Intelligent identification method for network attack source based on multi-view analysis

Abstract

The present application belongs to the field of network security, and discloses a network attack source intelligent identification method based on multi-view analysis. In view of the single view and fragmented clues of the existing tracing technology, the network traffic, session network behavior characteristics and attack text feature data are integrated, and after cleaning and standardization preprocessing, the feature vector fusion is completed by combining the entropy weight feature processing. The neural network model based on the entropy weight correction loss function is constructed by using the feature after the weight vector fusion and the network attack source identification method. The present application uses the entropy as the data comprehensive weight coefficient to fuse the input feature data, and corrects the loss function of the neural network model, realizes the attack entry positioning, the jump board identification, the attack classification and the organization attribution. The present application can adapt to the complex attack scene such as APT, effectively improves the accuracy and timeliness of the tracing, and is suitable for the scenes such as government and enterprise, energy and finance, and provides technical support for the network security disposal and tracing evidence.

Description

Technical Field

[0001] This invention belongs to the field of network security application technology, and in particular relates to a method for intelligent identification of network attack sources based on multi-perspective analysis. Background Technology

[0002] With the continuous evolution of cyberattack techniques, cyberspace security faces increasingly serious threats. Cyberattacks and defenses are a long-term, interdependent process. To achieve their objectives, many attacks are characterized by long durations, complex steps, and high stealth, such as Advanced Persistent Threats (APTs). Traditional static model-based security detection methods are no longer effective in addressing these threats. In real-world network environments, attackers often persist for months or even years, gradually penetrating target systems through multiple stages, each employing different attack methods and techniques. This long-term attack process requires security detection models to handle data streams with extremely long time spans. During this process, the model must not only identify new attack methods but also retain memories of early attack characteristics; otherwise, it will be unable to fully reconstruct the attack chain, leading to detection failure. Existing technologies, such as patent CN121283779B, employ gradient projection, covariance alignment, early stopping, and adaptive parameter merging training methods to improve knowledge retention and effectively overcome catastrophic forgetting. They also utilize Bayesian incremental learning to process label bias and noise, detect new / unknown attack categories, and achieve attack chain analysis and reconstruction for multi-stage attacks.

[0003] Therefore, existing technologies face several challenges: how to select relevant network attribution identification features for multi-perspective analysis, clean and standardize them before preprocessing, how to use entropy weight feature coefficients to complete the fusion of the aforementioned multi-perspective analysis feature vectors, how to use the features after weight vector fusion and network attack attribution identification methods to construct a neural network model based on entropy weight correction loss function, how to use entropy as a data-integrated weight coefficient to fuse input feature data and correct the neural network model loss function to achieve attack entry point location, springboard identification, attack classification, and organization attribution, and how to adapt to complex attack scenarios such as APTs to effectively improve the accuracy and timeliness of attribution, making it applicable to government, enterprise, energy, finance, and other scenarios, and providing technical support for network security handling and attribution evidence collection. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention proposes an intelligent identification method for network attack sources based on multi-perspective analysis.

[0005] In a first aspect of the present invention, a method for intelligent identification of network attack sources based on multi-perspective analysis is provided, the method comprising:

[0006] S1. Collect network traffic characteristics of the attacked network and session network behavior characteristics of the attacked network, and extract text features from the text of the attacked network to obtain attack text feature data. Perform data cleaning, standardization and preprocessing on the network traffic characteristics, session network behavior characteristics and attack text feature data.

[0007] S2. Using entropy weight feature coefficient processing technology, feature vector fusion is performed on the network traffic features, the session network behavior features, and the attack text feature data to obtain multi-perspective attack tracing features, and network attack tracing and identification methods are obtained by relying on network security personnel label processing.

[0008] S3. Construct a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on an entropy weight correction loss function.

[0009] S4. Using the network attack tracing intelligent identification model, network attack tracing intelligent identification is performed on different attacked networks to obtain a network attack tracing intelligent identification method. The network attack tracing intelligent identification method is then used for network attack classification and tracing.

[0010] Furthermore, the attack text feature data is calculated using the frequency of attack keywords on the attacked network and the inverse frequency features of the attack text.

