CN116760747A - Intelligent detection method and device for network information security - Google Patents

Abstract

The application discloses a network information security intelligent detection method and a device, which are used for carrying out standardized processing on flow data acquired in network information to obtain standard flow data and constructing a flow characteristic correlation matrix, carrying out characteristic value decomposition on the flow characteristic correlation matrix to obtain a flow characteristic vector and a flow characteristic value, selecting the flow characteristic vector as a flow characteristic according to the flow characteristic value, mapping the standard flow data onto the flow characteristic to obtain preprocessed flow characteristic data, determining an abnormal flow detection model according to the standard deviation and the average value of the preprocessed flow characteristic data, detecting the preprocessed flow characteristic data through the abnormal flow detection model to obtain a flow abnormal value, judging that the preprocessed flow characteristic data is the abnormal flow data when the flow abnormal value is larger than a preset abnormal threshold, and sending warning information to a control center when the abnormal flow data is detected, so that the problem that the network information security detection result is low in accuracy and high in false alarm can be solved.

Description

An intelligent detection method and device for network information security

Technical field

The present invention relates to the technical field of network information security, and in particular to an intelligent detection method and device for network information security.

Background technique

Network information security intelligent detection refers to the method of using artificial intelligence and machine learning technology to automatically monitor, identify and respond to network security threats. It can help detect potential network attacks, malicious behaviors and abnormal activities, and take appropriate measures to respond in a timely manner.

Anomaly detection is an important part of intelligent detection of network information security. It aims to discover abnormal activities that are inconsistent with normal behavior patterns, which may be an indication of potential network attacks, malicious behaviors, or system failures. The goal of anomaly detection is to establish a baseline model of normal behavior, and then through real-time monitoring and analysis of user behavior and system activities, identify anomalies that are inconsistent with the baseline model, use machine learning and statistical analysis methods to establish a baseline model, monitor user behavior and System activities to detect abnormal activities that are inconsistent with normal behavior patterns, which can help discover unknown attacks and new threats. However, in the existing technology, when the security of network information is detected through the analysis of behavior patterns, there is network information security. Technical problems include low accuracy of detection results and high false positives.

Contents of the invention

Embodiments of the present application provide a network information security intelligent detection method and device to solve the technical problems in the existing technology of low accuracy of network information security detection results and high false positives.

In order to solve the above technical problems, this application adopts the following technical solutions:

In the first aspect, this application provides an intelligent detection method for network information security, which includes the following steps:

Collect traffic data in network information, and standardize the collected traffic data to obtain standard traffic data;

Construct a traffic feature correlation matrix based on the standard traffic data, perform eigenvalue decomposition on the traffic feature correlation matrix to obtain a traffic feature vector and a traffic feature value, select a traffic feature vector as a traffic feature based on the traffic feature value, and then Mapping the standard traffic data to the traffic characteristics to obtain preprocessed traffic characteristic data;

Calculate the preprocessed traffic characteristic data to obtain a standard deviation and a mean value, determine an abnormal flow detection model based on the standard deviation and the mean value, and detect the preprocessed flow characteristic data through the abnormal flow detection model, Obtain traffic abnormal values;

When the flow abnormal value is greater than the preset abnormal threshold, the preprocessed flow characteristic data is determined to be abnormal flow data. When abnormal flow data is detected, a warning message is sent to the control center.

In some embodiments, standardizing the collected traffic data to obtain standard traffic data specifically includes:

Determine the maximum value and minimum value of the traffic data by traversing the traffic data;

The flow data is standardized according to the maximum value and the minimum value to obtain standard flow data. The standard flow data is determined according to the following formula:

Among them, X _s represents the standard flow data after normalization, X represents the flow data, X _max represents the maximum value of the flow data, and X _min represents the minimum value of the flow data.

In some embodiments, constructing a traffic feature correlation matrix based on the standard traffic data specifically includes:

Determine the number n and mean μ of standard flow data;

Determine the matrix φ of standard flow data;

A flow characteristic correlation matrix is constructed based on the number n and mean μ of the standard flow data and the matrix φ of the standard flow data. The flow characteristic correlation matrix is determined according to the following formula:

Among them, ψ represents the traffic characteristic correlation matrix, n represents the number of standard traffic data, φ represents the matrix of standard traffic data, μ represents the mean value of standard traffic data, and (φ-μ) ^T represents the transpose of the matrix.

