Behavior analysis system and method based on a secure large model

Abstract

The application discloses a behavior analysis system and method based on a security large model, relates to the technical field of network security, and comprises the following steps: analyzing original traffic to extract metadata features, generating an original time sequence feature matrix, and complementing the original time sequence feature matrix to obtain a time sequence feature matrix; inputting the time sequence feature matrix into a discriminant network model, generating a prompt word sequence, inputting the prompt word sequence into a security basic large model, outputting a suspicious traffic set and a flow control intensity coefficient, and constructing a flow association graph based on the suspicious traffic set; analyzing the flow association graph to extract target traffic, combining the flow control intensity coefficient, calculating queue scheduling parameters, and outputting modulated target traffic. The application utilizes the flow association graph and a dynamic flow control mechanism to adaptively modulate target traffic, improves the identification accuracy and real-time processing capability of malicious traffic in a complex network environment, and reduces the influence on normal business traffic.

Description

Technical Field

[0001] This invention relates to the technical field of network security, and in particular to a behavior analysis system and method based on a large security model. Background Technology

[0002] As cyberattacks become increasingly covert, traditional static rule-based intrusion detection systems struggle to cope with unknown threats. While large-scale security models possess powerful cross-flow context understanding capabilities, their high computational overhead and millisecond-level inference latency are orders of magnitude greater than the nanosecond-level line-speed forwarding requirements of underlying network devices. This mismatch between hardware and software time-series dimensions prevents existing deep intelligent analysis methods from being directly and in real-time applied to the traffic shaping and scheduling strategies of the underlying hardware's transmission queues.

[0003] Currently, Chinese invention patent application CN119484000A discloses a large-scale model method for cybersecurity. This invention, through multi-stage training, sequentially constructs an adaptive security policy generation model, a cybersecurity risk assessment model, and a multi-task deep neural network model, enabling the large model to cover a wide range of cybersecurity tasks and achieve comprehensive protection from threat detection to risk assessment. Refined training and optimization at each stage ensure the model deeply understands and handles complex cybersecurity challenges. The adaptive security policy generation model learns from changes in network state and adjusts security policies in real time, enhancing defense capabilities. The cybersecurity risk assessment model analyzes risk factors and generates accurate risk scores, providing managers with a clear security posture view. The introduction of a dual-attention mechanism further optimizes feature processing; channel attention strengthens key features, and spatial attention optimizes spatial distribution, making the model more accurate in capturing and locating abnormal behavior. However, related technologies lack real-time responsiveness to dynamic malicious network traffic and the accuracy of underlying queue modulation strategies. Summary of the Invention

[0004] The technical problem solved by this invention is that related technologies cannot effectively resolve the timing conflict between high inference latency of the model and high frequency scheduling of the data plane, and lack real-time responsiveness and accuracy.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A behavior analysis system based on a large security model includes: The hardware-based solidification module is used to parse the raw traffic, extract metadata features, generate the raw time-series feature matrix, and complete the raw time-series feature matrix to obtain the time-series feature matrix. The analysis and construction module is used to input the temporal feature matrix into the discriminant network model, generate a prompt word sequence to input into the security foundation model, output a set of suspected traffic and flow control strength coefficient, and construct a flow association graph based on the set of suspected traffic. The collaborative modulation module is used to parse the flow correlation graph to extract the target flow, combine it with the flow control intensity coefficient, calculate the queue scheduling parameters, and output the modulated target flow.

[0006] Preferably, the processing logic of the hardware firmware module is as follows: Obtain the raw traffic, map the raw traffic to the receive buffer, and allocate the corresponding hardware counter; Parse the protocol header of the raw traffic and strip the payload data to obtain metadata characteristics; The raw traffic is cleaned by recording the enqueue time, dequeue time, and packet length of the cleaned traffic using a hardware counter. The five-tuple information in the metadata features is used to establish an index for the receive buffer. The enqueue time, dequeue time, and packet length are accumulated and concatenated to generate an original time-series feature matrix. The original time-series feature matrix includes a result matrix and a covariate matrix. The system detects the occupancy status of the receive buffer. When the occupancy status reaches a preset occupancy threshold, it generates a priority flow control backpressure frame and sends it to the network peer.

[0007] Preferably, the processing logic for completing the original time-series feature matrix includes: Extract the missing value location identifiers from the result matrix and covariate matrix. Based on the missing value location identifiers, calculate the estimated feature quantity of the missing value location. Fill the estimated feature quantity into the corresponding missing value location in the result matrix and covariate matrix in the positive direction, and output the time series feature matrix.

[0008] Preferably, the processing logic for obtaining the suspected traffic set and flow control intensity coefficient includes: The discriminant network model includes an input layer, a convolutional layer, a recurrent neural network, and a fully connected layer; The temporal feature matrix is ​​mapped to a high-dimensional feature space, local temporal patterns are extracted using convolutional layers, and global temporal dependencies are captured using recurrent neural networks. The local temporal pattern and the global temporal dependency are fused and nonlinearly mapped by a fully connected layer to output the initial probability distribution of each preset traffic category label; When the initial probability distribution is within the preset trigger threshold range, the corresponding temporal feature matrix and metadata features are extracted and concatenated to generate a structured prompt word sequence; The structured prompt word sequence is input into the security foundation big model, cross-flow context association weights are calculated, and the features of the decoding layer of the security foundation big model are restored based on the cross-flow context association weights, and the confirmed traffic category labels and their corresponding confidence scores are output. Traffic that is confirmed to have a pre-defined malicious attribute will be categorized into the suspected traffic set. Extract the basic penalty weight corresponding to the confirmed traffic category label, and calculate the flow control strength coefficient by weighting the basic penalty weight with the confidence score. Then, store the flow control strength coefficient in the asynchronous control flow table.

