CN115242544B - Network security situation awareness method and system based on improved Res2net - Google Patents

Abstract

The invention relates to a network security situation awareness method and a system based on an improved Res2net, wherein the method comprises the following steps: acquiring network traffic data and preprocessing the network traffic data; introducing a first global-local feature extraction module between a first hierarchy and a second hierarchy of a Res2net model, and introducing a second global-local feature extraction module between the second hierarchy and a third hierarchy of the Res2net model to obtain an improved Res2net model; and inputting the preprocessed network traffic data into the improved Res2net model for feature classification, and analyzing the network security situation according to classification results. The network traffic data can be extracted in depth space-time characteristics by improving the Res2net model, and the accuracy of network security situation awareness can be improved.

Description

Network security situation awareness method and system based on improved Res2net

technical field

The invention relates to the technical field of network security situational awareness, in particular to a network security situational awareness method and system based on improved Res2net.

Background technique

With the vigorous development of 5G technology, the Internet and the continuous turmoil of today's international situation, various network security threats emerge in endlessly. In view of the characteristics of huge amount of network data, various data formats, many feature dimensions, and complex nonlinear relationship of features, network security situational awareness technology puts forward higher requirements accordingly. In the early research, most scholars used the traditional network security situational awareness method, using mathematical models, probability statistics and other methods to analyze the network situation. However, the traditional method has slow operation speed and robust classification in the face of high-volume and high-dimensional data. The disadvantage of poor sex. Therefore, the present invention proposes a network security situation awareness method and system based on improved Res2net.

Contents of the invention

The purpose of the present invention is to provide a network security situational awareness method and system based on the improved Res2net, based on the improved Res2net model, deep spatio-temporal feature extraction can be performed on network traffic data, and the accuracy of network security situational awareness can be improved.

To achieve the above object, the present invention provides the following scheme:

A network security situation awareness method based on improved Res2net, including:

Obtaining network traffic data and preprocessing the network traffic data;

A first global-local feature extraction module is introduced between the first layer and the second layer of the Res2net model, and a second global-local feature is introduced between the second layer and the third layer of the Res2net model The feature extraction module obtains an improved Res2net model; the first global-local feature extraction module and the second global-local feature extraction module are all used to extract deep spatio-temporal features in the network traffic data;

Using the preprocessed network traffic data to train the improved Res2net model to obtain a trained model, and using the trained model to perform network security situation awareness on the network traffic data to be tested.

A network security situation awareness system based on improved Res2net, including:

A data processing module, configured to acquire network traffic data and preprocess the network traffic data;

A model building block for introducing a first global-local feature extraction module between the first layer and the second layer of the Res2net model, between the second layer and the third layer of the Res2net model Introducing a second global-local feature extraction module to obtain an improved Res2net model; both the first global-local feature extraction module and the second global-local feature extraction module are used to extract deep spatiotemporal features in the network traffic data ;

The network security situation awareness module is used to train the improved Res2net model by using the preprocessed network traffic data to obtain a trained model, and use the trained model to perform network security situation awareness on the network traffic data to be tested.

According to the specific embodiments provided by the invention, the invention discloses the following technical effects:

The present invention relates to a network security situation awareness method and system based on improved Res2net, comprising: acquiring network traffic data and preprocessing the network traffic data; introducing The first global-local feature extraction module introduces a second global-local feature extraction module between the second layer and the third layer of the Res2net model to obtain an improved Res2net model; preprocessed network traffic The data is input into the improved Res2net model to obtain the result of network security situational awareness. By improving the Res2net model to extract deep spatiotemporal features of network traffic data, the accuracy of network security situational awareness can be improved.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is a flow chart of a network security situation awareness method based on improved Res2net provided by Embodiment 1 of the present invention;

Fig. 2 is the structural diagram of the improved Res2net model provided by Embodiment 1 of the present invention;

FIG. 3 is a structural diagram of the global-local feature extraction module provided by Embodiment 1 of the present invention;

FIG. 4 is a structural diagram of a residual module provided by Embodiment 1 of the present invention;

Fig. 5 is the training flowchart of the improved Res2net model provided by Embodiment 1 of the present invention;

FIG. 6 is a block diagram of a network security situation awareness system based on improved Res2net provided by Embodiment 2 of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The purpose of the present invention is to provide a network security situation awareness method and system based on improved Res2net. From the perspective of time and space, by constructing an improved Res2net model, mining the feature correlation information of time and space dimensions, the extraction level is higher, and the expression Classification features that are more specific and representative of categories, thereby improving the accuracy and robustness of network security situational awareness.

