WO2021196911A1 - 基于人工智能的网络安全防护方法、装置、电子设备 - Google Patents

基于人工智能的网络安全防护方法、装置、电子设备 Download PDF

Info

Publication number
WO2021196911A1
WO2021196911A1 PCT/CN2021/077170 CN2021077170W WO2021196911A1 WO 2021196911 A1 WO2021196911 A1 WO 2021196911A1 CN 2021077170 W CN2021077170 W CN 2021077170W WO 2021196911 A1 WO2021196911 A1 WO 2021196911A1
Authority
WO
WIPO (PCT)
Prior art keywords
access traffic
traffic
data
session
attack
Prior art date
Application number
PCT/CN2021/077170
Other languages
English (en)
French (fr)
Inventor
彭晨晨
陈国�
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2021196911A1 publication Critical patent/WO2021196911A1/zh
Priority to US17/702,766 priority Critical patent/US20220224706A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/047—Probabilistic or stochastic networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/08—Learning-based routing, e.g. using neural networks or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/72—Routing based on the source address
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2483—Traffic characterised by specific attributes, e.g. priority or QoS involving identification of individual flows
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/20—Support for services
    • H04L49/208—Port mirroring

Definitions

  • This application relates to artificial intelligence and network technology, and in particular to an artificial intelligence-based network security protection method, device, electronic equipment, and computer-readable storage medium.
  • AI Artificial Intelligence
  • Hypertext Transfer Protocol in related technologies uses clear text to transmit information, and there is a risk of eavesdropping and tampering.
  • HTTP HyperText Transfer Protocol over Secure Socket Layer
  • HTTP HyperText Transfer Protocol over Secure Socket Layer
  • HTTP HyperText Transfer Protocol over Secure Socket Layer
  • HTTP raise and use the secure socket layer for encrypted information interaction, providing identity verification, information confidentiality and integrity verification functions.
  • security requirements and some policy mandatory requirements more and more
  • the network service actively or passively switches its own service from HTTP to HTTPS, which brings higher security to data transmission, but also gives hackers an opportunity to use the HTTPS protocol to transmit encrypted messages on the network.
  • the content detection technology in the technology has lost its effect. Due to the huge resource consumption of processing HTTPS connections, the attack cost is low, but the damage is greater.
  • the embodiments of the present application provide a network security protection method, device, electronic device, and computer-readable storage medium based on artificial intelligence, which can realize the identification and cleaning of encrypted attack traffic and unencrypted attack traffic.
  • the embodiment of the present application provides a network security protection method based on artificial intelligence, the method is executed by an electronic device, and the method includes:
  • the source address of the attack access traffic is obtained, and the attack access traffic sent to the target network address and from the source address is shielded.
  • the embodiment of the present application provides an artificial intelligence-based network security protection device, the device includes:
  • the traffic acquisition module is used to acquire the access traffic to be protected sent to the target network address
  • the data extraction module is configured to extract the data statistical characteristics of each session for the multiple sessions included in the access traffic to be protected;
  • the traffic classification module is configured to call a neural network model to classify each session as normal or abnormal based on the statistical characteristics of the data of each session;
  • a traffic identification module configured to identify sessions classified as abnormal in the access traffic to be protected as attack access traffic
  • the traffic cleaning module is configured to obtain the source address of the attack access traffic, and perform shielding processing on the attack access traffic sent to the target network address and from the source address.
  • An embodiment of the present application provides an electronic device, and the electronic device includes:
  • Memory used to store executable instructions
  • the processor is configured to implement the artificial intelligence-based network security protection method provided in the embodiment of the present application when executing the executable instructions stored in the memory.
  • the embodiment of the present application provides a computer-readable storage medium storing executable instructions, which are used to implement the artificial intelligence-based network security protection method provided by the embodiment of the present application when executed by a processor.
  • the characteristics of the data statistics level are obtained, and the attack access traffic is not dependent on the characteristics of the information level. Therefore, the identification is not affected by whether the traffic packets are encrypted or not, so that compatible encryption and encryption can be achieved.
  • the identification of unencrypted attack access traffic can be shielded based on the source address of the attack access traffic to realize the cleaning of various access traffic (including encrypted and unencrypted attack access traffic), which improves the protection efficiency.
  • FIG. 1 is a schematic diagram of the architecture of an application system of an artificial intelligence-based network security protection method provided by an embodiment of the present application;
  • FIG. 2 is a schematic structural diagram of a security server 200 applying an artificial intelligence-based network security protection method provided by an embodiment of the present application;
  • 3A-3C are schematic flowcharts of the artificial intelligence-based network security protection method provided by the embodiments of the present application.
  • FIG. 4 is a diagram of the neural network model training architecture in the artificial intelligence-based network security protection method provided by an embodiment of the application;
  • FIG. 5 is a schematic diagram of packet capture in an artificial intelligence-based network security protection method provided by an embodiment of the present application
  • FIG. 6 is a neural network model architecture diagram of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • FIG. 7 is a diagram of the deployment architecture of the protection system of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of process communication of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • CC Challenge Collapsar
  • the principle of the CC attack is that the attacker controls some hosts to send a large number of data packets to the other server, causing the server resources to be exhausted, until the crash, CC is mainly used Attacking the page, when the number of people visiting a webpage is particularly large, the speed of opening the webpage will slow down. CC is to simulate multiple users constantly accessing those pages that require a large amount of data operations, resulting in a waste of server resources. The processor is in a 100% occupied state for a long time, and there will always be unfinished connections until network congestion is caused, and normal access is suspended.
  • DDoS Distributed Denial of Service
  • HTTPS CC HyperText Transfer Protocol
  • HTTPS Hypertext Transfer Protocol
  • SSL Secure Sockets Layer
  • Shielding intercepting, partially discarding, delaying forwarding or redirecting access traffic from a specific source address, so that the access traffic from a specific source address cannot be accessed or is difficult to access the protected target network address, thereby giving up the attack.
  • Network service provider In the network architecture, the client's access to the target address is routed through the egress of network service providers such as China Unicom and China Telecom.
  • the network service provider is an entity that provides network access functions to subscribers.
  • Traffic cleaning distinguish normal traffic from malicious traffic, intercept malicious traffic and inject normal traffic back into the target network address to ensure that the target network address can be accessed normally.
  • HTTPS HyperText Transfer Protocol
  • TLS Transport Layer Security
  • the HTTPS protocol transmits encrypted messages on the network.
  • the content detection technology in related technologies has lost its effect. Due to the huge resource consumption of processing HTTPS connections, the cost of HTTPS DDoS attacks is increased. It is relatively low, but it is more harmful. For this reason, it is necessary to provide a network security protection scheme without decryption.
  • the artificial intelligence-based network security protection method uses a neural network model to check the cipher suite, group content, packet length, cipher suite length, group length, extension length and extension The distribution and value of the number are learned to realize the identification of HTTPS attack traffic without decryption, which shows a good protection effect in multiple attacks.
  • the defense scheme for HTTPS CC attacks in related technologies is to decrypt the encrypted traffic on the one hand, and then extract the attack characteristics from the decrypted plaintext information to identify the attack traffic. On the other hand, it is based on the attack behavior pattern. Analyze, for example, scanning attacks will constantly traverse the resource directory, so the possibility of accessing different uniform resource locators is very high, and the response code obtained is also uncertain, and a large number of non-200 normal responses may appear Code, in the request method, there may also be continuous conversion attempts, such as a request to obtain data from the server, a request to transmit data to the server, an OPTION request, etc.
  • IP Internet Protocol
  • the HTTPS CC protection algorithm in related technologies mainly relies on the decryption of traffic, and its shortcomings are very obvious: 1. It is expensive, and decrypting massive encrypted traffic one by one consumes huge system resources. The consumption of the system to defend against HTTPS is about to defend against HTTP CC. 2. Scenarios are limited. In many scenarios, users do not import certificates into third-party protection equipment, especially public cloud scenarios. As a result, the protection system does not have the ability to decrypt and cannot protect against HTTPS CC attacks; 3. Manslaughter risk. In the recognition scheme based on behavior patterns, the normal user behavior in certain business scenarios is highly similar to the attacker’s behavior, which is prone to misjudgment. At the same time, the user behavior is diverse and changeable. The recognition scheme based on behavior patterns Brings challenges to building user behavior models.
  • HTTPS CC attack traffic is encrypted transmission. Therefore, content-based attack detection and protection solutions in related technologies have encountered bottlenecks. Although protection can still be achieved through decryption, the huge resource consumption of processing HTTPS connections makes HTTPS DDoS attacks more costly. Low, but relatively harmful.
  • the embodiments of this application provide a network security protection method based on artificial intelligence, which is actually a non-decryption identification scheme for HTTPS CC attacks based on convolutional neural networks.
  • the solution can train the neural network model through massive bypass data. After the model training is mature, it has the ability to automatically judge normal traffic and attack traffic.
  • the protection system maintains communication with the neural network model: the protection system receives the data, and Send to the neural network model.
  • the neural network model judges the validity of the data and sends the results to the protection system.
  • the protection system integrates the statistical principles of the captured files (that is, the data preprocessing of the convolutional neural network).
  • the protection system is based on the neural network.
  • the judgment result of the model can block malicious addresses (for example, IP addresses), thereby realizing effective protection against HTTPS CC attacks.
  • the artificial intelligence-based network security protection method provided by the embodiments of this application does not require users to add extra trouble to import certificates It can realize effective and automatic protection against HTTPS CC attacks, and will not have any impact on normal business. It is especially suitable for the cloud enterprise cloud, which has a variety of business types, serious attack threats, and high business importance.
  • the neural network model in the artificial intelligence-based network security protection method has formed a mature HTTPS CC attack without decryption identification protection scheme, and it has shown itself in multiple attacks and defenses on the network. Good cleaning rate.
  • the embodiments of the present application provide a network security protection method, device, electronic device, and computer-readable storage medium based on artificial intelligence, which can solve the technical problems of encrypted attack access traffic and unencrypted attack access traffic identification.
  • the following describes the embodiments of the present application Exemplary applications of the provided electronic devices.
  • the electronic devices provided in the embodiments of the present application can be implemented as notebook computers, tablet computers, desktop computers, set-top boxes, mobile devices (for example, mobile phones, portable music players, personal digital assistants, and dedicated messages).
  • Various types of user terminals, such as devices, portable game devices, etc. can also be implemented as servers. In the following, an exemplary application when the device is implemented as a server will be explained.
  • Figure 1 is a schematic diagram of the architecture of an application system of an artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the target network address network address of the business server 600
  • the terminal 500 generates a webpage access request corresponding to the target network address
  • the webpage access request sent to the business server 600 is carried on the access traffic to be sent to the network
  • the service provider 400 and the network service provider 400 send the access traffic to the core router 300, and the core router 300 forwards the access traffic to the network address of the service server 600 (that is, the target network address).
  • the security server In order to prevent the presence of attack traffic in the access traffic from attacking the business server, it is necessary to identify and clean the access traffic through the security server, and identify the session that is classified as abnormal in the access traffic to be protected as the attack access traffic, so as to obtain the information of the attack access traffic.
  • the source address is used as a malicious address, and the traffic from the malicious address is shielded, and the normal traffic whose source is not the malicious address is injected back to the core router, and the core router 300 forwards it to the target network address (the network address of the business server 600). ), the service server 600 carries the access result on the return traffic, and returns the return traffic to the terminal 500 through the network service provider 600, and the webpage access result is displayed in the terminal 500.
  • the network service provider 600 sends the access traffic to the core router 300, and the core router forwards the access traffic to the network address (that is, the target network address) of the service server 600.
  • the access traffic needs to be identified and cleaned by the security server 200.
  • the attack detection system 201 deployed in the security server 200 obtains it from the core router 300 and sends it to the target network.
  • the mirrored traffic formed by copying the access traffic of the address is used as the traffic to be detected.
  • the attack detection system 201 sends an alarm notification to the control system 202, and the control system 202 forwards the alarm notification to the network security protection system 203.
  • the security protection system 203 obtains the mirrored traffic of the access traffic from the core router 300 as the access traffic to be protected.
  • the network security protection system 203 extracts data from the access traffic to be protected, and communicates with the neural network model through the network security process in the network security protection system 203.
  • the neural network model extracts the hidden layer features from the data statistics of each session, and classifies each session of the network security protection system as normal or abnormal based on the hidden layer features of the network security protection system, and analyzes the access traffic to be protected
  • the session classified as abnormal in the network is identified as attack access traffic, and the source address of the attack access traffic is obtained as a malicious address.
  • the cleaning system 2031 in the network security protection system 203 pulls the access traffic from the core router 300, and then The attack traffic of the malicious address is shielded, and the normal traffic whose source is not the malicious address is injected back to the core router 300, and the core router 300 forwards it to the target network address.
  • the security server 200 may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or it may provide cloud services, cloud databases, cloud computing, cloud functions, and cloud storage. , Network services, cloud communications, middleware services, domain name services, security services, CDN, and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms.
  • FIG. 2 is a schematic structural diagram of a security server 200 applying an artificial intelligence-based network security protection method according to an embodiment of the present application.
  • the security server 200 shown in FIG. 2 includes: at least one processor 210, a memory 250, and at least A network interface 220.
  • the various components in the security server 200 are coupled together through the bus system 240.
  • the bus system 240 is used to implement connection and communication between these components.
  • the bus system 240 also includes a power bus, a control bus, and a status signal bus. However, for clear description, various buses are marked as the bus system 240 in FIG. 2.
  • the processor 210 may be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, or discrete hardware Components, etc., where the general-purpose processor may be a microprocessor or any conventional processor.
  • DSP Digital Signal Processor
  • the memory 250 may be removable, non-removable, or a combination thereof.
  • Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, and so on.
  • the memory 250 optionally includes one or more storage devices that are physically remote from the processor 210.
  • the memory 250 includes volatile memory or non-volatile memory, and may also include both volatile and non-volatile memory.
  • the non-volatile memory may be a read only memory (ROM, Read Only Memory), and the volatile memory may be a random access memory (RAM, Random Access Memory).
  • ROM read only memory
  • RAM Random Access Memory
  • the memory 250 described in the embodiment of the present application is intended to include any suitable type of memory.
  • the memory 250 can store data to support various operations. Examples of these data include programs, modules, and data structures, or a subset or superset thereof, as illustrated below.
  • the operating system 251 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;
  • the network communication module 252 is used to reach other computing devices via one or more (wired or wireless) network interfaces 220.
  • Exemplary network interfaces 220 include: Bluetooth, Wireless Compatibility Authentication (WiFi), and Universal Serial Bus ( USB, Universal Serial Bus), etc.
  • the device provided in the embodiments of the present application can be implemented in software.
  • Figure 2 shows an artificial intelligence-based network security protection device 255 stored in a memory 250, which can be software in the form of programs and plug-ins. , Including the following software modules: flow acquisition module 2551, data extraction module 2552, flow classification module 2553, flow identification module 2554, flow cleaning module 2555, and training module 2556. These modules are logical and can be performed according to the implemented functions. Any combination or further split, the function of each module will be explained below.
  • FIG. 3A is a schematic flowchart of an artificial intelligence-based network security protection method provided by an embodiment of the present application, which will be described in conjunction with the steps shown in FIG. 3A.
  • step 101 the server obtains the access traffic to be protected sent to the target network address.
  • a network security protection system is deployed in the server.
  • the security protection process in the network security protection system obtains the access traffic to be protected sent to the target network address.
  • the target network address is the protected network address, and attack detection is also deployed in the server.
  • the attack detection system actually performs coarse-grained attack detection on the to-be-detected access traffic sent to the target network address.
  • the attack detection system before performing step 101, obtains the access traffic to be detected sent to the target network address from the router, and the access traffic to be detected is the mirrored traffic formed by copying the access traffic sent to the target network address;
  • the access traffic is detected to perform attack behavior pattern matching.
  • the attack behavior is matched, it is determined that the access traffic to be protected sent to the target network address needs to be obtained, and the attack access traffic in the access traffic to be protected is identified based on the neural network model.
  • the process of forward routing of the access traffic will not be affected, thereby preventing communication delay and effectively improving the communication speed.
  • the network security protection system classifies the access traffic to be protected based on the neural network model.
  • the network security protection system classifies the sessions in the access traffic to be protected, and identifies the attack traffic composed of abnormal sessions. Detecting access traffic is the object of attack detection by the attack detection system based on the attack behavior pattern. The attack detection system identifies whether there is an attack in the access traffic to be detected. It is only a qualitative analysis of the access traffic to be detected. It is a kind of comparison based on neural network. Model recognition is a more coarse-grained recognition process. Attack detection can be based on behavioral mode detection. The core router uses light splitting to copy the access traffic sent to the target network address and forwards the mirrored traffic to the attack detection system. Perform attack detection.
  • the attack detection system When the attack detection system matches and detects the attack, it will generate and send an alarm to the control system.
  • the protection system receives the alarm from the control system and determines that it needs to obtain the access traffic to be protected sent to the target network address to be based on
  • the neural network model identifies the attack access traffic in the access traffic to be protected.
  • the access traffic to be protected and the access traffic to be detected can be access traffic that occurs in the same time period, or access traffic that occurs in different time periods (ie, staggered time), depending on the router’s data caching strategy, that is, the router’s
  • the cache time of the received access traffic Specifically, when the cache time of the access traffic received by the router exceeds the time spent in attack detection, the access traffic to be protected and the access traffic to be detected can be access traffic that occurs in the same time period.
  • the access traffic to be protected is the access traffic that occurs during the period after the access traffic to be detected, so as to ensure that the normal traffic can reach the target network address in a short time, and the corresponding forwarding will be performed without waiting for the completion of the attack detection.
  • obtaining the access traffic to be protected sent to the target network address in step 101 can be implemented by the following technical solution: sending a mirroring traffic request to the router, where the mirroring traffic request carries the target network address, so that the router performs the following Operation: When routing the access traffic sent to the target network address, copy the access traffic to obtain the mirrored traffic of the access traffic, where the access traffic includes the network request sent by the subscriber of the network service provider to the target network address; the receiving router The sent mirrored traffic is used as the access traffic to be protected.
  • the network service provider is an entity that provides network access functions to subscribers.
  • the network security protection system can send a mirrored traffic request to the router to obtain the mirrored traffic as the access traffic to be protected:
