CN101431416B - Synergistic learning invasion detection method used for data gridding - Google Patents

Abstract

A collaborative learning intrusion detection method applied to data grids, which absorbs the advantages of popular technologies such as distributed detection and integrated learning in the field of intrusion detection, combines anomaly detection and feature detection methods, and adopts BP neural network collaborative learning, The advantages are complementary, so that the intrusion detection system designed based on this method can be better applied to the data grid environment. According to the security requirements of different types of nodes in the data grid, this method deploys multiple strong detectors integrated by BP neural network on the central node, and collects the characteristics of new intrusion samples from various places at any time, ensuring the security of important copies on the central node sex. At the same time, a collaborative intrusion analysis engine is deployed on the central node to provide collaborative detection services for ordinary nodes. The central node organizes many ordinary nodes to participate in collaborative computing, which can detect suspicious data that cannot be judged by a single node, and improves the security of ordinary nodes. safety.

Description

A Collaborative Learning Intrusion Detection Method Applied to Data Grid

technical field

The invention is an intrusion detection method based on cooperative learning of BP neural network applied to data grid. It is mainly used to detect attacks on data nodes in the grid from the network, and belongs to the cross field of data grid technology and intrusion detection technology.

Background technique

With the rapid development of high-speed network technology and computing grid technology in recent years, people's demand for large-scale data sharing has become increasingly strong. Some current storage technologies, such as network-attached storage NAS, storage area network SAN, cluster storage, object Storage, etc., due to its closedness, independence, relatively high cost, and insufficient storage and expansion capabilities, it is difficult to share an increasingly large amount of data under the WAN. On the other hand, there is still a large amount of idle storage space on the WAN not being used effectively. Data grid is an ideal virtual storage system with data as the main resource, which can provide good support for various grid applications. On the one hand, using the efficient processing capability of the grid environment can realize the effective integration of large-scale data and effectively utilize the existing numerous data resources; It provides strong support for the effective management of database resources, the integration and optimization of distributed data, and the analysis and processing of big data.

When computing is deployed over a wide area network, security assurance is critical. The grid security mechanism will provide a basic security protection verification mechanism to verify legitimate users and resources, and provide interfaces for other security services, allowing users to choose different security policies, security levels and encryption methods, and provide underlying security facilities. This is the requirement and characteristic of grid computing. The intrusion detection system, as the second line of defense of network security after the firewall, has been further extended to the grid environment. As another line of defense on top of the underlying GSI of the grid, the prototype system of intrusion detection deployed on the computing grid has begun to take shape. , most of these systems detect the grid user's behavior profile in the form of upper-level security services to discover and prevent malicious users' attacks to ensure the security of the grid. However, the situation is different in the data grid. In order to improve the quality of data services, a large number of data copies are used in the data grid. These copies are distributed and stored on heterogeneous nodes in a wide area. There is no doubt that data redundancy The greater the degree, the more attack points are provided for the attacker. The attacker's attack on the data grid will first be launched from the network on some key nodes, and then destroy the entire data grid. If the security of each node computer storing important data cannot be guaranteed, the security of the data grid as a whole cannot be guaranteed. However, most of the existing intrusion detection technologies are aimed at stand-alone operating systems and networks, and the intrusion detection systems applied to the computing grid are deployed on the upper layer of the grid to target the users of the entire grid, lacking network security for a single node. considerations that are not suitable for the special case of data grids. At present, the research and development of data grid is still in its infancy, and the research on grid data security is even less, and the few data grid intrusion detection models that have been proposed now are all intrusion detection models in the computing grid. detection techniques without considering the attacks from the network faced by the nodes storing the data.

In recent years, distributed intrusion detection technology has made great progress. However, such a system either requires a unified control center to analyze and process security events from each key detection point, or uses agent technology to independently or collaboratively process distributed nodes. events on . Due to the large number of nodes in the grid, the use of a centralized processing engine will lead to a heavy load on the processing center, and the problem of single point failure cannot be avoided. The use of agent technology does not give full play to the complementary advantages of each agent in the grid heterogeneous environment and it is difficult to solve the problem of agent failure. trust issues among them. It can be seen that the existing distributed intrusion detection techniques are not suitable for the special environment of data grid.

