A network attack detection method and apparatus

Abstract

The application relates to the technical field of network security, in particular to a network attack detection method and device. The network flow data of each flow data set obtained is subjected to multi-level and multi-angle preset index analysis, and the statistical data of each preset index is decomposed based on variational mode decomposition to obtain the IMF corresponding to each preset index, so that the detection result is determined according to each preset feature corresponding to each IMF and a preset threshold value, the preset feature includes at least one of a time domain feature, a frequency domain feature and a time-frequency joint feature, multi-index collaborative correlation analysis is realized, and the accuracy of network attack detection is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for detecting network attacks. Background Technology

[0002] As cyberattack techniques become increasingly complex and covert, new attack methods such as Advanced Persistent Threats (APTs) and Low-rate Denial of Service (LDoS) attacks are emerging in large numbers, posing a serious challenge to existing cyberattack detection technologies. These attacks are typically characterized by low frequency, slow speed, and coordinated multiple indicators; their anomalous traces are weak and persistent, easily submerged in massive amounts of normal traffic.

[0003] Therefore, improving the accuracy of network attack detection has become an urgent problem to be solved. Summary of the Invention

[0004] This application provides a network attack detection method and apparatus to solve the problem of low accuracy in network attack detection in the prior art.

[0005] Firstly, this application provides a method for detecting network attacks, the method comprising: The network traffic data included in each acquired traffic dataset is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value of the corresponding preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index; Feature extraction is performed on each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain feature, frequency-domain feature, and time-frequency joint feature; The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold.

[0006] Furthermore, after determining the statistical data for each preset indicator, and before performing variational mode decomposition on the statistical data for each preset indicator, the method further includes: The statistical data for each preset indicator is normalized, and the normalized statistical data is used to update the corresponding statistical data.

[0007] Furthermore, the time-domain features include at least one of the following: energy characteristics, standard deviation, skewness, and kurtosis.

[0008] Furthermore, the frequency domain features include at least one of the following: center frequency, bandwidth, and spectral entropy.

[0009] Furthermore, the time-frequency joint feature includes at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

[0010] Further, determining the detection result based on the feature value corresponding to each preset feature and the preset threshold includes: Construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; The multidimensional feature sequence matrix is ​​processed based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix is ​​used to characterize the component value of each feature dimension corresponding to the time point when different network traffic data are collected. The feature dimension is a preset feature corresponding to each IMF of each preset indicator. The instantaneous energy corresponding to each component value in each matrix is ​​determined, and based on the instantaneous energy corresponding to each component value, the index energy distribution vector corresponding to each modal component at each collected time point is determined; The detection result is determined based on the energy distribution vector of each indicator and a preset threshold.

[0011] Further, determining the detection result based on the energy distribution vector of each indicator and a preset threshold includes: Calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; For each acquisition time point, the mean energy distribution entropy of that acquisition time point is determined based on the energy distribution entropy of each modal component corresponding to that acquisition time point and a preset weight. Based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, the anomaly score corresponding to the network traffic data acquired at that acquisition time point is determined. Based on the anomaly score and a preset threshold, the detection result of the network traffic data acquired at that acquisition time point is determined.

[0012] Furthermore, the process of determining the baseline energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted, the baseline energy distribution entropy corresponding to the collection time point is determined.

[0013] Furthermore, the process of determining the standard deviation of the reference energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted and the benchmark energy distribution entropy corresponding to the collection time point, the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point is determined.

[0014] Secondly, this application provides a network attack detection device, the device comprising: The determination module is used to perform statistics on the network traffic data included in each acquired traffic dataset, and determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. The decomposition module is used to perform variational mode decomposition on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index. The feature extraction module is used to extract features from each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain features, frequency-domain features, and time-frequency joint features; The detection module is used to determine the detection result based on the feature value corresponding to each preset feature and the preset threshold.

[0015] Furthermore, the decomposition module is also used to normalize the statistical data of each preset indicator, and update the corresponding statistical data using the normalized statistical data.

[0016] Furthermore, the time-domain features include at least one of the following: energy characteristics, standard deviation, skewness, and kurtosis.

[0017] Furthermore, the frequency domain features include at least one of the following: center frequency, bandwidth, and spectral entropy.

[0018] Furthermore, the time-frequency joint feature includes at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

[0019] Further, the detection module is specifically used to construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; process the multi-dimensional feature sequence matrix based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component, wherein any matrix is ​​used to characterize the component value of each feature dimension corresponding to different network traffic data collection time points, wherein the feature dimension is a preset feature corresponding to each IMF for each preset index; determine the instantaneous energy corresponding to each component value in each matrix, and determine the index energy distribution vector corresponding to each modal component at each collection time point based on the instantaneous energy corresponding to each component value; and determine the detection result based on each index energy distribution vector and a preset threshold.

[0020] Further, the detection module is specifically used to calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; for each acquisition time point, based on the energy distribution entropy corresponding to each modal component at that acquisition time point and a preset weight, determine the mean energy distribution entropy of that acquisition time point; based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, determine the anomaly score corresponding to the network traffic data acquired at that acquisition time point; based on the anomaly score and a preset threshold, determine the detection result of the network traffic data acquired at that acquisition time point.

[0021] Furthermore, the determining module is also used to determine the time interval to be counted based on the collection time point and the preset sliding window duration; and to determine the baseline energy distribution entropy corresponding to the collection time point based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted.

[0022] Furthermore, the determining module is also used to determine the time interval to be statistically analyzed based on the collection time point and the preset sliding window duration; and to determine the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point based on the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be statistically analyzed and the benchmark energy distribution entropy corresponding to the collection time point.

[0023] This application also provides an electronic device including a processor, which executes a computer program stored in a memory to implement the steps of any of the network attack detection methods described above.

[0024] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the network attack detection methods described above.

[0025] This application also provides a computer program product comprising: computer program code, which, when executed on a computer, causes the computer to perform the steps of any of the network attack detection methods described above.