[0009] The preferred training logic for the discriminant network model is as follows: The operating conditions generate an adversarial network. A random noise vector and a preset traffic category label are input. In the adversarial network, a simulation matrix is ​​output through convolution operation. The simulation matrix is ​​used as a pseudo sample and the real sample matrix is ​​used as a real sample. These are input to the discriminant network model to obtain the adversarial loss. Based on the adversarial loss, the parameters of the condition-generated adversarial network and the discriminant network model are updated alternately through backpropagation.

[0010] Preferably, the processing logic for constructing the flow association graph is as follows: Take the suspected traffic in the suspected traffic set as the ingress traffic and the ingress traffic as the root node to initialize the flow association tree; Obtain the forwarding traffic of the system's outgoing port, construct the forwarding traffic into a candidate flow set, extract the start arrival time of each candidate outgoing flow in the candidate flow set as the first time-series constraint feature, and extract the start arrival time of the incoming flow as the second time-series constraint feature. Compare the temporal order of the first and second temporal constraint features. If the first temporal constraint feature is earlier than the second temporal constraint feature, prune the computational branch containing the candidate exit flow in the flow association tree. Calculate the similarity distance between the remaining candidate exit flows that have not been pruned and the inlet flows. Connect the remaining candidate exit flows that have not been pruned and whose similarity distance meets the preset comparison conditions as child nodes into the flow association tree to generate a flow association graph.

[0011] Preferably, the processing logic for calculating similarity distance includes: Obtain the eigenvalue sequence of the temporal feature matrix corresponding to the remaining candidate exit flows that have not been pruned and the baseline eigenvalue sequence of the temporal feature matrix of the inlet flows. Use the dynamic time warping algorithm to compare the eigenvalue sequence with the baseline eigenvalue sequence to obtain the local cost matrix. Use the state transition equation to calculate the similarity distance on the local cost matrix.

[0012] Preferably, the processing logic of the coordinated modulation module is as follows: The topology of the flow association graph is analyzed, and the child nodes are extracted as target flows. The five-tuple information of the target traffic is input into a hash function to generate an encoding sequence, and the encoding sequence is mapped bit by bit to a state sequence, with specific values ​​of 00, 01, 10, and 11. Based on the specific values ​​of the state sequence, the flow control strength coefficient matched in the asynchronous control flow table is called to calculate the weight value of the weighted round-robin scheduling queue of the hardware sending queue corresponding to the target traffic and the token bucket rate limit value. The queue scheduling parameters are then combined and written into the flow table register of the corresponding hardware sending queue. The target traffic is divided into consecutive data packet groups according to the preset segmentation window; Based on queue scheduling parameters, the queue backlog and release time of the target traffic in each data packet group are controlled, the relative arrival time of data packets in each data packet group is changed, and the modulated target traffic is output.

[0013] Preferably, the processing logic for calculating the weight values ​​of the weighted round-robin scheduling queue and the token bucket rate limit includes: Establish a mapping table between the specific values ​​of the state sequence and the basic flow control factor, and perform multiplication and addition operations on the corresponding basic flow control factor and the flow control intensity coefficient respectively to generate the weight value of the weighted round-robin scheduling queue and the token bucket rate limit value; The basic flow control factors include basic weighting factors and basic rate factors.

[0014] The behavior analysis method based on a large security model includes the following steps: Step S1: Parse the raw traffic to extract metadata features, generate the raw time series feature matrix, and complete the raw time series feature matrix to obtain the time series feature matrix. Step S2: Input the temporal feature matrix into the discriminant network model, generate a prompt word sequence and input it into the security foundation model, output the suspected traffic set and flow control strength coefficient, and construct a flow association graph based on the suspected traffic set; Step S3: Analyze the flow correlation graph to extract the target flow, combine it with the flow control strength coefficient, calculate the queue scheduling parameters, and output the modulated target flow. The beneficial effects of this invention are as follows: This invention extracts metadata features and generates an original temporal feature matrix containing a result matrix and a covariate matrix. The completed original temporal feature matrix is ​​then input into a discriminative network model. The flow correlation graph is parsed to extract target traffic. Based on the state sequence, the flow control strength coefficient is asynchronously invoked, and the weight values ​​of the weighted round-robin scheduling queue and the token bucket rate limit are calculated. The network traffic with completed time-slot centroid modulation is then output. By separating control and transmission, the large model's computing power and hardware line-speed forwarding are decoupled. Precise empowerment of data plane queuing is achieved without causing network congestion, improving the accuracy of traffic behavior analysis and the timeliness of defense mechanisms. Attached Figure Description

[0015] Figure 1 This is a basic flowchart of a behavior analysis system based on a large security model provided in one embodiment of the present invention; Figure 2The flowchart illustrates the steps of a behavior analysis method based on a large security model, as provided in one embodiment of the present invention. Detailed Implementation

[0016] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0017] Example 1, refer to Figure 1 It provides a behavior analysis system based on a large security model, including: The hardware-based solidification module is used to parse the raw traffic, extract metadata features, generate the raw time-series feature matrix, and complete the raw time-series feature matrix to obtain the time-series feature matrix. The analysis and construction module is used to input the temporal feature matrix into the discriminant network model, generate a prompt word sequence to input into the security foundation model, output a set of suspected traffic and flow control strength coefficient, and construct a flow association graph based on the set of suspected traffic. The collaborative modulation module is used to parse the flow correlation graph to extract the target flow, combine it with the flow control intensity coefficient, calculate the queue scheduling parameters, and output the modulated target flow.

[0018] In practice, the processing logic of the hardware-based firmware module is as follows: Obtain the raw traffic, map the raw traffic to the receive buffer, and allocate the corresponding hardware counter; The receive buffer is managed based on a doubly linked list. Each memory block descriptor contains not only a pointer to the next data packet, but also a pointer to the previous data packet.

[0019] Parse the protocol header of the raw traffic and strip the payload data to obtain metadata characteristics; The raw traffic is cleaned by recording the enqueue time, dequeue time, and packet length of the cleaned traffic using a hardware counter. The five-tuple information in the metadata features is used to build an index for the receive buffer. The enqueue time, dequeue time, and packet length are accumulated and concatenated to generate the original time series feature matrix, which includes the result matrix and the covariate matrix. The system detects the occupancy status of the receive buffer. When the occupancy status reaches a preset occupancy threshold, it generates a priority flow control backpressure frame and sends it to the network peer.