In the field of intrusion detection, integrated learning is also a research hotspot in recent years. It integrates many independently trained weak learners such as BP neural network to obtain a strong learner to improve the detection rate, but this method is mainly used for stand-alone intrusion detection. Therefore, it is of great significance to study an intrusion detection method suitable for the data grid environment.

Contents of the invention

Technical problem: The purpose of the present invention is to provide an intrusion detection method applied to a data grid to detect attacks from the network targeting data nodes in the grid.

Technical solution: The present invention is an intrusion detection method based on collaborative learning. Based on BP neural network, the neural networks on each heterogeneous node in the data grid learn from each other and complement each other to improve the security of each data node and effectively resist Attacks from the network.

1. Architecture

According to the theory of complex network science, the network (Internet, grid) in the real world has scale-free characteristics. As a wide-area self-organized dynamic network, the topology of the data grid should also conform to the scale-free network model: few centers The node degree is very large, and many ordinary nodes are connected to it. Therefore, the typical topology of the data grid is shown in Figure 1, in which the central node is generally used to store important data copies (root copies), and its security is very important. In order to reduce security overhead and focus on protecting the security of key data nodes, the intrusion detection modules on the central node and common nodes are designed as follows:

Figure 2 shows the architecture of the central node intrusion detection module. Its functional components mainly include local data collectors, new intrusion sample receivers, collaborative request service agents, data preprocessing and format converters, and local integrated intrusion analysis engines ( detector), intrusion sample feature library, collaborative intrusion analysis engine, new intrusion sample sender, and response alarm.

Below we give a description of several specific parts:

Local data collector: Collect network data packets from the local network segment to detect attacks from the local network.

New intrusion sample receiver: Receives data samples sent by other nodes that have been detected and judged to be attacks.

Collaborative request service agent: Receive the suspicious sample that cannot be judged sent by a common node, and then broadcast it to all common nodes directly connected to the central node for collaborative analysis, and return the final judgment result of the collaborative intrusion analysis engine to the initiator Nodes that coordinate requests.

Data preprocessing and format converter: Due to the heterogeneity of the data grid, the format and detected fields of the network data packets processed by the detectors of each node computer are different, and the converter converts the received data into a unified format suitable for local The format that the detectors on the nodes handle, and do proper preprocessing to improve the detection efficiency.

Local integrated intrusion analysis engine: It is the main intrusion detection component of the central node. In order to ensure the security of the central node, the detector adopts the integrated detection method of multiple independently trained BP neural networks to form a strong local detection capability.

Intrusion sample feature library: store the new intrusion sample features submitted by ordinary nodes, and work with the local integrated intrusion analysis engine. For the data to be detected received by the analysis engine, it is first compared with the existing intrusion sample features in the feature library. Anomalies are found and then detected by the integrated BP neural network of the analysis engine.

Cooperative intrusion analysis engine: receives data from the cooperative request service agent, and provides cooperative detection services for common nodes.

New intrusion sample sender: Send new types of intrusion samples found on the local node to other nodes for their detection reference.

Response alarm: When an attack on the node from the network is found, an intrusion alarm is issued to prompt the system to take measures to prevent the intrusion.

Figure 3 shows the architecture of the common node intrusion detection module. Since it is not as important as the central node, its security requirements are lower than that of the central node, so its intrusion analysis engine only uses two BP neural network cooperative detection, and because the common node The degree is very small, and the computing performance is not as good as that of the central node. Therefore, in addition to performing local detection and responding to the requirements of the central node connected to it to participate in a certain cooperative detection calculation when idle, it does not undertake the obligation to provide cooperative detection services for other nodes. Its functional components mainly include local data collector, data preprocessing and format converter, local intrusion analysis engine (detector), local intrusion sample feature library, new intrusion sample sender, cooperative communication server, and response alarm device. Among them, the functions of local data collector, data preprocessing and format converter, new intrusion sample sender, and response alarm are the same as those of the central node, and will not be described in detail. The difference is the detector and feature library. To send a cooperative detection request to other nodes through the central node, it is necessary to add a cooperative communication server, which is explained as follows:

Local intrusion analysis engine: The detection engine of ordinary nodes adopts the cooperative detection method of two independent BP neural networks, one of which is the main detector and the other is the auxiliary detector. In actual detection, if both networks are judged to be normal, it is regarded as normal data; if both networks are judged to be abnormal, it is regarded as intrusion data; The suspicious data of the judgment, through the cooperative communication server, sends the suspicious samples to the central node connected to it, and then the central node cooperates with other common nodes to provide cooperative detection services to make a final judgment.