[0026] In this embodiment, the network traffic data included in each acquired traffic data is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset indicator to obtain the intrinsic mode function (IMF) corresponding to each preset indicator. Feature extraction is performed on each IMF to obtain the feature value corresponding to each preset feature. The preset feature includes at least one of time domain feature, frequency domain feature, and time-frequency joint feature. The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold. The network traffic data of each acquired traffic dataset is analyzed using multi-level and multi-angle preset indicators. The statistical data of each preset indicator is decomposed based on variational mode decomposition to obtain the IMF corresponding to each preset indicator. The detection result is determined based on the feature value corresponding to each preset feature of each extracted IMF and the preset threshold. The preset features include at least one of time-domain features, frequency-domain features, and time-frequency joint features, realizing multi-indicator collaborative correlation analysis, thereby improving the accuracy of network attack detection. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 A flowchart illustrating a network attack detection process provided in this application embodiment; Figure 2 This is a schematic diagram of an anomaly level determination process provided in an embodiment of this application; Figure 3 This is a schematic diagram illustrating a network attack detection process provided in an embodiment of this application; Figure 4 A detailed schematic diagram illustrating a network attack detection process provided in an embodiment of this application; Figure 5 This is a schematic diagram of a network attack detection device provided in an embodiment of this application; Figure 6 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art are within the scope of protection of this application.

[0030] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0031] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0032] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0033] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0034] Currently, mainstream network anomaly detection methods mainly rely on traffic statistics based on fixed thresholds, rule matching based on known attack features, and classification models based on traditional machine learning. However, these methods have significant limitations: threshold statistics are insensitive to slowly changing attacks; rule matching struggles to handle unknown attack variants; and traditional machine learning models heavily depend on high-quality, large-scale labeled data, with performance plummeting when training samples are insufficient or imbalanced. Crucially, most related technologies focus on single-indicator analysis or simple feature concatenation, lacking the ability to uncover deep, dynamic synergistic relationships between multiple traffic indicators, resulting in poor detection performance against multi-vector coordinated attacks. Therefore, the cybersecurity field urgently needs a new intelligent detection method that can deeply mine the intrinsic characteristics of traffic, has high sensitivity to subtle anomalies, and does not rely on extensive prior knowledge.

[0035] To address the aforementioned issues, this application provides a network attack detection method. The method involves statistically analyzing the network traffic data included in each acquired traffic dataset to determine the statistical data for each preset indicator. Each statistical data point includes the corresponding preset indicator value for each traffic dataset. The preset indicators include at least one of packet rate, byte traffic, connection rate of newly established connections, and packet error rate. Variational mode decomposition is performed on the statistical data for each preset indicator to obtain the intrinsic mode function (IMF) corresponding to each preset indicator. Feature extraction is performed on each IMF to obtain the feature value corresponding to each preset feature. The preset features include at least one of time-domain features, frequency-domain features, and time-frequency joint features. The detection result is determined based on the feature value corresponding to each preset feature and a preset threshold.

[0036] Example 1: Figure 1 This application provides a flowchart illustrating a network attack detection process, as shown in the embodiments below. Figure 1 As shown, the process includes the following steps: S101: Statistically analyze the network traffic data included in each acquired traffic dataset to determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and message error rate.

[0037] The network attack detection method provided in this application is applied to electronic devices, such as servers, PCs, and mobile terminals.

[0038] To achieve network attack detection and ensure network security, in this embodiment, the network traffic data included in each acquired traffic dataset can be statistically analyzed to determine the statistical data for each preset indicator. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connections, and packet error rate. In this embodiment, the obtained statistical data may include the indicator values ​​corresponding to the preset indicators for each traffic dataset.

[0039] In this embodiment, raw traffic packets from the network to be detected are first collected to obtain long-term traffic segments (e.g., 30-60 minutes), resulting in a continuous time-slice data stream with temporal characteristics. For ease of description, the acquired raw traffic packets can be referred to as network traffic data, and any continuous time-slice data stream with temporal characteristics can be referred to as a traffic dataset. Next, for each time slice, multi-dimensional traffic metrics are extracted in parallel. Based on this, the multiple traffic metrics extracted within the same time slice are aligned and standardized to form statistical data characterizing the network's operating status.

[0040] In this embodiment, each network traffic data collected within a preset time period can be divided into multiple traffic datasets according to a preset time slice length. For each traffic dataset, statistics are performed on each network traffic data point included in that dataset to determine the value of each preset indicator corresponding to that traffic dataset. Then, based on the indicator values ​​of each preset indicator corresponding to each traffic dataset, statistical data for each preset indicator is constructed.

[0041] Specifically, raw network traffic data can be collected from network traffic using traffic monitoring tools (such as Wireshark, NetFlow, etc.). Within the same time slice, time series of M indicators are constructed, with each indicator having the same time series length. In other words, the network traffic data included in each traffic dataset is statistically analyzed to construct the time series corresponding to each preset indicator; this time series is the statistical data. The number of preset indicators is M. The statistical data corresponding to each preset indicator includes the same number of data points; that is, the statistical data corresponding to each preset indicator is determined based on the same number of traffic datasets.

[0042] In this embodiment, for each traffic dataset, the total number of data packets within that dataset can be counted, and this number of data packets can be used as a data packet rate indicator to construct statistical data corresponding to the preset indicator: a data packet rate sequence. The total number of bytes transmitted within this traffic dataset is counted as the byte traffic metric, thereby constructing the statistical data corresponding to this preset metric: byte traffic sequence. The number of newly established connections within this traffic dataset is counted, and this number is used as the connection rate indicator for new connections, thereby constructing the statistical data corresponding to this preset indicator: the connection rate sequence. The number of abnormal packets in the traffic dataset is counted, and this abnormal packet data is used as the packet error rate indicator to construct the statistical data corresponding to the preset indicator: request error rate sequence. .

[0043] S102: Perform variational mode decomposition on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index.

[0044] After determining the statistical data for each preset indicator, variational mode decomposition (VMD) can be used to decompose the statistical data for each preset indicator to obtain the intrinsic mode function (IMF) corresponding to each preset indicator. In other words, the first-level parallel VMD decomposition is performed on the statistical data (multi-source time-series signals) of each preset indicator to obtain the multi-scale intrinsic mode function (IMF) of each indicator.

[0045] The process of VMD decomposing statistical data can be viewed as decomposing each preset indicator. Solving variational optimization problems:

[0046] The solution to this variational problem is achieved by introducing a quadratic penalty term and the Lagrange multiplier method, transforming the constrained variational problem into an unconstrained variational problem, and then solving it using the alternating direction multiplier method.

[0047] Decomposing a multi-source time-series signal yields K eigenmode functions of the m-th preset index:

[0048] Among them, the IMFs are arranged from high to low according to their center frequencies. The high-frequency IMF components represent instantaneous fluctuations and noise, the mid-frequency IMFs represent normal business fluctuations in network traffic, and the low-frequency components represent long-term trends in network activity.

