A network unknown attack detection method and system based on a rejection mechanism and dynamic category expansion, and a storage medium

Abstract

The application provides a network unknown attack detection method and system based on a rejection mechanism and dynamic category expansion and a storage medium, comprising: collecting and processing network traffic in real time to extract features; through an open set rejection discrimination module, classifying input samples as known attacks or determining unknown attacks based on an open classification boundary; performing clustering analysis and novelty evaluation on unknown attack samples to confirm whether a new attack category is formed; after confirming a new category, dynamically expanding the classification structure of the model, and based on new samples, updating the model through incremental learning combined with a knowledge distillation mechanism, and finally deploying the updated model to form a continuously evolving detection closed loop. The application can identify unknown attacks in real time, has the ability to autonomously discover, confirm and learn new attack patterns, and realizes the continuous evolution of the detection model in an open network environment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, system, and storage medium for detecting unknown network attacks based on a denial-of-identity mechanism and dynamic category expansion. Background Technology

[0002] With the large-scale deployment of cloud computing, edge computing, industrial internet, and IoT devices, the network environment is gradually becoming more open, dynamic, and complex. At the same time, network attack techniques are constantly evolving. Attackers are able to continuously generate new attack methods through zero-day exploits, malware variants, advanced persistent threats, and automated attack tools, resulting in a constantly changing threat environment for network security systems.

[0003] Most existing network intrusion detection systems are based on the closed classification assumption, meaning that all attack categories appearing during the testing phase are assumed to have already been labeled and used in model training. These systems typically employ supervised learning-based classification models, establishing classification boundaries using historical known attack samples, and then using the trained model to classify and detect subsequent network traffic. However, in real-world network environments, many novel attacks do not exist during model training. Therefore, traditional closed classification models are prone to misclassification when faced with unknown attacks, forcibly classifying unknown attacks into a known attack category, leading to increased false positive and false negative rates.

[0004] Furthermore, existing systems often require recollecting all historical data and performing overall retraining after discovering a new attack category. This process is not only lengthy and computationally expensive, making it difficult to meet real-time detection requirements, but it is also prone to "catastrophic forgetting" problems due to parameter drift during model updates. This means that after learning new categories, the model's recognition performance for previously known categories drops significantly, affecting the long-term stable operation of the system.

[0005] To identify unknown attacks, existing technologies have proposed some improvements, but significant shortcomings remain. For example, an open-set identification method (such as Chinese invention patent CN115221520A) can effectively identify and reject unknown attack samples by improving the loss function and utilizing extreme value theory for statistical modeling. However, this method is limited to "discovery" and "rejection," lacking a follow-up analysis and learning mechanism for rejected samples. It cannot transform newly emerging attack patterns into new knowledge for the system, resulting in stagnant model detection capabilities and an inability to adapt to dynamically evolving threat environments.

[0006] Another approach based on generalized zero-shot learning (such as Chinese invention patent CN119254471A) attempts to use generative models to synthesize pseudo-samples of unknown attacks for detection. However, this method heavily relies on prior knowledge of unknown attacks (such as predefined attribute vectors). In actual network attack and defense, it is almost impossible for the defender to predict the semantic information of all new types of attacks in advance, thus its application feasibility is low. Furthermore, this method is also a one-time static model and lacks the ability to continuously learn new attack patterns online from real traffic.

[0007] Therefore, existing technologies urgently need a network intrusion detection solution that can simultaneously possess the capabilities of real-time identification of unknown attacks, autonomous discovery and confirmation of new attack patterns, and continuous online incremental learning of models, in order to build an intelligent security system that can dynamically evolve and adapt to the open network threat environment in the long term. Summary of the Invention

[0008] This invention addresses the shortcomings of existing technologies by providing a method, system, and storage medium for detecting unknown network attacks based on a denial-of-identity mechanism and dynamic category expansion.

[0009] To achieve the above-mentioned objectives, the technical solution adopted by the present invention is as follows:

[0010] A method for detecting unknown network attacks based on a denial-of-identity mechanism and dynamic category expansion includes the following steps:

[0011] S1: Collect network traffic data in real time and preprocess it to generate network behavior feature vectors;

[0012] S2: Map the network behavior feature vector to a low-dimensional semantic embedding space to obtain a deep feature representation;

[0013] S3: Perform open set rejection discrimination on the deep feature representation based on open classification boundaries: if it is located within the open classification boundary of any known category, it is determined to be the corresponding known attack category; otherwise, it is determined to be an unknown attack sample and cached.