In order to make the above objects, features and advantages of the present invention more comprehensible, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

Example 1

As shown in Figure 1, the present embodiment provides a network security situation awareness method based on improved Res2net, including:

S1: Obtain network traffic data and preprocess the network traffic data; in this embodiment, the UNSW-NB15 data set is processed, and the processing operations include: data blank value deletion and filling, data normalization, character type Features undergo one-hot encoding and data slicing operations.

Specifically, step S1 specifically includes:

S11: Clean the network traffic data, and remove the data rows whose blank value occupancy rate is higher than the preset value; for example, the three columns of ct_flw_http_mthd, is_ftp_login and ct_ftp_cmd have more blank values, which affects the classification effect. Delete meaningless columns such as srcip, sport, dstip, and dsport in the dataset.

S12: standardize the numerical data in the cleaned data;

S13: performing a one-hot encoding operation on the character data in the standardized data;

S14: Perform slice processing on the one-hot encoded data to obtain multiple data slices; each of the data slices includes N characteristic variables.

Step S14 specifically includes:

Set the sliding window hyperparameter T. The parameter T can be set to 4 or any value.

Use the sliding window to move the window with a preset step size (can be set to 1 or other arbitrary values), and divide the one-hot encoded data into multiple data slices (the size of the data slice is T×N); for example:

Wherein, X represents the preprocessed network traffic data; X _t represents the tth data piece; t=1, 2, . . . , T; n=1, 2, . . . , N.

Taking the parameter T as 4, the step size as 1, and the number of characteristic variables N as 199 as an example, a data slice with a size of 4×199 is obtained.

Adjust the dimension of each data slice to obtain the adjusted data slice; specifically, convert each split data slice into a tensor size of (1×T×N), and the data of the adjusted data slice The format is suitable for the improved Res2net model, that is, the adjusted data slice is the data tensor required by the improved Res2net model (deep learning framework).

S2: Introduce the first global-local feature extraction module GLM1 between the first layer Layer1 and the second layer Layer2 of the Res2net model, between the second layer Layer2 and the third layer Layer3 of the Res2net model The second global-local feature extraction module GLM2 is introduced to obtain an improved Res2net model. As shown in Figure 2, the Res2Net model is used as the basic model when constructing the network security situational awareness model, and the key point is to introduce two global-local feature extraction modules on the basis of the traditional Res2Net model structure. Among them, each layer of the Res2net model contains a fixed number of residual modules, and the structure of the residual modules is shown in Figure 3. The Res2net model contains four layers, and the proposed global-local feature extraction module is a module connected in series between the first layer and the second layer, and a module connected in the middle of the second layer and the third layer.

Both the first global-local feature extraction module GLM1 and the second global-local feature extraction module GLM2 are used to extract deep spatiotemporal features in the network traffic data. Specifically, as shown in Figure 4, the first global-local feature extraction module GLM1 includes a global branch unit, a local branch unit, a feature merging operation layer and a first convolutional layer Conv1; the second global-local feature extraction Module GLM2 has the same structure as the first global-local feature extraction module GLM1;

The global branch unit includes a second convolutional layer Conv2, a vertical pooling layer, a horizontal pooling layer, and a Hadamard product operation layer;

The input end of the second convolutional layer Conv2 is connected to the output end of the first layered Layer1 or the second layered Layer2, and the output end of the second convolutional layer Conv2 is connected to the vertical pooling layer. The input terminal and the input terminal of the horizontal pooling layer; the output terminal of the vertical pooling layer and the output terminal of the horizontal pooling layer are connected to the Hadamard product operation layer;

The local branch unit includes a third convolutional layer Conv3 and a fourth convolutional layer Conv4 connected in series;

The input end of the third convolutional layer Conv3 is connected to the output end of the first layered Layer1 or the second layered Layer2, and the output end of the fourth convolutional layer Conv4 is connected to the Hadamard product operation layer The output terminals of the feature combination operation layer are all connected to the feature combination operation layer; the output terminals of the feature combination operation layer are connected to the input terminal of the second layer Layer2 or the input terminal of the third layer Layer3.