[0049] Variational mode decomposition (VMD) is an adaptive, fully non-recursive signal processing method used to decompose complex non-stationary signals into a series of quasi-orthogonal eigenmode functions (EMFs) with specific center frequencies. Its core idea is to construct the signal decomposition process as a variational problem, seeking a set of mode functions such that the sum of the estimated bandwidths of each mode is minimized, while constraining the sum of all modes to equal the original signal. This problem is typically solved using the alternating direction multiplier algorithm, which iteratively updates each mode function and its center frequency, ultimately decomposing the original signal into a finite number of EMFs oscillating around different frequencies.

[0050] S103: Perform feature extraction on each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain feature, frequency-domain feature, and time-frequency joint feature.

[0051] After obtaining each IMF, feature extraction can be performed on each IMF to obtain the feature value corresponding to each preset feature. The preset feature may include at least one of time-domain features, frequency-domain features, and time-frequency joint features.

[0052] Temporal characteristics can describe the amplitude distribution and shape properties of network traffic data, and network attacks often cause abnormal changes in traffic. For example, DDoS attacks cause a sudden increase in the energy of high-frequency components, while slow attacks cause an abnormal accumulation of energy in low-frequency components. In one possible implementation, the temporal characteristics may include at least one of the following: energy characteristics, standard deviation, skewness, and kurtosis. Energy characteristics and standard deviation characterize the distribution pattern and fluctuation intensity of traffic, while skewness and kurtosis are used to detect the non-Gaussianity of traffic distribution. It should be noted that the calculation methods for the above-mentioned temporal characteristics have been described in detail in the related technologies, and this application embodiment will not repeat the process.

[0053] Frequency domain features can reveal the frequency distribution patterns of signals. For example, DDoS flooding attacks can cause the center frequency to shift to higher frequencies and significantly broaden the bandwidth, while port scanning can cause multiple frequency components to appear, resulting in a slight increase in bandwidth. In one possible implementation, frequency domain features may include at least one of the following: center frequency, bandwidth, and spectral entropy. The center frequency and bandwidth are used to detect characteristic patterns, while the spectral entropy is used to quantify the complexity of the traffic frequency components. It should be noted that the calculation methods for the aforementioned frequency domain features have been described in detail in the related technologies, and this application will not repeat the process here.

[0054] Joint time-frequency features can capture the time-varying characteristics of non-stationary attacks. In one possible implementation, the joint time-frequency features may include at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency interleaving (TFI), and inter-scale features (e.g., inter-scale energy ratio, inter-scale correlation). Instantaneous amplitude and instantaneous frequency are used to capture the time-varying characteristics of non-stationary attacks, TFI can identify the degree of energy concentration in the time-frequency plane, and inter-scale features can reflect the disruption of multi-scale coordination caused by the attack.

[0055] The inter-scale energy ratio refers to the proportion of energy of each IMF among all IMFs, which can be expressed as:

[0056] in, represents the inter-scale energy ratio of the k-th IMF for the m-th preset index; t represents the number of flow datasets; This indicates that in the k-th IMF of the m-th indicator. The amplitude at the time point of data collection, i.e., the k-th IMF value of the m-th indicator. Each feature value.

[0057] Inter-scale correlation refers to the correlation coefficient between two adjacent IMFs, which can be expressed as:

[0058] in, This represents the inter-scale correlation of the k-th IMF with the m-th preset index; It represents the covariance of two adjacent IMF series, reflecting the degree of covariance in their synchronous fluctuations; , The variance of two adjacent IMFs is given.

[0059] S104: Determine the detection result based on the feature value corresponding to each preset feature and the preset threshold.

[0060] To detect network attacks, in this embodiment of the application, a preset threshold corresponding to each preset feature can be pre-stored. This preset threshold can be a specific data point or a range of values.

[0061] After determining the feature value corresponding to each preset feature, it can be determined whether the feature value corresponding to each preset feature meets the requirements of the corresponding preset threshold based on the feature value and the preset threshold corresponding to each preset feature. If the number of feature values ​​that meet the preset requirements is greater than the set value, it can be determined that there is no network attack risk in the currently acquired network traffic data. For example, if the feature values ​​of all preset features meet the preset threshold requirements, it can be determined that there is no network update risk. Alternatively, if the feature values ​​of some preset features meet the preset threshold requirements, it can be determined that there is no network update risk. Those skilled in the art can configure it as needed, and are not limited to the above examples.

[0062] In this embodiment, the network traffic data included in each acquired traffic data is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset indicator to obtain the intrinsic mode function (IMF) corresponding to each preset indicator. Feature extraction is performed on each IMF to obtain the feature value corresponding to each preset feature. The preset feature includes at least one of time domain feature, frequency domain feature, and time-frequency joint feature. The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold. The network traffic data of each acquired traffic dataset is analyzed using multi-level and multi-angle preset indicators. The statistical data of each preset indicator is decomposed based on variational mode decomposition to obtain the IMF corresponding to each preset indicator. The detection result is determined based on the feature value corresponding to each preset feature of each extracted IMF and the preset threshold. The preset features include at least one of time-domain features, frequency-domain features, and time-frequency joint features, realizing multi-indicator collaborative correlation analysis, thereby improving the accuracy of network attack detection.

[0063] To facilitate understanding of the two key decomposition parameters required for VMD decomposition: the number of modes... and punishment factors The process of determining [the value] will be explained.

[0064] In this embodiment, the optimal parameters for each VMD decomposition can be adaptively determined using the minimum envelope entropy optimization method. Its core optimization objective function is:

[0065] in: It is the envelope entropy of the k-th IMF, which can measure the sparsity of modal components. This is the reconstruction error weighting coefficient, which is set to 0.05 in this example. This is the k-th modal component obtained from VMD decomposition, i.e., the k-th IMF. It should be noted that the determination process of the penalty factor α is not shown in the above formula; its calculation process is reflected in the formula itself. middle.

[0066] In this embodiment, the optimal parameters for VMD decomposition can be adaptively determined using the minimum envelope entropy optimization method: a hybrid strategy combining grid search and gradient descent is employed to determine the optimal parameters. In this embodiment, it is possible to... [3,8], A coarse search is performed within the range [100, 5000], and the optimal parameters are fine-tuned using gradient descent in the optimal region. This method can automatically balance modal sparsity and reconstruction accuracy, and adapt to different network traffic feature sequences without requiring manual parameter setting based on experience.

[0067] It should be noted how the number of modes is determined. and punishment factors Since this is existing technology, the process will not be described in detail in the embodiments of this application.

[0068] Example 2: To further improve the accuracy of network attack detection, based on the above embodiments, in this embodiment, after determining the statistical data of each preset indicator and before performing variational mode decomposition on the statistical data of each preset indicator, the method further includes: The statistical data for each preset indicator is normalized, and the normalized statistical data is used to update the corresponding statistical data.

