolute value exceeds a preset acceleration threshold, it indicates that the security situation is rapidly deteriorating. A positive correction is added to the base frequency update coefficient, and the corrected frequency update coefficient = frequency update coefficient × (1 + α·arctan(β × rate of change)), where α is the acceleration coefficient and β is the sensitivity adjustment parameter. When the rate of change is negative and its absolute value exceeds a preset deceleration threshold, it indicates that the security threat is receding, and the frequency update coefficient can be appropriately reduced to avoid over-monitoring. The corrected frequency update coefficient = frequency update coefficient × (1 - γ·arctan(δ|rate of change|)), where γ is the deceleration coefficient and δ is the receding sensitivity parameter. When the absolute value of the rate of change is within the threshold range, the base frequency update coefficient remains unchanged, and the corrected frequency update coefficient = frequency update coefficient. By introducing a nonlinear arctangent function, both a sensitive response to drastic changes and the suppression of frequent adjustments caused by small fluctuations are ensured.

[0047] Next, the current monitoring frequency is multiplied by the corrected frequency update coefficient to obtain the updated monitoring frequency, i.e., "updated monitoring frequency = current monitoring frequency × corrected frequency update coefficient". The updated monitoring frequency is also subject to upper and lower limits. The minimum monitoring frequency is not lower than the critical value of the system's basic perception requirements to ensure that the monitoring capability will not be completely lost even during periods of stable security. The maximum monitoring frequency does not exceed the peak processing capacity of the data processing system to avoid inference delays or data loss of the feature recognition agent due to overload of monitoring tasks.

[0048] Furthermore, after the monitoring frequency is updated and determined, the sampling interval of the traffic data acquisition module, the sliding step size of the feature extraction window, and the inference triggering conditions of the feature recognition agent are adjusted synchronously to achieve frequency adaptation across the entire chain from data acquisition to intelligent analysis.

[0049] For example, assuming the current security threshold T is set to 0.5, and the current monitoring frequency is feature inference once per second. When a security risk parameter R of 0.75 is detected, the frequency update coefficient is 0.75 ÷ 0.5 = 1.5, and the monitoring frequency is initially adjusted to 1.5 times per second. If the rate of change of the security risk parameter relative to the previous moment is 0.2 per second, exceeding the preset acceleration threshold of 0.1, and α = 0.3 and β = 5, then the corrected frequency update coefficient = 1.5 × (1 + 0.3 × arctan(5 × 0.2)) ≈ 1.5 × (1 + 0.3 × 0.785) = 1.853, the monitoring frequency is updated to 1.854 times per second, and after rounding, feature inference is performed twice per second. At the same time, the traffic data collection interval is shortened from 100 milliseconds to 54 milliseconds, and the feature extraction window sliding step size is adjusted from 30 seconds to 16 seconds, realizing rapid tracking of the deterioration trend of the security situation.

[0050] S30: The protection strategy is used to protect the network security, and network behavior is monitored based on the update monitoring frequency to obtain the update traffic rate and update access type; In this embodiment, the updated protection strategy is deployed to each execution node of the network security protection system, and a dynamic protection mechanism is activated. Simultaneously, network behavior monitoring is reconstructed based on the update monitoring frequency to calculate the update traffic rate and update access type.

[0051] Specifically, step S30 in the method includes: The aforementioned updated protection strategy is used for network security protection. According to the aforementioned update monitoring frequency, the current traffic rate and access type of the network to be monitored are re-collected as the original update data; A smoothed update flow rate is obtained by performing a moving average calculation on the flow rate in the original update data. The frequency distribution of update access types is obtained by statistically analyzing the frequency of occurrence of access types in the original update data within a preset time window. The smooth update traffic rate and the frequency distribution of the update access type are used as the update traffic rate and update access type.

[0052] In this embodiment, network security protection is first implemented by updating the protection strategy. This includes distributing the parameter configuration set in the updated protection strategy to the network boundary firewall to dynamically adjust the matching rules and execution actions of the access control list; pushing the intrusion detection rule set update instruction to the intrusion prevention system to activate or deactivate specific detection features; sending the traffic scrubbing parameter configuration to the scrubbing center device to adjust the scrubbing threshold and redirection strategy; and synchronizing the session authentication strength parameter to the identity authentication gateway to strengthen multi-factor authentication or shorten the token validity period. After receiving the strategy, each execution node switches to the new strategy state at a preset effective timestamp and returns a strategy confirmation receipt, forming a closed-loop verification of the protection strategy execution.