[0011] Furthermore, the session network behavior characteristics are calculated from the time interval variance and the total number of session packets.

[0012] Furthermore, the average time interval of all data packets is calculated from the data packet timestamps.

[0013] Furthermore, the network traffic characteristics include packet traffic peak skewness and packet byte count coefficient ratio.

[0014] Furthermore, the data cleaning and standardization preprocessing involves performing dimensionless processing and data normalization on the network traffic characteristics, the session network behavior characteristics, and the attack text characteristics data.

[0015] Furthermore, the step of using entropy weight feature coefficient processing technology to perform feature vector fusion on the network traffic features, the session network behavior features, and the attack text feature data to obtain multi-view attack tracing features involves calculating the entropy weight feature coefficients by calculating the information entropy of the network traffic features, the session network behavior features, and the attack text feature data in the training set, and then using the entropy weight feature coefficients to perform feature vector fusion on the network traffic features, the session network behavior features, and the attack text feature data.

[0016] Furthermore, the network attack tracing intelligent identification model adopts a neural network model based on entropy weight correction loss function, which uses category entropy to correct the loss function.

[0017] A network attack source intelligent identification system based on multi-perspective analysis is also provided. This system implements a network attack source tracing intelligent identification method based on multi-perspective analysis. The system includes a network traffic feature acquisition unit, a session network behavior feature acquisition unit, an attack text feature data processing and acquisition unit, an entropy weight feature coefficient processing and fusion feature unit, a network attack source tracing intelligent identification model construction unit, and a network attack source tracing unit.

[0018] The network traffic feature acquisition unit is used to collect network traffic features of the attacked network.

[0019] The session network behavior feature acquisition unit is used to collect session network behavior features of the attacked network.

[0020] The attack text feature data processing and acquisition unit is used to extract text features from the text of the attacked network to obtain attack text feature data.

[0021] The entropy weight feature coefficient processing and fusion feature unit performs data cleaning, standardization and preprocessing on the network traffic features, the session network behavior features and the attack text feature data, and uses entropy weight feature coefficient processing technology to perform feature vector fusion on the network traffic features, the session network behavior features and the attack text feature data to obtain multi-view attack tracing features, and relies on network security personnel label processing to obtain network attack tracing and identification methods.

[0022] The network attack tracing intelligent identification model construction unit: constructs a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on an entropy weight correction loss function.

[0023] The network attack tracing unit: uses the network attack tracing intelligent identification model to perform network attack tracing intelligent identification on different attacked networks to obtain a network attack tracing intelligent identification method, and uses the network attack tracing intelligent identification method to classify and trace network attacks.

[0024] Furthermore, the network attack tracing intelligent identification model adopts a neural network model based on entropy weight correction loss function, which uses category entropy to correct the loss function.

[0025] This invention leverages a multi-perspective heterogeneous feature fusion technology based on traffic, session behavior, and attack text to effectively overcome the shortcomings of traditional attribution tracing methods that rely solely on structured data and ignore textual attack clues. It addresses the issues of low accuracy in identifying concealed, variant, and APT attacks. This invention uses a combination of word frequency and inverse frequency algorithms to transform unstructured attack text into modelable features, filtering out invalid noise and accurately mining specific attack vocabulary features to distinguish between normal operation and maintenance and malicious attack behaviors. Simultaneously, it constructs session behavior features coupled with traffic scale, accurately capturing concealed attack behaviors that are difficult to identify using traditional techniques, such as Trojan heartbeats and low-frequency covert C2 communication. Furthermore, by introducing entropy weighting technology to dynamically fuse multi-dimensional features, it adaptively strengthens high-value attack features and weakens noise features, adapting to diverse network attack patterns. Combined with a neural network model that uses entropy weighting to correct the loss function, it optimizes model training performance to address issues of imbalanced samples and blurred class boundaries, improving the accuracy of hard sample identification. Furthermore, this technology can learn the differentiated characteristics and patterns of different attack groups, enabling clustering of attacks from the same source, attribution of attack organizations, accurate reconstruction of attack paths, and location of jump node nodes. This significantly improves the accuracy and versatility of network attack classification and tracing, and is adaptable to various complex network attack scenarios. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the basic loss function of this invention;

[0027] Figure 2 This is a schematic diagram of the intelligent identification method for network attack sources based on multi-perspective analysis according to the present invention;

[0028] Figure 3 This is a schematic diagram of the intelligent identification system for network attack sources based on multi-perspective analysis according to the present invention.