[0069] To further improve the accuracy of network attack detection, after determining the statistical data of each preset indicator, the statistical data of each preset indicator can be normalized, and the corresponding statistical data can be updated using the normalized statistical data, so as to facilitate subsequent variational mode decomposition based on the updated statistical data.

[0070] Specifically, the statistical data of any preset indicator can be z-score standardized based on the following formula:

[0071] in, This represents statistical data after normalization. This represents statistical data before normalization. This represents the mean of the statistical data before normalization. This represents the standard deviation of the statistical data before normalization.

[0072] Example 3: To further improve the accuracy of network attack detection, based on the above embodiments, in this embodiment, determining the detection result according to the feature value corresponding to each preset feature and the preset threshold includes: Construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; The multidimensional feature sequence matrix is ​​processed based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix is ​​used to characterize the component value of each feature dimension corresponding to the time point when different network traffic data are collected. The feature dimension is a preset feature corresponding to each IMF of each preset indicator. Determine the instantaneous energy corresponding to each component value in each matrix, and based on the instantaneous energy corresponding to each component value, determine the index energy distribution vector corresponding to each modal component in each traffic dataset; The detection result is determined based on the energy distribution vector of each indicator and a preset threshold.

[0073] In this embodiment of the application, after feature extraction is performed on each IMF to obtain the feature value corresponding to each preset feature, when determining the detection result based on the feature value corresponding to each preset feature and the preset threshold, a multi-dimensional feature sequence matrix can be constructed based on the feature value corresponding to each preset feature extracted from each IMF.

[0074] Specifically, when constructing a multidimensional feature sequence matrix, a feature vector can be constructed for each time point:

[0075] in, This represents the feature vector constructed for the acquisition time point t; This represents the feature value of the energy feature extracted by the first IMF for the first preset index corresponding to the collection time point t; This represents the feature value of the standard deviation extracted by the first IMF for the first preset indicator corresponding to the collection time point t; This represents the feature value of the inter-scale energy ratio extracted by the k-th IMF for the m-th preset index corresponding to the acquisition time point t; This represents the feature value of the inter-scale correlation extracted from the k-th IMF of the m-th preset index corresponding to the collection time point t.

[0076] In one possible implementation, the feature value of each preset feature at the acquisition time point t in the above formula can also be calculated using a sliding window method. That is, when determining the feature value corresponding to each preset feature, it can also be calculated based on the following formula. The calculation process for determining the feature value of the energy feature is illustrated below using an example:

[0077] in, The value represents the energy feature extracted by the k-th IMF of the m-th preset indicator corresponding to the collection time point t; W represents the size of the time window, which is usually 2-3 times the time length corresponding to the flow dataset; t represents the collection time point t where the feature value to be determined is located. Indicates the time point of data collection The corresponding feature value of the m-th feature value is the feature value of the k-th IMF extracted from the preset feature. When determining the feature value of the energy feature, this... That is the time point of collection. The corresponding energy feature extracted by the k-th IMF is the m-th feature value.

[0078] The final result is a multi-dimensional feature sequence matrix:

[0079] Where F represents the multi-dimensional feature sequence matrix; F(1), F(2), ..., F(T) represent the feature vectors constructed at each collection time point 1, 2, ..., T, where T can be the time point corresponding to the collection of all network traffic data; , This represents the number of preset features extracted for each IMF, M represents the number of preset indicators, and K represents the number of IMFs extracted for each preset indicator.

[0080] In one possible implementation, after constructing the multi-dimensional feature sequence matrix, the matrix can be standardized to place features of different dimensions on a uniform scale. Therefore, in this embodiment, the obtained multi-dimensional feature sequence matrix can be standardized based on the following formula:

[0081] in, This represents the multi-dimensional feature sequence matrix after standardization. This represents the multi-dimensional feature sequence matrix before standardization. It represents the mean of all values ​​in the multidimensional feature sequence matrix; It represents the standard deviation of each value in the multidimensional feature sequence matrix.

[0082] In one possible implementation, since data at different time points have different characteristics, in this embodiment of the application, when performing standardization processing, different means and standard deviations can be calculated for each row in the multi-dimensional feature sequence matrix. When performing normalization processing, different means and standard deviations can be used for each row in the multi-dimensional feature sequence matrix to perform the processing shown in the above formula.

[0083] After obtaining the multi-dimensional feature sequence matrix, it can be processed using Multivariate Variational Mode Decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix represents the component value of each feature dimension at different network traffic data collection time points. The feature dimension is a preset feature corresponding to each IMF for each preset indicator. Compared to conventional VMD, MVMD considers multi-channel features. MVMD is an extension of VMD, extending it to multiple related signal domains, enabling synchronous and collaborative decomposition of related signals.

[0084] Specifically, the multivariable signal can be decomposed by optimizing the following constrained variational problem:

[0085] in, It is the first d Time series data with 1 feature dimension It is the first k The mode in the th ... d Components on each feature It is the first k The center frequency of each mode K It is the preset number of modes. D It is the number of preset features.

[0086] Solving the above optimization problem using the augmented Lagrangian function yields the frequency-aligned multivariable eigenmode functions:

[0087] The above introduction to the MVMD optimization objective function is for ease of understanding only. The above formulas have been explained in detail in related technologies. The physical meaning of the parameters in the above formulas will not be repeated in the embodiments of this application.

[0088] After the MVMD processing described above, MVMD will output K modal components, each of which is a matrix, and the dimension of any matrix is... This matrix is ​​used to represent the component values ​​of each feature dimension corresponding to different network traffic data collection time points. This feature dimension is a preset feature corresponding to each IMF for each preset indicator. In other words, T represents the collection time corresponding to the network traffic data included in each traffic dataset. , This represents the number of preset features extracted for each IMF, M represents the number of preset indicators, and K represents the number of IMFs extracted for each preset indicator.

[0089] After obtaining the matrix corresponding to each modal component, the instantaneous energy corresponding to each component value in each matrix can be determined, and based on the instantaneous energy corresponding to each component value, the index energy distribution vector corresponding to each modal component in each traffic dataset can be determined.

[0090] Specifically, this can be done for each modal component. k Calculate the instantaneous energy of each feature dimension at different time points:

[0091] in, This indicates the first data collection point t corresponding to the time point t. k Each mode in d The instantaneous energy of each characteristic; It is the size of the local energy integration window; This indicates the first time point corresponding to the data collection time t. k Each mode in d The eigenvalues ​​of each feature; Indicates the time point of data collection The corresponding number k Each mode in d The eigenvalues ​​of each feature; the first term in the formula Used to capture instantaneous amplitude energy; second item Used to capture local average energy.