[0020] Specifically, the Ethernet frame header is extracted, and the EtherType field is identified. Based on the EtherType field, an offset is calculated and fed into the IP header to extract the source IP, destination IP, and transport layer protocol type, and the IHL field is read. The offset calculated based on the IHL is then fed into the transport layer, where the TCP header is parsed to extract the source port, destination port, and transport layer protocol type, thus completing the extraction of the five-tuple information. The lengths of the Ethernet frame header, IP header, and transport layer header are added together to obtain the total byte length of the protocol header, which serves as the payload boundary pointer. A hardware truncation mechanism is then activated to discard all binary data following the payload boundary pointer, retaining only the header fields and metadata identifiers to form a metadata feature stream.

[0021] Perform frame check sequence comparison and checksum calculation between the network layer and the transport layer on the data packets, and discard corrupted data packets that fail the check; filter broadcast messages and multicast control frames that do not belong to a specific communication link; identify the fragmentation flag and fragmentation offset in the IP header, treat data packets belonging to the fragmented data stream as independent time nodes, extract the fragmentation flag and fragmentation offset and map them to the covariate matrix of the time sequence feature matrix.

[0022] The hardware counter uses a high-precision internal clock to record the first bit of a data packet falling into the receive buffer. (Enqueue time) is recorded when the last bit of the data packet leaves the buffer and is sent to the processing engine. (Dequeue time), and count the total number of bytes L of the packet.

[0023] Calculate hardware queuing dwell time: ; Calculate the arrival time interval between adjacent data packets: ; Calculate the cumulative transmitted load of this data stream: ; Initialize a dimension as The time window matrix (N is the sequence length, M is the feature dimension) is generated. The absolute timestamp, byte length, and cumulative payload are mapped to the result matrix; the derived time features of queuing dwell time and arrival time interval are mapped to the covariate matrix, completing the horizontal splicing and merging.

[0024] The preset occupancy threshold is preferably 70% to 85% of the total buffer capacity. When the threshold is detected and a backpressure frame is sent, the transmission of this control frame in the optical fiber takes time, and the parsing and stopping of transmission by the peer device also takes time. During this delay period, data packets that have already been sent will continue to flood into the system.

[0025] In specific implementation, the processing logic for completing the original time-series feature matrix includes: Extract the missing value location identifiers from the result matrix and covariate matrix. Based on the missing value location identifiers, calculate the estimated feature quantity at the missing value location. Fill the estimated feature quantity into the corresponding missing value location in the result matrix and covariate matrix in the positive direction, and output the time series feature matrix.

[0026] Specifically, the original time-series feature matrix is ​​traversed to locate the time step index t where the missing value is located; using t as a baseline, a local time window containing k valid historical observations is extracted. The time interval between each valid observation and the missing value within the local time window is extracted. Introducing a time decay factor Calculate the time-decay weight for each valid observation. Data closer to the current time has greater reference value. The estimated feature values ​​are obtained by multiplying the feature values ​​of each valid observation by their corresponding time-series decay weights, summing the results, and then normalizing by dividing by the total weights. These estimated feature values ​​are then used to fill in the missing value positions to complete the matrix completion.

[0027] It should be noted that this invention integrates the quintuple information in the metadata features, as well as the enqueue time, dequeue time, and packet length recorded by the hardware counter, into the time-series aggregation process of the doubly linked list index of the receive buffer. This yields the corresponding original time-series feature matrix that can be mapped according to the traffic behavior trajectory, thus solving the problems of single dimension, missing hardware forwarding environment context, and tensor calculation crash caused by abnormal missing values ​​in traditional traffic feature extraction.

[0028] In specific implementation, the processing logic for obtaining the suspected traffic set and flow control intensity coefficient includes: The discriminant network model includes an input layer, convolutional layers, recurrent neural networks, and fully connected layers; The temporal feature matrix is ​​mapped to a high-dimensional feature space, local temporal patterns are extracted using convolutional layers, and global temporal dependencies are captured using recurrent neural networks. The initial probability distribution of each preset traffic category label is output by performing feature fusion and nonlinear mapping on local temporal patterns and global temporal dependencies through a fully connected layer. When the initial probability distribution is within the preset trigger threshold range, the corresponding temporal feature matrix and metadata features are extracted and concatenated to generate a structured prompt word sequence; Specifically, the temporal feature matrix is ​​input into the fully connected embedding layer, and the basic features are expanded to a higher dimension through linear matrix multiplication to generate a high-dimensional feature tensor. A one-dimensional convolutional kernel slides along the time axis of the high-dimensional feature tensor. Within each sliding window, the dot product of the feature vectors is calculated, outputting a local temporal feature map. The local temporal feature maps, after pooling and dimensionality reduction, are sequentially input into the nodes of the Long Short-Term Memory (LSTM) network at each time step. Through the forget and update gate mechanisms of the RNN, the long-term state information of historical flows is preserved, and the hidden state vector of the last time step is output.

[0029] The global max-pooling vector output from the CNN and the final hidden state vector output from the RNN are extracted and directly concatenated along the channel dimension to generate a joint feature vector. This joint feature vector is then input into a fully connected layer containing a multilayer perceptron. A ReLU activation function is introduced between each layer of the fully connected layer to perform non-linear feature combination and spatial transformation. A Softmax normalization function is applied at the end of the fully connected layer to transform the non-linearly transformed feature output values ​​into an initial probability distribution vector with values ​​ranging from 0 to 1 and a sum of 1. Each dimension of this vector corresponds to a preset traffic category label.