[0029] Figure 4 This is a schematic diagram illustrating the principle of weighted feature coefficient fusion feature vector classification in this invention;

[0030] Figure 5 This is a schematic diagram of the electronic device structure for implementing the method of the present invention in an embodiment of the present invention. Detailed Implementation

[0031] The invention will now be further described with reference to the accompanying drawings and specific embodiments. The neural network model based on entropy weighting and modified loss function used in this invention differs from traditional generative adversarial network (GAN) models. It utilizes the entropy weight coefficients of the training set data and multi-view attack attribution features to modify the loss function. While conventional loss functions treat all sample categories equally, entropy weighting follows a principle of higher penalties for difficult samples and lower penalties for easy samples, conforming to the logic of gradient optimization weight allocation. Furthermore, this model is a specific modification of the model in this application for the intelligent identification scenario of network attack attribution through multi-view analysis.

[0032] The intelligent identification method for network attack sources based on multi-perspective analysis of the present invention is used in the field of network security and belongs to the development of other software such as network and perimeter security software. Therefore, it belongs to the field of emerging software and new information technology services.

[0033] In a first aspect of the present invention, a method for intelligent identification of network attack sources based on multi-perspective analysis is provided, the method comprising:

[0034] S1. Collect network traffic characteristics of the attacked network and session network behavior characteristics of the attacked network, and extract text features from the text of the attacked network to obtain attack text feature data. Perform data cleaning, standardization and preprocessing on the network traffic characteristics, session network behavior characteristics and attack text feature data.

[0035] S2. Using entropy weight feature coefficient processing technology, feature vector fusion is performed on the network traffic features, the session network behavior features, and the attack text feature data to obtain multi-perspective attack tracing features, and network attack tracing and identification methods are obtained by relying on network security personnel label processing.

[0036] S3. Construct a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on an entropy weight correction loss function.

[0037] S4. Using the network attack tracing intelligent identification model, network attack tracing intelligent identification is performed on different attacked networks to obtain a network attack tracing intelligent identification method. The network attack tracing intelligent identification method is then used for network attack classification and tracing.

[0038] This application collects heterogeneous data features from multiple perspectives and retrieves standard features for network attack attribution tracing. It utilizes intelligent data acquisition tools to obtain raw data and behavioral features from each perspective, and, based on the cross-perspective feature fusion algorithm, obtains global fusion features for subsequent model input, thereby constructing an intelligent network attack attribution tracing model. The implementation flow of the intelligent network attack attribution tracing method based on multi-perspective analysis in this application embodiment is as follows: Figure 2 As shown.

[0039] Furthermore, the attack text feature data is calculated using the frequency of attack keywords on the attacked network and the inverse frequency feature of the attack text. The calculation formula is as follows:

[0040]

[0041] In the formula, The attack text feature data, This represents the number of times the critical attack term t appears in the attack text d of the attacked network. Let be the number of times the i-th attack keyword appears in the attack text d, k be the total number of attack keywords in the attacked network, and N be the total number of sample texts in the attacked network. This represents the number of texts containing the keyword t.