When building an improved Res2net model, a convolution layer + normalization layer + activation function layer is also set before the model. The size of the convolution kernel is 1×1, and the number of output channels is 16. The reason for the implementation is to expand the input feature map channel to 16 channels, so as to better match the Res2net network model.

S3: Using the preprocessed network traffic data to train the improved Res2net model to obtain a trained model, and using the trained model to perform network security situation awareness on the network traffic data to be tested.

In step S3, using the trained model to perform network security situational awareness on the network traffic data to be tested specifically includes:

(1) inputting the network traffic data to be tested into the first layered Layer1 of the trained model for processing to obtain a first feature map;

(2) Input the first feature map to the first global-local feature extraction module GLM1 for feature extraction to obtain a second feature map.

Wherein, as shown in FIG. 4, the first feature map is input to the first global-local feature extraction module GLM1 for feature extraction to obtain a second feature map, which specifically includes:

Inputting the first feature map to the second convolutional layer Conv2 for dimensionality reduction;

Perform vertical stripe pooling on the feature map after the first dimension reduction process through the vertical pooling layer and the horizontal pooling layer (global extraction of the feature variable information contained in each column of the feature map) and horizontal stripe pooling (global extraction of the time feature information contained in each row of the feature map) to obtain the first branch feature map and the second branch feature map;

Performing a Hadamard product operation on the first branch feature map and the second branch feature map through the Hadamard product operation layer to obtain a feature map output by the global branch;

The first feature map is subjected to dimensionality reduction processing through the third convolutional layer Conv3, and the feature map after the second dimensionality reduction processing is subjected to local feature extraction through the fourth convolutional layer Conv4 to obtain a local branch output feature map;

The feature map output by the global branch and the feature map output by the local branch are combined through the feature merging operation layer, and then dimensionality reduction is performed through the first convolutional layer Conv1 to obtain the second feature picture.

(3) input the second feature map to the second layered Layer2 for processing and then input it to the second global-local feature extraction module GLM2 for feature extraction to obtain a third feature map;

(4) The third feature map is sequentially input to the fully connected layer (FCLayer) and Softmax layer after passing through the third layered Layer3 and the fourth layered Layer4 of the Res2net model for feature classification, and according to The classification results analyze the network security situation.

In step S3, as shown in Figure 5, when using the preprocessed network traffic data to train the improved Res2net model (the neural network model in Figure 5), the preprocessed network traffic data is divided into a training set and a test set The improved Res2net model is trained by the training set input, parameters such as optimizer, loss function, learning rate and Batchsize are set, in the present embodiment, the optimizer is set as Adam, the loss function is a cross-entropy loss function, and the learning rate is set to 0.0001, The batchsize is set to 512, and the parameter settings can be adjusted according to the needs. There is no limitation here, and the parameters of the Res2net model will be improved after training. After the training is completed, input the test set into the trained model to analyze and evaluate the network security situation.

In this embodiment, the constructed global-local feature extraction module can effectively extract data time and space dimension feature information, and can deeply mine data feature space information while effectively retaining data time feature information. The hybrid model of extracting data spatial features and using LSTM to extract temporal features is more concise and efficient. And it can use pure convolutional network to replace the temporal feature extraction process of LSTM, which effectively improves the accuracy and robustness of the model.

Example 2

As shown in Figure 6, the present embodiment provides a network security situational awareness system based on improved Res2net, including:

A data processing module M1, configured to acquire network traffic data and preprocess the network traffic data;

The data processing module M1 specifically includes:

The cleaning sub-module M11 is used to clean the network traffic data, and remove the data rows whose blank value occupancy rate is higher than the preset value;

The standardization processing sub-module M12 is used to standardize the numerical data in the cleaned data;

The encoding sub-module M13 is used to perform one-hot encoding operation on the character data in the standardized processed data;

The slicing sub-module M14 is configured to perform slicing processing on the one-hot encoded data to obtain multiple data slices; each of the data slices includes N characteristic variables.