[0053] Secondly, the current traffic rate and access type of the network under monitoring are re-collected according to the update monitoring frequency, serving as the original update data. Traffic rate collection is achieved through traffic mirroring ports or optical splitters deployed on critical network paths, recording the number of data packets and the total number of bytes per unit time. Access type collection is based on deep packet inspection technology, parsing application layer protocol identifiers, target service ports, and traffic behavior characteristics, classifying them into preset types such as web access, database access, file transfer, remote login, and email communication. The collection frequency is dynamically adjusted according to the update monitoring frequency; when the monitoring frequency increases, the sampling interval is shortened accordingly to ensure that the rhythm of data collection and intelligent analysis is matched.

[0054] Next, a moving average is calculated on the flow rate in the original updated data to obtain a smoothed updated flow rate. For example, an exponentially weighted moving average algorithm is used, with a smoothing factor of 0.3, to filter the original flow rate sequence, suppressing spurious fluctuations caused by instantaneous flow spikes or acquisition noise, while preserving the trend characteristics of flow changes. The sliding window length is adaptively adjusted according to the update monitoring frequency; when the monitoring frequency is high, the window length is shortened to improve response sensitivity, and when the monitoring frequency is low, the window length is extended to enhance trend stability.

[0055] Then, the frequency of access types in the original update data within a preset time window is statistically analyzed to obtain the frequency distribution of update access types. The width of the preset time window is inversely proportional to the update monitoring frequency; the higher the monitoring frequency, the narrower the time window to capture short-term evolution of access patterns; the lower the monitoring frequency, the wider the time window to reflect long-term characteristics of the access structure. The frequency distribution is represented in vector form, with each dimension corresponding to the normalized frequency of occurrence of the preset access type, and the vector dimension equal to the total number of categories in the access type classification system.

[0056] Finally, the smooth update traffic rate and the frequency distribution of the update access type are used as the update traffic rate and update access type, and output to the subsequent security situation assessment and strategy optimization stages to form a dynamic cycle of "monitoring-analysis-decision-execution-remonitoring".

[0057] S40: Based on the update traffic rate and the update access type, perform iterative identification and matching until the update security result reaches the security threshold standard.

[0058] The acquisition of the security threshold standard includes: Obtain historical security risk parameter sequences from historical network behavior data; Calculate the mean and standard deviation of the historical safety risk parameter sequence, and use the sum of the mean and the standard deviation of a preset multiple as the safety threshold standard, wherein the preset multiple is obtained based on the distribution characteristics of the historical safety risk parameter sequence.

[0059] In this embodiment of the application, to obtain the security threshold standard, the first step is to obtain the historical security risk parameter sequence of historical network behavior data. The construction of the historical security risk parameter sequence needs to cover the complete network operation cycle, including normal business periods, peak traffic periods and known security event periods, to ensure the comprehensiveness and representativeness of the statistical characteristics.

[0060] Secondly, the sum of the standard deviations of the mean and a preset multiple is used as the safety threshold standard. The preset multiple is dynamically determined based on the distribution characteristics of the historical safety risk parameter sequence. When the historical data shows an approximately normal distribution, the preset multiple is set to 3 using the 3σ principle, so that the safety threshold standard covers approximately 99.7% of the historical normal fluctuation range. When the historical data shows a skewed distribution or has heavy tails, a robust estimation method based on quantiles is used to adjust the preset multiple to the quantile offset corresponding to the 95% or 99% confidence level, avoiding excessive influence of extreme outliers on the threshold calculation.

[0061] For example, suppose that the mean of the historical security risk parameter sequence collected by a network system in the past 30 days is 0.35 and the standard deviation is 0.12. It has been verified that the sequence approximately follows a normal distribution. Using the 3σ principle, the preset multiple is set to 3. Then the security threshold standard = 0.35 + 3 × 0.12 = 0.71. This threshold means that when the real-time security risk parameter exceeds 0.71, it is determined that the current network situation deviates from the historical normal baseline and an enhanced protection response needs to be initiated.

[0062] Based on the update traffic rate and update access type output above, the update security result is compared with the security threshold, and iterative identification and matching are performed until the update security result reaches the security threshold standard.