[0092] For each time point t and each mode k Construct a multi-index energy distribution vector:

[0093] in,

[0094] Where D represents the number of preset features.

[0095] After obtaining the energy distribution vector of each indicator, the detection result can be determined based on the indicator energy distribution vector and the preset threshold.

[0096] Specifically, the similarity between the energy distribution vector of each indicator and the preset standard vector can be determined. If the similarity meets the preset threshold requirement, it can be determined that there is no risk of network attack.

[0097] To further improve the accuracy of network attack detection, based on the above embodiments, in this embodiment, determining the detection result according to the energy distribution vector of each indicator and a preset threshold includes: Calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; For each acquisition time point, the mean energy distribution entropy of that acquisition time point is determined based on the energy distribution entropy of each modal component corresponding to that acquisition time point and a preset weight. Based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, the anomaly score corresponding to the network traffic data acquired at that acquisition time point is determined. Based on the anomaly score and a preset threshold, the detection result of the network traffic data acquired at that acquisition time point is determined.

[0098] In this embodiment of the application, when determining the detection result based on the energy distribution vector of each indicator and a preset threshold, the energy distribution entropy corresponding to the energy distribution vector of each indicator can be calculated to quantify the uniformity of the energy distribution.

[0099] Specifically, this can be done for each modal component. k and time point t Calculate the energy distribution entropy:

[0100] in, This represents the energy distribution entropy of the k-th modal component corresponding to the acquisition time point t; This represents the energy distribution probability vector of the d-th feature of the k-th modal component corresponding to the acquisition time point t.

[0101] Once the entropy of each energy distribution is determined, the mean energy distribution entropy of the traffic dataset can be determined for each network traffic data collection time point based on the energy distribution entropy of each modal component corresponding to that collection time point and the preset weight.

[0102] Specifically, the energy distribution entropy of all modal components at acquisition time t can be weighted and averaged based on the following formula:

[0103] in, This represents the mean entropy of the energy distribution at time point t. Indicates the preset weight; The number of modal components is indicated; It represents the energy distribution entropy corresponding to the k-th modal component at the acquisition time point t.

[0104] Among them, weight The importance of the modal components can be set according to their relative importance. In this embodiment of the application, The following calculation method can be used:

[0105] in, represents the preset weight; M represents the number of preset indicators; T represents the total number of network traffic data collected; t=1 represents the time point when the first network traffic data was collected. express This represents the feature value of the energy feature extracted by the k-th IMF of the m-th preset index corresponding to the collection time point t.

[0106] After determining the mean energy distribution entropy at the collection time point, the anomaly score corresponding to the traffic dataset can be determined based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to the collection time point, and the standard deviation of the baseline energy distribution entropy corresponding to the collection time point.

[0107] Specifically, the outlier score can be calculated based on the following methods:

[0108] in, This represents the anomaly score corresponding to the network traffic data collected at time point t. This represents the pre-saved baseline energy distribution entropy corresponding to the acquisition time point; This represents the mean entropy of the energy distribution at the time point t during data collection. It represents the standard deviation of the baseline energy distribution entropy corresponding to the pre-saved acquisition time point.

[0109] After obtaining the anomaly score, the detection result of the network traffic data collected at that collection time point can be determined based on the anomaly score and the preset threshold.

[0110] Specifically, the severity level of anomalies can be classified based on a defined anomaly score:

[0111] in, Indicates the risk level; when the anomaly score S(t) satisfies When the probability of a network attack is low, the anomaly score S(t) satisfies the following conditions: When the probability of a network attack is moderate, the anomaly score S(t) satisfies... At that time, it was determined that there was a high probability of a cyberattack.

[0112] Figure 2 This is a schematic diagram of an anomaly level determination process provided in an embodiment of this application, such as... Figure 2As shown, in the process of anomaly level judgment, the baseline energy distribution entropy at time t can be calculated. and the standard deviation of the reference energy distribution entropy between this time and the previous time. Next, according to the formula for calculating abnormal scores... Calculate the anomaly score at time t. After obtaining the anomaly score, anomalies can be classified based on this score to determine whether there are any anomalies at time t. If so, the network traffic data collected at time t is considered anomalous and requires an alert; otherwise, the network traffic data collected at time t is considered normal, and the standard deviation of the baseline energy distribution entropy used for the next anomaly classification can be updated based on this network traffic data. .

[0113] To further improve the accuracy of network attack detection, based on the above embodiments, in this application embodiment, the process of determining the baseline energy distribution entropy corresponding to any collection time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted, the baseline energy distribution entropy corresponding to the collection time point is determined.

[0114] In order to determine the baseline energy distribution entropy corresponding to each collection time point, in this embodiment of the application, the baseline energy distribution entropy can be calculated based on historical traffic data. The historical traffic data can be each network traffic data collected within a preset sliding window period before the collection time point; or it can be each network traffic data collected within a preset sliding window period before the collection time point on a certain day prior to the collection time point.

[0115] Specifically, the reference energy distribution entropy at any acquisition time point can be calculated based on the following formula:

[0116] in, This represents the baseline energy distribution entropy corresponding to the acquisition time point t; This indicates the preset sliding window duration, which can be, for example, 30-60 minutes; t represents the data collection time point; Indicates the time point of data collection The corresponding mean energy distribution entropy; That is, the time interval to be statistically analyzed.

[0117] To further improve the accuracy of network attack detection, based on the above embodiments, in this application embodiment, the process of determining the standard deviation of the baseline energy distribution entropy corresponding to any collection time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted and the benchmark energy distribution entropy corresponding to the collection time point, the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point is determined.

[0118] To determine the standard deviation of the baseline energy distribution entropy corresponding to any given collection time point, in this embodiment, the time interval to be statistically analyzed can be determined based on the collection time point and a preset sliding window duration. Then, based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point within the time interval to be statistically analyzed and the baseline energy distribution entropy corresponding to that collection time point, the standard deviation of the baseline energy distribution entropy corresponding to that collection time point is determined.

[0119] Specifically, the standard deviation of the baseline energy distribution entropy at any acquisition time point can be calculated based on the following formula:

[0120] in, The standard deviation of the baseline energy distribution entropy corresponding to the acquisition time point t is used to characterize the fluctuation level of the baseline energy distribution entropy. Indicates the preset duration of the sliding window; This indicates the time interval to be statistically analyzed; Indicates the time point of data collection The corresponding mean energy distribution entropy; The baseline energy distribution entropy corresponding to the acquisition time point t.