[0042] In this embodiment, a global feature vector for attack text is constructed using the density of keywords representing attack behavior and the weight of rare attack commands. This vector can be used for text vectorization and is adapted to multimodal feature fusion input. The inverse frequency feature of the attack text is used to suppress the weight of general normal words and amplify the differences in features of specific attack words, distinguishing between normal and malicious operations. The frequency of attack keywords in the attacked network is used to quantify the importance of attack keywords in the attack text. The combination of these two features can improve the accuracy of tracing network attacks and provide input data for the feature vector output of subsequent model construction. Malicious attack behavior has a fixed operational paradigm. The frequency of attack keywords, such as vulnerability exploitation commands, Trojan operation commands, and penetration tool feature words, can directly represent the intensity and activity of the attack behavior. High-frequency attack words correspond to real attack operations, distinguishing them from irregular normal operation and maintenance text. General normal words with inverse document frequency are widely distributed in the entire network log text, while attack-specific keywords are sparse and specific. By reducing the weight of general words and increasing the weight of rare attack words, based on the principle of information scarcity, core features with attack identification are selected, and invalid noise information is filtered out. By combining the behavioral quantification capability of word frequency with the feature filtering capability of inverse frequency, unstructured attack logs, command texts, and alarm information are transformed into high-dimensional feature vectors that can be quantified, modeled, and input into neural networks, thus solving the core problem that attack text cannot be adapted to intelligent model calculations.

[0043] Compared to traditional attribution methods, the input feature selection in this application addresses the fragmentation problem of text features. Traditional attribution methods rely solely on structured data such as traffic and topology, neglecting textual clues like logs and attack commands. By leveraging keyword frequency and inverse frequency features, this application deeply mines unstructured text attack clues, supplementing fragmented behavioral evidence of covert and APT attacks, achieving multi-perspective feature complementarity. Normal operational text has a uniform vocabulary distribution and lacks specific high-frequency attack words, while attack text contains fixed high-frequency malicious words and rare exclusive attack words. Based on this feature difference, the model accurately distinguishes between normal operations and malicious attack behavior, effectively solving the problem of inaccurate identification of covert and variant attacks in traditional attribution techniques. These features can be fused with traffic and behavioral features using entropy weights. The model can dynamically adjust feature weights based on the scarcity and frequency of attack keywords, strengthening high-value attack features and weakening invalid noise features, adapting to diverse network attack patterns. Different attack groups and APT organizations possess unique command habits, tool characteristics, and operational scripts, corresponding to differentiated keyword frequencies and inverse frequency distributions. By learning the patterns of text features, the model can accurately cluster attacks from the same source, identify the TTP characteristics of attack organizations, and support attack path reconstruction, jump node location, and group attribution and tracing.

[0044] Furthermore, the session network behavior characteristics are calculated from the time interval variance and the total number of session packets:

[0045]

[0046] In the formula, The term "session network behavior characteristic" refers to M, where M is the number of data packets within a single attacked network session, used to characterize the activity level of the attacking session. The average time interval for all data packets. Let be the average time interval of the j-th data packet. Since the time-series variance of hidden Trojans and reverse shell traffic in some network attacks is extremely small, it can be used as a key anomaly characteristic.

[0047] Furthermore, the average time interval of all data packets is calculated from the data packet timestamps, and the calculation formula is as follows:

[0048]

[0049] In the formula, The time interval of all data packets is the average, and M is the number of data packets within a single network session under attack. The timestamp of the j-th data packet is used to identify low-frequency, covert C2 heartbeat traffic.

[0050] In this application, the session network behavior features integrate the quantitative attributes of attack session traffic scale with the temporal transmission rhythm attributes, serving as the core input features of the intelligent identification model for network attack tracing. Network attack behavior exhibits fixed temporal transmission patterns. The number of data packets and packet sending intervals of normal business traffic show random discrete distributions, while malicious attacks such as APT covert intrusion, Trojan C2 heartbeats, and lateral movement within the internal network possess stable and unique temporal transmission mechanisms. The total traffic volume and packet sending interval are strongly correlated, and the inherent rhythm of attack behavior can be quantified by coupling these two. Furthermore, the total number of a single data packet can only represent the volume of traffic transmission and cannot distinguish between high-frequency, short-interval normal traffic and low-frequency, long-interval malicious traffic; the average value of a single time interval can only represent the stability of transmission and cannot reflect the active scale of the attack session. The product of these two can achieve deep coupling of scale features and temporal features, compensating for the shortcomings of single features in terms of limited representation dimensions and insufficient discriminative power. On the other hand, the number of data packets and the packet sending interval of legitimate business traffic have no fixed coupling relationship, and the feature distribution is discrete; while malicious attack traffic has strong coupling characteristics. This composite feature can form a numerical distribution pattern that is different from normal traffic, providing a quantifiable mathematical basis for the model to identify covert attacks and variant attacks. For low-frequency covert attacks such as APTs and remote control Trojans, the total number of data packets is small and the packet sending interval is uniform and stable. This composite feature can accurately quantify their core characteristics of "low frequency and high stability," effectively capturing attack behaviors such as covert C2 communication and timed callbacks that cannot be identified by traditional single traffic features. Therefore, session network behavior features can be used as input features for subsequent intelligent identification models for network attack tracing to achieve more accurate outputs for intelligent identification methods for network attack tracing, thereby helping to classify and trace network attacks.