[0063] Specifically, step S40 in the method includes: Input the update traffic rate and update access type into the feature recognition agent to obtain the update security result; The difference between the updated security result and the security threshold standard is calculated to obtain the security deviation value; When the updated security result is greater than the security threshold standard, and the security deviation value is less than the preset deviation tolerance, network security protection is completed. When the updated security result is less than or equal to the security threshold standard, iterative identification and matching are performed based on the updated security result until the updated security result reaches the security threshold standard.

[0064] In this embodiment, firstly, the updated traffic rate and updated access type are input into a feature recognition agent. Based on a deep neural network architecture, the feature recognition agent jointly encodes and determines threats using the temporal features of the input traffic rate and the distribution features of the access type, outputting a quantitative assessment value of the current network situation's security risks. The input features are mapped to a high-dimensional representation space through a pre-trained feature extraction layer. A multi-scale temporal convolution module captures short-term fluctuations and long-term trends in the traffic rate. Simultaneously, an attention mechanism is used to weight and focus on abnormal patterns in the frequency distribution of access types, ultimately fusing and outputting an updated security result.

[0065] Secondly, the difference between the updated safety result and the safety threshold standard is calculated to obtain the safety deviation value, that is, "safety deviation value = updated safety result - safety threshold standard". The sign and magnitude of the safety deviation value directly reflect the gap between the current protection effect and the expected goal.

[0066] Secondly, when the updated security result exceeds the security threshold standard and the security deviation value is less than the preset deviation tolerance, the network security protection is deemed to have achieved the expected effect, completing the current round of dynamic protection cycle. The preset deviation tolerance is set to balance response speed and system stability, typically ranging from 5% to 10% of the security threshold standard, to avoid minor fluctuations near the threshold boundary triggering unnecessary policy oscillations. At this point, the current protection strategy and monitoring frequency are maintained, and routine situational awareness continues until the next risk assessment cycle begins or a sudden security event triggers new dynamic adjustments.

[0067] Furthermore, when the updated security result is less than or equal to the security threshold standard, it indicates that the current protection strength is insufficient to suppress the evolution of security threats, or the network situation has not yet recovered to an acceptable level, and an iterative identification and matching mechanism needs to be initiated based on the updated security result.

[0068] Specifically, the iterative process includes: using the updated security results as new security risk parameter inputs, re-executing the protection strategy generation and monitoring frequency update process to form an enhanced protection strategy and a higher frequency monitoring configuration; deploying the iterated protection strategy and monitoring parameters to the execution nodes to collect a new round of network behavior data; and performing feature identification and security assessment again until the updated security results exceed the security threshold standard and meet the deviation tolerance conditions.

[0069] A convergence control mechanism is introduced during the iteration process to prevent infinite loops or strategy divergence. A maximum limit is set for the number of iterations, usually 3 to 5. If the convergence condition is not met even after reaching the limit, a manual intervention alarm is triggered or the highest level emergency response plan is activated. At the same time, the trend of the change in the safety deviation value between adjacent iterations is monitored. If the improvement of the deviation value is less than the preset stagnation threshold for two consecutive iterations, it is determined that the iteration has fallen into a local optimum, and an exploratory strategy perturbation is actively introduced.

[0070] For example, assume the current security threshold standard is 0.71 and the preset deviation tolerance is 0.07. In the first iteration, the updated security result output by the feature recognition agent is 0.65, and the security deviation value = 0.65 - 0.71 = -0.06, which is less than zero and the absolute value exceeds the deviation tolerance, indicating insufficient protection. Using 0.65 as the new security risk parameter, the frequency update coefficient is recalculated as 0.65 ÷ 0.71 ≈ 0.915. After correction based on the current rate of change feature, an enhanced protection strategy is generated.

[0071] The matching granularity of the firewall's access control list has been refined from five-tuples to seven-tuples, increasing application-layer load depth detection; the detection mode of the intrusion prevention system has been switched from alarm mode to blocking mode; the cleaning threshold of the traffic scrubbing center has been lowered from 100,000 packets per second to 50,000 packets per second, increasing the proportion of abnormal traffic redirection; the single-factor authentication of the session authentication gateway has been forcibly upgraded to two-factor authentication, and the access token validity period has been shortened to one-third of its original length. Simultaneously, the monitoring frequency has been increased from once per second to 1.5 times per second, the traffic data collection interval has been shortened from 100 milliseconds to 67 milliseconds, and the feature extraction window sliding step size has been adjusted from 30 seconds to 20 seconds.