[0121] Example 4: To facilitate understanding, the following will be combined with... Figure 3 and Figure 4 The process of network attack detection provided in the embodiments of this application will be described. Figure 3 This is a schematic diagram illustrating a network attack detection process provided in an embodiment of this application. Figure 4 This diagram illustrates a detailed process for network attack detection, as provided in an embodiment of this application. The network attack detection process mainly includes the following steps: S301: Collect raw traffic data of the host under test to construct a multi-source time-series signal.

[0122] First, raw traffic data from the network under test is collected to obtain long-term (30-60 minutes) traffic segments, resulting in a continuous time-slice data stream with temporal characteristics. For each time slice, multi-dimensional traffic metrics are extracted in parallel.

[0123] like Figure 4 As shown, when collecting raw traffic data, the values ​​of multiple preset indicators are extracted, and multi-dimensional traffic indicators are constructed, which are the statistical data of each preset indicator.

[0124] S302: Perform the first-level parallel VMD decomposition to obtain the intrinsic mode function (IMF) corresponding to each preset index.

[0125] The statistical data of each preset index obtained in step 301 is used as an independent input, and the first-level parallel variational mode decomposition process is applied to it. For each statistical data, an appropriate number of modes K and a penalty parameter α are set, and the original signal is adaptively decomposed into a series of eigenmode functions with different center frequencies by the variational mode decomposition algorithm.

[0126] Furthermore, after decomposing each indicator, its corresponding multi-scale intrinsic mode function set is obtained, in which the high-frequency mode component captures the instantaneous fluctuation characteristics of the flow, and the low-frequency mode component characterizes the long-term trend change of the flow.

[0127] like Figure 4 As shown, multiple IMFs were obtained during the first layer VMD decomposition in S2.

[0128] Let the k-th IMF component of the m-th indicator be:

[0129] Where M represents the number of preset indicators; K represents the number of IMF components for each indicator.

[0130] S303: Extract features from each IMF to obtain the feature value corresponding to each preset feature, and construct a multi-dimensional feature sequence matrix based on the feature value corresponding to each preset feature extracted from each IMF.

[0131] In this step, based on the set of intrinsic mode functions corresponding to each preset index obtained from the first layer VMD decomposition, time-domain features, frequency-domain features, and time-frequency joint features are extracted for each intrinsic mode function.

[0132] Furthermore, the modal component features of different traffic metrics within the same traffic dataset are horizontally concatenated to construct a comprehensive feature vector containing information on multiple metrics such as packet rate, byte traffic, connection rate, and error rate. For example... Figure 4As shown, after extracting the feature values ​​of the preset features in step S3, the feature vectors constructed for each time point are F(1), F(2), F(3), ..., F(t).

[0133] Finally, the multidimensional feature vectors of each time slice are arranged in chronological order to form a multidimensional feature sequence matrix with temporal relationships, which provides input for the second-level multivariate variational mode decomposition (MVMD) decomposition.

[0134] S304: Perform MVMD decomposition on the multi-dimensional feature sequence matrix to uncover cross-index collaborative anomaly features.

[0135] Based on the above multi-dimensional feature sequence matrix, a set of frequency-aligned multivariate intrinsic mode function components are obtained through MVMD decomposition, and key energy distribution features are extracted: for each mode component, the instantaneous energy value of each feature dimension is calculated to form a multi-index energy probability distribution vector.

[0136] like Figure 4 As shown, step S4 yields a multi-dimensional feature sequence matrix:

[0137] Then, a second-level MVMD decomposition is performed on the multi-dimensional feature matrix to obtain the matrix corresponding to each modal component. And based on the instantaneous energy corresponding to each component value in each matrix, the index energy distribution vector corresponding to each modal component at each collected time point is determined. .

[0138] S305: Anomaly detection is performed by extracting the mean of energy distribution entropy based on the multi-index energy probability distribution vector.

[0139] First, based on the multi-index energy distribution vector, the energy distribution entropy time series is calculated: the information entropy is calculated for the multi-index energy distribution vector at each time point. Figure 4 During the energy distribution entropy extraction process, S5 obtained the energy distribution entropy of each mode at time point t:

[0140] Next, we quantify the uniformity of energy distribution. Under normal conditions, energy distribution is relatively uniform with a high entropy value; when an anomaly occurs, energy concentrates on a few indicators, leading to uneven distribution and a significant decrease in entropy. Therefore, based on the mean energy distribution and pre-defined severity levels of the anomaly, we can determine whether a network attack is possible.

[0141] In one possible implementation, network attack detection can be based on a dynamic threshold. Specifically, a sliding window method can be used to statistically analyze the historical distribution of energy distribution entropy and calculate its dynamic threshold. When the real-time energy distribution entropy value remains below the dynamic threshold, it is determined to be an abnormal event, and the severity of the anomaly is assessed based on the duration and magnitude of the entropy decrease. In this embodiment, the sliding window method can reuse historical data to smoothly detect traffic anomalies.

[0142] The network attack detection method provided in this application is an abnormal network traffic detection method based on variational mode decomposition and hierarchical fusion. Firstly, a hierarchical fusion analysis framework is proposed. Firstly, multiple key indicators such as packet rate and byte traffic are subjected to a first-level independent VMD decomposition to accurately obtain the multi-scale features of each indicator, from high-frequency fluctuations to low-frequency trends. Then, these features are constructed into a new multi-dimensional sequence, and a second-level fusion decomposition is performed using a multivariate VMD method. This hierarchical structure achieves a leap from "isolated analysis of single indicators" to "coordinated correlation analysis of multiple indicators," enabling in-depth mining of cross-indicator attack traces.

[0143] Secondly, energy distribution entropy is proposed as the core detection index for fusion features. Based on the second-level decomposition results, the information entropy of the energy distribution vector of multiple indices is calculated. This entropy value quantifies the uniformity of network energy distribution among different indices: under normal business conditions, the energy distribution is uniform, and the entropy value is high; attacks disrupt the balance, leading to abnormal energy concentration, and the entropy value decreases significantly. This index is more sensitive to slow, coordinated, and complex attacks, overcoming the shortcomings of traditional threshold methods that are insensitive to weak anomalies.