  • the function of network address for security protection is just activated, there is no source address data of the attack access traffic in the network security protection system; the source address of the attack access traffic exceeds the validity period, that is, it loses timeliness, and thus has no protective meaning;
  • the ratio of the number of source addresses to the number of times the target network address was attacked is less than the ratio threshold, indicating that there are potentially offensive source addresses that have not been discovered; the number of source addresses of attack access traffic is less than the number threshold, and the number threshold can be the entire network.
  • the average value of the number of addresses in the attack access traffic of the protected address indicates that the number of detected source addresses has not reached the average level of the entire network.
  • the mirrored traffic is regarded as the access traffic to be protected, which belongs to the bypass monitoring mode.
  • the bypass deployment plan is The monitoring mode that has the least impact on the current network will not affect the existing network structure and will not cause any impact on the network speed.
  • Bypass mode analyzes the data copied from the mirror port, and will not cause delay to the original data packet.
  • the obtaining of the access traffic to be protected sent to the target network address in step 101 can be achieved by the following technical solution: sending a traction routing rule to the router, where the traction routing rule carries the target network address and the traction target network address , So that the router performs the following operations: direct the access traffic sent to the target network address to the traction target network address, where the access traffic includes the network request sent to the target network address by the subscribers of the network service provider; the receiving router directs to the traction target network address
  • the access traffic of the target network address is used as the access traffic to be protected.
  • Regarding the access traffic as the access traffic to be protected can ensure comprehensive detection, prevent access traffic from malicious addresses from being routed to the business server, and improve the protection quality of network security protection.
  • the target network address is the network address of the network security protection system
  • the network service provider is an entity that provides network access functions to subscribers.
  • Route traction is a technical means to achieve traffic traction, and the essence is to publish a new route.
  • Rule to the router that is, forward the message whose destination address is the target network address to the network security protection system.
  • the network address of the network security protection system is the traction target network address.
  • the new routing rule here is to forward the message from the router to the network security
  • the protection system replaces the original routing rules of the packets in the router.
  • the original routing rules here are used to forward the packets whose destination address is the target network address to the next-hop router normally.
  • the network security protection system can Send access traffic pull request: When the function of security protection for the target network address is just activated, there is no source address data of the attack access traffic in the network security protection system; It is of protective significance; the ratio of the number of source addresses of attack access traffic to the number of times the target network address is attacked is less than the ratio threshold, indicating that there are potentially offensive source addresses that have not been discovered; the number of source addresses of attack access traffic is less than the number threshold ,
  • the number threshold can be the average of the number of addresses in the attack access traffic of the protected addresses in the entire network, indicating that the number of source addresses that have been detected does not reach the average level of the entire network, and the traffic obtained through the traction rule is used as the access traffic to be protected , It can ensure that every data packet is not missed, that is, every data packet is obtained from the core router, and after the attack flow identification of each data packet, the corresponding attack flow shielding and normal flow forwarding behavior are performed.
  • step 102 the server extracts data statistical characteristics of each session for multiple sessions included in the access traffic to be protected.
  • a network security protection system is deployed in the server.
  • the security protection process in the network security protection system can extract the statistical characteristics of each session for multiple sessions included in the access traffic to be protected.
  • the message is transmitted in the form of a data-level statistical analysis of the message received by the router through the security protection process in the network security protection system to obtain data statistical characteristics, which are input into the neural network model for classification.
  • Figure 3B is a schematic flowchart of an artificial intelligence-based network security protection method provided by an embodiment of the present application. It will be described with reference to the steps 1021-1023 shown in Figure 3B. For multiple sessions, extracting the statistical characteristics of the data of each session can be achieved through the following steps 1021-1023.
  • step 1021 for multiple sessions included in the access traffic to be protected, multiple data packets included in each session are extracted.
  • each session contains multiple data packets
  • a session refers to a set of data packets with the same source IP, destination IP, source port, destination port, and protocol.
  • step 1022 extract data features in at least one dimension from the multiple data packets included in each session: the protocol version of the secure socket layer applied during the transmission of the data packet; and the handshake applied during the transmission of the data packet Version; the packet length of the secure socket layer used in the transmission of the data packet; the encryption suite length of the data packet; the encryption suite of the data packet; the group length of the data packet; the group content of the data packet; the extended length of the data packet; the data packet The number of supported extensions.
  • step 1023 the corresponding data statistical features are extracted from the data features of at least one dimension of each session.
  • the corresponding data statistical characteristics are extracted from the data characteristics of at least one dimension of each session, which can be implemented by the following technical solutions to obtain the normal mode of the data characteristics of each dimension in the normal session sample , And the abnormal mode of the data of each dimension in the abnormal conversation sample; determine the distance between the data feature of at least one dimension of each conversation and the normal mode of the corresponding dimension as the normal absolute distance of the corresponding dimension; determine each The distance between the data feature of at least one dimension of the conversation and the abnormal mode of the corresponding dimension is used as the abnormal absolute distance of the corresponding dimension; the normal absolute distance and the abnormal absolute distance of at least one dimension determined for each conversation are combined It is the statistical characteristics of the corresponding session data.
  • the data characteristics of each dimension in the session are used as the data statistical characteristics of the corresponding session, so that the identification of the session type can be realized without the process of encryption and decryption.
  • the basic data characteristics of each message are extracted from the capture file: SSL protocol version, handshake version, SSL packet length, cipher suite length, cipher suite, group length, group content, extension length, support extension Number; through the analysis of the basic data characteristics of each message, the mode of each basic data characteristic gathered in the attack packet and the normal packet is extracted, and these data can be used as the input data of the convolutional neural network, and the SSL of the data packet Protocol version, handshake version, SSL packet length, cipher suite length, cipher suite, group length, group content, extension length, and number of supported extensions are the basic features of the protocol, which can be extracted directly from the packet capture file of the protocol traffic to further understand the basics
  • Data characteristics are the secondary characteristics obtained by statistical analysis, analyze the aggregate value of each basic data characteristic in normal and abnormal conversation samples, that is, the mode, and calculate the absolute distance between the basic characteristic and the mode in the captured file, and pass the protection access The session in the traffic analyzes the characteristics of the data at the statistical level, and does not rely on the characteristics
  • the characteristics of the data statistics level are the data statistics characteristics of the above multiple dimensions, thus It can perform more accurate identification of attack traffic based on the statistical characteristics of data in multiple dimensions.
  • the session samples are obtained by bypassing the packet capture from the router, and the pre-labeled normal session samples and abnormal session samples are combined into a training sample set; the neural network model is initialized and initialized Including the session samples and the loss function of the classification results of the corresponding session samples; the following processing is performed during each iteration of the neural network model: through the neural network model, the session samples included in the training sample set are classified to obtain the corresponding session samples Classification result: Substitute the true category and classification result of the corresponding session sample into the loss function to determine the corresponding neural network model parameters when the loss function obtains the minimum value; update the neural network model according to the determined neural network model parameters.
  • the neural network model includes an embedding layer, a hidden layer, and a fully connected layer.
  • the embedding layer is used as the first layer of the neural network model to fix the input dimensions, and the convolutional layer is used to extract features.
  • the pooling layer in the layer is used to sample features, and the fully connected layer is used to map the learned distributed feature representation to the sample label space as a classifier.
  • the hidden layer also includes a batch normalization layer and random inactivation Layer, convolutional layer, pooling layer, unfolding layer and Gaussian noise layer, the batch normalization layer re-normalizes the activation value of the previous layer on each batch of training sample sets, that is, the mean value of its output data is close to 0, and its standard deviation Close to 1, that is, a normal distribution is formed.
  • the random inactivation layer is used to disconnect the entire 1-dimensional feature map instead of a single neuron. If there is a strong correlation between adjacent elements of a feature map (usually occurs in In the low-level convolutional layer), the ordinary random inactivation (dropout) operation cannot regularize its output, otherwise it will cause a significant drop in the learning rate.
  • the random inactivation layer in the random inactivation layer can help improve the independence between feature maps.
  • the Gaussian noise layer in the hidden layer applies zero mean to the data, and the standard deviation is the additive Gaussian noise of the sample standard deviation. Timely more useful Gaussian noise is a natural choice when it is necessary to destroy the input data.
  • the flattening process in the hidden layer is to flatten the input, that is, to make the multi-dimensional input one-dimensional. It is often used from the convolutional layer to the fully connected layer. After the convolutional neural network is built, the model is trained through massive normal business data and attack data. After the model converges, it will have the ability to automatically identify normal business data and attack data, which is used in the training iteration process See formula (1) for the loss function:
  • t i is the real label, which represents the real category
  • y i is obtained by classification processing through the neural network model
  • H(y, t) is the loss function.
  • the statistical characteristics of each session are sent to the neural network model, so that the neural network model performs classification processing
  • the neural network model can be the process of running the neural network model.
  • the following technical solutions can also be implemented: through the socket connection between the network security protection process and the neural network model, receive the neural network model return Classification results.
  • step 103 the server calls the neural network model to classify each session as normal or abnormal based on the statistical characteristics of the data of each session.
  • a network security protection system is deployed in the server here, and the network security protection process communicates with the neural network model (that is, the process that runs the neural network model).
  • the neural network model includes cascaded embedded layers, hidden layers, and Fully connected layer; in step 103, based on the statistical characteristics of each session, call the neural network model to classify each session as normal or abnormal.
  • the following technical solutions can be executed for each session to perform Classification: Receive the statistical features of the session data through the embedded layer of the neural network model and transmit them to the hidden layer; extract the hidden layer features from the statistical features of the received data through the hidden layer of the neural network model, and transmit them to the full connection Layer; the received hidden layer features are mapped into normal category probabilities and abnormal category probabilities through the fully connected layer of the neural network model; among them, the category corresponding to the larger value of the normal category probability and the abnormal category probability is the classification result of the conversation .
  • the fully connected layer plays the role of a "classifier" in the entire neural network model. If operations such as the convolutional layer and the pooling layer map the original data to the hidden layer feature space, the fully connected layer plays the role of The role of mapping the learned "distributed feature representation" to the sample label space.
  • the fully connected layer can be realized by the convolution operation: the fully connected layer that is fully connected to the previous layer can be transformed into a convolution with a 1x1 convolution kernel; and the fully connected layer that is the convolutional layer in the previous layer can be transformed into The convolution kernel is a global convolution of height x width. The height and width are respectively the height and width of the previous convolution result.
  • the core operation of fully connected is the matrix-vector product. The essence is to linearly transform from one feature space to another feature space. , The fully connected layer often appears in the last few layers, and is used to perform weighted summation processing on the previously involved features.
  • the hidden layer includes: a batch normalization layer, a convolutional layer, and a pooling layer; extracting hidden layer features from the received data statistical characteristics through the hidden layer includes: performing a batch normalization layer on the received data. Standardize the activation values of the statistical features of the data to obtain statistical features that meet the normal distribution; perform feature extraction processing on the statistical features of the data output by the batch normalization layer through the convolutional layer to obtain the convolutional layer features corresponding to the statistical features of the data; Through the pooling layer, the convolutional layer features output by the convolutional layer are sampled and processed to obtain the hidden layer features corresponding to the statistical features of the data.
  • the batch normalization layer re-normalizes the activation value of the previous layer on each batch of training sample sets, so that the mean value of its output data is close to 0, and its standard deviation is close to 1, that is, a normal distribution is formed.
  • the convolutional layer is used for feature extraction to obtain the feature map.
  • the pooling layer compresses the input feature map. On the one hand, the feature map becomes smaller and the network calculation complexity is simplified; In terms of feature compression, the main features are extracted.
  • step 104 the server identifies the session classified as abnormal in the access traffic to be protected as the attack access traffic.
  • a network security protection system is deployed in the server, and the network security protection process in the network security protection system receives the classification results of the neural network, and when the neural network model performs classification, it outputs that each session in the access traffic to be protected belongs to The probability of an abnormal session and the probability of belonging to a normal session. When the probability of belonging to an abnormal session exceeds the probability of belonging to a normal session, the session is classified as an abnormal session and identified as attacking access traffic.
  • step 105 the server obtains the source address of the attack access traffic, and performs shielding processing on the attack access traffic sent to and from the target network address of the source address.
  • the attack access traffic sent to the target network address and from the source address is shielded, which can be achieved by the following technical solutions : Filter the attack access traffic in the access traffic to be protected, send the normal access traffic obtained after filtering to the router, so that the router can forward; send the source address to the router, so that the router will receive the new access traffic from the source address Identify the new attack access traffic, and shield the new attack access traffic; among them, the new access traffic is sent by the network service provider to the target network address after the access traffic to be protected, and the new access traffic includes the contract of the network service provider The network request sent by the user to the target network address.
  • using the traffic obtained through the traction rule as the access traffic to be protected can ensure that every data packet is not missed, that is, every data packet is obtained from the core router, and the attack traffic is identified for each data packet before proceeding.
  • Corresponding attack traffic shielding and normal traffic forwarding behavior although compared with the scheme for identifying mirrored traffic, the network transmission speed of using the traffic obtained through the traction rule as the access traffic to be protected is slightly lower, but it can ensure that it is not missed Any packet of attack traffic.
  • the access traffic to be protected when the access traffic to be protected is guided from the router through the traction routing rule, the access traffic to be protected here is the original traffic that has not been mirrored.
  • the attack access traffic in the access traffic to be protected is filtered, and the The normal access traffic obtained after filtering is sent to the router so that the router forwards it to the next hop router that reaches the target network address.
  • the above process belongs to the re-injection process of normal traffic.
  • the source address obtained is sent to the router. Make the router recognize the new access traffic from the source address as a new attack access traffic, and shield the new attack access traffic. Here you can also not send the source address to the router, but pull the new access traffic from the router to the network again.
  • Security protection system The network security protection system discards the new access traffic from the source address, and sends the new access traffic that is not from the source address to the router, so that the router forwards it to the next hop that reaches the destination network address router.
  • the attack access traffic sent to the target network address and from the source address is shielded, which can be implemented by the following technical solutions:
  • the source address is sent to the router so that the router recognizes the new access traffic from the source address as the new attack access traffic, and shields the new attack access traffic; among them, the new access traffic is the network service provider after the access traffic to be protected
  • the new access traffic sent to the target network address includes the network request sent to the target network address by the subscribers of the network service provider.
  • using mirrored traffic as the access traffic to be protected belongs to the bypass monitoring mode.
  • the bypass deployment scheme is the monitoring mode that has the least impact on the current network. It will not affect the existing network structure and will not cause any impact on the network speed.
  • Bypass mode analyzes the data copied from the mirror port, which will not cause delay to the original data packet.
  • the original traffic corresponding to the mirrored traffic can be normally shielded and forwarded, and it will not wait for the network security protection system to recognize the mirrored traffic. After the results come out, the original traffic corresponding to the mirrored traffic is shielded and forwarded.
  • the object of identification here is mirrored traffic
  • the mirrored traffic cannot be directly injected back into traffic, but the traffic is cleaned based on the source address.
  • the method of traffic cleaning can be to send the source address to the router to Make the router recognize the new access traffic from the source address as a new attack access traffic, and shield the new attack access traffic. It is also possible not to send the source address to the router, but to pull the new access traffic from the router to the network security again.
  • the protection system the network security protection system will discard the new access traffic from the source address, and send the new access traffic that is not from the source address to the router, so that the router will forward it to the next hop router that reaches the target network address .
  • a query transaction is sent to the blockchain network, where the query transaction indicates a smart contract used to query the ledger in the blockchain network and query parameters, so that the consensus nodes in the blockchain network can execute the corresponding
  • the smart contract is used to query the target network address reported by multiple network security protection systems recorded in the ledger, the source address of the attack access traffic, and the target network address reported by the network security protection system that meets the query parameters in the ledger, and the source of the attack access traffic It can also send an update transaction to the blockchain network.
  • the update transaction indicates the smart contract used to update the ledger and the new target network address identified by the network security protection system to attack the source address of the access traffic. Make the consensus node in the blockchain network update the new target network address identified by the network security protection system and the source address of the attack access traffic to the ledger by executing the smart contract used to update the ledger for the security protection system Or routers for query and use.
  • FIG. 3C is an interactive flowchart of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the attack detection system deployed in the security server executes steps 301-303, and in step 301 , The attack detection system deployed in the security server obtains the access traffic sent to the target network address from the router and copies the mirrored traffic as the traffic to be detected.
  • attack detection is performed on the traffic to be detected.
  • step 303 when When an attack is detected, the attack detection system sends an alarm notification to the control system, and the control system executes step 304.
  • the alarm notification is forwarded to the network security protection system, and the network security protection system executes steps 305-307 and steps 309.
  • the network security protection system obtains the mirrored traffic of the access traffic from the router as the access traffic to be protected or obtains the access traffic as the access traffic to be protected by traction.
  • the access traffic to be protected is subjected to attack traffic identification processing
  • the network security protection system extracts data from the access traffic to be protected, and communicates with the neural network model through the network security process in the network security protection system.
  • the neural network model extracts the hidden layer of the data statistical characteristics of each session Feature, to classify each session as normal or abnormal based on hidden layer features, and identify the session classified as abnormal in the access traffic to be protected as attack access traffic, so as to obtain the source address of the attack access traffic as a malicious address .