[0030] The preset traffic category labels include normal business traffic, denial-of-service attack traffic, probe scan traffic, brute-force attack traffic, botnet traffic, slow exhaustion attack traffic, and jump server forwarding traffic. Among them, the sudden high-frequency behavior of denial-of-service attack traffic and probe scan traffic is mainly identified by local temporal patterns extracted by convolutional layers; the covert slow behavior of botnet traffic and jump server forwarding traffic is mainly identified by global temporal dependencies captured by recurrent neural networks.

[0031] The preset trigger threshold range is preferably between 0.75 and 0.85. If the initial probability distribution is higher than the upper limit of the preset trigger threshold range (0.85), it is directly classified into the suspected traffic set and a basic penalty weight is issued. If it falls within the preset trigger threshold range, it is determined to be gray zone traffic, and the corresponding temporal feature matrix is ​​extracted and uploaded to the large model. The multi-head attention mechanism of the large model is used to combine the context for in-depth analysis, which protects the computing power of the large model and blocks the risk of missed detection of unknown attacks. If the initial probability distribution is lower than the upper limit of the preset trigger threshold range (0.75), it is determined to be normal business traffic, and line-rate lossless forwarding is directly executed without triggering the call of the security large model.

[0032] The structured prompt word sequence is input into the security foundation big model, the cross-flow context association weight is calculated, and the feature restoration of the decoding layer of the security foundation big model is performed based on the cross-flow context association weight, and the confirmed traffic category label and its corresponding confidence score are output. Traffic that is confirmed to have a pre-defined malicious attribute will be categorized into the suspected traffic set. Extract the basic penalty weight corresponding to the confirmed traffic category label, and calculate the flow control strength coefficient by weighting the basic penalty weight with the confidence score. Then, store the flow control strength coefficient in the asynchronous control flow table.

[0033] Specifically, the security foundation model includes an embedding layer, a self-attention encoder block, and a decoding layer; Obtain the prompt word sequence vector output from the embedding layer, and multiply it by three pre-trained weight matrices to generate the query matrix Q, key matrix K, and value matrix V. Calculate the dot product of the transpose of the query matrix Q and the key matrix K, calculate the similarity score between features from different data streams, divide the similarity score by a scaling factor, and normalize it using the Softmax function to generate the cross-stream context association weight matrix. This mathematical process can be expressed as: ; in, This is the scaling factor.

[0034] Receives a set of semantic vectors containing cross-stream context association weights.

[0035] The feedforward neural network in the decoding layer performs a non-linear mapping with layer normalization to filter out noise features. The mapped feature vector is then input into a fully connected layer and projected into a preset traffic label space. After passing through a Softmax activation function, the final probability distribution of the data stream belonging to each preset label is output. The maximum probability value in the probability distribution is extracted as the confidence score, and the label corresponding to the maximum probability value is output as the confirmed traffic category label.

[0036] Preset malicious attributes include distributed collaborative exhaustion attribute, covert channel and heartbeat attribute, illegal lateral movement and proxy attribute, and authentication attack attribute.

[0037] Distributed collaborative exhaustion attributes include DDoS flood attacks and slow connection exhaustion attacks; covert channel and heartbeat attributes include timed heartbeat communication of botnets and DNS tunnel data outgoing; illegal lateral movement and proxy attributes include internal network port scanning and multi-level proxy forwarding communication of jump servers; authentication attack attributes include dictionary brute-force cracking of protocols such as SSH and RDP.

[0038] The asynchronous control flow table is a high-speed memory-mapped table deployed in the underlying hardware. When forwarding each data packet, the underlying hardware module simply queries this table at line speed. If the coefficient is found, time-slot modulation is performed; otherwise, the packet is allowed to pass at the default speed.

[0039] In one embodiment, if the confirmed traffic category label is probe scanning traffic, it is considered to be an early probing behavior that has not yet caused substantial damage, and its basic penalty weight is preset to be low, preferably set to 2; if the confirmed traffic category label is denial-of-service attack traffic and brute-force attack traffic, it is considered to be directly consuming network bandwidth or computing resources, and its basic penalty weight is preset to be medium to high, preferably set to 6; if the confirmed traffic category label is jump-forward traffic and botnet traffic, it is considered to involve the loss of internal core assets, being remotely controlled by external hackers, and being used as an attack relay, and is extremely harmful, and its basic penalty weight is preset to reach the highest level, preferably set to 10.

[0040] The calculation expression for weighting the base penalty weight with the confidence score is as follows: ; in, Indicates the flow control intensity coefficient. This indicates the confirmed traffic category label, where k is the index value of this label in the preset malicious attributes. This indicates that it is built into the mapping table, and is related to the label. The corresponding base penalty weight, This indicates the confidence score corresponding to the confirmation label, and .

[0041] The basic security model structure is as follows: The system accepts the structured prompt word sequence generated by the edge discrimination network and maps it into a high-dimensional continuous semantic feature vector through word embedding and temporal position encoding modules; the self-attention encoder block calculates the similarity score between features of different data streams through multi-head attention, generates cross-stream context association weights, and extracts covert attack semantics spanning long physical cycles; the decoding layer restores features through layer normalization and fully connected mapping network, and combines the Softmax activation function to output the confirmed traffic category label probability distribution and corresponding confidence score. Training parameters include: a loss function, which is a joint loss function consisting of a weighted sum of masked flow modeling loss and a supervised contrastive loss with a temperature coefficient; the AdamW optimizer is configured with a weight decay coefficient of 0.01 to prevent overfitting of hundreds of billions of parameters; and an initial learning rate of 5 × 10⁻⁶. -5 Batch size is 256; number of fine-tuning training rounds is 50; training set accounts for 80%, validation set accounts for 10%, and test set accounts for 10%; a linear warm-up combined with cosine annealing decay strategy is adopted, and the number of warm-up steps is set to 10% of the total training steps; In a fine-tuning iterative training session: Set the initial learning rate to 5×10. -5With a batch size of 256, the weights of the masked traffic modeling loss and the supervised comparison loss in the joint loss function are 0.3:0.7. When the stacking number L of the self-attention mechanism block in the deep cognitive layer is set to 12 layers, after about 40 rounds of training, the model's classification accuracy against complex jump-gate attacks in the test set stabilizes above 94.5%, and the rate of change of the joint loss tends to converge. Ablation experiments show that when L=12, compared with L=6, the false negative rate for long-range dependent attacks on APT heartbeats is significantly reduced by 22.3%. Compared with L=24, not only is the cloud inference time for a single prompt word sequence reduced by nearly 45%, but the attention collapse phenomenon caused by excessive network depth is also effectively avoided. Therefore, the final stacking number L of the self-attention mechanism block is confirmed to be 12.