Local intrusion sample feature library: If the final result of the suspected sample is indeed an intrusion after collaborative detection, its features will be extracted and stored in the local intrusion sample feature library, and the feature library will be checked first in the subsequent detection. If a record matches, it is directly judged as an intrusion, and there is no need to perform collaborative detection again to reduce security overhead.

Cooperative communication server: Send the suspected samples that cannot be judged by this node to the remote central node, put forward a cooperative service request or respond to the request of a certain central node, receive the suspicious data sent by it, submit it to the intrusion analysis engine on the local machine for analysis, and then Return the calculation results of the analysis engine to the central node.

2. Method flow

A collaborative learning intrusion detection method applied to data grid improves the security of each data node through collaborative learning and complementary advantages of BP neural network on each heterogeneous node in the data grid, and effectively resists attacks from the network. as follows:

Common node local intrusion detection process:

Step 1: The local data collector collects network data packets in real time,

Step 2: Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine,

Step 3: The converted data is sent to the local intrusion analysis engine, which is detected by two BP detectors respectively.

Step 4: If both detectors judge the normal data as normal, then judge it as normal data, end the current round of detection, and go to step 1 to continue collecting network data packets; if both detectors judge it as an attack attack, start a response alarm Detector, warning that local network intrusion is found, go to step 5; if the judgment results of the two detectors are inconsistent, go to step 6,

Step 5: The new intrusion sample sender sends the attack data sample to the new intrusion sample receiver of the central node directly connected to the node, informs the central node that an intrusion has been found here, ends the current round of detection, and proceeds to step 1 to continue collecting network data Bag,

Step 6: The local intrusion analysis engine connects to the local intrusion sample signature database, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the response alarm will be activated to warn of local network intrusion, and go to step 1 to continue collecting the network. data packet; if not, it is considered as suspicious data, sent to the cooperative communication server, and then step 7,

Step 7: The collaborative communication server sends the suspected sample to a collaborative request service agent of a central node directly connected to the node, and proposes a collaborative service request,

Step 8: The cooperative communication server receives the result returned by the cooperative request service agent and submits it to the detector,

Step 9: The detector receives and checks the returned results. If it is normal data, go to step 1 to continue collecting network data packets; if it is attack data, start the response alarm to warn that local network intrusion is found, and at the same time record the characteristics of the attack sample Store it in the local intrusion sample signature database, and go to step 1 to continue collecting network data packets;

Ordinary nodes participate in the collaborative computing workflow:

Step 21: The collaborative communication server receives the suspicious data and collaborative computing requirements from other nodes sent by the collaborative request service agent of the central node, and inquires whether the status of the local intrusion analysis engine is idle,

Step 22: If the local intrusion analysis engine is busy and has no time to participate in collaborative computing, it will not respond to the request of the central node, discard the data packet, and end the process; otherwise, go to step 23,

Step 23: The cooperative communication server submits the suspicious data received from the central node to the intrusion analysis engine,

Step 24: detect the suspected data by the main detector of the analysis engine, and return the result to the collaborative communication server,

Step 25: The cooperative communication server sends the calculation result of the node to the cooperative request service agent of the central node;

Central node local intrusion detection workflow:

Step 31: The local data collector collects network data packets in real time,

Step 32: Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine,

Step 33: The converted data is sent to the local integrated intrusion analysis engine for detection by the integrated detector,

Step 34: If the detection result is normal, go to step 35; if it is abnormal, start the response alarm to warn of local network intrusion, go to step 36,

Step 35: The intrusion analysis engine connects to the intrusion sample signature database, and inquires whether there is an attack signature sample matching the data in the signature database. If yes, start the response alarm to warn that a local network intrusion is found, and go to step 36; if not, then Consider it to be normal data, end the current round of detection, go to step 31 to continue collecting network data packets,

Step 36: The new-type intrusion sample sender sends the attack data sample to the new-type intrusion sample receivers of other central nodes directly connected to the central node, notifying that an intrusion has been found here, end the current round of detection, and go to step 31 to continue collecting the network data pack;

The central node collects new intrusion sample feature flow:

Step 41: The new-type intrusion sample receiver receives the detected attack data submitted by other nodes or the cooperative request service agent on the local machine, and submits the data to the integrated detector,

Step 42: The integrated detector detects the data, if the detection result is also an attack, the process ends; otherwise, enter the next step,

Step 43: The integrated detector connects to the intrusion sample signature database, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the process ends; if not, it is regarded as a newly discovered intrusion, and proceeds to the next step ,

Step 44: store the feature of the attack sample in the intrusion sample feature database;

The central node provides collaborative detection service process:

Step 51: The collaborative request service agent receives a suspicious sample and a collaborative service request from a common node,

Step 52: The service agent broadcasts the suspicious data and collaborative computing requirements to all common nodes connected to the node,

Step 53: The service agent receives the calculation results returned by all the responding nodes and submits them to the collaborative intrusion analysis engine,

Step 54: The cooperative intrusion analysis engine counts the cooperative detection results of each response node submitted to it by the service agent, and if the suspected data is judged as the number of attacking nodes is greater than or equal to the number of normal nodes num(attack)>=num (normal), it is judged as an attack, otherwise it is judged as normal.

Step 55: The cooperative intrusion analysis engine returns the judgment result to the service agent,

Step 56: The service agent checks the received result, if it is normal, it will directly return it to the node that issued the collaborative service request; if it is abnormal, in addition to returning the result to the node that issued the collaborative service request, it will also confirm the data as the attack The sample is sent to the local new intrusion sample receiver, reporting the discovery of a new intrusion.

The functional components of the central node intrusion detection module mainly include local data collector, new intrusion sample receiver, collaborative request service agent, data preprocessing and format converter, local integrated intrusion analysis engine, intrusion sample feature library, collaborative intrusion analysis engine, New intrusion sample sender, response alarm device; the functional components of the common node intrusion detection module mainly include local data collector, data preprocessing and format converter, local intrusion analysis engine, local intrusion sample feature library, new intrusion sample sender, Cooperate with the communication server and respond to the alarm.

Beneficial effect: using this scheme has the following advantages:

1. It greatly guarantees the security and invulnerability of the central node of the data grid. Since the experimental research has proved that the integration of weak learners can form a strong detection ability, the integrated learner deployed on the central node can effectively ensure the security of the data center, and the central node collects information from other nodes (including the central node and ordinary node) discovers new intrusion features, and learns the "experience" of other nodes at any time, making the knowledge of its feature library more and more abundant and comprehensive. This design combines anomaly detection and feature detection, and powerful anomaly detectors cooperate with comprehensive enrichment The feature detection and complementary advantages make the data grid have a strong ability to resist targeted attacks.

2. Effectively improve the network security of ordinary nodes. Although ordinary nodes cannot deploy powerful detectors due to their own performance limitations, the present invention cleverly utilizes the heterogeneity and respective advantages of data grid nodes, because ordinary nodes are physically distributed in a wide area and located in multiple In various virtual organizations and network segments, the security level is different, the network data packets collected by each are very different, and the types of attacks encountered are very different. It may be easy for the detector of a certain node to detect an attack that often targets itself However, this kind of attack is rarely encountered by other nodes and is not easy to detect. Ordinary nodes can learn collaboratively with many other ordinary nodes through the collaborative detection service provided by the central node, learn from each other, and greatly improve their own detection capabilities.

3. Reduce the security overhead of the data grid. Since the intrusion detection module on each node independently detects local intrusions, the data that is certain for itself is processed by each node itself, without the need for a unified central processing unit, and a true distribution is realized in the data grid environment Type intrusion detection; for suspected samples confirmed as attacks by collaborative detection, the attack signatures are extracted in time and stored in the local signature database. When encountering such attacks in the future, you can directly search the signature database without performing collaborative calculations again, which reduces security. overhead.

Description of drawings

Figure 1 is a simplified diagram of a typical topology of a data grid based on complex network theory.

Figure 2 is the architecture diagram of the intrusion detection module of the central node.

Fig. 3 is the architecture diagram of common node intrusion detection module.

Fig. 4 is a flow chart of local intrusion detection of common nodes.

Fig. 5 is a flow chart of common nodes participating in collaborative computing.

Fig. 6 is a flow chart of the local intrusion detection of the central node.

Fig. 7 is a flow chart of collecting new intrusion sample features by the central node.