The slicing sub-module M14 specifically includes:

The hyperparameter setting unit is used to set the sliding window hyperparameter T;

A segmentation unit, configured to use a sliding window to move the window at a preset step distance, and segment the one-hot encoded data into multiple data slices;

A dimension adjustment unit, configured to perform dimension adjustment on each data slice to obtain an adjusted data slice; the adjusted data slice is the data tensor required by the improved Res2net model.

The model construction module M2 is used to introduce the first global-local feature extraction module GLM1 between the first layer Layer1 and the second layer Layer2 of the Res2net model, and the second layer Layer2 and the first layer of the Res2net model The second global-local feature extraction module GLM2 is introduced between the three layers of Layer3 to obtain an improved Res2net model;

The network security situation awareness module M3 is used to use the preprocessed network traffic data to train the improved Res2net model to obtain a trained model, and use the trained model to perform network security situation awareness on the network traffic data to be tested.

The network security situation awareness module M3 specifically includes:

A first feature map acquisition submodule, configured to input the network traffic data to be tested into the first layer Layer1 of the trained model for processing to obtain a first feature map;

The second feature map acquisition submodule is used to input the first feature map to the first global-local feature extraction module GLM1 for feature extraction to obtain a second feature map;

The third feature map acquisition sub-module is used to input the second feature map to the second layer Layer2 for processing and then input it to the first global-local feature extraction module GLM2 for feature extraction to obtain a third feature picture;

The network security situation awareness sub-module is used to sequentially input the third feature map through the third layer Layer3 and the fourth layer Layer4 of the Res2net model to the fully connected layer and the Softmax layer for feature classification , and analyze the network security situation according to the classification results.

As for the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

In this paper, specific examples have been used to illustrate the principle and implementation of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; meanwhile, for those of ordinary skill in the art, according to the present invention Thoughts, there will be changes in specific implementation methods and application ranges. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (6)

1. A network security situation awareness method based on an improved Res2net, comprising:

acquiring network traffic data and preprocessing the network traffic data;

introducing a first global-local feature extraction module between a first hierarchy and a second hierarchy of a Res2net model, and introducing a second global-local feature extraction module between the second hierarchy and a third hierarchy of the Res2net model to obtain an improved Res2net model; the first global-local feature extraction module and the second global-local feature extraction module are both used for extracting depth space-time features in the network traffic data;

training the improved Res2net model by using the preprocessed network traffic data to obtain a trained model, and sensing network security situation of the network traffic data to be tested by using the trained model;

preprocessing the network traffic data, specifically including:

cleaning the network flow data, and removing data lines with blank value occupation ratio higher than a preset value;

carrying out standardization processing on numerical data in the cleaned data;

performing single-heat encoding operation on character data in the standardized data;

slicing the data subjected to the single-heat coding to obtain a plurality of data sheets; each data slice comprises N characteristic variables;

slicing the data subjected to the single-heat encoding to obtain a plurality of data pieces, wherein the slicing comprises the following steps:

setting a sliding window super parameter T;

moving a window by utilizing a sliding window at a distance of a preset step length, and dividing the data subjected to the single-heat coding into a plurality of data pieces;

performing dimension adjustment on each data sheet to obtain adjusted data sheets; the adjusted data slice is the data tensor required by the improved Res2net model.

2. The method of claim 1, wherein the first global-local feature extraction module comprises a global branching unit, a local branching unit, a feature merge operation layer, and a first convolution layer; the second global-local feature extraction module has the same structure as the first global-local feature extraction module;

the global branch unit comprises a second convolution layer, a longitudinal pooling layer, a transverse pooling layer and a Hadamard product operation layer;

the input end of the second convolution layer is connected with the output end of the first layering or the second layering, and the output end of the second convolution layer is connected with the input end of the longitudinal pooling layer and the input end of the transverse pooling layer; the output end of the longitudinal pooling layer and the output end of the transverse pooling layer are connected with the Hadamard product operation layer;

the local branch unit comprises a third convolution layer and a fourth convolution layer which are connected in series;

the input end of the third convolution layer is connected with the output end of the first layering or the second layering, and the output end of the fourth convolution layer and the output end of the Hadamard product operation layer are both connected with the characteristic merging operation layer; and the output end of the characteristic merging operation layer is connected with the input end of the second layer or the input end of the third layer.