In some embodiments, performing eigenvalue decomposition on the traffic feature correlation matrix to obtain the traffic feature vector and traffic feature value specifically includes:

The flow characteristic value sequence is obtained according to the solution equation of the flow characteristic value. The solution equation of the flow characteristic value is determined by the following formula:

|ψ-αθ|=0

Among them, ψ represents the flow characteristic correlation matrix, α represents the flow characteristic value, and θ represents the unit matrix;

The flow characteristic vector is determined through the flow characteristic value sequence, and the solution equation of the flow characteristic vector is determined by the following formula:

|ψ-α _i θ|β _i =0

Among them, ψ represents the traffic characteristic correlation matrix, α _i represents the i-th traffic characteristic value in the traffic characteristic value sequence, θ represents the unit matrix, and β _i represents the traffic characteristic vector corresponding to α _i .

In some embodiments, the traffic feature values are sorted by size, and a traffic feature vector is selected as the traffic feature from the sorted traffic feature values according to a preset dimension.

In some embodiments, mapping the standard traffic data to the traffic characteristics to obtain preprocessed traffic characteristic data specifically includes:

Multiply the matrix composed of standard traffic data and the matrix composed of traffic characteristics to obtain the preprocessed traffic characteristic matrix;

Determine preprocessing flow characteristic data according to the preprocessing flow characteristic matrix.

In some embodiments, the feature is that the preset abnormal threshold is determined through historical data analysis of abnormal traffic.

In the second aspect, this application provides an intelligent detection device for network information security, including:

The standard traffic data determination module is used to collect traffic data in network information, standardize the collected traffic data, and obtain standard traffic data;

A preprocessing flow characteristic data determination module is used to construct a flow characteristic correlation matrix based on the standard flow data, perform eigenvalue decomposition on the flow characteristic correlation matrix, and obtain a flow characteristic vector and a flow characteristic value. According to the flow characteristic Select the traffic feature vector as the traffic feature, map the standard traffic data to the traffic feature, and obtain the preprocessed traffic feature data;

A flow abnormal value determination module is used to calculate the preprocessed flow characteristic data to obtain a standard deviation and a mean value, determine an abnormal flow detection model based on the standard deviation and the mean value, and detect the abnormal flow detection model through the abnormal flow detection model. Preprocess traffic characteristic data for detection and obtain traffic abnormal values;

A warning module, configured to determine that the preprocessed traffic characteristic data is abnormal flow data when the flow abnormal value is greater than a preset abnormal threshold, and to send warning information to the control center when abnormal flow data is detected.

In a third aspect, the present application provides a computer device. The computer device includes a memory and a processor. The memory stores code. The processor is configured to obtain the code and perform the above-mentioned intelligent detection of network information security. method.

In a fourth aspect, the present application provides a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, the above-mentioned intelligent detection method for network information security is implemented.

The technical solutions provided by the embodiments of this application have the following beneficial effects:

In the intelligent detection method and device for network information security disclosed in this application, the traffic data in the network information is collected, the collected traffic data is standardized to obtain standard traffic data, and a traffic characteristic correlation matrix is constructed based on the standard traffic data. , perform eigenvalue decomposition on the flow characteristic correlation matrix to obtain the flow characteristic vector and flow characteristic value, select the flow characteristic vector as the flow characteristic according to the flow characteristic value, and map the standard flow data to the flow characteristic to obtain Preprocess the traffic characteristic data, calculate the preprocessed traffic characteristic data to obtain the standard deviation and the mean, determine the abnormal flow detection model based on the standard deviation and the mean, and use the abnormal flow detection model to perform the preprocessing The flow characteristic data is detected to obtain the flow abnormal value. When the flow abnormal value is greater than the preset abnormal threshold, the preprocessed flow characteristic data is determined to be abnormal flow data. When abnormal flow data is detected, a warning message is sent to the system. , which can solve the technical problems of low accuracy and high false positives in network information security detection results in the existing technology.