  • the network security protection system pulls the access traffic from the router, then shields the attack traffic originating from the malicious address, and forwards the normal traffic.
  • step 307 when the identified access traffic to be protected is mirrored traffic, Send the malicious source address to the router so that the router executes step 308.
  • the router intercepts the traffic from the malicious source address.
  • step 309 when the access traffic to be protected is obtained by traction to obtain access traffic , The attack traffic is processed for packet loss, and the normal traffic is injected back to the router.
  • step 310 the router forwards normal traffic.
  • the normal access traffic of the social network is the access traffic constituted by the visits of ordinary users
  • the attack traffic is that hackers build servers to simulate the visits of ordinary users to slow down the response of the business servers of the social network or go down to achieve maliciousness.
  • the terminal in response to the user’s terminal receiving the user’s refresh operation to refresh the social network information flow, the terminal will carry the information refresh request for the service server on the access traffic to send it to the network service provider, and the network service provider will visit The traffic is sent to the core router, and the core router forwards the access traffic to the network address (that is, the target network address) of the business server.
  • the security server In order to prevent the presence of attack traffic in the access traffic from attacking the business server, it is necessary to identify and clean the access traffic through the security server, and identify the session that is classified as abnormal in the access traffic to be protected as the attack access traffic, so as to obtain the information of the attack access traffic.
  • the source address is used as a malicious address, and the traffic from the source and the malicious address is shielded, and the normal traffic whose source is not the malicious address is injected back to the core router, and the core router forwards it to the target network address (the network address of the business server),
  • the business server carries the information refresh result on the return traffic, and returns the return traffic to the terminal through the network service provider, and presents the information refresh result in the terminal.
  • the artificial intelligence-based network security protection method provided by the embodiments of the application is to continuously iteratively train the convolutional neural network model through bypass data including normal flow data and abnormal flow data, so that it has the ability to judge normal flow and abnormal flow. After the model training is mature, it is deployed in an existing network security protection system for protection. Therefore, the artificial intelligence-based network security protection method provided in the embodiment of the present application mainly includes two aspects: convolutional neural network model training and network security protection system deployment.
  • FIG 4 is a neural network model training architecture diagram in the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the training process of the neural network model is as follows. Attack packet capture. Bypass packet capture refers to a way to observe network traffic through bypass, so as not to affect the flow of network traffic on the main road. Then the above-mentioned packet capture is extracted and integrated into a normal session data sample by the data extraction module And abnormal session data samples, normal session data samples and abnormal session data samples are labeled with different labels, which are used for neural network model training. Then, after continuous training through massive normal session data samples and abnormal session data samples, the volume The product neural network is becoming mature, so it has the ability to automatically identify normal business traffic and attack traffic. After the model is mature, it will be deployed in the network security protection system for actual attack protection.
  • the data extraction module extracts data from the captured file and assigns labels to each data.
  • the label of normal business data is 0, and the label of attack data is 1.
  • the specific steps are as follows: extract the basic data characteristics of each message in the capture file: SSL protocol version, handshake version, SSL packet length, encryption suite length, encryption suite, Group length, group content, extension length, number of extensions supported; through the analysis of the basic data characteristics of each message, the mode of each basic characteristic gathered in the attack packet and the normal packet is extracted, and the further characteristics are extracted as shown in Table 1.
  • Table 1 is the data feature extraction table of the artificial intelligence-based network security protection method provided by the embodiment of this application. These data can be used as the input data of the convolutional neural network.
  • the first column is the basic features of the protocol, which can be directly obtained from the protocol. Extracted from the traffic capture file, the second column and the third column are the secondary features obtained by further statistical analysis of the basic features in the first column. The aggregate values of the basic features of the normal and abnormal samples are analyzed respectively. Mode, and calculate the absolute distance of each sample from the mode.
  • FIG. 5 is a schematic diagram of packet capture in an artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the data packet includes the SSL protocol version 501, the handshake version 502, and the SSL packet length of the captured data packet.
  • Encryption Suite Length 506, Encryption Suite 503, Group Length and Content 505, Extended Content 507, Extended Length 504, and the number of extensions supported for example, the packet length is 326, the SSL protocol version is TLS1.0, and the handshake version is TLS2.0, The length of the encryption suite is 148, the extension length is 133, and the group length is 52.
  • Figure 6 is a neural network model architecture diagram of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the neural network model is embedded Layer (Embedding), common layer, convolutional layer (Conv1D), pooling layer (Maxpooling1D) and fully connected layer (Dense() layer).
  • the embedding layer is used as the first layer of the neural network model to fix the input dimension
  • the convolutional layer is used to extract features
  • the pooling layer is used to sample the features
  • the fully connected layer is used to map the learned distributed feature representation to the sample label space as a classifier.
  • the batch normalization layer ( Spatial Dropout 1D) is similar to the ordinary random inactivation operation (Dropout operation), but it disconnects the entire 1D feature map instead of a single neuron.
  • the flattening process of the expansion layer (Flatten() layer) in the common layer is to flatten the input, that is, the multi-dimensional input is one-dimensional It is commonly used in the transition from the convolutional layer to the fully connected layer.
  • the fully connected layer (Dense() layer) also has three rounds of iteration. After the convolutional neural network is built, the model is performed through massive normal business data and attack data. Training, after the model convergence is completed, it will have the ability to automatically identify normal business data and attack data.
  • the loss function used in the training iteration process is shown in formula (2):
  • FIG. 7 is a protection system deployment diagram of the artificial intelligence-based network security protection method provided by an embodiment of the present application.
  • the DDoS protection process involves: an attack detection system, a control system, and a network security protection system.
  • the detection and protection process is as follows: When the core router receives the access traffic from the network service provider, the core router forwards the mirrored traffic to the attack detection system for attack detection through light splitting. When the attack detection system detects an attack, it will generate an alarm to the control system.
  • the network security protection system receives the alarm from the control system, and will publish the traction route of the attacked IP address to the core router through the border gateway protocol established with the core router to realize the border gateway traction, and obtain the bypass packet capture through the network security protection system
  • the mirrored traffic (including normal traffic and attack traffic) is identified, the source address of the attack traffic is obtained as a malicious address (for example, IP address), and the network security protection system will be led to the access traffic on the network security protection system according to the identification result Clean the attack traffic in the network, and inject the normal traffic back to the core router, then forward it to the core gateway, and then forward it to the business server of the target network address.
  • the neural network model will be deployed in the network security protection after the training is completed. In the system.
  • FIG. 8 is a schematic diagram of the process communication of the artificial intelligence-based network security protection method provided by the embodiment of the present application. , Deploy the DDoS protection process (network security protection process) and neural network model in the network security protection system. The DDoS protection process and the neural network model communicate through sockets. The DDoS protection process collects current traffic during the protection process.
  • All the characteristic data (the data collection and statistics method is the same as the implementation method of the data extraction module), and sent to the neural network model.
  • the neural network model judges the data to be tested, and will label the result of each session data and output the result to DDoS protection process.
  • a session contains multiple data packets.
  • a session refers to a set of data packets with the same source IP, destination IP, source port, destination port, and protocol. The DDoS protection process will clean based on these results.
  • the source IP that is identified as an abnormal packet will be blocked by the DDoS protection process, that is, all packets of this source IP will be discarded, and the packets of normal source IP will be recognized as normal by the neural network model, and all normal source IPs Will not be blocked, so the traffic from these IPs will be forwarded to the server by the DDoS protection process.
  • the identification and cleaning of the attack traffic can be completed, and the normal traffic will be forwarded to the server, which is actually the server.
  • the DDoS protection process Run the DDoS protection process, and use the process to interact with the neural network model in the server (that is, the running instance of the model), so that the neural network model can complete the flow identification, which is compared with the "model and process" coupling in the related technology
  • the solution is improved by decoupling.
  • the neural network model can be flexibly offline, suspended or updated without shutting down the entire protection function, thus avoiding the protection caused by re-launching Delay.
  • the artificial intelligence-based network security protection method is a non-decrypted identification protection scheme for HTTPS CC attacks based on convolutional neural networks. It can be used as an effective supplement to the existing network DDoS protection algorithm system.
  • the neural network model is trained on road data. After the model is matured, it has the ability to automatically judge normal traffic and attack traffic, thereby achieving efficient and accurate cleaning of HTTPS CC, ensuring the stability of the attacked server’s business, and ensuring that normal business is not affected.
  • the solution does not require any modification of the server/client to access, and it has good compatibility.
  • the machine learning algorithm can be modeled by appropriate algorithms and can be used in irregular It can achieve classification in the case of, with strong generalization ability, automatic learning and training based on a large amount of data, without relying on baselines, and protection for new online services. Therefore, the neural network model is of great significance to the protection of existing networks.
  • the network security protection method provided by the embodiment of the present application may also use other machine learning algorithms to build a neural network model.
  • the artificial intelligence-based network security protection device 255 may include: a traffic acquisition module 2551, configured to acquire the access traffic to be protected sent to the target network address; the data extraction module 2552, configured to extract multiple sessions included in the access traffic to be protected The data statistics characteristics of each session; the traffic classification module 2553 is configured to call the neural network model to classify each session normally or abnormally based on the data statistics characteristics of each session; the traffic identification module 2554 is configured to be protected Sessions classified as abnormal in the access traffic are identified as attack access traffic; the traffic cleaning module 2555 is configured to obtain the source address of the attack access traffic, and shield the attack access traffic sent to the target network address and from the source address.
  • a traffic acquisition module 2551 configured to acquire the access traffic to be protected sent to the target network address
  • the data extraction module 2552 configured to extract multiple sessions included in the access traffic to be protected The data statistics characteristics of each session
  • the traffic classification module 2553 is configured to call the neural network model to classify each session normally or abnormally based on the data statistics characteristics of each session
  • the traffic acquisition module 2551 is further configured to send a mirrored traffic request to the router, where the mirrored traffic request carries a target network address, so that the router can perform access to traffic when routing the traffic sent to the target network address.
  • the traffic is copied to obtain the mirrored traffic of the access traffic, where the access traffic includes the network request sent by the subscriber of the network service provider to the target network address; the mirrored traffic sent by the router is received as the access traffic to be protected.
  • the traffic acquisition module 2551 is further configured to send a traction routing rule to the router, where the traction routing rule carries the target network address and the traction target network address, so that the router directs the access traffic sent to the target network address to Traction the target network address, where the access traffic includes the network request sent to the target network address by the subscribers of the network service provider; the access traffic directed by the receiving router to the traction target network address is used as the access traffic to be protected.
  • the traffic classification module 2553 is further configured to: send the statistical characteristics of each session to the neural network model through the socket connection between the network security protection process and the neural network model; and pass the network security protection process Socket connection with the neural network model to receive the classification results returned by the neural network model.
  • the traffic acquisition module 2551 before acquiring the access traffic to be protected sent to the target network address, is further configured to: acquire the access traffic to be detected sent to the target network address from the router, and the access traffic to be detected is sent to the target The access traffic of the network address is copied to form the mirrored traffic; the attack behavior pattern matching is performed on the access traffic to be detected. When the attack behavior is matched, it is determined that it is necessary to obtain the access traffic to be protected sent to the target network address.
  • the data extraction module 2552 is further configured to: extract multiple data packets included in each session for multiple sessions included in the access traffic to be protected; from the multiple data packets included in each session , Extract the data characteristics of at least one of the following dimensions: the protocol version of the secure socket layer applied during the transmission of the data packet; the handshake version applied during the transmission of the data packet; the packet length of the secure socket layer applied during the transmission of the data packet ; Data packet encryption suite length; data packet encryption suite; data packet group length; data packet group content; data packet extension length; data packet support extension number; data characteristics from at least one dimension of each session , Extract the corresponding statistical characteristics of the data.
  • the data extraction module 2552 is further configured to: obtain the normal mode of the data features of each dimension in the normal conversation sample and the abnormal mode of the data of each dimension in the abnormal conversation sample; determine the at least The distance between the data feature of one dimension and the normal mode of the corresponding dimension is taken as the normal absolute distance of the corresponding dimension; the distance between the data feature of at least one dimension of each session and the abnormal mode of the corresponding dimension is determined as As the abnormal absolute distance of the corresponding dimension; the normal absolute distance and the abnormal absolute distance of at least one dimension determined for each session are combined into the data statistical characteristics of the corresponding session.
  • the neural network model includes a cascaded embedded layer, a hidden layer, and a fully connected layer; the traffic classification module, the traffic classification module 2553, is further configured to: perform the following processing for each session: receive the session through the embedded layer
  • the statistical features of the data are transmitted to the hidden layer.
  • the hidden layer features are extracted from the received data statistical features through the hidden layer and transmitted to the fully connected layer; the received hidden layer features are mapped to the fully connected layer Normal category probability and abnormal category probability; among them, the category corresponding to the larger value of the normal category probability and the abnormal category probability is the classification result of the conversation.
  • the hidden layer includes: a batch normalization layer, a convolutional layer, and a pooling layer; the traffic classification module 2553 is further configured to: standardize the activation values of the received data statistical features through the batch normalization layer, Obtain data statistical features that meet the normal distribution; perform feature extraction processing on the data statistical features output by the batch normalization layer through the convolution layer to obtain the convolution layer features corresponding to the data statistical features; pass the convolution layer to the convolution layer output convolution The multi-layer features are sampled to obtain the hidden layer features corresponding to the statistical features of the data.
  • the traffic cleaning module 2555 is further configured to filter the attack access traffic in the access traffic to be protected, and the normal access traffic obtained after filtering is filtered.
  • the access traffic is sent to the router to enable the router to forward; the source address is sent to the router so that the router recognizes the new access traffic from the source address as the new attack access traffic, and shields the new attack access traffic; among them, the new The access traffic is sent by the network service provider to the target network address after the access traffic to be protected, and the new access traffic includes the network request sent to the target network address by the subscribers of the network service provider.
  • the traffic cleaning module 2555 is further configured to: send the source address to the router so that the router recognizes the new access traffic from the source address as new Attack access traffic, and shield the new attack access traffic; among them, the new access traffic is sent by the network service provider to the target network address after the access traffic to be protected, and the new access traffic includes the network service provider’s subscribers.
  • the network request for the target network address is further configured to: send the source address to the router so that the router recognizes the new access traffic from the source address as new Attack access traffic, and shield the new attack access traffic; among them, the new access traffic is sent by the network service provider to the target network address after the access traffic to be protected, and the new access traffic includes the network service provider’s subscribers.
  • the network request for the target network address is mirrored traffic received from the router.
  • the device 255 further includes: a training module 2556, configured to: based on the statistical characteristics of each session, before calling the neural network model to classify each session as normal or abnormal, by bypassing the router to capture Obtain session samples in a package, and combine the pre-labeled normal session samples and abnormal session samples into a training sample set; initialize the neural network model, and initialize the loss function including the session samples and the classification results of the corresponding session samples; in the neural network model The following processing is performed during each iteration of the training process: through the neural network model, the session samples included in the training sample set are classified to obtain the classification results of the corresponding session samples; the true category and classification results of the corresponding session samples are substituted into the loss function to Determine the corresponding neural network model parameters when the loss function obtains the minimum value; update the neural network model according to the determined neural network model parameters.
  • a training module 2556 configured to: based on the statistical characteristics of each session, before calling the neural network model to classify each session as normal or abnormal, by bypassing the router to capture
  • the embodiment of the application provides a storage medium storing executable instructions, and the executable instructions are stored therein.
  • the processor will cause the processor to execute the artificial intelligence-based network security provided by the embodiments of the application.
  • the protection method is, for example, a network security protection method based on artificial intelligence as shown in FIGS. 3A-3C.
  • the storage medium may be FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM, etc.; it may also be various devices including one or any combination of the foregoing memories. .
  • the executable instructions may be in the form of programs, software, software modules, scripts or codes, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and their It can be deployed in any form, including being deployed as an independent program or as a module, component, subroutine or other unit suitable for use in a computing environment.
  • executable instructions may but do not necessarily correspond to files in the file system, and may be stored as part of files that store other programs or data, for example, in a HyperText Markup Language (HTML, HyperText Markup Language) document
  • HTML HyperText Markup Language
  • One or more scripts in are stored in a single file dedicated to the program in question, or in multiple coordinated files (for example, a file storing one or more modules, subroutines, or code parts).
  • executable instructions can be deployed to be executed on one computing device, or on multiple computing devices located in one location, or on multiple computing devices that are distributed in multiple locations and interconnected by a communication network Executed on.
  • the mode characteristics of the data statistics level in the embodiments of this application are used to identify the attack access traffic without relying on the information level characteristics of the response content. Therefore, the identification is not affected by whether the traffic message is encrypted, so that compatible encryption can be realized.
  • the source address of the attack access traffic is obtained based on the identification result to shield the attack access traffic sent to the target network address, so as to realize the cleaning of compatible encryption and unencrypted attack access traffic.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Mathematical Physics (AREA)
  • Biomedical Technology (AREA)
  • Molecular Biology (AREA)
  • General Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Biophysics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种基于人工智能的网络安全防护方法、装置、电子设备及计算机可读存储介质；方法包括：获取发送到目标网络地址的待防护访问流量；针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理；将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量；获取所述攻击访问流量的来源地址，对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理。