[0014] S4: Perform cluster analysis on cached unknown attack samples to identify potential new attack pattern clusters;

[0015] S5: Perform a novelty assessment on the results of the cluster analysis. If the assessment results meet the preset conditions, then confirm the formation of a new attack category.

[0016] S6: In response to the confirmation of new attack categories, dynamically expand the classification structure of the model and add corresponding category prototypes and classification output nodes;

[0017] S7: Based on samples of new attack categories, and combined with a knowledge distillation mechanism, the model is incrementally learned and updated to slow down the forgetting of historical category knowledge;

[0018] S8: Deploy the updated model and return to step S1 to form a continuously evolving detection loop.

[0019] Furthermore, in step S3, the open set rejection discrimination is based on the feature space and open classification boundary obtained by training through the joint loss function; the joint loss function includes cross-entropy loss for improving classification accuracy, prototype center loss for compressing intra-class distance, and repulsion loss term for expanding inter-class distance and constraining open space distribution.

[0020] Furthermore, in step S4, a density-based clustering algorithm is used to perform cluster analysis on the unknown attack samples.

[0021] Furthermore, in step S5, the novelty assessment is achieved by calculating the internal compactness of the cluster and the separation degree between the cluster and all known attack category clusters.

[0022] Furthermore, in step S7, the knowledge distillation mechanism constrains the output distribution of the updated model for historical category samples by learning incrementally, so that it remains consistent with the output distribution of the model before the update.

[0023] Furthermore, the low-dimensional semantic embedding space has a dimension of 128; the distance judgment threshold for the open classification boundary is 0.65; the core distance parameter for the clustering analysis is 0.4; the preset threshold for the novelty assessment is 2.0; and the weight coefficient for the knowledge distillation loss is 0.3.

[0024] This invention also discloses a network unknown attack detection system for implementing the above-described network unknown attack detection method, the system comprising:

[0025] The data preprocessing module is used to process the collected network traffic data to generate network behavior feature vectors;

[0026] The feature encoding module is used to map the network behavior feature vector into a deep feature representation;

[0027] The open set rejection discrimination module is used to classify input samples for known attacks or reject them for unknown attacks based on open classification boundaries.

[0028] The unknown attack caching module is used to store samples that are identified as unknown attacks;

[0029] The unknown sample clustering analysis module is used to perform clustering analysis on cached unknown attack samples;

[0030] The novelty assessment module is used to evaluate clustering results to confirm whether new attack categories have been formed.

[0031] The dynamic category expansion module is used to expand the classification structure of the model after a new category is identified.

[0032] The incremental learning and update module is used to perform incremental learning and updates on the model based on new samples and in conjunction with a knowledge distillation mechanism.

[0033] The model deployment management module is used to complete the online deployment of updated models.

[0034] Furthermore, the system also includes a data layer, which includes:

[0035] A known attack knowledge base is used to store the feature distribution models and decision boundary parameters of known attack categories;

[0036] The model parameter storage area is used to store the network weight parameters of the feature encoding module and the open set rejection discrimination module.

[0037] An unknown attack caching library is used to persistently store the data in the unknown attack caching module.

[0038] The present invention also discloses a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the above-described method for detecting unknown network attacks.

[0039] The present invention also discloses an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the above-described method for detecting unknown network attacks.

[0040] Compared with the prior art, the advantages of the present invention are as follows:

[0041] 1. Effectively identify unknown attacks and avoid misclassification: By establishing open classification boundaries and rejection mechanisms, it is possible to effectively identify new network attack samples that have not appeared during the model training phase and distinguish them from known attack categories. This avoids the false alarm problem caused by traditional closed-world classification models that force unknown attacks to be classified into a certain known category, and significantly improves the ability to detect unknown threats.

[0042] 2. Achieve dynamic model expansion and efficient updates: Through a dynamic category expansion mechanism, the system can automatically integrate new categories and expand the model structure after identifying new attack patterns. Combined with incremental learning, the model only needs to be updated based on new samples and some historical knowledge, without retraining all historical data. This significantly reduces the computational resources and time costs required for model updates, and improves the efficiency of online deployment and updates.

[0043] 3. Mitigating catastrophic forgetting and maintaining the stability of historical knowledge: During the incremental learning and updating process, by introducing knowledge preservation mechanisms such as knowledge distillation, the updating process of model parameters can be effectively constrained when biased towards new types of data, thereby significantly mitigating the "catastrophic forgetting" problem and ensuring that the system maintains stable recognition accuracy of historically known attack types after learning new attack types, thus guaranteeing the long-term reliability of the system.