[0042] In practice, the training logic for the discrimination network model is as follows: The operating conditions generate an adversarial network. The input is a random noise vector and a preset traffic category label. In the adversarial network, a simulation matrix is ​​output through convolution operation. The simulation matrix is ​​used as a pseudo sample and the real sample matrix is ​​used as a real sample. These are input into the discriminant network model to obtain the adversarial loss. Based on the adversarial loss, the parameters of the condition-generated adversarial network and the discriminant network model are updated alternately through backpropagation.

[0043] Specifically, the discriminant network model structure is as follows: The input layer receives the simulated matrix output by the conditional generative adversarial network and the real sample matrix captured from the lower layer; the convolutional layer maps the input matrix to a high-dimensional feature space and extracts local temporal patterns using one-dimensional convolution operations; the recurrent neural network is used to capture global temporal dependencies between sequences; the fully connected layer performs feature fusion and nonlinear mapping on the local temporal patterns and global temporal dependencies. In the adversarial network, a multi-branch output is used, with one branch mapping to a scalar probability value and outputting the true / false judgment probability, and another branch outputting the conditional classification probability distribution of multiple categories; Training parameters include loss functions: the discriminative network model uses least squares adversarial loss, while the conditional generative adversarial network uses a joint loss function consisting of a weighted sum of least squares adversarial loss, conditional classification cross-entropy loss, and temporal physical constraint loss; both the conditional generative adversarial network and the discriminative network model are independently configured with Adam optimizers, and a momentum decay parameter of 0.5 is set for stable adversarial games; the initial learning rate is set to 2×10⁻⁶. -4 Batch size is 128; number of training rounds is 800; training set accounts for 85% and validation set accounts for 15%; cosine annealing with hot restart is used for periodic decay. In one alternating adversarial training session, the initial learning rate for both generation and discrimination was set to 2 × 10⁻⁴, and the batch size to 128. The weights of the adversarial loss, conditional classification cross-entropy loss, and temporal physical constraint loss in the joint loss function of the conditional generative adversarial network were allocated as 0.2:0.4:0.4. When the number of one-dimensional deconvolutional layers M in the conditional generative adversarial network was set to 5, after approximately 650 training rounds, the output probability of the discriminant network model for true and false samples stabilized in the range of 0.48 to 0.52, and the rate of change of the joint loss approached a minimum. Ablation experiments showed that when M=5, compared to M=3, the mean squared error of the generated simulation matrix in temporal physical constraints was reduced by 18.4%. Compared to M=7, not only was the time consumed per round of alternating adversarial training reduced by nearly 25%, but the overfitting phenomenon caused by the generative network forcibly memorizing a single known attack flow feature due to excessive parameter capacity was effectively avoided. Therefore, the final number of convolutional layers M was confirmed to be 5.

[0044] It should be noted that this invention fuses random noise vectors and preset traffic category labels into a conditional generative adversarial network, and then uses the resulting simulated matrix to update the parameters of the discriminant network model. Furthermore, by strictly defining the simulated matrix as pseudo-samples and the real sample matrix as true samples, and inputting them respectively into the discriminant network model for backpropagation alternating update, the mathematical correctness of the zero-sum game learning path between the generator and discriminator is guaranteed, effectively solving the problem of the model reinforcing and absorbing erroneous features.

[0045] In practice, the processing logic for constructing the flow association graph is as follows: Take the suspected traffic in the suspected traffic set as the ingress traffic and the ingress traffic as the root node to initialize the flow association tree; Obtain the forwarding traffic at the system's outgoing port, construct a candidate flow set from the forwarding traffic, extract the start arrival time of each candidate outgoing flow in the candidate flow set as the first time-series constraint feature, and extract the start arrival time of the incoming flow as the second time-series constraint feature. Compare the temporal order of the first and second temporal constraint features. If the first temporal constraint feature is earlier than the second temporal constraint feature, prune the computational branch containing the candidate exit flow in the flow association tree. Calculate the similarity distance between the remaining candidate exit flows that have not been pruned and the inlet flows. Connect the remaining candidate exit flows that have not been pruned and whose similarity distance meets the preset comparison conditions as child nodes into the flow association tree to generate a flow association graph.

[0046] Specifically, suspected traffic is received and confirmed to be either hop-forwarded or proxy traffic. The five-tuple information of the suspected traffic is used as a unique entity identifier, instantiated as a data structure node, and this node is defined as the root node of the flow association tree. An association graph space is allocated in system memory, and the depth level of the root node is initialized to... (Represents the first hop entry point of the attack chain), and initializes an empty array of child node memory pointers for it, waiting for the subsequent successfully matched exit stream to be connected. This completes the initialization of the stream association tree.

[0047] In one embodiment, at the underlying network hardware's transmit pipeline stage, a traffic capture probe symmetrical to the receiver is deployed. When the system kernel or application is preparing to send data packets to the external network, and the data packets enter the transmit descriptor ring before triggering a physical transmit interrupt, the header information of that batch of data packets is copied through the mirror endpoint. The five-tuple information of the copied outgoing port packets is parsed to establish a sender flow table index. The various independent data streams currently in an active transmit state are aggregated to construct a candidate flow set.