Description

基于人工智能的网络安全防护方法、装置、电子设备
相关申请的交叉引用
本申请基于申请号为202010234182.4、申请日为2020年03月30日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及人工智能和网络技术，尤其涉及一种基于人工智能的网络安全防护方法、装置、电子设备及计算机可读存储介质。
背景技术
人工智能(AI，Artificial Intelligence)是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法和技术及应用系统。
相关技术中的超文本传输协议(HTTP，Hypertext Transfer Protocol)采用明文传输信息，存在被窃听和篡改的风险，基于安全套接字层的HTTP(HTTPS，Hyper Text Transfer Protocol over Secure Socket Layer)基于HTTP开发，使用安全套接层进行加密的信息交互，提供了身份验证、信息机密性和完整性校验功能，随着用户对安全性要求的增强，以及一些政策性的强制性要求，越来越多的网络服务主动或被动的将自己的服务由HTTP切换到HTTPS为数据传输带来更高的安全性的同时，也给了黑客可乘之机，HTTPS协议在网络上传输加密的报文，相关技术中的内容检测技术失去了效果，由于处理HTTPS连接的巨大资源消耗，使得攻击成本较低，危害性却较大。
发明内容
本申请实施例提供一种基于人工智能的网络安全防护方法、装置、电子设 备及计算机可读存储介质，能够实现对加密攻击流量和不加密攻击流量的识别与清洗。
本申请实施例的技术方案是这样实现的：
本申请实施例提供一种基于人工智能的网络安全防护方法，所述方法由电子设备执行，所述方法包括：
获取发送到目标网络地址的待防护访问流量；
针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；
基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理；
将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量；
获取所述攻击访问流量的来源地址，对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理。
本申请实施例提供一种基于人工智能的网络安全防护装置，所述装置包括：
流量获取模块，用于获取发送到目标网络地址的待防护访问流量；
数据提取模块，用于针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；
流量分类模块，用于基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理；
流量识别模块，用于将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量；
流量清洗模块，用于获取所述攻击访问流量的来源地址，对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理。
本申请实施例提供一种电子设备，所述电子设备包括：
存储器，用于存储可执行指令；
处理器，用于执行所述存储器中存储的可执行指令时，实现本申请实施例提供的基于人工智能的网络安全防护方法。
本申请实施例提供一种计算机可读存储介质，存储有可执行指令，用于被处理器执行时，实现本申请实施例提供的基于人工智能的网络安全防护方法。
本申请实施例具有以下有益效果：
通过对待防护访问流量中的会话进行分析，得出数据统计层面的特征，不依赖于信息层面的特征来识别攻击访问流量，因此识别不受流量报文是否加密的影响，从而能够实现兼容加密和不加密攻击访问流量的识别，进而能够基于攻击访问流量的来源地址进行屏蔽处理以实现各种访问流量(包括加密和不加密攻击访问流量)的清洗，提高了防护效率。
附图说明
图1是本申请实施例提供的基于人工智能的网络安全防护方法的应用系统的架构示意图；
图2是本申请实施例提供的应用基于人工智能的网络安全防护方法的安全服务器200的结构示意图；
图3A-3C是本申请实施例提供的基于人工智能的网络安全防护方法的流程示意图；
图4是本申请实施例提供的基于人工智能的网络安全防护方法中神经网络模型训练架构图；
图5是本申请实施例提供的基于人工智能的网络安全防护方法中的抓包示意图；
图6是本申请实施例提供的基于人工智能的网络安全防护方法的神经网络模型架构图；
图7是本申请实施例提供的基于人工智能的网络安全防护方法的防护系统部署架构图；
图8是本申请实施例提供的基于人工智能的网络安全防护方法的进程通信示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，所描述的实施例不应视为对本申请的限制，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
在以下的描述中，涉及到“一些实施例”，其描述了所有可能实施例的子集，但是可以理解,“一些实施例”可以是所有可能实施例的相同子集或不同子集，并且可以在不冲突的情况下相互结合。
除非另有定义，本文所使用的所有的技术和科学术语与属于本申请的技术领域的技术人员通常理解的含义相同。本文中所使用的术语只是为了描述本申请实施例的目的，不是旨在限制本申请。
对本申请实施例进行进一步详细说明之前，对本申请实施例中涉及的名词和术语进行说明，本申请实施例中涉及的名词和术语适用于如下的解释。
1)挑战黑洞(CC，Challenge Collapsar)攻击：CC攻击的原理是攻击者控制某些主机不停地发大量数据包给对方服务器造成服务器资源耗尽，一直到宕机崩溃，CC主要是用来攻击页面的，当一个网页访问的人数特别多的时候，打开网页的速度就会变慢，CC就是模拟多个用户不停地进行访问那些需要大量数据操作的页面，造成服务器资源的浪费，中央处理器长时间处于100％占用状态，永远都有处理不完的连接直至造成网络拥塞，正常的访问被中止。
2)分布式拒绝服务攻击(DDoS，Distributed Denial of Service)：分布式的DoS攻击，黑客通过控制分布在互联网各处的肉鸡在同时间内对目标服务器发送大量异常流量，服务器忙于处理异常流量，无法处理正常用户请求，甚至系统崩溃，造成拒绝服务，随着技术本身的发展，持续对抗过程中出现一些相比以往非常高级的攻击手法，例如，HTTPS CC攻击。
3)HTTPS：是以安全为目标的超文本传输协议(HTTP，Hypertext Transfer Protocol)通道，简单讲是HTTP的安全版，即HTTP下加入安全套接层(SSL， Secure Sockets Layer)。
4)屏蔽：对特定来源地址的访问流量进行拦截、部分丢弃、延迟转发或重定向，以使来自于特定来源地址的访问流量无法访问或难以访问被保护的目标网络地址，从而放弃攻击。
5)网络服务提供方：在网络架构中，客户端针对目标地址的访问是通过联通、电信这样的网络服务提供方出口路由的，网络服务提供方是向签约用户提供网络访问功能的实体。
6)流量清洗：将正常流量和恶意流量进行区分，拦截恶意流量并将正常流量回注目标网络地址，以保证目标网络地址能够被正常访问。
相关技术中的HTTP协议采用明文传输信息，存在被窃听和篡改的风险，HTTPS基于HTTP开发，使用SSL/传输层安全(TLS，Transport Layer Security)协议进行加密的信息交互，提供了身份验证、信息机密性和完整性校验功能。随着用户对安全性要求的增强，以及一些政策性的强制性要求，越来越多的网络服务主动或被动的将自己的服务由HTTP切换到HTTPS，HTTPS为数据传输带来更高的安全性的同时，也给了黑客可乘之机，HTTPS协议在网络上传输加密的报文，相关技术中的内容检测技术失去了效果，由于处理HTTPS连接的巨大资源消耗，让HTTPS的DDoS攻击成本较低，危害性却较大，为此需要提供一种在不解密场景下的网络安全防护方案。
基于大数据分析、机器学习、深度学习的人工智能技术在网络安全领域的实践非常丰富，已广泛应用于实际安全场景，包括垃圾邮件识别、骚扰短信识别、网页后门检测、智能扫描器、基于域名生成算法的域名检测、反信用卡欺诈等，本申请实施例提供的基于人工智能的网络安全防护方法通过神经网络模型对密码套件、组内容、包长、密码套件长度、组长度、扩展长度与扩展数的分布和取值情况进行学习，实现在不解密情况下对HTTPS攻击流量的识别，在多次攻击中体现出良好的防护效果。
相关技术中对于HTTPS CC攻击的防御方案，一方面是采用对加密流量进行解密，然后在已解密的明文信息中提取攻击特征，从而进行攻击流量识别的 方案，另一方面是从攻击行为模式上来分析，例如通常扫描式攻击会对资源目录进行不断遍历，那么其访问不同统一资源定位符的可能性会非常大，同时获取到的响应码也是不确定的，可能会出现大量的非200正常响应码，在请求方法上，也可能会进行不停的变换尝试，如从服务器获取数据的请求、向服务器传输数据的请求、选择(OPTION)请求等，针对请求同一统一资源定位符的参数，会进行不同的替换，集中时间段内可能会有大量互联网协议(IP，Internet Protocol)地址访问同一个固定的统一资源定位符，会不断伪造合法的用户代理来避免用户代理规则的特征查杀等。
相关技术中的HTTPS CC防护算法主要依赖对流量进行解密，其缺点非常明显：1、开销大，对海量的加密流量逐个解密耗费巨大的系统资源，防御HTTPS CC对系统的消耗大约是防御HTTP CC的10倍；2、场景受限，在很多场景下用户并不会将证书导入第三方的防护设备，特别是公有云场景，因而导致防护系统不具备解密能力，无法防护HTTPS CC攻击；3、误杀风险，基于行为模式的识别方案中，某些业务场景下的正常用户行为与攻击者行为相似度高，易产生误判，同时，用户行为具有多样性和多变性，基于行为模式的识别方案为构建用户行为模型带来挑战。
HTTPS CC攻击流量是加密传输，因此相关技术中基于内容的攻击检测防护方案遇到瓶颈，虽然通过解密的方式仍然可以进行防护，但由于处理HTTPS连接的巨大资源消耗，让HTTPS的DDoS攻击成本较低，危害性却较大，基于上述问题，本申请实施例提供了一种基于人工智能的网络安全防护方法，其实际上是基于卷积神经网络的对HTTPS CC攻击的不解密识别方案，该方案可以通过海量的旁路数据训练神经网络模型，模型训练成熟后就具有自动判断正常流量和攻击流量的能力，最后在防护过程中，防护系统保持与神经网络模型通信：防护系统接收数据，并发送到神经网络模型，神经网络模型判断数据的合法性并把结果发送到防护系统，防护系统对抓包文件进行整合统计原理(也就是卷积神经网络的数据预处理)，防护系统根据神经网络模型的判断结果可以把恶意地址(例如，IP地址)拉黑屏蔽，从而实现对HTTPS CC攻击的有效防护， 本申请实施例提供的基于人工智能的网络安全防护方法无需用户增加额外麻烦去导入证书即可实现对HTTPS CC攻击的有效自动的防护，而且对正常业务不会有任何影响，特别适合云企业云这种业务类型繁多、攻击威胁严重、业务重要性高的平台，本申请实施例提供的基于人工智能的网络安全防护方法中的神经网络模型通过多次的迭代与优化后，已经形成一套成熟的HTTPS CC攻击的不解密识别防护方案，并在网络的多次攻防对抗中表现出良好的清洗率。
本申请实施例提供一种基于人工智能的网络安全防护方法、装置、电子设备和计算机可读存储介质，能够解决加密攻击访问流量以及不加密攻击访问流量识别的技术问题，下面说明本申请实施例提供的电子设备的示例性应用，本申请实施例提供的电子设备可以实施为笔记本电脑，平板电脑，台式计算机，机顶盒，移动设备(例如，移动电话，便携式音乐播放器，个人数字助理，专用消息设备，便携式游戏设备)等各种类型的用户终端，也可以实施为服务器。下面，将说明设备实施为服务器时的示例性应用。
参见图1，图1是本申请实施例提供的基于人工智能的网络安全防护方法的应用系统的架构示意图，例如，在网页访问场景中，终端500接收用户针对网页链接的点击操作，终端从网页链接中提取对应网页链接的目标网络地址(业务服务器600的网络地址)，终端500生成对应目标网络地址的网页访问请求，将发送到业务服务器600的网页访问请求承载于访问流量上以发送至网络服务提供方400，网络服务提供方400将访问流量发送至核心路由器300，由核心路由器300将访问流量转发至业务服务器600的网络地址(即目标网络地址)。为了防止访问流量中存在攻击流量对业务服务器进行攻击，需要通过安全服务器对访问流量进行识别与清洗，将待防护访问流量中被分类为异常的会话识别为攻击访问流量，从而获取攻击访问流量的来源地址作为恶意地址，并将来源于恶意地址的流量进行屏蔽处理，将来源不是恶意地址的正常流量回注到核心路由器，由核心路由器300将其转发到目标网络地址(业务服务器600的网络地址)，业务服务器600将访问结果承载于返回流量，并将返回流量通过网络服务提供方600返回至终端500，在终端500中呈现网页访问结果。
在一些实施例中，网络服务提供方600将访问流量发送至核心路由器300，由核心路由器将访问流量转发至业务服务器600的网络地址(即目标网络地址)。为了防止访问流量中存在攻击流量对业务服务器600进行攻击，需要通过安全服务器200对访问流量进行识别与清洗，具体是，安全服务器200中部署的攻击检测系统201从核心路由器300获取发送到目标网络地址的访问流量进行复制形成的镜像流量作为待检测流量，当检测到攻击行为时，攻击检测系统201发送告警通知到控制系统202，由控制系统202将告警通知转发至网络安全防护系统203，网络安全防护系统203从核心路由器300获取访问流量的镜像流量作为待防护访问流量，网络安全防护系统203对待防护访问流量进行数据提取，通过网络安全防护系统203中的网络安全进程与神经网络模型通信，由神经网络模型对每个会话的数据统计特征提取隐含层特征，以基于网络安全防护系统隐含层特征对网络安全防护系统每个会话进行正常或异常的分类处理，并将待防护访问流量中被分类为异常的会话识别为攻击访问流量，从而获取攻击访问流量的来源地址作为恶意地址，网络安全防护系统203中的清洗系统2031从核心路由器300中进行访问流量的牵引，再对来源于恶意地址的攻击流量进行屏蔽，将来源不是恶意地址的正常流量回注到核心路由器300，由核心路由器300将其转发到目标网络地址。