Description of the drawings

Figure 1 is an exemplary flow chart of a network information security intelligent detection method according to some embodiments of the present application;

Figure 2 is a schematic diagram of exemplary hardware and/or software of a network information security intelligent detection device according to some embodiments of the present application;

Figure 3 is a schematic structural diagram of an exemplary computer device applying a network information security intelligent detection method according to some embodiments of the present application.

Detailed ways

This application example provides an intelligent detection method and device for network information security. Its core is to collect traffic data in network information, standardize the collected traffic data to obtain standard traffic data, and construct traffic characteristics based on the standard traffic data. Correlation matrix, perform eigenvalue decomposition on the flow characteristic correlation matrix to obtain flow characteristic vector and flow characteristic value, select the flow characteristic vector as the flow characteristic according to the flow characteristic value, and map the standard flow data to the flow rate Characteristically, the preprocessed flow characteristic data is obtained, the preprocessed flow characteristic data is calculated to obtain the standard deviation and the mean, the abnormal flow detection model is determined based on the standard deviation and the mean, and all the abnormal flow detection models are detected through the abnormal flow detection model. The preprocessed flow characteristic data is detected to obtain the flow abnormal value. When the flow abnormal value is greater than the preset abnormal threshold, the preprocessed flow characteristic data is determined to be abnormal flow data. When abnormal flow data is detected, the system reports Sending warning information can solve the technical problems of low accuracy and high false positives in network information security detection results in the existing technology.

In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation modes. Referring to Figure 1, this figure is an exemplary flow chart of a network information security intelligent detection method according to some embodiments of the present application. The network information security intelligent detection method 100 mainly includes the following steps:

In step 101, traffic data in the network information is collected, and the collected traffic data is standardized to obtain standard traffic data.

In some embodiments, standardizing the collected traffic data to obtain standard traffic data specifically includes: determining the maximum value and minimum value of the traffic data by traversing the traffic data, and comparing the traffic data according to the maximum value and the minimum value. Perform standardization processing to obtain standard flow data, which is determined according to the following formula:

Among them, X _s represents the standard flow data after normalization, X represents the flow data, X _max represents the maximum value of the flow data, and X _min represents the minimum value of the flow data.

In some embodiments, assuming there is a data traffic data set [120, 60, 95, 110, 75, 130, 90], it is determined by traversing the traffic data that the maximum value of the traffic data is 130 and the minimum value is 75. Next , normalize the flow through the maximum and minimum values, and obtain the standard flow data [0.4167, 0.0833, 0.25, 0.375, 0, 0.5833, 0.1667].

It should be noted that through standardization processing, the traffic data will be mapped to a range, so that the minimum value corresponds to the lower limit of the target range, and the maximum value corresponds to the upper limit of the target range. This standardization processing method can retain the relative relationship and distribution of the traffic data. form, and map the traffic data to a certain range to facilitate subsequent processing and comparison.

In step 102, construct a traffic feature correlation matrix based on the standard traffic data, perform eigenvalue decomposition on the traffic feature correlation matrix to obtain a traffic feature vector and a traffic feature value, and select a traffic feature vector as the traffic flow based on the traffic feature value. Features, mapping the standard traffic data to the traffic features to obtain preprocessed traffic feature data.

In some embodiments, the following method may be used to construct the traffic feature correlation matrix based on the standard traffic data, namely:

First, determine the number n and mean μ of standard flow data, and then determine the matrix φ of standard flow data. Finally, based on the number n and mean μ of standard flow data and the matrix φ of standard flow data, the flow characteristic correlation matrix is constructed. The feature correlation matrix is determined according to the following formula:

Among them, ψ represents the traffic characteristic correlation matrix, n represents the number of standard traffic data, φ represents the matrix of standard traffic data, μ represents the mean value of standard traffic data, (φ-μ) ^T represents the transpose of the matrix, it needs to be explained Yes, building a traffic feature correlation matrix can help enhance the correlation between features in traffic data.