[0048] The temporal order refers to the order in which network proxy nodes forward a data packet, following the sequence of receiving (incoming) data before sending (outgoing) data. The second temporal constraint characteristic (arrival time of the ingress stream)... The moment when the first packet of suspected traffic enters the system. First timing constraint feature (candidate egress flow sending time). The moment when the first packet of the candidate target traffic leaves the system.

[0049] ,in This represents the lowest forwarding processing latency within the system.

[0050] When the first time-series constraint feature (exit time) is earlier than the second time-series constraint feature (entry time), it indicates that the exit flow was already being sent out before the suspected flow entered.

[0051] In practice, the logic for calculating the similarity distance includes: Obtain the eigenvalue sequence of the temporal feature matrix corresponding to the remaining candidate exit flows that have not been pruned and the baseline eigenvalue sequence of the temporal feature matrix of the inlet flows. Use the dynamic time warping algorithm to compare the eigenvalue sequence with the baseline eigenvalue sequence to obtain the local cost matrix. Use the state transition equation to calculate the similarity distance on the local cost matrix.

[0052] Specifically, the eigenvalue sequence of the temporal feature matrix corresponding to the remaining candidate exit flows that were not pruned is: Where n is the time step length of the eigenvalue sequence, and the baseline eigenvalue sequence of the temporal feature matrix of the ingress stream is... , where m is the time step length of the baseline feature value sequence; Calculate the spatial distance between the feature components at each time step in sequences X and Y. Generate size is The local cost matrix; Initialize the cumulative distance matrix D, and calculate the cumulative distance of each element in the matrix according to the state transition equation based on the local cost matrix: ; Extract the cumulative final value from the end of the cumulative distance matrix The cumulative final value is divided by the total step length of the normalized path for normalization, and the normalized value is output as the similarity distance between the two sequences.

[0053] Introducing the ability to process variable-length sequences (n and m), in real-world networks, the number of packets in the outgoing flow (X) and incoming flow (Y) forwarded via jump servers is often unequal. It is shown that sequence lengths n and m can be different, proving the system's practical ability to process asymmetric sequences in physical networks. The state transition equation... In physical network behavior, this corresponds to: A data packet backlog delay occurred at the corresponding export end; A sudden out-of-order data packet occurred at the corresponding entry point; The corresponding inbound and outbound packet rates are perfectly synchronized and matched.

[0054] In practice, the processing logic of the cooperative modulation module is as follows: Analyze the topology of the flow association graph and extract the child nodes as target flows; The five-tuple information of the target traffic is input into a hash function to generate an encoding sequence, and the encoding sequence is mapped bit by bit to a state sequence, with specific values ​​of 00, 01, 10, and 11. Based on the specific values ​​of the state sequence, the flow control strength coefficient matched in the asynchronous control flow table is called to calculate the weight value of the weighted round-robin scheduling queue of the hardware sending queue corresponding to the target traffic and the token bucket rate limit value. The queue scheduling parameters are then combined and written into the flow table register of the corresponding hardware sending queue. The target traffic is divided into consecutive data packet groups according to the preset segmentation window; Based on queue scheduling parameters, the queue backlog and release time of the target traffic in each data packet group are controlled, the relative arrival time of data packets in each data packet group is changed, and the modulated target traffic is output.

[0055] Specifically, the source IP address, destination IP address, source port, destination port, and transport layer protocol number of the target traffic are extracted and concatenated into a continuous binary string with a fixed bit width. This binary string is then input into a hash function embedded in the underlying hardware, which generates a fixed-width hash digest value through polynomial bit operations. Specific bits of the hash digest value are then extracted, such as the lowest two bits. These extracted bit values ​​are then mapped to a state sequence.

[0056] The flow table register is a static random access memory (SRAM) in the underlying network forwarding chip. Queue scheduling parameters are written into this register. When a packet of the target traffic arrives at the sending queue, the hardware queries this register at a nanosecond speed, reads the parameters, and automatically performs rate limiting or weighted round-robin, without relying on the upper-layer CPU, thus ensuring line-speed forwarding.

[0057] The preset segmentation window is preferably between 1 millisecond and 10 milliseconds. If it is less than 1 millisecond, the underlying hardware timer will interrupt too frequently, which will overload the hardware scheduler. If it is greater than 10 milliseconds, the packet queuing time will be too long, which will trigger the TCP protocol's retransmission mechanism and destroy the original form of the traffic.

[0058] Based on the number of packets, the optimal window size is 16 to 64 packets. In PCIe architecture and hardware buffer descriptor management, 16 and 64 are often the default alignment lengths for a single hardware burst. Grouping and segmenting according to this number best matches the memory read / write cycle of the underlying hardware.

[0059] Queue backlog refers to the number of bytes or packets of traffic that are currently stuck in the network interface card's send buffer (SRAM) and have not been sent. The release time is a timestamp, assigned by the hardware scheduler based on the token bucket algorithm, to the first packet at the head of the queue, allowing it to pass.

[0060] The target traffic packets enter the sending queue in a natural state, at which point the natural arrival time interval between packets is... The hardware scheduler limits the rate at which tokens are injected into the queue based on the token bucket rate limit in the flow table register. Because token generation is slower, subsequently arriving packets are forced to queue, causing the queue backlog to rise rapidly. Packets are clustered together. When the queue is allocated a continuous transmission time slice according to its assigned weight value, the hardware bursts the backlog of packets out in a short period. At this point, the transmission interval between packets leaving the network card becomes extremely compressed. Furthermore, the energy center of the entire data packet group shifted on the time axis.

[0061] As a preferred embodiment, the weight value is preferably equivalent to a data volume quota of 8 to 64 MTUs, with a maximum transmission unit typically of 1500 bytes. If the weight value is less than 8 MTUs, the continuous transmission time slice allocated by the hardware is too short, and the queued data packets cannot form a sufficiently large burst, making it difficult to induce a significant time slot centroid shift on the macroscopic time axis, thus failing to achieve the marking effect of timing modulation. If the weight value is greater than 64 MTUs, although the compression effect of a single burst is extremely strong, the malicious queue will occupy the underlying PCIe bus and MAC layer transmission resources for too long, causing normal system service queues to even trigger protocol timeouts and disconnections.