在一些实施例中，安全服务器200可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、CDN、以及大数据和人工智能平台等基础云计算服务的云服务器。
参见图2，图2是本申请实施例提供的应用基于人工智能的网络安全防护方法的安全服务器200的结构示意图，图2所示的安全服务器200包括：至少一个处理器210、存储器250、至少一个网络接口220。安全服务器200中的各个组件通过总线系统240耦合在一起。可理解，总线系统240用于实现这些组件之间的连接通信。总线系统240除包括数据总线之外，还包括电源总线、控 制总线和状态信号总线。但是为了清楚说明起见，在图2中将各种总线都标为总线系统240。
处理器210可以是一种集成电路芯片，具有信号的处理能力，例如通用处理器、数字信号处理器(DSP，Digital Signal Processor)，或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等，其中，通用处理器可以是微处理器或者任何常规的处理器等。
存储器250可以是可移除的，不可移除的或其组合。示例性的硬件设备包括固态存储器，硬盘驱动器，光盘驱动器等。存储器250可选地包括在物理位置上远离处理器210的一个或多个存储设备。
存储器250包括易失性存储器或非易失性存储器，也可包括易失性和非易失性存储器两者。非易失性存储器可以是只读存储器(ROM，Read Only Me mory)，易失性存储器可以是随机存取存储器(RAM，Random Access Memor y)。本申请实施例描述的存储器250旨在包括任意适合类型的存储器。
在一些实施例中，存储器250能够存储数据以支持各种操作，这些数据的示例包括程序、模块和数据结构或者其子集或超集，下面示例性说明。
操作系统251，包括用于处理各种基本系统服务和执行硬件相关任务的系统程序，例如框架层、核心库层、驱动层等，用于实现各种基础业务以及处理基于硬件的任务；
网络通信模块252，用于经由一个或多个(有线或无线)网络接口220到达其他计算设备，示例性的网络接口220包括：蓝牙、无线相容性认证(WiFi)、和通用串行总线(USB，Universal Serial Bus)等。
在一些实施例中，本申请实施例提供的装置可以采用软件方式实现，图2示出了存储在存储器250中的基于人工智能的网络安全防护装置255，其可以是程序和插件等形式的软件，包括以下软件模块：流量获取模块2551、数据提取模块2552、流量分类模块2553、流量识别模块2554、流量清洗模块2555以及训练模块2556，这些模块是逻辑上的，因此根据所实现的功能可以进行任意的组合或进一步拆分，将在下文中说明各个模块的功能。
将结合本申请实施例提供的服务器的示例性应用和实施，说明本申请实施例提供的基于人工智能的网络安全防护方法。
参见图3A，图3A是本申请实施例提供的基于人工智能的网络安全防护方法的流程示意图，将结合图3A示出的步骤进行说明。
在步骤101中，服务器获取发送到目标网络地址的待防护访问流量。
作为示例，服务器中部署有网络安全防护系统，网络安全防护系统中的安全防护进程获取发送到目标网络地址的待防护访问流量，目标网络地址即为被保护网络地址，服务器中还部署有攻击检测系统，攻击检测系统实际上是对发送到目标网络地址的待检测访问流量进行粗粒度的攻击检测。
在一些实施例中，在执行步骤101之前，攻击检测系统从路由器获取发送到目标网络地址的待检测访问流量，待检测访问流量是发送到目标网络地址的访问流量进行复制形成的镜像流量；对待检测访问流量进行攻击行为模式匹配，当匹配到攻击行为时，确定需要获取发送到目标网络地址的待防护访问流量，以基于神经网络模型识别出待防护访问流量中的攻击访问流量。通过对镜像流量进行检测，不会影响访问流量进行正向路由的过程，从而防止通信延迟并有效提高了通信速度。
在一些实施例中，网络安全防护系统基于神经网络模型对待防护访问流量进行分类处理，作为示例，网络安全防护系统对待防护访问流量中的会话进行分类，识别出由异常会话构成的攻击流量，待检测访问流量是攻击检测系统基于攻击行为模式进行攻击检测的对象，攻击检测系统识别出待检测访问流量中是否存在攻击行为，仅仅是对待检测访问流量进行定性分析，其是一种比基于神经网络模型进行识别的方式更为粗粒度的识别过程，攻击检测可以采用基于行为模式进行检测的方式，核心路由器通过分光将发送到目标网络地址的访问流量进行复制形成的镜像流量转发到攻击检测系统以进行攻击检测，当攻击检测系统匹配检测到攻击行为之后，会产生并发送告警到控制系统，防护系统接收到来自控制系统的告警，确定需要获取发送到目标网络地址的待防护访问流 量，以基于神经网络模型识别出待防护访问流量中的攻击访问流量。
在一些实施例中，待防护访问流量和待检测访问流量可以是相同时段发生的访问流量，也是不同时段(即交错时间)发生的访问流量，这具体取决于路由器的数据缓存策略，即路由器所接收的访问流量的缓存时长，具体而言，当路由器所接收的访问流量的缓存时间超过进行攻击检测所耗费的时间，则待防护访问流量和待检测访问流量可以是相同时段发生的访问流量，从而保证所有的流量都能经过攻击检测以及通过神经网络模型进行识别，保证不存在漏过的攻击流量抵达目标网络地址，当路由器所接收的访问流量的缓存时间不超过进行攻击检测所耗费的时间，则待防护访问流量是待检测访问流量之后时段发生的访问流量，从而保证正常流量能够在较短的时间内抵达目标网络地址，而没有完全等待进行攻击检测完成之后就会进行相应的转发。
在一些实施例中，步骤101中的获取发送到目标网络地址的待防护访问流量，可以通过以下技术方案实现：向路由器发送镜像流量请求，其中镜像流量请求携带目标网络地址，以使路由器执行以下操作：在对发送到目标网络地址的访问流量进行路由时，对访问流量进行复制得到访问流量的镜像流量，其中访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求；接收路由器发送的镜像流量，以作为待防护访问流量。
在一些实施例中，网络服务提供方是向签约用户提供网络访问功能的实体，在以下情形中，网络安全防护系统可以向路由器发送镜像流量请求，以获取镜像流量作为待防护访问流量：针对目标网络地址进行安全防护的功能刚刚被启动时，网络安全防护系统中没有攻击访问流量的来源地址数据；攻击访问流量的来源地址超出有效期，即丧失时效性，从而不具有防护意义；攻击访问流量的来源地址的数量与目标网络地址被攻击次数的比值小于比值阈值，表征还有潜在具有攻击性的来源地址没被发现；攻击访问流量的来源地址的数量小于数量阈值，数量阈值可以是全网受保护地址的攻击访问流量的地址数量的平均值，说明已经探测到的来源地址到数量未到达全网的平均水平，将镜像流量作为待防护访问流量，属于旁路监控模式，旁路部署方案是对当前网络影响最小的监 控模式，不会影响现有的网络结构，不会对网速造成任何影响。旁路模式分析的是镜像端口拷贝过来的数据，对原始数据包不会造成延时。
在一些实施例中，步骤101中的获取发送到目标网络地址的待防护访问流量，可以通过以下技术方案实现：向路由器发送牵引路由规则，其中，牵引路由规则携带目标网络地址和牵引目标网络地址，以使路由器执行以下操作：将发送到目标网络地址的访问流量引导至牵引目标网络地址，其中，访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求；接收路由器引导至牵引目标网络地址的访问流量，以作为待防护访问流量。将访问流量作为待防护访问流量，可以保证检测全面性，防止来自恶意地址的访问流量被路由至业务服务器，提高了网络安全防护的防护质量。
在一些实施例中，目标网络地址为网络安全防护系统的网络地址，网络服务提供方为向签约用户提供网络访问功能的实体，路由牵引是实现流量牵引的技术手段，本质是发布一个新的路由规则到路由器，即将目的地址为目标网络地址的报文转发到网络安全防护系统，网络安全防护系统的网络地址即为牵引目标网络地址，这里新的路由规则是将报文从路由器转发到网络安全防护系统，以替代路由器中报文的原先的路由规则，这里原先的路由规则用于将目的地址为目标网络地址的报文正常转发到下一跳路由器，在以下情形中，网络安全防护系统可以发送访问流量牵引请求：针对目标网络地址进行安全防护的功能刚刚被启动时，网络安全防护系统中没有攻击访问流量的来源地址数据；攻击访问流量的来源地址超出有效期，即丧失时效性，从而不具有防护意义；攻击访问流量的来源地址的数量与目标网络地址被攻击次数的比值小于比值阈值，表征还有潜在具有攻击性的来源地址没被发现；攻击访问流量的来源地址的数量小于数量阈值，数量阈值可以是整个网络中受保护地址的攻击访问流量的地址数量的平均值，说明已经探测到的来源地址到数量未到达全网的平均水平，通过牵引规则获取的流量作为待防护访问流量，可以保证不漏过每一个数据包，即从核心路由器获取每一个数据包，并对每一个数据包进行攻击流量识别后，再进行相应的攻击流量屏蔽以及正常流量的转发行为。
在步骤102中，服务器针对待防护访问流量中包括的多个会话，提取每个会话的数据统计特征。
服务器中部署有网络安全防护系统，网络安全防护系统中的安全防护进程可以针对待防护访问流量中包括的多个会话，提取每个会话的数据统计特征，会话中客户端的数据包在网络中以报文的形式传输，通过网络安全防护系统中的安全防护进程对路由器接收的报文进行数据层面的统计分析得到数据统计特征，以此输入神经网络模型来进行分类。
参见图3B，图3B是本申请实施例提供的基于人工智能的网络安全防护方法的流程示意图，将结合图3B示出的1021-1023步骤进行说明，步骤102中针对待防护访问流量中包括的多个会话，提取每个会话的数据统计特征，可以通过以下步骤1021-1023实现。
在步骤1021中，针对待防护访问流量中包括的多个会话，提取出每个会话包括的多个数据包。
作为示例，每个会话包含多个数据包，会话指具备相同的源IP、目的IP、源端口、目的端口、协议的一组数据包的集合。
在步骤1022中，从每个会话包括的多个数据包中，提取以下至少一个维度的数据特征：数据包的传输过程所应用的安全套接层的协议版本；数据包的传输过程所应用的握手版本；数据包的传输过程所应用的安全套接层的包长；数据包的加密套件长度；数据包的加密套件；数据包的组长度；数据包的组内容；数据包的扩展长度；数据包的支持扩展数。
在步骤1023中，从每个会话的至少一个维度的数据特征中，提取对应的数据统计特征。
在一些实施例中，步骤1023中从每个会话的至少一个维度的数据特征中，提取对应的数据统计特征，可以通过以下技术方案实现，获取正常会话样本中各个维度的数据特征的正常众数、以及异常会话样本中各个维度的数据的异常众数；确定每个会话的至少一个维度的数据特征与对应维度的正常众数之间的距离，以作为对应维度的正常绝对距离；确定每个会话的至少一个维度的数据 特征与对应维度的异常众数之间的距离，以作为对应维度的异常绝对距离；将针对每个会话所确定的至少一个维度的正常绝对距离和异常绝对距离，组合为对应会话的数据统计特征。以会话中各维度的数据特征为对应会话的数据统计特征，从而不需要加解密的过程便能够实现会话类型的识别。
在一些实施例中，在抓包文件中提取每个报文的基本数据特征：SSL协议版本、握手版本、SSL包长、加密套件长度、加密套件、组长度、组内容、扩展长度、支持扩展数；通过对每个报文的基本数据特征进行分析，提取出各基本数据特征在攻击包和正常包中聚集的众数，这些数据就可以作为卷积神经网络的输入数据，数据包的SSL协议版本、握手版本、SSL包长、加密套件长度、加密套件、组长度、组内容、扩展长度、支持扩展数是协议的基本特征，可直接从协议流量的抓包文件中提取，进一步对基本数据特征进行统计分析得到的二次特征，分析正常和异常会话样本中各基本数据特征的聚集值即众数，并分别计算抓包文件中的基本特征与众数的绝对距离，通过对待防护访问流量中的会话进行分析出数据统计层面的特征，不依赖于信息层面的特征来识别攻击访问流量，因此识别不受流量报文是否加密的影响，从而能够实现兼容加密和不加密攻击访问流量的识别，进而能够基于攻击访问流量的来源地址进行屏蔽处理以实现各种访问流量(包括加密和不加密攻击访问流量)的清洗，这里数据统计层面的特征是如上多个维度的数据统计特征，从而能够基于多个维度的数据统计特征进行更加准确的攻击流量识别。
在一些实施例中，在执行步骤103之前，通过从路由器旁路抓包的方式获取会话样本，并将预标记的正常会话样本和异常会话样本组合为训练样本集合；初始化神经网络模型，并初始化包括会话样本以及对应会话样本的分类结果的损失函数；在神经网络模型每次迭代训练过程中执行以下处理：通过神经网络模型，对训练样本集合包括的会话样本进行分类处理，得到对应会话样本的分类结果；将对应会话样本的真实类别和分类结果代入损失函数，以确定损失函数取得最小值时对应的神经网络模型参数；根据所确定的神经网络模型参数更新神经网络模型。