In some embodiments, a flow characteristic value sequence is obtained according to the solution equation of the flow characteristic value, and the solution equation of the flow characteristic value is determined by the following formula:

|ψ-αθ|=0

Among them, ψ represents the flow characteristic correlation matrix, α represents the flow characteristic value, and θ represents the unit matrix;

The flow characteristic vector is determined through the flow characteristic value sequence, and the solution equation of the flow characteristic vector is determined by the following formula:

|ψ-α _i θ|β _i =0

Among them, ψ represents the traffic characteristic correlation matrix, α _i represents the i-th traffic characteristic value in the traffic characteristic value sequence, θ represents the unit matrix, and β _i represents the traffic characteristic vector corresponding to α _i .

It should be noted that eigenvalue decomposition can help enhance the correlation and importance between various features in the traffic data set. In actual implementation, the calculation of eigenvalue decomposition can also be implemented using functions provided by a numerical calculation library or a linear algebra library. , which will not be described again.

In some embodiments, the traffic characteristic values are sorted according to size, and the traffic characteristic vector is selected as the traffic characteristic from the sorted traffic characteristic values according to a preset dimension, where the preset dimension refers to the standard traffic data that is to be reduced. Dimension of the dimension, sort the traffic characteristic values from large to small, and adjust the order of the traffic feature vectors accordingly, so that the traffic feature vectors with larger traffic feature values will correspond to more important traffic in the standard traffic data Features, for example, when the preset dimension is 3, the first three traffic feature vectors with the largest traffic feature values are selected as the traffic features. It should be noted that this traffic feature is the most important traffic retained by the standard traffic data. feature.

In some embodiments, mapping standard traffic data to traffic characteristics and obtaining preprocessed traffic characteristics data can be implemented in the following ways, namely:

Multiply the matrix composed of standard flow data and the matrix composed of flow characteristics to obtain the preprocessing flow characteristic matrix. The preprocessing flow characteristic data is determined according to the preprocessing flow characteristic matrix. By mapping the standard flow data to the flow characteristics, we can Convert higher-dimensional standard traffic data into lower-dimensional preprocessed traffic feature data while retaining the key features of the standard traffic data as much as possible.

In step 103, the preprocessed traffic characteristic data is calculated to obtain a standard deviation and a mean value, an abnormal flow detection model is determined based on the standard deviation and the mean value, and the preprocessed traffic characteristics are determined through the abnormal flow detection model. The data is detected and traffic abnormal values are obtained.

In some embodiments, the preprocessed traffic characteristic data is calculated to obtain the standard deviation and mean. It is assumed that the preprocessed traffic characteristic data is collected over a period of time, such as the network traffic transmission rate per minute, the characteristics are statistically described, and the mean and mean are calculated. Standard deviation, assuming that the statistical results are obtained, the mean τ = 100, and the standard deviation λ = 10. It should be noted that the units of the mean and standard deviation are Mbps (Million bits per second), that is, megabits per second. Calculation of the mean and standard The process will not be described again here.

In some embodiments, the preprocessing flow characteristic data x can be determined first, then the standard deviation λ and the mean τ of the preprocessing flow characteristic data x can be determined, and finally the anomaly can be determined based on the preprocessing flow characteristic data x, the standard deviation λ and the mean τ Traffic detection model, as a preferred embodiment, the abnormal traffic detection model can be determined by the following formula:

Among them, ω(x) represents the traffic abnormal value, x represents the preprocessed traffic characteristic data, τ represents the mean value of the preprocessed traffic characteristic data, λ represents the standard deviation of the preprocessed traffic characteristic data, e represents Euler's number, and π represents pi. a represents an intermediate substitution variable.

It should be noted that the abnormal traffic detection model is crucial to realizing network information security. In this application, the abnormal traffic detection model can discover potential network threats, identify abnormal behaviors, optimize defense strategies, and help with emergency response and malicious activity analysis. , through effective abnormal traffic detection, the security and stability of the network can be improved, and important data and resources can be protected.