Fig. 8 is a flow chart of the central node providing cooperative detection service.

Detailed ways

1. Ordinary node intrusion detection process

The local intrusion analysis engine on a normal node is composed of two BP neural networks. The two networks are trained independently. One of them is designated as the main detector and the other as the auxiliary detector. The two detectors cooperate to detect the network data packets collected locally, and the main detector not only performs local detection, but also participates in cooperative intrusion detection with the main detector on other nodes. For local network data, only when the primary and secondary detectors are judged to be normal, it is determined to be normal data. If the judgment results of the two detectors are different, it will be sent as a suspected data sample by the cooperative communication server to the node directly connected. A central node of , the collaborative intrusion analysis engine on the central node provides collaborative detection services. As long as any common node finds an intrusion behavior, it must send the intrusion data to the central node connected to it to provide reference for the detection of the central node.

The main workflow of local intrusion detection of ordinary nodes (see Figure 4):

Step1: The local data collector collects network data packets in real time.

Step2: Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine.

Step3: The converted data is sent to the local intrusion analysis engine, which is detected by two BP detectors.

Step4: If both detectors judge as normal data (normal), then judge as normal data, end the current round of detection, go to step1 to continue collecting network data packets; if both detectors judge as attack (attack), start Respond to the alarm, if the local network intrusion is detected, go to step5; if the judgment results of the two detectors are inconsistent, go to step6.

Step5: The new intrusion sample sender sends the attack data sample to the new intrusion sample receiver of the central node directly connected to the node, informs the central node that an intrusion has been found here, ends the current round of detection, and turns to step1 to continue collecting network data packets.

Step6: The local intrusion analysis engine connects to the local intrusion sample signature database, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the response alarm will be activated to warn of local network intrusion, and go to step1 to continue collecting network data packets. ; If not, it is considered as suspicious data, sent to the collaborative communication server, and transferred to step7.

Step7: The collaborative communication server sends the suspected sample to a collaborative request service agent of a central node directly connected to the node, and proposes a collaborative service request.

Step8: The cooperative communication server receives the result returned by the cooperative request service agent and submits it to the detector.

Step9: The detector receives and checks the returned results. If it is normal data, it will go to step 1 to continue collecting network data packets; if it is attack data, it will start the response alarm to warn of local network intrusion, and store the characteristics of the attack sample in In the local intrusion sample signature database, go to step 1 and continue to collect network data packets.

Ordinary nodes participate in the collaborative computing workflow (see Figure 5):

Step1: The collaborative communication server receives suspicious data and collaborative computing requirements from other nodes sent by the collaborative request service agent of the central node, and inquires whether the status of the local intrusion analysis engine is idle.

Step2: If the local intrusion analysis engine is busy and has no time to participate in collaborative computing, it will not respond to the request of the central node, discard the data packet, and end the process; otherwise, go to step3.

Step3: The collaborative communication server will receive the suspected data from the central node and submit it to the intrusion analysis engine.

Step4: The suspicious data is detected by the main detector of the analysis engine, and the result is returned to the collaborative communication server.

Step5: The cooperative communication server sends the calculation result of this node to the cooperative request service agent of the central node.

2. Central node intrusion detection process

The central node is deployed with a strong detector integrated by many BP networks, and it collects the detected intrusion data features from other nodes in real time and stores them in the feature library. Therefore, the central node does not need to cooperate with other nodes to detect local intrusions. Because of its powerful computing power and high connectivity, it can easily provide cooperative detection services for ordinary nodes in the grid.

Central node local intrusion detection workflow (see Figure 6):

Step1: The local data collector collects network data packets in real time.

Step2: Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine.

Step3: The transformed data is sent to the local integrated intrusion analysis engine for detection by the integrated detector.

Step4: If the detection result is normal, go to step5; if it is abnormal, start a response alarm to warn of local network intrusion, go to step6.

Step5: The intrusion analysis engine connects to the intrusion sample signature database, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the response alarm will be activated to warn of local network intrusion, and go to step6; if not, it will be considered For normal data, end the current round of detection and go to step 1 to continue collecting network data packets.

Step6: The new intrusion sample sender sends the attack data samples to the new intrusion sample receivers of other central nodes directly connected to the central node, and informs that an intrusion has been found here, ends the current round of detection, and continues to collect network data packets in step1 .