在一些实施例中，神经网络模型包括嵌入层、隐含层和全连接层，其中，嵌入层作为神经网络模型的第一层，用于固定输入维度，卷积层用于提取特征，隐含层中的池化层用于对特征进行采样，全连接层用于将学到的分布式特征表示映射到样本标记空间，以作为分类器，隐含层中还包括批量标准化层、随机失活层、卷积层、池化层、展开层和高斯噪声层，批量标准化层在每批训练样本集合上将前一层的激活值重新规范化，即使得其输出数据的均值接近0，其标准差接近1，即形成正态分布，随机失活层用于断开整个1维特征图，而不是单个神经元，如果一张特征图的相邻元素之间有很强的相关性(通常发生在低层的卷积层中)，那么普通的随机失活(dropout)操作无法正则化其输出，否则就会导致明显的学习率下降，这种情况下随机失活层中的随机失活层(Sp atial Dropout 1D)的操作能够帮助提高特征图之间的独立性，隐含层中的高斯噪声层是为数据施加0均值，标准差为样本标准偏差的加性高斯噪声，该层在克服过拟合时比较有用高斯噪声是需要对输入数据进行破坏时的自然选择，隐含层中的扁平化处理是将输入压平，即将多维的输入一维化，常用在从卷积层到全连接层的过渡，在搭建卷积神经网络后，通过海量的正常业务数据和攻击数据对模型进行训练，待模型收敛完成后就具备了自动识别正常业务数据和攻击数据的能力，训练迭代过程中所使用的损失函数参见公式(1)：
H(y，t)＝H t(y)＝-∑ it ilogy i          (1)
其中，t i是真实标签，表征真实类别，y i是通过神经网络模型进行分类处理得到的，H(y，t)是损失函数。
在一些实施例中，在执行步骤103之前，通过网络安全防护进程与神经网络模型之间的套接字连接，向神经网络模型发送每个会话的数据统计特征，以使神经网络模型进行分类处理，神经网络模型可以是运行神经网络模型的进程。在将待防护访问流量中被分类为异常的会话识别为攻击访问流量之前，还可以执行以下技术方案：通过网络安全防护进程与神经网络模型之间的套接字连接，接收神经网络模型返回的分类结果。
在步骤103中，服务器基于每个会话的数据统计特征，调用神经网络模型对每个会话进行正常或异常的分类处理。
在一些实施例中，这里服务器中部署有网络安全防护系统，网络安全防护进程与神经网络模型(即运行神经网络模型的进程)进行通信，神经网络模型包括级联的嵌入层、隐含层和全连接层；步骤103中基于每个会话的数据统计特征，调用神经网络模型对每个会话进行正常或异常的分类处理，例如，可以针对每个会话执行过以下技术方案以对每个会话进行分类：通过神经网络模型的嵌入层接收会话的数据统计特征，并传输到隐含层；通过神经网络模型的隐含层从所接收的数据统计特征中提取隐含层特征，并传输到全连接层；通过神经网络模型的全连接层将所接收的隐含层特征映射为正常类别概率和异常类别概率；其中，正常类别概率和异常类别概率中的较大值对应的类别为会话的分类结果。
作为示例，全连接层在整个神经网络模型中起到“分类器”的作用，如果说卷积层、池化层等操作是将原始数据映射到隐层特征空间的话，全连接层则起到将学到的“分布式特征表示”映射到样本标记空间的作用。在实际使用中，全连接层可由卷积操作实现：对前层是全连接的全连接层可以转化为卷积核为1x1的卷积；而前层是卷积层的全连接层可以转化为卷积核为高x宽的全局卷积，高和宽分别为前层卷积结果的高和宽，全连接的核心操作就是矩阵向量乘积，本质就是由一个特征空间线性变换到另一个特征空间，全连接层常出现在最后几层，用于对前面涉及的特征进行加权求和处理。
在一些实施例中，隐含层包括：批量标准化层、卷积层和池化层；通过隐含层从所接收的数据统计特征中提取隐含层特征，包括：通过批量标准化层对所接收的数据统计特征的激活值进行标准化处理，得到满足正态分布的数据统计特征；通过卷积层对批量标准化层输出的数据统计特征进行特征提取处理，得到对应数据统计特征的卷积层特征；通过池化层对卷积层输出的卷积层特征进行采样处理，得到对应数据统计特征的隐含层特征。
作为示例，批量标准化层在每批训练样本集合上将前一层的激活值重新规 范化，即使得其输出数据的均值接近0，其标准差接近1，即形成正态分布，神经网络模型中卷积层以及池化层会存在三轮迭代，卷积层用于进行特征提取得到特征图，池化层对输入的特征图进行压缩，一方面使特征图变小，简化网络计算复杂度；一方面进行特征压缩，提取主要特征。
在步骤104中，服务器将待防护访问流量中被分类为异常的会话识别为攻击访问流量。
在一些实施例中，服务器中部署有网络安全防护系统，网络安全防护系统中的网络安全防护进程接收神经网络的分类结果，在神经网络模型进行分类时会输出待防护访问流量中每个会话属于异常的会话的概率以及属于正常的会话的概率，当属于异常的会话的概率超过属于正常的会话的概率时，将该会话分类为异常的会话，且识别为攻击访问流量。
在步骤105中，服务器获取攻击访问流量的来源地址，对发送到、且来自来源地址的目标网络地址的攻击访问流量进行屏蔽处理。
在一些实施例中，当待防护访问流量是通过牵引路由规则从路由器引导得到时，步骤105中对发送到目标网络地址、且来自来源地址的攻击访问流量进行屏蔽处理，可以通过以下技术方案实现：将待防护访问流量中的攻击访问流量进行过滤，将过滤后得到的正常访问流量发送到路由器，以使路由器进行转发；将来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理；其中，新访问流量是网络服务提供方在待防护访问流量之后向目标网络地址发送的，新访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求。
作为示例，将通过牵引规则获取的流量作为待防护访问流量，可以保证不漏过每一个数据包，即从核心路由器获取每一个数据包，并对每一个数据包进行攻击流量识别后，再进行相应的攻击流量屏蔽以及正常流量的转发行为，虽然相对于针对镜像流量进行识别的方案相比，将通过牵引规则获取的流量作为待防护访问流量的网络传输速度略微降低，但是能够保证不漏过任何一个攻击流量的数据包。
在一些实施例中，当待防护访问流量是通过牵引路由规则从路由器引导得到时，这里待防护访问流量是没有经过镜像的原始流量，这里将待防护访问流量中的攻击访问流量进行过滤，将过滤后得到的正常访问流量发送到路由器，以使路由器将其转发到到达目标网络地址的下一跳路由器，以上过程属于正常流量的回注过程，同时也将获得的来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理，这里还可以不将来源地址发送到路由器，而是再次从路由器将新访问流量牵引到网络安全防护系统，由网络安全防护系统将来自来源地址的新访问流量进行丢包处理，将不是来自来源地址的新访问流量发送到路由器，以使路由器将其转发到到达目标网络地址的下一跳路由器。
在一些实施例中，当待防护访问流量是从路由器接收的镜像流量时，步骤105中对发送到目标网络地址、且来自来源地址的攻击访问流量进行屏蔽处理，可以通过以下技术方案实现，将来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理；其中，新访问流量是网络服务提供方在待防护访问流量之后向目标网络地址发送的，新访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求。
作为示例，将镜像流量作为待防护访问流量，属于旁路监控模式，旁路部署方案是对当前网络影响最小的监控模式，不会影响现有的网络结构，不会对网速造成任何影响。旁路模式分析的是镜像端口拷贝过来的数据，对原始数据包不会造成延时，对应镜像流量的原始流量可以被正常的屏蔽和转发，并不会等待网络安全防护系统对镜像流量的识别结果出来之后再对对应镜像流量的原始流量进行屏蔽和转发。
在一些实施例中，由于这里进行识别的对象是镜像流量，因此不能直接对镜像流量进行流量回注，而是基于来源地址进行流量清洗，流量清洗的方式可以是将来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理，还可以不将来源地址 发送到路由器，而是再次从路由器将新访问流量牵引到网络安全防护系统，由网络安全防护系统将来自来源地址的新访问流量进行丢包处理，将不是来自来源地址的新访问流量发送到路由器，以使路由器将其转发到到达目标网络地址的下一跳路由器。
在一些实施例中，向区块链网络发送查询交易，其中，查询交易指示了用于查询区块链网络中账本的智能合约以及查询参数，以使区块链网络中的共识节点通过执行对应的智能合约来查询账本中记录的多个网络安全防护系统上报的目标网络地址，攻击访问流量的来源地址，得到账本中符合查询参数的网络安全防护系统上报的目标网络地址，攻击访问流量的来源地址，还可以向区块链网络发送更新交易，其中，更新交易指示了用于更新账本的智能合约、以及网络安全防护系统所识别出来的新的目标网络地址，攻击访问流量的来源地址，以使区块链网络中的共识节点通过执行用于更新账本的智能合约，将网络安全防护系统所识别出来的新的目标网络地址，攻击访问流量的来源地址更新到账本中，以供安全防护系统或者路由器进行查询和使用。
在一些实施例中，参见图3C，图3C是本申请实施例提供的基于人工智能的网络安全防护方法的交互流程图，由安全服务器中部署的攻击检测系统执行步骤301-303，在步骤301中，安全服务器中部署的攻击检测系统从路由器获取发送到目标网络地址的访问流量进行复制形成的镜像流量作为待检测流量，在步骤302中，对待检测流量进行攻击检测，在步骤303中，当检测到攻击行为时，攻击检测系统发送告警通知到控制系统，由控制系统执行步骤304，在步骤304中，将告警通知转发至网络安全防护系统，由网络安全防护系统执行步骤305-307以及步骤309，在步骤305中，网络安全防护系统从路由器获取访问流量的镜像流量作为待防护访问流量或者通过牵引获取访问流量作为待防护访问流量，在步骤306中，对待防护访问流量进行攻击流量识别处理，以获取恶意地址，网络安全防护系统对待防护访问流量进行数据提取，通过网络安全防护系统中的网络安全进程与神经网络模型通信，由神经网络模型对每个会话的数据统计特征提取隐含层特征，以基于隐含层特征对每个会话进行正常或异常 的分类处理，并将待防护访问流量中被分类为异常的会话识别为攻击访问流量，从而获取攻击访问流量的来源地址作为恶意地址，网络安全防护系统从路由器中进行访问流量的牵引，再对来源于恶意地址的攻击流量进行屏蔽，对正常流量进行转发，在步骤307中，当进行识别的待防护访问流量为镜像流量时，将恶意源地址发送至路由器，以使路由器执行步骤308，在步骤308中，路由器对来自于恶意源地址的流量进行拦截，在步骤309中，当获取的待防护访问流量是牵引获得访问流量时，将攻击流量进行丢包处理，并将正常流量回注至路由器。以使路由器执行步骤310，在步骤310中，路由器将正常流量进行转发。
下面，将说明本申请实施例在应用层的网络安全防护场景的示例性应用。
在一些实施例中，社交网络的正常访问流量是普通用户的访问所构成的访问流量，攻击流量是黑客搭建服务器模拟普通用户的访问来使社交网络的业务服务器响应变慢或宕机以达到恶意目的，作为示例，响应于用户的终端接收到用户刷新社交网络信息流的刷新操作，终端将针对业务服务器的信息刷新请求承载于访问流量上以发送至网络服务提供方，网络服务提供方将访问流量发送至核心路由器，由核心路由器将访问流量转发至业务服务器的网络地址(即目标网络地址)。为了防止访问流量中存在攻击流量对业务服务器进行攻击，需要通过安全服务器对访问流量进行识别与清洗，将待防护访问流量中被分类为异常的会话识别为攻击访问流量，从而获取攻击访问流量的来源地址作为恶意地址，并将来源与恶意地址的流量进行屏蔽处理，将来源不是恶意地址的正常流量回注到核心路由器，由核心路由器将其转发到目标网络地址(业务服务器的网络地址)，业务服务器将信息刷新结果承载于返回流量，并将返回流量通过网络服务提供方返回至终端，在终端中呈现信息刷新结果，通过对上述攻击流量进行识别以及屏蔽处理，保证了社交网络的业务服务器的正常运行。
下面说明识别上述攻击访问流量的过程。
本申请实施例提供的基于人工智能的网络安全防护方法是通过包括正常流量数据与异常流量数据的旁路数据，不断迭代训练卷积神经网络模型，使其具 有判断正常流量及异常流量的能力，模型训练成熟后部署在现网网络安全防护系统中进行防护，所以本申请实施例提供的基于人工智能的网络安全防护方法主要包括卷积神经网络模型训练以及网络安全防护系统部署两个方面。
参见图4，图4是本申请实施例提供的基于人工智能的网络安全防护方法中神经网络模型训练架构图，神经网络模型的训练流程如下，首先通过旁路抓包方式采集正常业务抓包和攻击抓包，旁路抓包指的是通过旁路进行网络流量的观测的方式，从而不会影响网络流量是在主干道流通，接着上述抓包被数据提取模块提取整合成正常的会话数据样本和异常的会话数据样本，正常的会话数据样本和异常的会话数据样本分别打上不同标签，用于神经网络模型训练，接着通过海量的正常的会话数据样本和异常的会话数据样本不断训练后，卷积神经网络趋于成熟，从而具备了自动识别正常业务流量和攻击流量的能力，模型成熟后将部署在网络安全防护系统中用于实际攻击的防护。
接下来将详细说明数据提取模块的实现原理以及神经网络模型的搭建方法，数据提取模块从抓包文件中提取数据，并且为各个数据分配标签，正常业务数据的标签为0，攻击数据的标签为1，作为用于训练神经网络模型的训练数据，具体步骤如下：在抓包文件中提取每个报文的基本数据特征：SSL协议版本、握手版本、SSL包长、加密套件长度、加密套件、组长度、组内容、扩展长度、支持扩展数；通过对每个报文的基本数据特征进行分析，提取出各基本特征在攻击包和正常包中聚集的众数，进一步提取特征如下表1，表1是本申请实施例提供的基于人工智能的网络安全防护方法的数据特征提取表格，这些数据就可以作为卷积神经网络的输入数据，第一栏部分是协议的基本特征，可直接从协议流量的抓包文件中提取，第二栏和第三栏部分为对第一栏中的基本特征的进一步统计分析得到的二次特征，分别分析了正常和异常样本的各基本特征的聚集值即众数，并计算每个样本与众数的绝对距离。
Figure PCTCN2021077170-appb-000001
Figure PCTCN2021077170-appb-000002