[0051] Furthermore, the network traffic characteristics include packet traffic peak skewness and packet byte count ratio. The packet traffic peak skewness is calculated from the average size of multiple packets, and its calculation formula is as follows:

[0052]

[0053] In the formula, The peak skewness of the data packet traffic. This represents the average size of the data packets. Let L be the size of the i-th traffic packet, and L be the total number of data packets received by the attacked network during the attack period; the network traffic feature is represented by a spatial feature column vector consisting of the ratio of the traffic peak skewness of the data packet to the byte number coefficient of the data packet.

[0054] In this embodiment, the packet byte count ratio is determined by the ratio of the average number of bytes received in a packet before the network was attacked to the average number of bytes received in a packet after the network was attacked. This is because after a network is attacked, the average number of bytes received in a packet will increase significantly. The packet byte count ratio can effectively characterize the network attack situation and can be used to construct the input feature parameters of the subsequent intelligent identification model for network attack tracing.

[0055] Packet traffic peak skewness can capture subtle differences in the packet size distribution between normal and malicious traffic. The packet traffic peak skewness of normal traffic is usually close to 0, while the packet traffic peak skewness of some malicious traffic (such as DDoS attacks) may be significantly greater than 0.

[0056] Furthermore, the data cleaning and standardization preprocessing involves performing dimensionless processing and data normalization on the network traffic characteristics, the session network behavior characteristics, and the attack text characteristics data.

[0057] Furthermore, the step of using entropy weight feature coefficient processing technology to perform feature vector fusion on the network traffic features, session network behavior features, and attack text feature data to obtain multi-view attack tracing features involves calculating the entropy weight feature coefficient by analyzing the information entropy of the network traffic features, session network behavior features, and attack text feature data in the training set, and then using the entropy weight feature coefficient to perform feature vector fusion on the network traffic features, session network behavior features, and attack text feature data. The formula for calculating the entropy weight feature coefficient is as follows:

[0058]

[0059] In the formula, The entropy weight feature coefficients are... Let w be the probability of the w-th feature value occurring in the a-th feature data, where w is the probability of the w-th feature value occurring in the a-th feature data. The number of modified features for the entropy weight feature coefficients is 3 in this embodiment, representing the network traffic features, the session network behavior features, and the attack text feature data, respectively. H is the number of categories of different feature values ​​in the a-th feature data.

[0060] In this embodiment of the application, if a is 1, then The calculated value represents the entropy weight feature coefficient of the network traffic characteristic. If a is 2, then... The calculated value represents the entropy weight feature coefficient of the session network behavior characteristics. If a is 3, then... The calculated value represents the entropy weight feature coefficient of the attack text feature data. In this embodiment, feature vector fusion is performed to obtain multi-view attack tracing features. This is done by merging the feature space vector column vectors of the network traffic features, the session network behavior features, and the corresponding feature values ​​of the attack text feature data, and multiplying the corresponding entropy weight feature coefficients before the corresponding feature values ​​to obtain the final multi-view attack tracing features. Figure 4 The diagram shown illustrates the principle of weight coefficient correction for the input feature space feature vector.

[0061] Furthermore, the network attack tracing intelligent identification model adopts a neural network model based on an entropy weight-corrected loss function. This entropy weight-corrected loss function utilizes category entropy to correct the loss function, and its calculation formula is as follows:

[0062]

[0063] In the formula, L is the value of the loss function based on entropy weight correction. The basic loss function is the loss function value of the mean squared error or the loss function value of the mean absolute error, where K is the total number of classes in the training set data. Let be the proportion of the k-th class samples in the entire training dataset.