The central node collects the characteristic flow of new intrusion samples (see Figure 7):

Step1: The new intrusion sample receiver receives the detected attack data submitted by other nodes or cooperative request service agents on the local machine, and submits the data to the integrated detector.

Step2: The integrated detector detects the data. If the detection result is also an attack, the process ends; otherwise, go to the next step.

Step3: The integrated detector connects to the intrusion sample signature database, and queries whether there is an attack signature sample matching the data in the signature database. If there is, the process ends; if not, it is regarded as a newly discovered intrusion, and proceeds to the next step.

Step4: Store the features of the attack sample in the intrusion sample feature database.

The central node provides collaborative detection service process (see Figure 8):

Step1: The collaborative request service agent receives a suspicious sample and a collaborative service request from a common node.

Step2: The service agent broadcasts the suspected data and collaborative computing requirements to all common nodes connected to the node.

Step3: The service agent receives the calculation results returned by all the responding nodes and submits them to the collaborative intrusion analysis engine.

step4: The collaborative intrusion analysis engine counts the collaborative detection results of each response node submitted to it by the service agent. If the suspected data is judged as attacking nodes, the number is greater than or equal to the number of normal nodes num(attack)>=num( normal), it is judged as an attack, otherwise it is judged as normal.

Step5: The cooperative intrusion analysis engine returns the judgment result to the service agent.

Step6: The service agent checks the received result, if it is normal, it will directly return it to the node that issued the collaborative service request; if it is abnormal, in addition to returning the result to the node that issued the collaborative service request, it will also confirm the data sample as the attack Sent to the local new intrusion sample receiver, reporting the discovery of a new intrusion.

For the convenience of description, we assume that the topological structure of the data grid instance is shown in Figure 1. The detection process of ordinary nodes and central nodes is represented by ai and A respectively. The detection process of other nodes is the same, and the specific implementation method It is: initial: on the central nodes A, B, C and their respective ordinary nodes a1, a2, ..., am; b1, b2, ..., bn; c1, c2, ..., ck according to Fig. 2, Fig. The architecture diagram of 3 establishes its own intrusion detection system for each node, and independently trains the BP neural network on each detector according to the data of the actual network environment where each node is located (each neural network of the same node detector uses this The training data subsets are independently randomly extracted from the node training data set, and different subsets of reduced attributes are taken to ensure the heterogeneity of each neural network obtained through training), and the feature library of each node is initialized. In the initial library, only the local Several of the most common intrusion signatures encountered by nodes.

Local intrusion detection of common node ai:

(1) The local data collector on the AI collects network data packets in real time.

(2) Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine.

(3) The transformed data is sent to the local intrusion analysis engine, which is detected by two BP detectors respectively.

(4) If both detectors judge as normal data (normal), then judge as normal data, end the current round of detection, go to (1) continue to collect network data packets; if both detectors judge as attack (attack) , then start the response alarm device to warn that local network intrusion is found, and go to (5); if the judgment results of the two detectors are inconsistent, go to (6).

(5) The new-type intrusion sample sender sends the attack data sample to A's new-type intrusion sample receiver, and informs A that an intrusion has been found here, ends the current round of detection, and turns to (1) to continue collecting network data packets.

(6) The local intrusion analysis engine connects to the local intrusion sample signature database, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the response alarm will be activated to warn of local network intrusion, and go to (1) to continue collecting Network data packet; If not, then think that suspicious data, send cooperative communication server, turn (7).

(7) The cooperative communication server sends the suspected sample to A's cooperative request service agent, and makes a cooperative service request.

(8) The cooperative communication server receives the result returned by the cooperative request service agent and submits it to the detector.

(9) The detector receives and checks the returned result. If it is normal data, then turn to (1) to continue collecting network data packets; The signatures are stored in the local intrusion sample signature database, and turn to (1) to continue collecting network data packets.

ai participates in collaborative computing workflow:

(1) The collaborative communication server receives suspicious data and collaborative computing requirements from other nodes sent by A's collaborative request service agent, and asks whether the local intrusion analysis engine is idle.

(2) If the state of the local intrusion analysis engine is busy and has no time to participate in collaborative computing, it will not respond to A's request, discard the data packet, and end the process; otherwise, go to (3).

(3) The collaborative communication server submits the suspected data received from A to the intrusion analysis engine.