表1数据特征提取表格
参见图5，图5是本申请实施例提供的基于人工智能的网络安全防护方法中的抓包示意图，数据包中包括了所抓取数据包的SSL协议版本501、握手版本502、SSL包长、加密套件长度506、加密套件503、组长度和内容505、扩展内容507、扩展长度504以及支持扩展数，例如，包长为326，SSL协议版本为TLS1.0，握手版本为TLS2.0，加密套件长度为148，扩展长度为133，组长度为52，参见图6，图6是本申请实施例提供的基于人工智能的网络安全防护方法的神经网络模型架构图，神经网络模型中有嵌入层(Embedding)、常用层、卷积层(Conv1D)、池化层(Maxpooling1D)以及全连接层(Dense()层)，其中，嵌入层作为神经网络模型的第一层，用于固定输入维度，卷积层用于提取特征，池化层用于对特征进行采样，全连接层用于将学到的分布式特征表示映射到样本标记空间，以作为分类器，常用层中批量标准化层(BatchNormalization)进行均衡化处理，即在每批训练样本集合上将前一层的激活值重新规范化，即使得其输出数据的均值接近0，其标准差接近1，常用层中的随机失活层 (Spatial Dropout 1D)与普通随机失活操作(Dropout操作)的作用类似，但它断开的是整个1D特征图，而不是单个神经元，如果一张特征图的相邻元素之间有很强的相关性(通常发生在低层的卷积层中)，那么普通的dropout无法正则化其输出，否则就会导致明显的学习率下降，这种情况下Spatial Dropout1D能够帮助提高特征图之间的独立性，卷积层、随机失活层与池化层会存在三轮迭代，常用层中高斯噪声层(GaussianNoise)的高斯噪声处理是为数据施加0均值，标准差为stddev的加性高斯噪声，该层在克服过拟合时比较有用高斯噪声是需要对输入数据进行破坏时的自然选择，常用层中展开层(Flatten()层)的扁平化处理是将输入压平，即将多维的输入一维化，常用在从卷积层到全连接层的过渡，全连接层(Dense()层)也存在三轮迭代，在搭建卷积神经网络后，通过海量的正常业务数据和攻击数据对模型进行训练，待模型收敛完成后就具备了自动识别正常业务数据和攻击数据的能力，训练迭代过程中所使用的损失函数参见公式(2)：
H(y，t)＝H t(y)＝-∑ it ilogy i          (2)
参见图7，图7是本申请实施例提供的基于人工智能的网络安全防护方法的防护系统部署架构图，DDoS防护流程涉及：攻击检测系统、控制系统、网络安全防护系统，检测防护流程如下，当核心路由器接收到来自于网络服务提供方的访问流量时，核心路由器通过分光，把镜像流量转发到攻击检测系统以进行攻击检测，当攻击检测系统检测到攻击之后，会产生告警到控制系统，网络安全防护系统接收到来自控制系统的告警，会通过与核心路由器建立的边界网关协议向核心路由器发布被攻击IP地址的牵引路由以实现边界网关牵引，通过网络安全防护系统对旁路抓包获取的镜像流量(包括正常流量和攻击流量)进行识别，获取到攻击流量的来源地址作为恶意地址(例如，IP地址)，网络安全防护系统根据识别结果将被牵引到网络安全防护系统上的访问流量中的攻击流量进行清洗，并把正常流量回注到核心路由器，再转发到核心的网关，再进一步转发到目标网络地址的业务服务器上，这里神经网络模型在完成训练后 将部署在网络安全防护系统中。
下面继续说明攻击流量的清洗过程，当被保护IP地址遭受到攻击后，通向这个IP地址的所有流量(包括正常流量和攻击流)都被牵引到网络安全防护系统上，网络安全防护系统会对攻击流量进行识别和清洗，最后把正常流量回注到服务器上，攻击流量的清洗方法如下：参见图8，图8是本申请实施例提供的基于人工智能的网络安全防护方法的进程通信示意图，在网络安全防护系统中部署DDoS防护进程(网络安全防护进程)和神经网络模型，DDoS防护进程与神经网络模型通过套接字(socket)进行通信，DDoS防护进程在防护过程中采集当前流量中的所有特征数据(数据采集统计方式与数据提取模块的实现方式一样)，并发送到神经网络模型，神经网络模型对待检测数据判断，会在每个会话数据打上结果标签，并把这个结果输出到DDoS防护进程，一个会话包含多个数据包，会话指具备相同的源IP、目的IP、源端口、目的端口、协议的一组数据包的集合，DDoS防护进程会基于这些结果来做清洗，针对被识别为异常报文的源IP，DDoS防护进程会将其拉黑，即这个来源IP的所有报文将被丢弃，正常来源IP的报文会被神经网络模型识别成正常，所有正常来源IP不会被拉黑，所以来源于这些IP的流量会被DDoS防护进程转发到服务器，通过上述步骤，就可以完成对攻击流量的识别和清洗，并将正常流量转发到服务器上，实际是服务器中运行DDoS防护进程，并通过该进程与服务器中神经网络模型(即模型的运行实例)之间进行数据交互，从而使神经网络模型完成流量识别，相比于相关技术中“模型与进程”耦合的方案进行了解耦改进，通过DDoS防护进程与神经网络模型的解耦，神经网络模型可以灵活下线、暂停或更新，而不需要将整个防护功能关停，从而避免了重新上线所导致的防护延迟。
本申请实施例提供的基于人工智能的网络安全防护方法是一种基于卷积神经网络的HTTPS CC攻击的不解密识别防护方案，可以作为现网DDoS防护算法体系中的有效补充，通过海量的旁路数据训练神经网络模型，模型训练成熟后就具有自动判断正常流量和攻击流量的能力，从而对HTTPS CC实现高效准确的清洗，保障被攻击服务器业务稳定，保证正常业务不受影响，同时，本方 案不需要服务器/客户端做任何改造即可接入，具有很好的兼容性，另一方面，相对于相关技术中的大数据方案，机器学习算法通过合适的算法建模，可以在无规则的情况下实现分类，泛化能力强，基于大量数据进行自动化学习和训练，不依赖基线，对于新上线业务也能进行防护，因此，神经网络模型对现网防护能力提升具有重要意义，除了使用本申请实施例提供的网络安全防护方法还可以使用其他机器学习算法来搭建神经网络模型。
下面继续说明本申请实施例提供的基于人工智能的网络安全防护装置255的实施为软件模块的示例性结构，在一些实施例中，如图2所示，存储在存储器250的基于人工智能的网络安全防护装置255中的软件模块可以包括：流量获取模块2551，配置为获取发送到目标网络地址的待防护访问流量；数据提取模块2552，配置为针对待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；流量分类模块2553，配置为基于每个会话的数据统计特征，调用神经网络模型对每个会话进行正常或异常的分类处理；流量识别模块2554，配置为将待防护访问流量中被分类为异常的会话识别为攻击访问流量；流量清洗模块2555，配置为获取攻击访问流量的来源地址，对发送到目标网络地址、且来自来源地址的攻击访问流量进行屏蔽处理。
在一些实施例中，流量获取模块2551，还配置为：向路由器发送镜像流量请求，其中镜像流量请求携带目标网络地址，以使路由器在对发送到目标网络地址的访问流量进行路由时，对访问流量进行复制得到访问流量的镜像流量，其中访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求；接收路由器发送的镜像流量，以作为待防护访问流量。
在一些实施例中，流量获取模块2551，还配置为：向路由器发送牵引路由规则，其中牵引路由规则携带目标网络地址和牵引目标网络地址，以使路由器将发送到目标网络地址的访问流量引导至牵引目标网络地址，其中访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求；接收路由器引导至牵引目标网络地址的访问流量，以作为待防护访问流量。
在一些实施例中，流量分类模块2553，还配置为：通过网络安全防护进程与神经网络模型之间的套接字连接，向神经网络模型发送每个会话的数据统计特征；通过网络安全防护进程与神经网络模型之间的套接字连接，接收神经网络模型返回的分类结果。
在一些实施例中，获取发送到目标网络地址的待防护访问流量之前，流量获取模块2551，还配置为：从路由器获取发送到目标网络地址的待检测访问流量，待检测访问流量是发送到目标网络地址的访问流量进行复制形成的镜像流量；对待检测访问流量进行攻击行为模式匹配，当匹配到攻击行为时，确定需要获取发送到目标网络地址的待防护访问流量。
在一些实施例中，数据提取模块2552，还配置为：针对待防护访问流量中包括的多个会话，提取出每个会话包括的多个数据包；从每个会话包括的多个数据包中，提取以下至少一个维度的数据特征：数据包的传输过程所应用的安全套接层的协议版本；数据包的传输过程所应用的握手版本；数据包的传输过程所应用的安全套接层的包长；数据包的加密套件长度；数据包的加密套件；数据包的组长度；数据包的组内容；数据包的扩展长度；数据包的支持扩展数；从每个会话的至少一个维度的数据特征中，提取对应的数据统计特征。
在一些实施例中，数据提取模块2552，还配置为：获取正常会话样本中各个维度的数据特征的正常众数、以及异常会话样本中各个维度的数据的异常众数；确定每个会话的至少一个维度的数据特征与对应维度的正常众数之间的距离，以作为对应维度的正常绝对距离；确定每个会话的至少一个维度的数据特征与对应维度的异常众数之间的距离，以作为对应维度的异常绝对距离；将针对每个会话所确定的至少一个维度的正常绝对距离和异常绝对距离，组合为对应会话的数据统计特征。
在一些实施例中，神经网络模型包括级联的嵌入层、隐含层和全连接层；流量分类模块，流量分类模块2553，还配置为：针对每个会话执行以下处理：通过嵌入层接收会话的数据统计特征，并传输到隐含层通过隐含层从所接收的数据统计特征中提取隐含层特征，并传输到全连接层；通过全连接层将所接收 的隐含层特征映射为正常类别概率和异常类别概率；其中，正常类别概率和异常类别概率中的较大值对应的类别为会话的分类结果。
在一些实施例中，隐含层包括：批量标准化层、卷积层和池化层；流量分类模块2553，还配置为：通过批量标准化层对所接收的数据统计特征的激活值进行标准化处理，得到满足正态分布的数据统计特征；通过卷积层对批量标准化层输出的数据统计特征进行特征提取处理，得到对应数据统计特征的卷积层特征；通过池化层对卷积层输出的卷积层特征进行采样处理，得到对应数据统计特征的隐含层特征。
在一些实施例中，当待防护访问流量是通过牵引路由规则从路由器引导得到时，流量清洗模块2555，还配置为：将待防护访问流量中的攻击访问流量进行过滤，将过滤后得到的正常访问流量发送到路由器，以使路由器进行转发；将来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理；其中，新访问流量是网络服务提供方在待防护访问流量之后向目标网络地址发送的，新访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求。
在一些实施例中，当待防护访问流量是从路由器接收的镜像流量时，流量清洗模块2555，还配置为：将来源地址发送到路由器，以使路由器将来自来源地址的新访问流量识别为新攻击访问流量，并对新攻击访问流量进行屏蔽处理；其中，新访问流量是网络服务提供方在待防护访问流量之后向目标网络地址发送的，新访问流量包括网络服务提供方的签约用户发送到目标网络地址的网络请求。
在一些实施例中，装置255还包括：训练模块2556，配置为：基于每个会话的数据统计特征，调用神经网络模型对每个会话进行正常或异常的分类处理之前，通过从路由器旁路抓包的方式获取会话样本，并将预标记的正常会话样本和异常会话样本组合为训练样本集合；初始化神经网络模型，并初始化包括会话样本以及对应会话样本的分类结果的损失函数；在神经网络模型每次迭代训练过程中执行以下处理：通过神经网络模型，对训练样本集合包括的会话样 本进行分类处理，得到对应会话样本的分类结果；将对应会话样本的真实类别和分类结果代入损失函数，以确定损失函数取得最小值时对应的神经网络模型参数；根据所确定的神经网络模型参数更新神经网络模型。
本申请实施例提供一种存储有可执行指令的存储介质，其中存储有可执行指令，当可执行指令被处理器执行时，将引起处理器执行本申请实施例提供的基于人工智能的网络安全防护方法，例如，如图3A-3C示出的基于人工智能的网络安全防护方法。
在一些实施例中，存储介质可以是FRAM、ROM、PROM、EPROM、EEPROM、闪存、磁表面存储器、光盘、或CD-ROM等存储器；也可以是包括上述存储器之一或任意组合的各种设备。
在一些实施例中，可执行指令可以采用程序、软件、软件模块、脚本或代码的形式，按任意形式的编程语言(包括编译或解释语言，或者声明性或过程性语言)来编写，并且其可按任意形式部署，包括被部署为独立的程序或者被部署为模块、组件、子例程或者适合在计算环境中使用的其它单元。
作为示例，可执行指令可以但不一定对应于文件系统中的文件，可以可被存储在保存其它程序或数据的文件的一部分，例如，存储在超文本标记语言(HTML，Hyper Text Markup Language)文档中的一个或多个脚本中，存储在专用于所讨论的程序的单个文件中，或者，存储在多个协同文件(例如，存储一个或多个模块、子程序或代码部分的文件)中。
作为示例，可执行指令可被部署为在一个计算设备上执行，或者在位于一个地点的多个计算设备上执行，又或者，在分布在多个地点且通过通信网络互连的多个计算设备上执行。
综上，通过本申请实施例对数据统计层面的众数特征，而不依赖反应内容的信息层面的特征来识别攻击访问流量，因此识别不受流量报文是否加密的影响，从而能够实现兼容加密和不加密攻击访问流量的识别，基于识别结果获取攻击访问流量的来源地址，以对发送到目标网络地址的攻击访问流量进行屏蔽 处理，从而能够实现兼容加密和不加密攻击访问流量的清洗。
以上，仅为本申请的实施例而已，并非用于限定本申请的保护范围。凡在本申请的精神和范围之内所作的任何修改、等同替换和改进等，均包含在本申请的保护范围之内。