3. The method according to claim 2, wherein the network security situation awareness for the network traffic data to be tested by using the trained model specifically includes:

inputting the network traffic data to be tested into the first layering of the trained model for processing to obtain a first feature map;

inputting the first feature map to the first global-local feature extraction module for feature extraction to obtain a second feature map;

inputting the second feature map to the second hierarchical layer for processing, and then inputting the second feature map to the second global-local feature extraction module for feature extraction to obtain a third feature map;

and sequentially inputting the third feature map to a full-connection layer and a Softmax layer after sequentially passing through the third layering and a fourth layering of the Res2net model to perform feature classification, and analyzing the network security situation according to classification results.

4. A method according to claim 3, wherein the inputting the first feature map into the first global-local feature extraction module performs feature extraction to obtain a second feature map, specifically includes:

inputting the first feature map to the second convolution layer for dimension reduction;

performing longitudinal strip pooling and transverse strip pooling on the feature map subjected to the first dimension reduction treatment through the longitudinal pooling layer and the transverse pooling layer to obtain a first branch feature map and a second branch feature map;

carrying out Hadamard product operation on the first branch characteristic diagram and the second branch characteristic diagram through the Hadamard product operation layer to obtain a characteristic diagram of global branch output;

performing dimension reduction processing on the first feature map through the third convolution layer, and performing local feature extraction on the feature map subjected to the second dimension reduction processing through the fourth convolution layer to obtain a feature map of local branch output;

and carrying out feature combination on the feature map of the global branch output and the feature map of the local branch output through the feature combination operation layer, and then carrying out dimension reduction processing through the first convolution layer to obtain the second feature map.

5. A network security posture awareness system based on an improved Res2net, comprising:

the data processing module is used for acquiring network flow data and preprocessing the network flow data;

the data processing module specifically comprises:

the cleaning submodule is used for cleaning the network flow data and removing data lines with the blank value occupancy rate higher than a preset value;

the standardized processing submodule is used for carrying out standardized processing on numerical data in the cleaned data;

the coding sub-module is used for performing single-heat coding operation on character type data in the standardized data;

the slicing submodule is used for slicing the data subjected to the single-heat coding to obtain a plurality of data slices; each data slice comprises N characteristic variables;

the slicing submodule specifically comprises:

the super parameter setting unit is used for setting a sliding window super parameter T;

the splitting unit is used for moving the window by utilizing the sliding window at a distance of a preset step length and splitting the data subjected to the single-heat coding into a plurality of data pieces;

the dimension adjustment unit is used for carrying out dimension adjustment on each data sheet to obtain adjusted data sheets; the adjusted data sheet is the data tensor required by the improved Res2net model;

the model construction module is used for introducing a first global-local feature extraction module between a first layering and a second layering of the Res2net model, and introducing a second global-local feature extraction module between the second layering and a third layering of the Res2net model to obtain an improved Res2net model; the first global-local feature extraction module and the second global-local feature extraction module are both used for extracting depth space-time features in the network traffic data;

the network security situation awareness module is used for training the improved Res2net model by utilizing the preprocessed network traffic data to obtain a trained model, and performing network security situation awareness on the network traffic data to be detected by utilizing the trained model.

6. The system of claim 5, wherein the network security posture awareness module specifically comprises:

the first feature map acquisition sub-module is used for inputting the network traffic data to be tested into the first layering of the trained model for processing to obtain a first feature map;

the second feature map acquisition sub-module is used for inputting the first feature map to the first global-local feature extraction module for feature extraction to obtain a second feature map;

the third feature map obtaining sub-module is used for inputting the second feature map into the second hierarchical layer for processing and then inputting the second feature map into the second global-local feature extraction module for feature extraction to obtain a third feature map;

and the network security situation awareness submodule is used for sequentially inputting the third characteristic diagram to the full-connection layer and the Softmax layer after sequentially passing through the third layering and the fourth layering of the Res2net model to conduct characteristic classification, and analyzing the network security situation according to classification results.

Images