(4) The suspicious data is detected by the main detector of the analysis engine, and the result is returned to the collaborative communication server.

(5) The cooperative communication server sends the calculation result of this node to A's cooperative request service agent.

Local intrusion detection of central node A:

(1) The local data collector on A collects network data packets in real time.

(2) Data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine.

(3) The transformed data is sent to the local integrated intrusion analysis engine for detection by the integrated detector.

(4) If the detection result is normal (normal), then go to (5); if it is abnormal, start a response alarm to warn that local network intrusion is found, go to (6).

(5) The intrusion analysis engine connects the intrusion sample feature library, and checks whether there is an attack feature sample matching the data in the query feature library, and if so, starts the response alarm device, warns that local network intrusion is found, and turns to (6); if not, Then it is considered as normal data, end the current round of detection, and turn to (1).

(6) The new-type intrusion sample sender sends the attack data sample to the new-type intrusion sample receivers on B and C, and informs that an intrusion has been found here, and turns to (1).

A collects the characteristics of new intrusion samples:

(1) The new intrusion sample receiver on A receives the detected attack data submitted by B, C or the cooperative request service agent on this machine, and submits the data to the integrated detector.

(2) The integrated detector detects the data, and if the detection result is also an attack, the process ends; otherwise, enter (3).

(3) The integrated detector connects to the intrusion sample feature library, and checks whether there is an attack feature sample matching the data in the feature library. If there is, the process ends; if not, it is considered to be a newly discovered intrusion, and enters (4 ).

(4) Store the feature of the attack sample into the intrusion sample feature database.

A provides collaborative detection service process:

(1) The collaborative request service agent on A receives the suspicious sample and collaborative service request from ai.

(2) The service agent broadcasts the suspected data and collaborative computing requirements to all common nodes a1, a2, . . . , am connected to A.

(3) The service agent receives the calculation results returned by all the responding nodes and submits them to the collaborative intrusion analysis engine.

(4) Cooperative intrusion analysis engine statistical service agent submits the cooperative detection results of each response node to it, if the suspected data is judged as the number of attacking nodes is greater than or equal to the number of normal nodes num(attack)>=num (normal), it is judged as an attack, otherwise it is judged as normal.

(5) The cooperative intrusion analysis engine returns the judgment result to the service agent.

(6) The service agent checks the received result, if it is normal, it will directly return it to ai; if it is abnormal, in addition to returning the result to ai, it will also send the data sample confirmed as attack to the local new intrusion sample receiver , reports the discovery of a new intrusion.

Claims (2)