[0144] The network attack detection method provided in this application first collects multi-dimensional traffic indicators from the network to construct multi-source time-series signals. Then, through a hierarchical fusion processing framework: in the first layer, each traffic indicator is independently decomposed using Variational Mode Decomposition (MVD) to extract its multi-scale intrinsic mode components, accurately capturing the local time-frequency features within each indicator; in the second layer, multi-dimensional time-frequency features such as energy, entropy, and instantaneous frequency are extracted from the VMD components of each indicator and fused to construct a unified multi-dimensional feature sequence; in the third layer, the fused feature sequence is subjected to multivariate variational mode decomposition (MVMD) to deeply mine collaborative anomaly patterns and cross-dimensional correlation features among multiple traffic indicators. Finally, a dynamic detection threshold is constructed based on the energy distribution entropy of the components after secondary decomposition, enabling accurate identification and early warning of various types of network attacks, especially highly concealed and long-lasting abnormal traffic.

[0145] Example 5: Based on the same inventive concept, embodiments of this application provide a network attack detection device. Figure 5 Please refer to the schematic diagram of a network attack detection device provided in this application embodiment. Figure 5 The device includes: The determining module 501 is used to perform statistics on the network traffic data included in each acquired traffic dataset, and determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. The decomposition module 502 is used to perform variational mode decomposition on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index. The feature extraction module 503 is used to extract features from each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain features, frequency-domain features, and time-frequency joint features; The detection module 504 is used to determine the detection result based on the feature value corresponding to each preset feature and the preset threshold.

[0146] In one possible implementation, the decomposition module 502 is further configured to normalize the statistical data of each preset indicator and update the corresponding statistical data using the normalized statistical data.

[0147] In one possible implementation, the time-domain features include at least one of energy characteristics, standard deviation, skewness, and kurtosis.

[0148] In one possible implementation, the frequency domain features include at least one of: center frequency, bandwidth, and spectral entropy.

[0149] In one possible implementation, the time-frequency joint feature includes at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

[0150] In one possible implementation, the detection module 504 is specifically configured to: construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; process the multi-dimensional feature sequence matrix based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component, wherein any matrix is ​​used to characterize the component value of each feature dimension corresponding to different network traffic data collection time points, wherein the feature dimension is a preset feature corresponding to each IMF for each preset index; determine the instantaneous energy corresponding to each component value in each matrix, and determine the index energy distribution vector corresponding to each modal component at each collection time point based on the instantaneous energy corresponding to each component value; and determine the detection result based on each index energy distribution vector and a preset threshold.

[0151] In one possible implementation, the detection module 504 is specifically used to calculate the energy distribution entropy corresponding to each indicator energy distribution vector; for each acquisition time point, based on the energy distribution entropy corresponding to each modal component at that acquisition time point and a preset weight, determine the mean energy distribution entropy of that acquisition time point; based on the mean energy distribution entropy, a pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, determine the anomaly score corresponding to the network traffic data acquired at that acquisition time point; and based on the anomaly score and a preset threshold, determine the detection result of the network traffic data acquired at that acquisition time point.

[0152] In one possible implementation, the determining module 501 is further configured to determine the time interval to be statistically analyzed based on the collection time point and the preset sliding window duration; and to determine the baseline energy distribution entropy corresponding to the collection time point based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be statistically analyzed.

[0153] In one possible implementation, the determining module 501 is further configured to determine the time interval to be statistically analyzed based on the collection time point and the preset sliding window duration; and to determine the standard deviation of the reference energy distribution entropy corresponding to the collection time point based on the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be statistically analyzed and the reference energy distribution entropy corresponding to the collection time point.

[0154] Example 6: Based on the same inventive concept, embodiments of this application provide an electronic device that can implement the steps of the network attack detection method described above. Figure 6 This application provides a schematic diagram of an electronic device structure, such as... Figure 6 As shown, it includes: processor 601, communication interface 602, memory 603 and communication bus 604, wherein processor 601, communication interface 602 and memory 603 communicate with each other through communication bus 604. The memory 603 stores a computer program, which, when executed by the processor 601, causes the processor 601 to perform the following steps: The network traffic data included in each acquired traffic dataset is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value of the corresponding preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index; Feature extraction is performed on each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain feature, frequency-domain feature, and time-frequency joint feature; The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold.

[0155] In one possible implementation, after determining the statistical data for each preset indicator and before performing variational mode decomposition on the statistical data for each preset indicator, the method further includes: The statistical data for each preset indicator is normalized, and the normalized statistical data is used to update the corresponding statistical data.

[0156] In one possible implementation, the time-domain features include at least one of energy characteristics, standard deviation, skewness, and kurtosis.

[0157] In one possible implementation, the frequency domain features include at least one of: center frequency, bandwidth, and spectral entropy.

[0158] In one possible implementation, the time-frequency joint feature includes at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

[0159] In one possible implementation, determining the detection result based on the feature value corresponding to each preset feature and a preset threshold includes: Construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; The multidimensional feature sequence matrix is ​​processed based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix is ​​used to characterize the component value of each feature dimension corresponding to the time point when different network traffic data are collected. The feature dimension is a preset feature corresponding to each IMF of each preset indicator. The instantaneous energy corresponding to each component value in each matrix is ​​determined, and based on the instantaneous energy corresponding to each component value, the index energy distribution vector corresponding to each modal component at each collected time point is determined; The detection result is determined based on the energy distribution vector of each indicator and a preset threshold.

[0160] In one possible implementation, determining the detection result based on the energy distribution vector of each indicator and a preset threshold includes: Calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; For each acquisition time point, the mean energy distribution entropy of that acquisition time point is determined based on the energy distribution entropy of each modal component corresponding to that acquisition time point and a preset weight. Based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, the anomaly score corresponding to the network traffic data acquired at that acquisition time point is determined. Based on the anomaly score and a preset threshold, the detection result of the network traffic data acquired at that acquisition time point is determined.

[0161] In one possible implementation, the process of determining the reference energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted, the baseline energy distribution entropy corresponding to the collection time point is determined.

[0162] In one possible implementation, the process of determining the standard deviation of the reference energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted and the benchmark energy distribution entropy corresponding to the collection time point, the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point is determined.

[0163] The communication bus mentioned in the aforementioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not indicate that there is only one bus or one type of bus. Communication interface 602 is used for communication between the aforementioned electronic device and other devices. The memory can include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory can also be at least one storage device located remotely from the aforementioned processor.

[0164] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0165] Example 7: Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, it causes the processor to perform the following steps: The network traffic data included in each acquired traffic dataset is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value of the corresponding preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index; Feature extraction is performed on each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain feature, frequency-domain feature, and time-frequency joint feature; The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold.