[0072] Furthermore, after deploying the enhanced protection strategy, a second round of data collection and feature recognition is conducted. Assuming the updated security result reaches 0.73, the security deviation value = 0.73 - 0.71 = 0.02, which is less than the preset deviation tolerance of 0.07, and the updated security result is greater than the security threshold standard, it is determined that the network security protection has achieved the expected effect, the dynamic protection cycle is completed, the strategy parameters and convergence path of this iteration are recorded, the reinforcement learning experience pool of the feature recognition agent is updated, and the efficiency of strategy generation under similar future situations is optimized.

[0073] In summary, compared with existing technologies, this application realizes a paradigm shift in network security protection from static rule matching to adaptive intelligent decision-making by constructing a closed-loop collaborative architecture of feature recognition intelligent agent and dynamic policy generation mechanism.

[0074] In summary, the embodiments of this application have at least the following technical effects: This application provides a deep learning-based network security protection method. First, by constructing a feature recognition intelligent agent, deep feature extraction and security posture assessment of network traffic rates and access types are performed, achieving intelligent perception and identification of network security risks. Second, based on preliminary security results, protection adaptation parameters are obtained and updated protection strategies and monitoring frequencies are matched and updated, enabling adaptive adjustment of protection strength and monitoring granularity, allowing security protection to be dynamically optimized according to real-time network conditions. Third, an iterative recognition and matching mechanism continuously updates security results, forming a closed-loop feedback control to ensure that the security protection effect continuously approaches and reaches the security threshold standard. Finally, a deep learning technology is used to construct an intelligent agent model, which can automatically learn the potential correlations of network behaviors, enhancing the detection capability of unknown threats and variant attacks, thereby comprehensively improving the intelligence level and overall protection effectiveness of network security protection.

[0075] Through the above technical solution, this application realizes intelligent analysis of network behavior by constructing a feature recognition intelligent agent. Combined with adaptive parameter configuration and iterative recognition and matching mechanism, it achieves dynamic optimization of protection strategy and monitoring frequency, effectively improving the real-time performance and accuracy of network security protection.

[0076] Example 2, as Figure 2 As shown, based on the same inventive concept as the deep learning-based network security protection method provided in Embodiment 1, this application also provides a deep learning-based network security protection system, including: Information acquisition module 11 is used to obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; The parameter configuration module 12 is used to obtain protection adaptation parameters based on the preliminary security results, match the protection parameters to obtain updated protection strategies, and obtain updated monitoring frequencies. The network monitoring module 13 is used to perform network security protection using the protection strategy and to perform network behavior monitoring based on the update monitoring frequency, thereby obtaining update traffic rate and update access type. The iterative identification and matching module 14 is used to perform iterative identification and matching based on the update traffic rate and the update access type until the update security result reaches the security threshold standard.

[0077] In one embodiment, the information acquisition module 11 is specifically used for: Obtain the current traffic rate and access type, wherein the current traffic rate is the amount of data transmitted in the network to be monitored per unit time, and the access type is the request method and request target of network access; A smoothed flow rate is obtained by performing a moving average calculation on the current flow rate; The frequency of each access type is counted within a preset time window, and the frequency distribution of each access type is obtained. The smooth traffic rate and the access type frequency distribution are input into the feature recognition agent to obtain preliminary security results, wherein the preliminary security results include security risk parameters and risk categories.

[0078] Furthermore, in one embodiment of the application, the construction of the feature recognition agent includes: Acquire historical network behavior data, including historical traffic rates and historical access types, and obtain the raw dataset; The historical network behavior data is security-labeled to obtain corresponding security risk parameters and risk categories as labels, and a training label set is constructed. The historical flow rates in the original dataset are processed by a moving average to obtain the historical smoothed flow rates. The frequency of historical access types within a preset time window is statistically analyzed to obtain the frequency distribution of historical access types. The historical smooth traffic rate and the frequency distribution of historical access types are used as training feature sets. A feature recognition intelligent agent framework is constructed based on deep learning. The model is trained using the training feature set and the training label set until convergence, thereby obtaining the feature recognition intelligent agent.