[0062] In specific implementation, the processing logic for calculating the weight values ​​of the weighted round-robin scheduling queue and the token bucket rate limit includes: Establish a mapping table between the specific values ​​of the state sequence and the basic flow control factors, and perform multiplication and addition operations on the corresponding basic flow control factors and the flow control intensity coefficients respectively to generate the weight values ​​of the weighted round-robin scheduling queue and the token bucket rate limit values. The basic flow control factors include the basic weighting factor and the basic rate factor.

[0063] Specifically, a mapping table containing four sets of basic configurations is established in the underlying hardware. The mapping table maps the four specific values ​​of the state sequence to four physical transmission queues respectively, and statically configures the corresponding basic weight factor and basic rate factor for each physical transmission queue. The mapping rules are as follows: when the state sequence is 00, it is mapped to the first physical transmission queue, with a base weight factor of 16 and a base rate factor of 100Mbps; when the state sequence is 01, it is mapped to the second physical transmission queue, with a base weight factor of 12 and a base rate factor of 80Mbps; when the state sequence is 10, it is mapped to the third physical transmission queue, with a base weight factor of 8 and a base rate factor of 50Mbps; and when the state sequence is 11, it is mapped to the fourth physical transmission queue, with a base weight factor of 4 and a base rate factor of 10Mbps.

[0064] Obtain the weight decay step size coefficient and the rate decay step size coefficient; the preferred value range for the weight decay step size coefficient is 0.5 to 2.0, and in this embodiment, it is preferably 1; the preferred value range for the rate decay step size coefficient is... to In this embodiment, it is preferred that... ; The initial weight value of the weighted round-robin scheduling queue is calculated by multiplying the flow control intensity coefficient with the corresponding weight decay step size coefficient and subtracting the product from the corresponding basic weight factor. Similarly, the initial rate limit value of the token bucket is calculated by multiplying the flow control intensity coefficient with the corresponding rate decay step size coefficient and subtracting the product from the corresponding base rate factor. Compare the initial weight value with the minimum guaranteed weight threshold, and the minimum guaranteed weight threshold is preferably 1; When the initial weight value is less than the minimum guaranteed weight threshold, the weight value of the weighted round-robin scheduling queue will be forcibly assigned to the minimum guaranteed weight threshold. Comparing the initial rate limit value with the minimum communication rate threshold, the minimum communication rate threshold is preferably... ; When the initial rate limit is less than the minimum communication rate threshold, the token bucket rate limit will be forcibly assigned to the minimum communication rate threshold. The weight values ​​and rate limit values ​​that have been truncated at the boundary are concatenated in binary according to the instruction bit width format of the hardware flow table register to generate queue scheduling parameters.

[0065] Example 2, refer to Figure 2 It provides a behavior analysis method based on a large security model, including the following steps: Step S1: Parse the raw traffic to extract metadata features, generate the raw time series feature matrix, and complete the raw time series feature matrix to obtain the time series feature matrix. Step S2: Input the temporal feature matrix into the discriminant network model, generate a prompt word sequence and input it into the security foundation model, output the suspected traffic set and flow control strength coefficient, and construct a flow association graph based on the suspected traffic set; Step S3: Analyze the flow correlation graph to extract the target flow, combine it with the flow control intensity coefficient, calculate the queue scheduling parameters, and output the modulated target flow.

[0066] This invention utilizes a hardware-based embedded module to perform protocol parsing, metadata extraction, and time-series feature construction on raw traffic. A hardware counter enables real-time traffic statistics, reducing computational overhead associated with traditional software processing and improving traffic processing efficiency and system real-time response capabilities. It employs an analysis approach combining discriminative network models and a comprehensive security model, using these models for cross-flow contextual analysis to achieve deep reasoning about complex behavioral patterns. This improves the accuracy of identifying unknown, mutated, and covert attacks. A flow correlation graph is constructed to analyze correlated traffic, identifying related behaviors in multi-stage attack processes and enhancing the ability to discover complex attack chains and trace attack paths. Based on the flow control strength coefficient, queue scheduling parameters are dynamically calculated to adaptively modulate target traffic, dynamically suppressing malicious traffic without directly blocking communication. This reduces the impact on normal business traffic, improving network security protection capabilities and business continuity.

[0067] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, and the software modules can be housed in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0068] In this specification, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] It should be noted that the above description of the embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. It should be pointed out that those skilled in the art can make various improvements and modifications to the present invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the present invention.

Claims

1. A behavior analysis system based on a large security model, characterized in that, include: The hardware-based solidification module is used to parse the raw traffic, extract metadata features, generate the raw time-series feature matrix, and complete the raw time-series feature matrix to obtain the time-series feature matrix. The analysis and construction module is used to input the temporal feature matrix into the discriminant network model, generate a prompt word sequence to input into the security foundation model, output a set of suspected traffic and flow control strength coefficient, and construct a flow association graph based on the set of suspected traffic. The collaborative modulation module is used to parse the flow correlation graph to extract the target flow, combine it with the flow control intensity coefficient, calculate the queue scheduling parameters, and output the modulated target flow.

2. The behavior analysis system based on a large security model as described in claim 1, characterized in that, The processing logic of the hardware firmware module is as follows: Obtain the raw traffic, map the raw traffic to the receive buffer, and allocate the corresponding hardware counter; Parse the protocol header of the raw traffic and strip the payload data to obtain metadata characteristics; The raw traffic is cleaned by recording the enqueue time, dequeue time, and packet length of the cleaned traffic using a hardware counter. The five-tuple information in the metadata features is used to establish an index for the receive buffer. The enqueue time, dequeue time, and packet length are accumulated and concatenated to generate an original time-series feature matrix. The original time-series feature matrix includes a result matrix and a covariate matrix. The system detects the occupancy status of the receive buffer. When the occupancy status reaches a preset occupancy threshold, it generates a priority flow control backpressure frame and sends it to the network peer.