[0064] Information entropy characterizes the degree of uncertainty of random events. The higher the entropy value of the training set, the lower the sample feature discrimination, the more blurred the class boundaries, and the greater the difficulty of model fitting. The more unbalanced the class distribution and the more overlapping the samples, the more obvious the entropy deviates from the uniform distribution characteristics, and there are inherent differences in learning difficulty. Conventional loss treats all sample classes equally, while entropy weighting follows the principle of high penalty for difficult samples and low penalty for easy samples, which conforms to the gradient optimization weight allocation logic. High-entropy regions have high classification risk. By amplifying the loss constraint through entropy, the model is forced to reduce the prediction error in uncertain regions, which aligns with the principle of minimizing empirical risk.

[0065] In this embodiment, due to the data processing transformation of the input feature vector and the corresponding adjustment of the loss function, the neural network model based on entropy weight correction loss function uses 5 hidden layers, with 64 neurons in each layer. To ensure intelligent identification of network attack tracing, the intelligent identification method for network attack tracing includes, but is not limited to, obtaining the specific correspondence between the attack source IP, attack type, and the number of tracing node categories. The hidden layer activation function of the neural network model uses the ReLU activation function, the classification output layer uses the traditional Softmax function, and some Citibank uses Adam. The initial learning rate is set to 0.0001, the training batch size is 32 batches, the number of iterations is 80, the L2 regularization coefficient is 0.0001, and the ratio of training set to validation set data is 8:2. Other related neural network hyperparameter settings are set according to the training and use of conventional neural network models, and will not be elaborated here.

[0066] A network attack source intelligent identification system based on multi-perspective analysis is also provided. This system implements a network attack source intelligent identification method based on multi-perspective analysis. The system includes a network traffic feature acquisition unit, a session network behavior feature acquisition unit, an attack text feature data processing and acquisition unit, an entropy weight feature coefficient processing and fusion feature unit, a network attack source tracing intelligent identification model construction unit, and a network attack source tracing unit.

[0067] The network traffic feature acquisition unit is used to collect network traffic features of the attacked network.

[0068] The session network behavior feature acquisition unit is used to collect session network behavior features of the attacked network.

[0069] The attack text feature data processing and acquisition unit is used to extract text features from the text of the attacked network to obtain attack text feature data.

[0070] The entropy weight feature coefficient processing and fusion feature unit performs data cleaning, standardization and preprocessing on the network traffic features, the session network behavior features and the attack text feature data, and uses entropy weight feature coefficient processing technology to perform feature vector fusion on the network traffic features, the session network behavior features and the attack text feature data to obtain multi-view attack tracing features, and relies on network security personnel label processing to obtain network attack tracing and identification methods.

[0071] The network attack tracing intelligent identification model construction unit: constructs a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on an entropy weight correction loss function.

[0072] The network attack tracing unit: uses the network attack tracing intelligent identification model to perform network attack tracing intelligent identification on different attacked networks to obtain a network attack tracing intelligent identification method, and uses the network attack tracing intelligent identification method to classify and trace network attacks.

[0073] Furthermore, the network attack tracing intelligent identification model adopts a neural network model based on an entropy weight-corrected loss function. This entropy weight-corrected loss function utilizes category entropy to correct the loss function, and its calculation formula is as follows:

[0074]

[0075] In the formula, L is the value of the loss function based on entropy weight correction. The basic loss function is the loss function value of the mean squared error or the loss function value of the mean absolute error, where K is the total number of classes in the training set data. Let be the proportion of the k-th class samples in the entire training dataset.

[0076] Information entropy characterizes the degree of uncertainty of random events. The higher the entropy value of the training set, the lower the sample feature discrimination, the more blurred the class boundaries, and the greater the difficulty of model fitting. The more unbalanced the class distribution and the more overlapping the samples, the more obvious the entropy deviates from the uniform distribution characteristics, and there are inherent differences in learning difficulty. Conventional loss treats all sample classes equally, while entropy weighting follows the principle of high penalty for difficult samples and low penalty for easy samples, which conforms to the gradient optimization weight allocation logic. High-entropy regions have high classification risk. By amplifying the loss constraint through entropy, the model is forced to reduce the prediction error in uncertain regions, which aligns with the principle of minimizing empirical risk.