[0044] 4. Developing Autonomous Evolution Capabilities to Adapt to Dynamic Threat Environments: This invention links multiple stages, including unknown attack discovery, cluster analysis, novelty assessment, category expansion, and incremental learning, to construct a complete closed loop of "detection-discovery-learning-update." This enables the system to automatically discover, confirm, and learn new attacks from continuous network traffic, achieving autonomous evolution and continuous improvement of the detection model, thus allowing it to adapt to dynamic and open network threat environments over the long term.

[0045] 5. Possesses significant engineering application value: The method and system described can be deployed in various real-world scenarios such as enterprise security gateways, cloud security platforms, industrial internet security nodes, and security operation centers. It supports real-time detection of network traffic and online hot updates of models, meeting the needs of modern network security systems for real-time performance, adaptability, and sustainable operation. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart of a network unknown attack detection method based on a rejection mechanism and dynamic category expansion in an embodiment of the present invention;

[0048] Figure 2 This is a system architecture diagram of a network unknown attack detection system according to an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] This embodiment provides a method for detecting unknown network attacks based on a denial-of-identity mechanism and dynamic category expansion. The process is as follows: Figure 1 As shown, the specific steps include:

[0051] Step S101: Network traffic collection and preprocessing.

[0052] The network traffic acquisition module collects raw network traffic data in real time from the mirror port of the enterprise network boundary switch or cloud security probe. This data may include TCP / IP packets, HTTP requests, DNS query records, etc. The data preprocessing module performs protocol parsing and session reassembly on the raw traffic (e.g., reassembling it into a bidirectional session flow based on 5-tuples and timing relationships), and extracts predefined behavioral features (such as packet length statistics, protocol flag distribution, and time interval characteristics) to form a structured network behavior feature vector. Subsequently, the feature vector is normalized to eliminate the influence of unit dimensions.

[0053] Step S102: Deep feature encoding.

[0054] The preprocessed network behavior feature vector is input into the feature encoding module. This module consists of a deep neural network (e.g., a multi-layer fully connected network or a one-dimensional convolutional neural network), and its function is to map the high-dimensional, sparse original features into a low-dimensional, dense semantic embedding space, thereby obtaining a deep feature representation with stronger class discrimination ability. In this embodiment, the dimension of the semantic embedding space is preferably set to 128 dimensions.

[0055] Step S103: Open set rejection judgment.

[0056] The deep feature representation obtained in step S102 is input into the open set rejection discrimination module. All open set rejection discrimination modules are preferably implemented using an Open Classification Network (OCN). This module makes decisions based on the "open classification boundary." Specifically, during the model training phase, the feature encoding network and the classifier are trained end-to-end using a joint loss function. The joint loss function... It consists of three parts:

[0057]

[0058] in, This is the standard cross-entropy loss, used to optimize the classification accuracy of known categories; The prototype center loss is used to minimize the distance between features of samples of the same class and their class prototype (the mean of all features of all samples in that class), thereby achieving intra-class aggregation. The repulsion loss term is used to expand the distance between different class prototypes and constrain the distribution of the open space. It is used to maximize the distance between different class prototypes and constrain the known class prototypes to move away from the origin of the feature space, thereby reserving "open space" for unknown samples. and Hyperparameters are used to balance the weights of various losses.

[0059] After training, an adaptive distance threshold is calculated for each known attack category (e.g., taking the distance from all training samples of that category to its prototype). ,in The mean, Standard deviation (As a moderating factor). During the inference phase, the input sample feature x is calculated to all known category prototypes. distance If a certain category exists , making Less than its corresponding threshold If so, then the sample is determined to belong to category Otherwise, the sample is classified as an "unknown attack". In this embodiment, Euclidean distance is preferably used as the distance metric, and the open classification boundary threshold can be set to 0.65.

[0060] Step S104: Unknown sample cache.

[0061] Samples identified as "unknown attacks" by the open set rejection discrimination module (including their original traffic fragments, feature vectors, and related metadata) are stored in the unknown attack cache module for subsequent batch analysis.

[0062] Step S105: Cluster analysis of unknown samples.