[0079] In one embodiment, the parameter configuration module 12 is specifically used for: Based on the security risk parameters and current protection parameters in the preliminary security results, protection adaptation parameters are obtained, wherein the protection adaptation parameters include protection parameter adaptation values ​​and protection type adaptation values; Based on the protection adaptation parameters, match the protection parameters and obtain the updated protection strategy; The updated monitoring frequency is obtained based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency.

[0080] Furthermore, in one embodiment, obtaining an updated monitoring frequency based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency includes: The frequency update coefficient is obtained based on the ratio of the security risk parameter to the security threshold; Calculate the rate of change of the safety risk parameter relative to the previous moment, correct the frequency update coefficient, and obtain the corrected frequency update coefficient; The updated monitoring frequency is obtained by multiplying the current monitoring frequency by the corrected frequency update coefficient.

[0081] Furthermore, based on the protection adaptation parameters, the protection parameters are matched to obtain the updated protection strategy, including: Based on the mapping relationship between the security risk parameters and the preset risk level, the protection strength adjustment coefficient is determined; Multiply the current protection parameter by the protection strength adjustment coefficient to obtain the protection parameter adaptation value; Based on the risk categories in the preliminary security results, a preset protection type mapping table is matched to obtain the protection type adaptation value; The protection parameter adaptation value and the protection type adaptation value are integrated into an updated protection strategy.

[0082] Furthermore, the network monitoring module 13 is specifically used for: The aforementioned updated protection strategy is used for network security protection. According to the aforementioned update monitoring frequency, the current traffic rate and access type of the network to be monitored are re-collected as the original update data; A smoothed update flow rate is obtained by performing a moving average calculation on the flow rate in the original update data. The frequency distribution of update access types is obtained by statistically analyzing the frequency of occurrence of access types in the original update data within a preset time window. The smooth update traffic rate and the frequency distribution of the update access type are used as the update traffic rate and update access type.

[0083] Furthermore, the iterative identification and matching module 14 is specifically used for: Input the update traffic rate and update access type into the feature recognition agent to obtain the update security result; The difference between the updated security result and the security threshold standard is calculated to obtain the security deviation value; When the updated security result is greater than the security threshold standard, and the security deviation value is less than the preset deviation tolerance, network security protection is completed. When the updated security result is less than or equal to the security threshold standard, iterative identification and matching are performed based on the updated security result until the updated security result reaches the security threshold standard.

[0084] Furthermore, obtaining the security threshold standard includes: Obtain historical security risk parameter sequences from historical network behavior data; Calculate the mean and standard deviation of the historical safety risk parameter sequence, and use the sum of the mean and the standard deviation of a preset multiple as the safety threshold standard, wherein the preset multiple is obtained based on the distribution characteristics of the historical safety risk parameter sequence.

Claims

1. A network security protection method based on deep learning, characterized in that, include: Obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; Based on the preliminary security results, protection adaptation parameters are obtained, and protection parameters are matched to obtain updated protection strategies and updated monitoring frequencies. The aforementioned protection strategy is used for network security protection, and network behavior monitoring is performed based on the aforementioned update monitoring frequency to obtain update traffic rate and update access type; Based on the update traffic rate and the update access type, iterative identification and matching are performed until the update security result reaches the security threshold standard.

2. The network security protection method based on deep learning according to claim 1, characterized in that, Obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results, including: Obtain the current traffic rate and access type, wherein the current traffic rate is the amount of data transmitted in the network to be monitored per unit time, and the access type is the request method and request target of network access; A smoothed flow rate is obtained by performing a moving average calculation on the current flow rate; The frequency of each access type is counted within a preset time window, and the frequency distribution of each access type is obtained. The smooth traffic rate and the access type frequency distribution are input into the feature recognition agent to obtain preliminary security results, wherein the preliminary security results include security risk parameters and risk categories.

3. The network security protection method based on deep learning according to claim 2, characterized in that, The construction of the feature recognition agent includes: Acquire historical network behavior data, including historical traffic rates and historical access types, and obtain the raw dataset; The historical network behavior data is security-labeled to obtain corresponding security risk parameters and risk categories as labels, and a training label set is constructed. The historical flow rates in the original dataset are processed by a moving average to obtain the historical smoothed flow rates. The frequency of historical access types within a preset time window is statistically analyzed to obtain the frequency distribution of historical access types. The historical smooth traffic rate and the frequency distribution of historical access types are used as training feature sets. A feature recognition intelligent agent framework is constructed based on deep learning. The model is trained using the training feature set and the training label set until convergence, thereby obtaining the feature recognition intelligent agent.