1. A collaborative learning intrusion detection method applied to data grids, characterized in that the security of each data node is improved through collaborative learning and complementary advantages of BP neural networks on each heterogeneous node in the data grid, effectively resisting Attacks from the network, as follows: Common node local intrusion detection process: Step 1: The local data collector of common nodes collects network data packets in real time, Step 2: Common node data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine, Step 3: The converted data is sent to the local intrusion analysis engine, which is detected by two BP detectors respectively. Step 4: If both detectors judge the normal data as normal, then judge it as normal data, end the current round of detection, go to step 1 to continue collecting network data packets; if both detectors judge as attack attack, start the normal node Respond to the alarm and warn that local network intrusion is found, go to step 5; if the judgment results of the two detectors are inconsistent, go to step 6, Step 5: The new-type intrusion sample transmitter of the common node sends the attack data sample to the new-type intrusion sample receiver of the central node directly connected to the node, and informs the central node that an intrusion has been found here, ends the current round of detection, and continues to collect in step 1 network packets, Step 6: The local intrusion analysis engine connects to the local intrusion sample signature database of ordinary nodes, and checks whether there are any attack signature samples matching the data in the signature database. If so, it starts the ordinary node to respond to the alarm, warns that local network intrusions are found, and proceeds to step 1 Continue to collect network data packets; if not, then consider it suspicious data, send it to the collaborative communication server, go to step 7, Step 7: The collaborative communication server sends the suspected sample to a collaborative request service agent of a central node directly connected to the node, and proposes a collaborative service request, Step 8: The cooperative communication server receives the result returned by the cooperative request service agent and submits it to the detector, Step 9: The detector receives and checks the returned results. If it is normal data, go to step 1 to continue collecting network data packets; if it is attack data, start the normal node to respond to the alarm, warn that the local network intrusion is found, and at the same time send the attack sample The signatures are stored in the local intrusion sample signature database, and go to step 1 to continue collecting network data packets; Ordinary nodes participate in the collaborative computing workflow: Step 21: The collaborative communication server receives the suspicious data and collaborative computing requirements from other nodes sent by the collaborative request service agent of the central node, and inquires whether the status of the local intrusion analysis engine is idle, Step 22: If the local intrusion analysis engine is busy and has no time to participate in collaborative computing, it will not respond to the request of the central node, discard the data packet, and end the process; otherwise, go to step 23, Step 23: The collaborative communication server submits the suspected data received from the central node to the local intrusion analysis engine, Step 24: The main detector of the local intrusion analysis engine detects the suspected data, and the result is returned to the collaborative communication server, Step 25: The cooperative communication server sends the calculation result of the node to the cooperative request service agent of the central node; Central node local intrusion detection workflow: Step 31: The local data collector of the central node collects network data packets in real time, Step 32: Central node data preprocessing and format converter Extract the attributes and characteristics of the collected data packets, perform preprocessing and convert them into a format suitable for the node machine, Step 33: The transformed data is sent to the local integrated intrusion analysis engine of the central node, and is detected by the integrated detector. Step 34: If the detection result is normal, go to step 35; if it is abnormal, start the central node to respond to the alarm, warn that local network intrusion is found, go to step 36, Step 35: The local integrated intrusion analysis engine of the central node connects to the intrusion sample signature database of the central node, and inquires whether there is an attack signature sample matching the data in the signature database, and if so, starts the central node to respond to the alarm, and warns that a local network intrusion is found, Go to step 36; if not, then consider it to be normal data, end this round of detection, go to step 31 and continue to collect network data packets, Step 36: The new intrusion sample transmitter of the central node sends the attack data sample to the new intrusion sample receivers of other central nodes directly connected to the central node, informing that an intrusion has been found here, end the current round of detection, and go to step 31 to continue Collect network data packets; The central node collects new intrusion sample feature flow: Step 41: The new-type intrusion sample receiver receives the detected attack data submitted by other nodes or the cooperative request service agent on the local machine, and submits the data to the integrated detector, Step 42: The integrated detector detects the data, if the detection result is also an attack, the process ends; otherwise, enter the next step, Step 43: The integrated detector connects to the intrusion sample signature database of the central node, and checks whether there is an attack signature sample matching the data in the signature database. If there is, the process ends; if not, it is regarded as a newly discovered intrusion, and enters Next step, Step 44: store the feature of the attack sample in the central node intrusion sample feature library; The central node provides collaborative detection service process: Step 51: The collaborative request service agent receives a suspicious sample and a collaborative service request from a common node, Step 52: The collaborative request service agent broadcasts the suspected data and collaborative computing requirements to all common nodes connected to this node, Step 53: The cooperative request service agent receives the calculation results returned by all the responding nodes and submits them to the cooperative intrusion analysis engine, Step 54: The cooperative intrusion analysis engine counts the cooperative detection results of each response node submitted to it by the cooperative request service agent, if the suspected data is judged as the number of attacking nodes is greater than or equal to the number of normal nodes num(attack)> ＝num(normal), it is judged as an attack, otherwise it is judged as normal, Step 55: The collaborative intrusion analysis engine returns the judgment result to the cooperative request service agent, Step 56: The collaborative request service agent checks the received result, if it is normal, it will return it directly to the node that issued the collaborative service request; if it is abnormal, in addition to returning the result to the node that issued the collaborative service request, it will also be confirmed as an attack The data samples are sent to the local new intrusion sample receiver, and the report discovers a new intrusion. 2. A kind of collaborative learning intrusion detection method applied to data grid according to claim 1, characterized in that the functional components of the central node intrusion detection module mainly include central node local data collectors, new intrusion sample receivers, collaborative Request service agent, central node data preprocessing and format converter, central node local integrated intrusion analysis engine, central node intrusion sample feature library, collaborative intrusion analysis engine, central node new intrusion sample sender, central node response alarm device; common node The functional components of the intrusion detection module mainly include common node local data collectors, common node data preprocessing and format converters, common node local intrusion analysis engines, common node local intrusion sample signature databases, common node new intrusion sample transmitters, collaborative communication The server and ordinary nodes respond to the alarm.

Images