[0077] This loss function uses the base loss function (mean squared error or mean absolute error loss) as a foundation, and incorporates the proportion of each type of sample dataset to calculate the category entropy correction weight. Following the gradient optimization logic of high penalty for difficult samples and low penalty for easy samples, it amplifies the loss constraint for regions with high entropy and strong classification uncertainty, strengthening the model's learning ability for difficult samples such as occult attacks and variant attacks, reducing prediction errors in uncertain regions, adhering to the principle of minimizing empirical risk, and ultimately improving the overall classification and source identification accuracy of the model. The principle diagram of the loss function is shown below. Figure 1 As shown, the conventional loss function performs mathematical operations on the model's predicted values ​​and the true labels, and finally outputs a single error scalar to characterize the overall prediction error of the model.

[0078] In this embodiment, due to the data processing transformation of the input feature vector and the corresponding adjustment of the loss function, the neural network model based on entropy weight correction loss function uses 5 hidden layers, with 64 neurons in each layer. To ensure intelligent identification of network attack tracing, the intelligent identification method for network attack tracing includes, but is not limited to, obtaining the specific correspondence between the attack source IP, attack type, and the number of tracing node categories. The hidden layer activation function of the neural network model uses the ReLU activation function, the classification output layer uses the traditional Softmax function, and some Citibank uses Adam. The initial learning rate is set to 0.0001, the training batch size is 32 batches, the number of iterations is 80, the L2 regularization coefficient is 0.0001, and the ratio of training set to validation set data is 8:2. Other related neural network hyperparameter settings are set according to the training and use of conventional neural network models, and will not be elaborated here.

[0079] This invention leverages a multi-perspective heterogeneous feature fusion technology based on traffic, session behavior, and attack text to effectively overcome the shortcomings of traditional attribution tracing methods that rely solely on structured data and ignore textual attack clues. It addresses the issues of low accuracy in identifying concealed, variant, and APT attacks. This invention uses a combination of word frequency and inverse frequency algorithms to transform unstructured attack text into modelable features, filtering out invalid noise and accurately mining specific attack vocabulary features to distinguish between normal operation and maintenance and malicious attack behaviors. Simultaneously, it constructs session behavior features coupled with traffic scale, accurately capturing concealed attack behaviors that are difficult to identify using traditional techniques, such as Trojan heartbeats and low-frequency covert C2 communication. Furthermore, by introducing entropy weighting technology to dynamically fuse multi-dimensional features, it adaptively strengthens high-value attack features and weakens noise features, adapting to diverse network attack patterns. Combined with a neural network model that uses entropy weighting to correct the loss function, it optimizes model training performance to address issues of imbalanced samples and blurred class boundaries, improving the accuracy of hard sample identification. Furthermore, this technology can learn the differentiated characteristics and patterns of different attack groups, enabling clustering of attacks from the same source, attribution of attack organizations, accurate reconstruction of attack paths, and location of jump node nodes. This significantly improves the accuracy and versatility of network attack classification and tracing, and is adaptable to various complex network attack scenarios.

[0080] like Figure 5 As shown, the intelligent identification method for network attack sources based on multi-view analysis proposed in this invention operates on the general hardware architecture of computing devices. The system consists of basic components such as a processor, memory, communication interface, and bus, achieving integrated data processing through hardware and software collaboration.

[0081] It should be noted that the method of this application can be used with a computer-readable storage medium, which can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0082] The combination of multiple embodiments of the present invention can achieve all the above effects, but it is not required that each embodiment of the present invention achieve all the above advantages and effects, because each embodiment of the present invention can constitute a separate technical solution and make one or more contributions to the prior art.

[0083] For any module structures not specifically defined in this invention, the existing technical specifications shall prevail. The existing technical specifications mentioned in the foregoing background and specific embodiments sections are considered part of this invention and are used to understand the meaning of certain technical features or parameters. The scope of protection of this invention is determined by the actual contents of the claims.