[0063] Periodically (e.g., after a certain cumulative number, or within a fixed time window), accumulated unknown attack samples are retrieved from the cache and processed by the unknown sample clustering analysis module. This embodiment preferably uses a density-based clustering algorithm (such as the DBSCAN algorithm) to cluster the depth features of these samples. This algorithm can automatically discover clusters of arbitrary shapes based on the density of the sample distribution and identify noise points. The clustering core distance parameter (eps) can be set to 0.4. After clustering, each identified cluster represents a potential new attack pattern.

[0064] Step S106: Novelty assessment.

[0065] The novelty assessment module evaluates each cluster generated in step S105 to determine whether it constitutes a truly new and meaningful attack category. Evaluation metrics may include:

[0066] 1. Internal compactness: Calculates the average distance between samples within a cluster. The smaller the value, the more compact the cluster structure.

[0067] 2. External Separation: Calculates the minimum distance between the center of the cluster and all known attack category prototypes. A larger value indicates a higher degree of differentiation from existing categories.

[0068] 3. Sample size: The number of samples within a cluster needs to reach a minimum threshold to ensure statistical significance.

[0069] In this embodiment, a comprehensive novelty score threshold (e.g., 2.0) can be set. The comprehensive novelty score is calculated by weighting internal compactness, external separation, and sample size. When the comprehensive score of a cluster exceeds this threshold, it is confirmed as a new attack category.

[0070] Step S107: Dynamic category expansion.

[0071] Once a cluster passes the novelty evaluation, the dynamic category expansion module is triggered. This module performs the following operations:

[0072] 1. New category prototype: Calculate the prototype vector of the new category from the mean of the feature vectors of all samples in the cluster. And store it in the known attack knowledge base.

[0073] 2. Expand the classifier: Add a new neuron node to the model's output layer, corresponding to this new class. Simultaneously, adjust the open classification boundary to... Calculate and set the initial distance threshold.

[0074] Step S108: Incremental learning and model update.

[0075] The incremental learning update module updates the model based on newly identified class samples (i.e., samples within the cluster) and some known class samples sampled from historical data. To mitigate catastrophic forgetting, knowledge distillation is introduced during the training process. )mechanism:

[0076] In the training loss of the new model (student model), in addition to the standard cross-entropy loss... In addition to new and old data, an additional knowledge distillation loss is considered. . The output probability distribution of the student model for historical category samples is constrained to be as close as possible to the output probability distribution of the old model (teacher model) before the update. The knowledge distillation loss is preferably calculated using the KL divergence function, and the total loss function is:

[0077]

[0078] in, The distillation loss weight can be set to 0.3 in this embodiment. In this way, the model can effectively learn the features of new attack categories while retaining its ability to identify historical attack categories to the greatest extent.

[0079] Step S109: Model hot deployment and closed-loop detection.

[0080] The model deployment management module synchronizes the updated model parameters and application strategies to the online detection environment, typically using hot update technology to ensure uninterrupted detection services. After the update is complete, the system returns to step S101 to continue processing new network traffic, thus forming a continuous autonomous evolution closed loop of "detection-discovery-learning-update".

[0081] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0082] In another embodiment, a network unknown attack detection system is provided, which corresponds one-to-one with the network unknown attack detection methods in the above embodiments. Detailed descriptions of each functional module are as follows:

[0083] The data preprocessing module is used to process the collected network traffic data to generate network behavior feature vectors;

[0084] The feature encoding module is used to map the network behavior feature vector into a deep feature representation;

[0085] The open set rejection discrimination module is used to classify input samples for known attacks or reject them for unknown attacks based on open classification boundaries.

[0086] The unknown attack caching module is used to store samples that are identified as unknown attacks;

[0087] The unknown sample clustering analysis module is used to perform clustering analysis on cached unknown attack samples;

[0088] The novelty assessment module is used to evaluate clustering results to confirm whether new attack categories have been formed.

[0089] The dynamic category expansion module is used to expand the classification structure of the model after a new category is identified.

[0090] The incremental learning and update module is used to perform incremental learning and updates on the model based on new samples and in conjunction with a knowledge distillation mechanism.

[0091] The model deployment management module is used to complete the online deployment of updated models.

[0092] The system architecture of the corresponding network unknown attack detection system is as follows: Figure 2 As shown. The system adopts a hierarchical design, including:

[0093] Infrastructure layer: Provides GPU computing clusters and distributed storage systems to provide computing power and storage support for the upper layers.

[0094] Data layer: Contains a known attack knowledge base, a model parameter storage area, and an unknown attack cache library, and is responsible for the persistent management of various types of data.