[0166] In one possible implementation, after determining the statistical data for each preset indicator and before performing variational mode decomposition on the statistical data for each preset indicator, the method further includes: The statistical data for each preset indicator is normalized, and the normalized statistical data is used to update the corresponding statistical data.

[0167] In one possible implementation, the time-domain features include at least one of energy characteristics, standard deviation, skewness, and kurtosis.

[0168] In one possible implementation, the frequency domain features include at least one of: center frequency, bandwidth, and spectral entropy.

[0169] In one possible implementation, the time-frequency joint feature includes at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

[0170] In one possible implementation, determining the detection result based on the feature value corresponding to each preset feature and a preset threshold includes: Construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; The multidimensional feature sequence matrix is ​​processed based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix is ​​used to characterize the component value of each feature dimension corresponding to the time point when different network traffic data are collected. The feature dimension is a preset feature corresponding to each IMF of each preset indicator. The instantaneous energy corresponding to each component value in each matrix is ​​determined, and based on the instantaneous energy corresponding to each component value, the index energy distribution vector corresponding to each modal component at each collected time point is determined; The detection result is determined based on the energy distribution vector of each indicator and a preset threshold.

[0171] In one possible implementation, determining the detection result based on the energy distribution vector of each indicator and a preset threshold includes: Calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; For each acquisition time point, the mean energy distribution entropy of that acquisition time point is determined based on the energy distribution entropy of each modal component corresponding to that acquisition time point and a preset weight. Based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, the anomaly score corresponding to the network traffic data acquired at that acquisition time point is determined. Based on the anomaly score and a preset threshold, the detection result of the network traffic data acquired at that acquisition time point is determined.

[0172] In one possible implementation, the process of determining the reference energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted, the baseline energy distribution entropy corresponding to the collection time point is determined.

[0173] In one possible implementation, the process of determining the standard deviation of the reference energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted and the benchmark energy distribution entropy corresponding to the collection time point, the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point is determined.

[0174] Example 8: Based on the same inventive concept, this application also provides a computer program product, which includes computer program code. When the computer program code is run on a computer, it causes the computer to execute any of the network attack detection methods discussed above. Since the principle by which the above-described computer program product solves the problem is similar to that of the network attack detection method, the implementation of the above-described computer program product can be referred to the implementation of the method, and repeated details will not be described again.

[0175] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0176] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0177] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0178] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of user-operated steps to be executed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0179] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting network attacks, characterized in that, The method includes: The network traffic data included in each acquired traffic dataset is statistically analyzed to determine the statistical data of each preset indicator. Each statistical data includes the indicator value of the corresponding preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. Variational mode decomposition is performed on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index; Feature extraction is performed on each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain feature, frequency-domain feature, and time-frequency joint feature; The detection result is determined based on the feature value corresponding to each preset feature and the preset threshold.

2. The method according to claim 1, characterized in that, After determining the statistical data for each preset indicator, and before performing variational mode decomposition on the statistical data for each preset indicator, the method further includes: The statistical data for each preset indicator is normalized, and the normalized statistical data is used to update the corresponding statistical data.

3. The method according to claim 1, characterized in that, The time-domain features include at least one of the following: energy characteristics, standard deviation, skewness, and kurtosis.

4. The method according to claim 1, characterized in that, The frequency domain features include at least one of the following: center frequency, bandwidth, and spectral entropy.

5. The method according to claim 1, characterized in that, The time-frequency joint features include at least one of the following: instantaneous amplitude, instantaneous frequency, time-frequency aggregation index (TFI), inter-scale energy ratio, and inter-scale correlation.

6. The method according to claim 1, characterized in that, The step of determining the detection result based on the feature value corresponding to each preset feature and the preset threshold includes: Construct a multi-dimensional feature sequence matrix based on the feature values ​​corresponding to each preset feature extracted from each IMF; The multidimensional feature sequence matrix is ​​processed based on multivariate variational mode decomposition (MVMD) to obtain a matrix corresponding to each modal component. Any matrix is ​​used to characterize the component value of each feature dimension corresponding to the time point when different network traffic data are collected. The feature dimension is a preset feature corresponding to each IMF of each preset indicator. The instantaneous energy corresponding to each component value in each matrix is ​​determined, and based on the instantaneous energy corresponding to each component value, the index energy distribution vector corresponding to each modal component at each collected time point is determined; The detection result is determined based on the energy distribution vector of each indicator and a preset threshold.

7. The method according to claim 6, characterized in that, The step of determining the detection result based on the energy distribution vector of each indicator and a preset threshold includes: Calculate the energy distribution entropy corresponding to the energy distribution vector of each indicator; For each acquisition time point, the mean energy distribution entropy of that acquisition time point is determined based on the energy distribution entropy of each modal component corresponding to that acquisition time point and a preset weight. Based on the mean energy distribution entropy, the pre-saved baseline energy distribution entropy corresponding to that acquisition time point, and the standard deviation of the baseline energy distribution entropy corresponding to that acquisition time point, the anomaly score corresponding to the network traffic data acquired at that acquisition time point is determined. Based on the anomaly score and a preset threshold, the detection result of the network traffic data acquired at that acquisition time point is determined.

8. The method according to claim 7, characterized in that, The process of determining the baseline energy distribution entropy corresponding to any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration and the average energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted, the baseline energy distribution entropy corresponding to the collection time point is determined.

9. The method according to claim 7, characterized in that, The process of determining the standard deviation of the reference energy distribution entropy at any acquisition time point includes: Based on the data collection time point and the preset sliding window duration, the time interval to be statistically analyzed is determined. Based on the preset sliding window duration, the difference between the mean energy distribution entropy of the historical traffic data collected at each time point in the time interval to be counted and the benchmark energy distribution entropy corresponding to the collection time point, the standard deviation of the benchmark energy distribution entropy corresponding to the collection time point is determined.

10. A network attack detection device, characterized in that, The device includes: The determination module is used to perform statistics on the network traffic data included in each acquired traffic dataset, and determine the statistical data of each preset indicator. Each statistical data includes the indicator value corresponding to the preset indicator in each traffic dataset. The preset indicator includes at least one of the following: packet rate, byte traffic, connection rate of newly established connection, and packet error rate. The decomposition module is used to perform variational mode decomposition on the statistical data of each preset index to obtain the intrinsic mode function (IMF) corresponding to each preset index. The feature extraction module is used to extract features from each of the IMFs to obtain the feature value corresponding to each preset feature, wherein the preset feature includes at least one of time-domain features, frequency-domain features, and time-frequency joint features; The detection module is used to determine the detection result based on the feature value corresponding to each preset feature and the preset threshold.

Images