4. The network security protection method based on deep learning according to claim 1, characterized in that, Based on the preliminary security results, protection adaptation parameters are obtained, and updated protection strategies are obtained by matching the protection parameters. The update monitoring frequency is also obtained, including: Based on the security risk parameters and current protection parameters in the preliminary security results, protection adaptation parameters are obtained, wherein the protection adaptation parameters include protection parameter adaptation values ​​and protection type adaptation values; Based on the protection adaptation parameters, match the protection parameters and obtain the updated protection strategy; The updated monitoring frequency is obtained based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency.

5. The deep learning-based network security protection method according to claim 4, characterized in that, Based on the ratio of the security risk parameter to the security threshold and the current monitoring frequency, an updated monitoring frequency is obtained, including: The frequency update coefficient is obtained based on the ratio of the security risk parameter to the security threshold; Calculate the rate of change of the safety risk parameter relative to the previous moment, correct the frequency update coefficient, and obtain the corrected frequency update coefficient; The updated monitoring frequency is obtained by multiplying the current monitoring frequency by the corrected frequency update coefficient.

6. The deep learning-based network security protection method according to claim 4, characterized in that, Based on the protection adaptation parameters, the protection parameters are matched to obtain the updated protection strategy, including: Based on the mapping relationship between the security risk parameters and the preset risk level, the protection strength adjustment coefficient is determined; Multiply the current protection parameter by the protection strength adjustment coefficient to obtain the protection parameter adaptation value; Based on the risk categories in the preliminary security results, a preset protection type mapping table is matched to obtain the protection type adaptation value; The protection parameter adaptation value and the protection type adaptation value are integrated into an updated protection strategy.

7. The network security protection method based on deep learning according to claim 1, characterized in that, The aforementioned update protection strategy is used for network security protection, and network behavior monitoring is performed based on the aforementioned update monitoring frequency to obtain update traffic rate and update access type, including: The aforementioned updated protection strategy is used for network security protection. According to the aforementioned update monitoring frequency, the current traffic rate and access type of the network to be monitored are re-collected as the original update data; A smoothed update flow rate is obtained by performing a moving average calculation on the flow rate in the original update data. The frequency distribution of update access types is obtained by statistically analyzing the frequency of occurrence of access types in the original update data within a preset time window. The smooth update traffic rate and the frequency distribution of the update access type are used as the update traffic rate and update access type.

8. The network security protection method based on deep learning according to claim 1, characterized in that, Based on the update traffic rate and the update access type, iterative identification and matching are performed until the update security result reaches the security threshold standard, including: Input the update traffic rate and update access type into the feature recognition agent to obtain the update security result; The difference between the updated security result and the security threshold standard is calculated to obtain the security deviation value; When the updated security result is greater than the security threshold standard, and the security deviation value is less than the preset deviation tolerance, network security protection is completed. When the updated security result is less than or equal to the security threshold standard, iterative identification and matching are performed based on the updated security result until the updated security result reaches the security threshold standard.

9. The network security protection method based on deep learning according to claim 8, characterized in that, The acquisition of the security threshold standard includes: Obtain historical security risk parameter sequences from historical network behavior data; Calculate the mean and standard deviation of the historical safety risk parameter sequence, and use the sum of the mean and the standard deviation of a preset multiple as the safety threshold standard, wherein the preset multiple is obtained based on the distribution characteristics of the historical safety risk parameter sequence.

10. A network security protection system based on deep learning, characterized in that, The method for implementing the deep learning-based network security protection method according to any one of claims 1-9 includes: The information collection module is used to obtain the current traffic rate and access type, input the feature recognition agent, and obtain preliminary security results; The parameter configuration module is used to obtain protection adaptation parameters based on the preliminary security results, match the protection parameters to obtain updated protection strategies, and obtain updated monitoring frequencies. The network monitoring module is used to perform network security protection using the protection strategy and to perform network behavior monitoring based on the update monitoring frequency, thereby obtaining the update traffic rate and update access type. The iterative identification and matching module is used to perform iterative identification and matching based on the update traffic rate and the update access type until the update security result reaches the security threshold standard.

Images