In some embodiments, the preprocessed traffic characteristic data is detected through an abnormal traffic detection model to obtain the traffic abnormal value. For example, suppose there is a preprocessed traffic characteristic data representing the transmission rate of the traffic, and the transmission rate is 92Mbps. Substitute it into the abnormal value. The traffic detection model obtained the traffic abnormal value as 0.048. The calculation process of substituting the abnormal traffic detection model into the abnormal traffic detection model will not be described again here.

In step 104, when the traffic abnormal value is greater than the preset abnormal threshold, the preprocessed traffic characteristic data is determined to be abnormal traffic data. When abnormal traffic data is detected, warning information is sent to the control center.

In some embodiments, the preset abnormal threshold is determined by analyzing historical data of abnormal traffic, for example, collecting historical traffic data over a period of time, including sample data of normal traffic and known abnormal traffic, and analyzing the collected historical traffic. Data is preprocessed, including data cleaning, data filtering, and data standardization. There are no limitations here. Based on the preprocessed historical traffic data, statistical indicators, such as mean, standard deviation, etc., are calculated. These statistical indicators can reflect historical traffic data. This application uses the standard deviation and mean of historical traffic data to reflect the distribution of historical traffic data.

The preset abnormality threshold is determined based on the standard deviation and mean of historical traffic data. In some embodiments, the preset abnormality threshold is determined by using the mean plus or minus multiple standard deviations. For example, you can choose to use the mean minus twice the standard deviation. as the lower anomaly threshold, and the mean plus two standard deviations as the upper anomaly threshold.

It should be noted that when comparing the preset abnormal threshold and the traffic abnormal value, the preset abnormal threshold needs to be reduced by a hundred times to facilitate comparison. The determination of the preset abnormal threshold is a key step and needs to be carried out based on actual scenarios and needs. Adjustment and optimization. At the same time, as traffic data changes and new anomalies appear, the preset anomaly thresholds may also need to be periodically updated and adjusted to maintain the effectiveness of the anomaly traffic detection model.

In some embodiments, when the traffic abnormal value is greater than the preset abnormal threshold, the preprocessed traffic characteristic data is determined to be abnormal traffic data. For example, suppose we have a preprocessed traffic characteristic data of 92Mbps, and the upper limit of the preset threshold is 3.9 , after reducing it one hundred times, it is 0.039. The traffic abnormal value can be compared with the preset abnormal threshold. If the traffic abnormal value is greater than the reduced value of the upper limit threshold (0.048>0.039), it is determined to be abnormal traffic data.

In some embodiments, when abnormal traffic data is detected, the system administrator or relevant personnel can be notified by sending an alert message to the control center, so that timely measures can be taken to deal with the abnormal situation and prevent possible network problems or security threats. Warning information can be sent through various methods, such as email, text messages, instant messaging tools, etc., and there are no limitations here. By sending warning information, abnormal traffic can be discovered and processed in a timely manner to ensure the stability and security of the network. At the same time, timely warnings can also help reduce potential impacts and losses.

It should be noted that the detection of traffic data in the above embodiments can provide a more comprehensive analysis, thereby distinguishing normal traffic data and abnormal traffic data, and making more accurate judgments, improving accuracy and reducing false alarm rates. Standardized processing of traffic data can map traffic data to a certain range. The traffic feature correlation matrix can help enhance the correlation between various features in traffic data. By mapping standard traffic data to traffic features, it can Convert higher-dimensional standard traffic data into lower-dimensional preprocessed traffic feature data, while retaining the key features of the standard traffic data as much as possible. Use the abnormal traffic detection model to detect traffic anomalies and compare them with the preset thresholds. Determination is made after comparison. Compared with traditional detection methods based on rules or behavior patterns, detection of traffic data can capture more details and changes, which can improve the accuracy of network information security detection results and reduce the false alarm rate. .