Claims

1. A method for intelligent identification of network attack sources based on multi-perspective analysis, characterized in that, The method includes: S1. Collect network traffic characteristics of the attacked network and session network behavior characteristics of the attacked network, and extract text features from the text of the attacked network to obtain attack text feature data. Perform data cleaning, standardization and preprocessing on the network traffic characteristics, the session network behavior characteristics and the attack text feature data. S2. Using entropy weight feature coefficient processing technology, feature vector fusion is performed on the network traffic features, the session network behavior features, and the attack text feature data to obtain multi-perspective attack tracing features, and network attack tracing and identification methods are obtained by relying on network security personnel label processing. S3. Construct a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on the entropy weight correction loss function. S4. Using the network attack tracing intelligent identification model, network attack tracing intelligent identification is performed on different attacked networks to obtain a network attack tracing intelligent identification method. The network attack tracing intelligent identification method is then used for network attack classification and tracing.

2. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 1, characterized in that: The attack text feature data is calculated using the frequency of attack keywords on the attacked network and the inverse frequency features of the attack text.

3. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 1, characterized in that: The session network behavior characteristics are calculated from the time interval variance and the total number of session packets.

4. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 3, characterized in that: The average time interval of all data packets is calculated from the data packet timestamps.

5. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 1 or 3, characterized in that: The network traffic characteristics include packet traffic peak skewness and packet byte count ratio.

6. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 2, 3, or 4, characterized in that: The data cleaning and standardization preprocessing involves dimensionless processing and data normalization of the network traffic features, session network behavior features, and attack text feature data.

7. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 5, characterized in that: The method of using entropy weight feature coefficient processing technology to perform feature vector fusion of network traffic features, session network behavior features and attack text feature data to obtain multi-view attack tracing features involves calculating the entropy weight feature coefficient by calculating the information entropy of the network traffic features, session network behavior features and attack text feature data in the training set, and then using the entropy weight feature coefficient to perform feature vector fusion of the network traffic features, session network behavior features and attack text feature data.

8. The intelligent identification method for network attack sources based on multi-view analysis as described in claim 7, characterized in that: The network attack tracing intelligent identification model adopts a neural network model based on entropy weight correction loss function, which uses category entropy to correct the loss function.

9. A network attack source intelligent identification system based on multi-perspective analysis, wherein the system implements the network attack source intelligent identification method based on multi-perspective analysis as described in claims 1-8, the system comprising a network traffic feature acquisition unit, a session network behavior feature acquisition unit, an attack text feature data processing and acquisition unit, an entropy weight feature coefficient processing and fusion feature unit, a network attack source tracing intelligent identification model construction unit, and a network attack source tracing unit, characterized in that: The network traffic feature acquisition unit is used to collect network traffic features of the attacked network. The session network behavior feature acquisition unit is used to collect session network behavior features of the attacked network. The attack text feature data processing and acquisition unit is used to extract text features from the text of the attacked network to obtain attack text feature data. The entropy weight feature coefficient processing and fusion feature unit performs data cleaning, standardization and preprocessing on the network traffic features, the session network behavior features and the attack text feature data, and uses entropy weight feature coefficient processing technology to perform feature vector fusion on the network traffic features, the session network behavior features and the attack text feature data to obtain multi-view attack tracing features, and relies on network security personnel label processing to obtain network attack tracing and identification methods. The network attack tracing intelligent identification model construction unit: constructs a network attack tracing intelligent identification model using the multi-perspective attack tracing features and the network attack tracing identification method. The network attack tracing intelligent identification model adopts a neural network model based on an entropy weight correction loss function. The network attack tracing unit: uses the network attack tracing intelligent identification model to perform network attack tracing intelligent identification on different attacked networks to obtain a network attack tracing intelligent identification method, and uses the network attack tracing intelligent identification method to classify and trace network attacks.

10. The intelligent identification system for network attack sources based on multi-view analysis as described in claim 9, characterized in that: The network attack tracing intelligent identification model adopts a neural network model based on entropy weight correction loss function, which uses category entropy to correct the loss function.

Images