3. The behavior analysis system based on a large security model as described in claim 2, characterized in that, The processing logic for completing the original time-series feature matrix includes: Extract the missing value location identifiers from the result matrix and covariate matrix. Based on the missing value location identifiers, calculate the estimated feature quantity of the missing value location. Fill the estimated feature quantity into the corresponding missing value location in the result matrix and covariate matrix in the positive direction, and output the time series feature matrix.

4. The behavior analysis system based on a large security model as described in claim 3, characterized in that, The processing logic for obtaining the suspected traffic set and flow control intensity coefficient includes: The discriminant network model includes an input layer, a convolutional layer, a recurrent neural network, and a fully connected layer; The temporal feature matrix is ​​mapped to a high-dimensional feature space, local temporal patterns are extracted using convolutional layers, and global temporal dependencies are captured using recurrent neural networks. The local temporal pattern and the global temporal dependency are fused and nonlinearly mapped by a fully connected layer to output the initial probability distribution of each preset traffic category label; When the initial probability distribution is within the preset trigger threshold range, the corresponding temporal feature matrix and metadata features are extracted and concatenated to generate a structured prompt word sequence; The structured prompt word sequence is input into the security foundation big model, cross-flow context association weights are calculated, and the features of the decoding layer of the security foundation big model are restored based on the cross-flow context association weights, and the confirmed traffic category labels and their corresponding confidence scores are output. Traffic that is confirmed to have malicious attributes will be categorized into the suspected traffic set. Extract the basic penalty weight corresponding to the confirmed traffic category label, and calculate the flow control strength coefficient by weighting the basic penalty weight with the confidence score. Then, store the flow control strength coefficient in the asynchronous control flow table.

5. The behavior analysis system based on a large security model as described in claim 4, characterized in that, The training logic for the discriminant network model is as follows: The operating conditions generate an adversarial network. A random noise vector and a preset traffic category label are input. In the adversarial network, a simulation matrix is ​​output through convolution operation. The simulation matrix is ​​used as a pseudo sample and the real sample matrix is ​​used as a real sample. These are input to the discriminant network model to obtain the adversarial loss. Based on the adversarial loss, the parameters of the condition-generated adversarial network and the discriminant network model are updated alternately through backpropagation.

6. The behavior analysis system based on a large security model as described in claim 4, characterized in that, The processing logic for constructing the flow association graph is as follows: Take the suspected traffic in the suspected traffic set as the ingress traffic and the ingress traffic as the root node to initialize the flow association tree; Obtain the forwarding traffic of the system's outgoing port, construct the forwarding traffic into a candidate flow set, extract the start arrival time of each candidate outgoing flow in the candidate flow set as the first time-series constraint feature, and extract the start arrival time of the incoming flow as the second time-series constraint feature. Compare the temporal order of the first and second temporal constraint features. If the first temporal constraint feature is earlier than the second temporal constraint feature, prune the computational branch containing the candidate exit flow in the flow association tree. Calculate the similarity distance between the remaining candidate exit flows that have not been pruned and the inlet flows. Connect the remaining candidate exit flows that have not been pruned and whose similarity distance meets the preset comparison conditions as child nodes into the flow association tree to generate a flow association graph.

7. The behavior analysis system based on a large security model as described in claim 6, characterized in that, The processing logic for calculating similarity distance includes: Obtain the eigenvalue sequence of the temporal feature matrix corresponding to the remaining candidate exit flows that have not been pruned and the baseline eigenvalue sequence of the temporal feature matrix of the inlet flows. Use the dynamic time warping algorithm to compare the eigenvalue sequence with the baseline eigenvalue sequence to obtain the local cost matrix. Use the state transition equation to calculate the similarity distance on the local cost matrix.

8. The behavior analysis system based on a large security model as described in claim 7, characterized in that, The processing logic of the coordinated modulation module is as follows: The topology of the flow association graph is analyzed, and the child nodes are extracted as target flows. The five-tuple information of the target traffic is input into a hash function to generate an encoding sequence, and the encoding sequence is mapped bit by bit to a state sequence, with specific values ​​of 00, 01, 10, and 11. Based on the specific values ​​of the state sequence, the flow control strength coefficient matched in the asynchronous control flow table is called to calculate the weight value of the weighted round-robin scheduling queue of the hardware sending queue corresponding to the target traffic and the token bucket rate limit value. The queue scheduling parameters are then combined and written into the flow table register of the corresponding hardware sending queue. The target traffic is divided into consecutive data packet groups according to the preset segmentation window; Based on queue scheduling parameters, the queue backlog and release time of the target traffic in each data packet group are controlled, the relative arrival time of data packets in each data packet group is changed, and the modulated target traffic is output.

9. The behavior analysis system based on a large security model as described in claim 8, characterized in that, The processing logic for calculating the weight values ​​of the weighted round-robin scheduling queue and the token bucket rate limit includes: Establish a mapping table between the specific values ​​of the state sequence and the basic flow control factor, and perform multiplication and addition operations on the corresponding basic flow control factor and the flow control intensity coefficient respectively to generate the weight value of the weighted round-robin scheduling queue and the token bucket rate limit value; The basic flow control factors include basic weighting factors and basic rate factors.

10. A behavior analysis method based on a security big model, applied to a behavior analysis system based on a security big model as described in any one of claims 1-9, characterized in that, Includes the following steps: Step S1: Parse the raw traffic to extract metadata features, generate the raw time series feature matrix, and complete the raw time series feature matrix to obtain the time series feature matrix. Step S2: Input the temporal feature matrix into the discriminant network model, generate a prompt word sequence and input it into the security foundation model, output the suspected traffic set and flow control strength coefficient, and construct a flow association graph based on the suspected traffic set; Step S3: Analyze the flow correlation graph to extract the target flow, combine it with the flow control intensity coefficient, calculate the queue scheduling parameters, and output the modulated target flow.

Images