[0095] Application Business Layer: This is the core logic layer, integrating all processing modules such as data preprocessing, feature encoding, open set rejection discrimination, unknown sample clustering analysis, novelty assessment, dynamic category expansion, and incremental learning update.

[0096] User layer: Provides a human-computer interaction interface for system monitoring, policy configuration, and alarm display.

[0097] Specific limitations regarding the network unknown attack detection system can be found in the limitations of the network unknown attack detection method described above, and will not be repeated here. Each module in the above system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0098] In another embodiment of the present invention, a terminal device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a network unknown attack detection method.

[0099] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory). This computer-readable storage medium is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device.

[0100] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the network unknown attack detection method in the above embodiments; one or more instructions in the computer-readable storage medium are loaded and executed by a processor.

[0101] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0102] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0103] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for detecting unknown network attacks based on a rejection mechanism and dynamic category expansion, characterized in that, Includes the following steps: S1: Collect network traffic data in real time and preprocess it to generate network behavior feature vectors; S2: Map the network behavior feature vector to a low-dimensional semantic embedding space to obtain a deep feature representation; S3: Perform open set rejection discrimination on the deep feature representation based on open classification boundaries: if it is located within the open classification boundary of any known category, it is determined to be the corresponding known attack category; otherwise, it is determined to be an unknown attack sample and cached. S4: Perform cluster analysis on cached unknown attack samples to identify potential new attack pattern clusters; S5: Perform a novelty assessment on the results of the cluster analysis. If the assessment results meet the preset conditions, then confirm the formation of a new attack category. S6: In response to the confirmation of new attack categories, dynamically expand the classification structure of the model and add corresponding category prototypes and classification output nodes; S7: Based on samples of new attack categories, and combined with a knowledge distillation mechanism, the model is incrementally learned and updated to slow down the forgetting of historical category knowledge; S8: Deploy the updated model and return to step S1 to form a continuously evolving detection loop.

2. The method according to claim 1, characterized in that, In step S3, the open set rejection discrimination is based on the feature space and open classification boundary obtained by training through the joint loss function; the joint loss function includes cross-entropy loss for improving classification accuracy, prototype center loss for compressing intra-class distance, and rejection loss term for expanding inter-class distance and constraining open space distribution.

3. The method according to claim 1, characterized in that, In step S4, a density-based clustering algorithm is used to perform cluster analysis on the unknown attack samples.

4. The method according to claim 1, characterized in that, In step S5, the novelty assessment is achieved by calculating the internal compactness of the cluster and the separation degree between the cluster and all known attack category clusters.

5. The method according to claim 1, characterized in that, In step S7, the knowledge distillation mechanism constrains the output distribution of the updated model for historical category samples by limiting incremental learning, so that it is consistent with the output distribution of the model before the update.

6. The method according to claim 1, characterized in that, The low-dimensional semantic embedding space has 128 dimensions; the distance threshold for the open classification boundary is 0.65; the core distance parameter for the clustering analysis is 0.4; the preset threshold for novelty evaluation is 2.0; and the weighting coefficient for the knowledge distillation loss is 0.

3.

7. A network unknown attack detection system, characterized in that, The system for implementing the network unknown attack detection method according to any one of claims 1-6, the system comprising: The data preprocessing module is used to process the collected network traffic data to generate network behavior feature vectors; The feature encoding module is used to map the network behavior feature vector into a deep feature representation; The open set rejection discrimination module is used to classify input samples for known attacks or reject them for unknown attacks based on open classification boundaries. The unknown attack caching module is used to store samples that are identified as unknown attacks; The unknown sample clustering analysis module is used to perform clustering analysis on cached unknown attack samples; The novelty assessment module is used to evaluate clustering results to confirm whether new attack categories have been formed. The dynamic category expansion module is used to expand the classification structure of the model after a new category is identified. The incremental learning and update module is used to perform incremental learning and updates on the model based on new samples and in conjunction with a knowledge distillation mechanism. The model deployment management module is used to complete the online deployment of updated models.

8. The system according to claim 7, characterized in that, The system further includes a data layer, which includes: A known attack knowledge base is used to store the feature distribution models and decision boundary parameters of known attack categories; The model parameter storage area is used to store the network weight parameters of the feature encoding module and the open set rejection discrimination module. An unknown attack caching library is used to persistently store the data in the unknown attack caching module.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network unknown attack detection method as described in any one of claims 1-6.

10. An electronic device, characterized in that, include: The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the network unknown attack detection method as described in any one of claims 1-6.

Images