In addition, in some embodiments, refer to Figure 2, which is a schematic diagram of exemplary hardware and/or software of a network information security intelligent detection device according to some embodiments of the present application. In this embodiment, the network information security intelligence The detection device 200 may include: a standard flow data determination module 201, a preprocessed flow characteristic data determination module 202, a flow abnormal value determination module 203 and a warning module 204, which are respectively described as follows:

Standard traffic data determination module 201. The standard traffic data determination module 201 in this application is mainly used to collect traffic data in network information, standardize the collected traffic data, and obtain standard traffic data;

Preprocessing flow characteristic data determination module 202. In this application, the preprocessing flow characteristic data determination module 202 is mainly used to construct a flow characteristic correlation matrix based on the standard flow data, and perform eigenvalue decomposition on the flow characteristic correlation matrix to obtain Traffic feature vector and traffic feature value, select the traffic feature vector as the traffic feature according to the traffic feature value, map the standard traffic data to the traffic feature, and obtain preprocessed traffic feature data;

Traffic abnormal value determination module 203. In this application, the traffic abnormal value determination module 203 is mainly used to calculate the preprocessed traffic characteristic data, obtain the standard deviation and the mean, and determine the abnormal traffic detection model based on the standard deviation and the mean. , detect the preprocessed traffic characteristic data through the abnormal traffic detection model, and obtain traffic abnormal values;

Warning module 204. The warning module 204 in this application is mainly used to determine that the preprocessed traffic characteristic data is abnormal traffic data when the traffic abnormal value is greater than the preset abnormal threshold. When abnormal traffic data is detected, notify the control center Send an alert message.

In some embodiments, the present application also provides a computer device, the computer device includes a memory and a processor; the memory stores code, and the processor is configured to obtain the code and execute the above network information Intelligent security detection method.

In some embodiments, refer to FIG. 3 , which is a schematic structural diagram of a computer device according to an intelligent detection method for network information security provided by an embodiment of the present application. The above-mentioned intelligent detection method of network information security in the above-mentioned embodiment can be implemented by the computer device shown in FIG. 3 . The computer device 300 includes at least one processor 301 , a communication bus 302 , a memory 303 and at least one communication interface 304 .

The processor 301 may be a general central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more intelligent detection methods for controlling network information security in this application. execution.

Communication bus 302 may include a path that carries information between the above-mentioned components.

The memory 303 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (random access memory (RAM)) or other type that can store information and instructions. The dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage ( Including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer Any other medium, but not limited to this. The memory 303 may exist independently and be connected to the processor 301 through the communication bus 302. The memory 303 may also be integrated with the processor 301.

Among them, the memory 303 is used to store the program code for executing the solution of the present application, and the processor 301 controls the execution. The processor 301 is used to execute program codes stored in the memory 303 . The program code may include one or more software modules. The intelligent detection method for network information security in the above embodiment can be implemented by one or more software modules in the program code in the processor 301 and the memory 303 .

The communication interface 304 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, wireless access network (radio access network, RAN), wireless local area networks (WLAN), etc.

In specific implementation, as an embodiment, the computer device may include multiple processors, and each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. processor. A processor here may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

The above computer device may be a general computer device or a special computer device. In a specific implementation, the computer device may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device or an embedded device. The embodiments of the present application do not limit the type of computer equipment.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

For example, in some embodiments, the present application also provides a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, the above-mentioned intelligent detection of network information security is implemented. method.

The present invention is described in terms of flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Although the preferred embodiments of the present invention have been described, those skilled in the art will be able to make additional changes and modifications to these embodiments once the basic inventive concepts are apparent. Therefore, it is intended that the appended claims be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims (10)

1. The intelligent network information security detection method is characterized by comprising the following steps:

collecting flow data in network information, and carrying out standardized processing on the collected flow data to obtain standard flow data;

constructing a flow characteristic correlation matrix according to the standard flow data, decomposing a characteristic value of the flow characteristic correlation matrix to obtain a flow characteristic vector and a flow characteristic value, selecting the flow characteristic vector as a flow characteristic according to the flow characteristic value, and mapping the standard flow data to the flow characteristic to obtain preprocessed flow characteristic data;

calculating the preprocessed flow characteristic data to obtain standard deviation and average value, determining an abnormal flow detection model according to the standard deviation and the average value, and detecting the preprocessed flow characteristic data through the abnormal flow detection model to obtain a flow abnormal value;

when the abnormal flow value is larger than a preset abnormal threshold value, judging that the preprocessed flow characteristic data is abnormal flow data, and when the abnormal flow data is detected, sending warning information to a control center.

2. The method of claim 1, wherein the normalizing the collected flow data to obtain standard flow data specifically comprises:

determining a maximum value and a minimum value of flow data by traversing the flow data;

and carrying out standardization processing on the flow data according to the maximum value and the minimum value to obtain standard flow data, wherein the standard flow data is determined according to the following formula:

wherein X is _s Represents standard flow data after standardized processing, X represents flow data, X _max Represents the maximum value of flow data, X _min Representing the minimum value of the flow data.

3. The method of claim 1, wherein constructing a flow characteristic correlation matrix from the standard flow data comprises:

determining the number n and the average mu of standard flow data;

determining a matrix phi of standard flow data;

constructing a flow characteristic correlation matrix according to the number n and the mean value mu of the standard flow data and a matrix phi of the standard flow data, wherein the flow characteristic correlation matrix is determined according to the following formula:

wherein, psi represents the flow characteristic correlation matrix, n represents the number of standard flow data, phi represents the matrix of standard flow data, mu represents the average value of standard flow data, (phi-mu) ^T Representing the transpose of the matrix.

4. The method of claim 1, wherein performing eigenvalue decomposition on the flow characteristic correlation matrix to obtain a flow characteristic vector and a flow characteristic value specifically comprises:

obtaining a flow characteristic value sequence according to a solution equation of the flow characteristic value, wherein the solution equation of the flow characteristic value is determined by the following formula:

|ψ-αθ|＝0

wherein, psi represents a flow characteristic correlation matrix, alpha represents a flow characteristic value, and theta represents a unit matrix;

and determining a flow characteristic vector through the flow characteristic value sequence, wherein a solution equation of the flow characteristic vector is determined by the following formula:

|ψ-α _i θ|β _i ＝0

wherein, psi represents a flow characteristic correlation matrix, alpha _i Represents the ith flow characteristic value in the flow characteristic value sequence, theta represents the identity matrix and beta _i Representing alpha _i Corresponding flow characteristic vectors.

5. The method of claim 1 wherein the flow feature values are ranked by size and a flow feature vector is selected as a flow feature from the ranked flow feature values according to a predetermined dimension.

6. The method of claim 1, wherein mapping the standard flow data onto the flow characteristics to obtain pre-processed flow characteristic data comprises:

multiplying a matrix formed by standard flow data by a matrix formed by flow characteristics to obtain a preprocessed flow characteristic matrix;

and determining preprocessing flow characteristic data according to the preprocessing flow characteristic matrix.

7. The method of claim 1, wherein the predetermined anomaly threshold value is determined by historical data analysis of anomaly traffic.

8. The utility model provides a network information security intelligent detection device which characterized in that includes:

the standard flow data determining module is used for collecting flow data in the network information and carrying out standardized processing on the collected flow data to obtain standard flow data;

the preprocessing flow characteristic data determining module is used for constructing a flow characteristic correlation matrix according to the standard flow data, decomposing the characteristic value of the flow characteristic correlation matrix to obtain a flow characteristic vector and a flow characteristic value, selecting the flow characteristic vector as a flow characteristic according to the flow characteristic value, and mapping the standard flow data to the flow characteristic to obtain preprocessing flow characteristic data;

the flow abnormal value determining module is used for calculating the preprocessed flow characteristic data to obtain standard deviation and average value, determining an abnormal flow detection model according to the standard deviation and the average value, and detecting the preprocessed flow characteristic data through the abnormal flow detection model to obtain a flow abnormal value;

and the warning module is used for judging that the preprocessed flow characteristic data is abnormal flow data when the flow abnormal value is larger than a preset abnormal threshold value, and sending warning information to the control center when the abnormal flow data is detected.

9. A computer device comprising a memory storing code and a processor configured to obtain the code and to perform the network information security intelligent detection method of any of claims 1 to 7.

10. A computer readable storage medium storing a computer program, wherein the computer program when executed by a processor implements the network information security intelligent detection method according to any one of claims 1 to 7.