Claims (15)

  1. 一种基于人工智能的网络安全防护方法，所述方法由电子设备执行，所述方法包括：
    获取发送到目标网络地址的待防护访问流量；
    针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；
    基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理；
    将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量；
    获取所述攻击访问流量的来源地址，对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理。
  2. 根据权利要求1所述的方法，其中，所述获取发送到目标网络地址的待防护访问流量，包括：
    向路由器发送镜像流量请求，其中所述镜像流量请求携带所述目标网络地址，以使所述路由器执行以下操作：在对发送到所述目标网络地址的访问流量进行路由时，对所述访问流量进行复制得到所述访问流量的镜像流量，其中所述访问流量包括网络服务提供方的签约用户发送到所述目标网络地址的网络请求；
    接收所述路由器发送的所述镜像流量，以作为所述待防护访问流量。
  3. 根据权利要求1所述的方法，其中，所述获取发送到目标网络地址的待防护访问流量，包括：
    向路由器发送牵引路由规则，其中所述牵引路由规则携带所述目标网络地址和牵引目标网络地址，以使所述路由器执行以下操作：将发送到所述目标网络地址的访问流量引导至所述牵引目标网络地址，其中所述访问流量包括网络服务提供方的签约用户发送到所述目标网络地址的网络请求；
    接收所述路由器引导至所述牵引目标网络地址的所述访问流量，以作为所 述待防护访问流量。
  4. 根据权利要求1所述的方法，其中，所述提取每个会话的数据统计特征之后，所述方法还包括：
    通过网络安全防护进程与所述神经网络模型之间的套接字连接，向所述神经网络模型发送所述每个会话的数据统计特征；
    在将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量之前，所述方法还包括：
    通过所述网络安全防护进程与所述神经网络模型之间的套接字连接，接收所述神经网络模型返回的分类结果。
  5. 根据权利要求1所述的方法，其中，所述获取发送到目标网络地址的待防护访问流量之前，所述方法还包括：
    从路由器获取发送到所述目标网络地址的待检测访问流量，所述待检测访问流量是发送到所述目标网络地址的访问流量进行复制形成的镜像流量；
    对所述待检测访问流量进行攻击行为模式匹配，当匹配到攻击行为时，确定需要获取发送到所述目标网络地址的待防护访问流量。
  6. 根据权利要求1所述的方法，其中，所述针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征，包括：
    针对所述待防护访问流量中包括的多个会话，提取出每个会话包括的多个数据包；
    从所述每个会话包括的多个数据包中，提取以下至少一个维度的数据特征：
    所述数据包的传输过程所应用的安全套接层的协议版本；所述数据包的传输过程所应用的握手版本；所述数据包的传输过程所应用的安全套接层的包长；所述数据包的加密套件长度；所述数据包的加密套件；所述数据包的组长度；所述数据包的组内容；所述数据包的扩展长度；所述数据包的支持扩展数；
    从所述每个会话的至少一个维度的数据特征中，提取对应的数据统计特征。
  7. 根据权利要求6所述的方法，其中，所述从所述每个会话的至少一个维度的数据特征中，提取对应的数据统计特征，包括：
    获取正常会话样本中各个维度的数据特征的正常众数、以及异常会话样本中各个维度的数据的异常众数；
    确定所述每个会话的至少一个维度的数据特征与对应维度的正常众数之间的距离，以作为对应维度的正常绝对距离；
    确定所述每个会话的至少一个维度的数据特征与对应维度的异常众数之间的距离，以作为对应维度的异常绝对距离；
    将针对每个会话所确定的至少一个维度的正常绝对距离和异常绝对距离，组合为对应会话的数据统计特征。
  8. 根据权利要求1所述的方法，其中，
    所述神经网络模型包括级联的嵌入层、隐含层和全连接层；
    所述基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理，包括：
    针对所述每个会话执行以下处理：
    通过所述嵌入层接收所述会话的数据统计特征，并传输到所述隐含层；
    通过所述隐含层从所接收的数据统计特征中提取隐含层特征，并传输到全连接层；
    通过所述全连接层将所接收的隐含层特征映射为正常类别概率和异常类别概率；
    其中，所述正常类别概率和异常类别概率中的较大值对应的类别为所述会话的分类结果。
  9. 根据权利要求8所述的方法，其中，
    所述隐含层包括：批量标准化层、卷积层和池化层；
    所述通过所述隐含层从所接收的数据统计特征中提取隐含层特征，包括：
    通过所述批量标准化层对所接收的数据统计特征的激活值进行标准化处理，得到满足正态分布的数据统计特征；
    通过所述卷积层对所述批量标准化层输出的数据统计特征进行特征提取处理，得到对应所述数据统计特征的卷积层特征；
    通过所述池化层对所述卷积层输出的卷积层特征进行采样处理，得到对应所述数据统计特征的隐含层特征。
  10. 根据权利要求1至9任一项所述的方法，其中，当所述待防护访问流量是通过牵引路由规则从路由器引导得到时，所述对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理，包括：
    将所述待防护访问流量中的所述攻击访问流量进行过滤，将过滤后得到的正常访问流量发送到所述路由器，以使所述路由器进行转发；
    将所述来源地址发送到所述路由器，以使所述路由器将来自所述来源地址的新访问流量识别为新攻击访问流量，并对所述新攻击访问流量进行屏蔽处理；
    其中，所述新访问流量是网络服务提供方在所述待防护访问流量之后向所述目标网络地址发送的，所述新访问流量包括所述网络服务提供方的签约用户发送到所述目标网络地址的网络请求。
  11. 根据权利要求1至9任一项所述的方法，其中，当所述待防护访问流量是从路由器接收的镜像流量时，所述对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理，包括：
    将所述来源地址发送到所述路由器，以使所述路由器将来自所述来源地址的新访问流量识别为新攻击访问流量，并对所述新攻击访问流量进行屏蔽处理；
    其中，所述新访问流量是网络服务提供方在所述待防护访问流量之后向所述目标网络地址发送的，所述新访问流量包括所述网络服务提供方的签约用户发送到所述目标网络地址的网络请求。
  12. 根据权利要求1至9任一项所述的方法，其中，所述通过神经网络模型对所述每个会话的数据统计特征提取隐含层特征，以基于所述隐含层特征对所述每个会话进行正常或异常的分类处理之前，所述方法还包括：
    通过从路由器旁路抓包的方式获取会话样本，并将预标记的正常会话样本和异常会话样本组合为训练样本集合；
    初始化所述神经网络模型，并初始化包括会话样本以及对应所述会话样本的分类结果的损失函数；
    在所述神经网络模型每次迭代训练过程中执行以下处理：
    通过所述神经网络模型，对所述训练样本集合包括的会话样本进行分类处理，得到对应所述会话样本的分类结果；
    将对应所述会话样本的真实类别和所述分类结果代入所述损失函数，以确定所述损失函数取得最小值时对应的神经网络模型参数；
    根据所确定的神经网络模型参数更新所述神经网络模型。
  13. 一种基于人工智能的网络安全防护装置，所述装置包括：
    流量获取模块，配置为获取发送到目标网络地址的待防护访问流量；
    数据提取模块，配置为针对所述待防护访问流量中包括的多个会话，提取每个会话的数据统计特征；
    流量分类模块，配置为基于所述每个会话的数据统计特征，调用神经网络模型对所述每个会话进行正常或异常的分类处理；
    流量识别模块，配置为将所述待防护访问流量中被分类为异常的会话识别为攻击访问流量；
    流量清洗模块，配置为获取所述攻击访问流量的来源地址，对发送到所述目标网络地址、且来自所述来源地址的攻击访问流量进行屏蔽处理。
  14. 一种电子设备，所述电子设备包括：
    存储器，用于存储可执行指令；
    处理器，用于执行所述存储器中存储的可执行指令时，实现权利要求1至12任一项所述的基于人工智能的网络安全防护方法。
  15. 一种计算机可读存储介质，存储有可执行指令，用于被处理器执行时，实现权利要求1至12任一项所述的基于人工智能的网络安全防护方法。
PCT/CN2021/077170 2020-03-30 2021-02-22 基于人工智能的网络安全防护方法、装置、电子设备 WO2021196911A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/702,766 US20220224706A1 (en) 2020-03-30 2022-03-23 Artificial intelligence-based network security protection method and apparatus, and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010234182.4A CN111131335B (zh) 2020-03-30 2020-03-30 基于人工智能的网络安全防护方法、装置、电子设备
CN202010234182.4 2020-03-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/702,766 Continuation US20220224706A1 (en) 2020-03-30 2022-03-23 Artificial intelligence-based network security protection method and apparatus, and electronic device

Publications (1)

Publication Number Publication Date
WO2021196911A1 true WO2021196911A1 (zh) 2021-10-07

Family

ID=70493852

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/077170 WO2021196911A1 (zh) 2020-03-30 2021-02-22 基于人工智能的网络安全防护方法、装置、电子设备

Country Status (3)

Country Link
US (1) US20220224706A1 (zh)
CN (1) CN111131335B (zh)
WO (1) WO2021196911A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205151A (zh) * 2021-12-12 2022-03-18 南京理工大学 基于多特征融合学习的http/2页面访问流量识别方法
CN114300146A (zh) * 2022-01-11 2022-04-08 大理楠诺互联网科技有限公司 一种应用于智慧医疗的用户信息安全处理方法及系统
CN114338853A (zh) * 2021-12-31 2022-04-12 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114500071A (zh) * 2022-02-10 2022-05-13 江苏大学 一种针对目标网站动态增长的自适应指纹攻击方法和系统
CN114726654A (zh) * 2022-05-25 2022-07-08 青岛众信创联电子科技有限公司 一种应对云计算网络攻击的数据分析方法及服务器

Families Citing this family (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111131335B (zh) * 2020-03-30 2020-08-28 腾讯科技（深圳）有限公司 基于人工智能的网络安全防护方法、装置、电子设备
CN111294365B (zh) * 2020-05-12 2020-08-18 腾讯科技（深圳）有限公司 攻击流量防护系统、方法、装置、电子设备和存储介质
CN112804230B (zh) * 2020-05-12 2023-01-24 上海有孚智数云创数字科技有限公司 分布式拒绝服务攻击的监控方法、系统、设备及存储介质
CN111861716B (zh) * 2020-07-23 2021-06-22 北京睿知图远科技有限公司 一种基于软件系统的贷中监控预警等级生成方法
TWI741698B (zh) * 2020-07-28 2021-10-01 中華電信股份有限公司 察覺惡意攻擊的方法及網路安全管理裝置
CN114158080B (zh) * 2020-08-17 2024-03-01 中国电信股份有限公司 监测方法、装置及计算机可读存储介质
CN112039871B (zh) * 2020-08-28 2022-04-19 绿盟科技集团股份有限公司 一种确定调用的网络防护设备的方法及装置
CN112506699A (zh) * 2020-11-25 2021-03-16 江苏恒信和安电子科技有限公司 一种数据安全备份方法、设备和系统
CN112738109A (zh) * 2020-12-30 2021-04-30 杭州迪普科技股份有限公司 一种Web攻击的检测方法及装置
CN112882696B (zh) * 2021-03-24 2024-02-02 国家超级计算天津中心 一种基于超级计算机的全要素模型训练系统
CN113132388B (zh) * 2021-04-21 2023-04-07 广东电网有限责任公司 一种数据安全交互方法及系统
CN112968915B (zh) * 2021-05-18 2021-08-06 卓尔智联(武汉)研究院有限公司 Dns域名服务器攻击的处理方法、处理系统、处理装置
CN113114541B (zh) * 2021-06-15 2021-09-14 上海兴容信息技术有限公司 一种判断网络节点之间能否建立网络连接的方法和系统
CN113630381A (zh) * 2021-07-05 2021-11-09 郑州云智信安安全技术有限公司 一种基于分布式与人工智能的双工赋能网络攻防的方法及系统
CN114186269A (zh) * 2021-12-06 2022-03-15 淄博云科互联网信息技术有限公司 基于人工智能的大数据信息安全防护方法及人工智能系统
CN114301698A (zh) * 2021-12-30 2022-04-08 北京天融信网络安全技术有限公司 流量数据库构建方法和流量检测模型训练方法
CN114866486A (zh) * 2022-03-18 2022-08-05 广州大学 一种基于数据包的加密流量分类系统
CN114553939B (zh) * 2022-04-25 2022-07-19 北京广通优云科技股份有限公司 一种it智能运维系统中基于加密流量的资源稳定切换方法
CN114710437B (zh) * 2022-06-07 2022-08-23 南京邮电大学 一种结合区块链的物联网边缘网络路由系统
CN116436649B (zh) * 2023-03-23 2024-02-09 北京神州安付科技股份有限公司 基于云服务器密码机的网络安全系统和方法
CN116471057A (zh) * 2023-03-29 2023-07-21 华能信息技术有限公司 一种恶意流量解析分析方法
CN116702152A (zh) * 2023-05-11 2023-09-05 李香 一种具有漏洞扫描功能的计算机安全防护管理系统
CN116668120A (zh) * 2023-06-01 2023-08-29 泰州市野徐太丰防护用品厂 基于访问习性分析的网络安全防护系统
CN117118749A (zh) * 2023-10-20 2023-11-24 天津奥特拉网络科技有限公司 一种基于个人通信网络的身份验证系统
CN117692207B (zh) * 2023-12-12 2024-05-03 国网湖北省电力有限公司鄂州供电公司 一种基于加权相似度匹配的指令级电力系统业务防护方法
CN117421729B (zh) * 2023-12-18 2024-04-26 湖南森鹰科技有限公司 一种自动化程序攻击检测方法、装置、系统及介质
CN117792800B (zh) * 2024-02-28 2024-05-03 四川合佳科技有限公司 一种基于物联网安全评估系统的信息验证方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109818970A (zh) * 2019-03-07 2019-05-28 腾讯科技（深圳）有限公司 一种数据处理方法及装置
US10341391B1 (en) * 2016-05-16 2019-07-02 EMC IP Holding Company LLC Network session based user behavior pattern analysis and associated anomaly detection and verification
CN111131335A (zh) * 2020-03-30 2020-05-08 腾讯科技（深圳）有限公司 基于人工智能的网络安全防护方法、装置、电子设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9948666B2 (en) * 2016-02-09 2018-04-17 International Business Machines Corporation Forecasting and classifying cyber-attacks using analytical data based neural embeddings
US20190019058A1 (en) * 2017-07-13 2019-01-17 Endgame, Inc. System and method for detecting homoglyph attacks with a siamese convolutional neural network
US11265168B2 (en) * 2018-03-07 2022-03-01 Private Identity Llc Systems and methods for privacy-enabled biometric processing
CN110247930B (zh) * 2019-07-01 2020-05-12 北京理工大学 一种基于深度神经网络的加密网络流量识别方法
CN110719275B (zh) * 2019-09-30 2021-04-02 南方电网科学研究院有限责任公司 一种基于报文特征的电力终端漏洞攻击检测方法
CN110855682A (zh) * 2019-11-18 2020-02-28 南京邮电大学 网络攻击检测方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10341391B1 (en) * 2016-05-16 2019-07-02 EMC IP Holding Company LLC Network session based user behavior pattern analysis and associated anomaly detection and verification
CN109818970A (zh) * 2019-03-07 2019-05-28 腾讯科技（深圳）有限公司 一种数据处理方法及装置
CN111131335A (zh) * 2020-03-30 2020-05-08 腾讯科技（深圳）有限公司 基于人工智能的网络安全防护方法、装置、电子设备

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205151A (zh) * 2021-12-12 2022-03-18 南京理工大学 基于多特征融合学习的http/2页面访问流量识别方法
CN114338853A (zh) * 2021-12-31 2022-04-12 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114338853B (zh) * 2021-12-31 2022-09-20 西南民族大学 一种工业互联网下的区块链流量监检测方法
CN114300146A (zh) * 2022-01-11 2022-04-08 大理楠诺互联网科技有限公司 一种应用于智慧医疗的用户信息安全处理方法及系统
CN114300146B (zh) * 2022-01-11 2023-03-31 贵州云上医疗科技管理有限公司 一种应用于智慧医疗的用户信息安全处理方法及系统
CN114500071A (zh) * 2022-02-10 2022-05-13 江苏大学 一种针对目标网站动态增长的自适应指纹攻击方法和系统
CN114500071B (zh) * 2022-02-10 2024-04-16 江苏大学 一种针对目标网站动态增长的自适应指纹攻击方法和系统
CN114726654A (zh) * 2022-05-25 2022-07-08 青岛众信创联电子科技有限公司 一种应对云计算网络攻击的数据分析方法及服务器
CN114726654B (zh) * 2022-05-25 2022-12-06 北京徽享科技有限公司 应对云计算网络攻击的数据分析方法及服务器

Also Published As

Publication number Publication date
CN111131335A (zh) 2020-05-08
US20220224706A1 (en) 2022-07-14
CN111131335B (zh) 2020-08-28

Similar Documents

Publication Publication Date Title
WO2021196911A1 (zh) 基于人工智能的网络安全防护方法、装置、电子设备
US20230074151A1 (en) Multi-representational learning models for static analysis of source code
US8635697B2 (en) Method and system for operating system identification in a network based security monitoring solution
US8561188B1 (en) Command and control channel detection with query string signature
US20150215334A1 (en) Systems and methods for generating network threat intelligence
CN114679338A (zh) 一种基于网络安全态势感知的网络风险评估方法
TW201703483A (zh) 用於改善分散式網路中分析之方法及系統
Gu et al. A novel website fingerprinting attack against multi-tab browsing behavior
CN111565203B (zh) 业务请求的防护方法、装置、系统和计算机设备
CN110362992A (zh) 在基于云端环境中阻挡或侦测计算机攻击的方法和设备
WO2016164403A1 (en) Systems and methods for generating network threat intelligence
CN114338064B (zh) 识别网络流量类型的方法、装置、系统、设备和存储介质
Huang et al. An authentication scheme to defend against UDP DrDoS attacks in 5G networks
Blostein et al. Detection of small moving objects in image sequences using multistage hypothesis testing
Jeyanthi Internet of things (iot) as interconnection of threats (iot)
Lu et al. Integrating traffics with network device logs for anomaly detection
Aslam et al. ONOS flood defender: An intelligent approach to mitigate DDoS attack in SDN
JP2006067605A (ja) 攻撃検知装置および攻撃検知方法
Yen Detecting stealthy malware using behavioral features in network traffic
EP4033717A1 (en) Distinguishing network connection requests
CN108737332A (zh) 一种基于机器学习的中间人攻击预测方法
Hwa et al. Review of peer-to-peer botnets and detection mechanisms
CN116668051A (zh) 攻击行为的告警信息处理方法、装置、程序、电子及介质
Modi et al. Design and implementation of RESTFUL API based model for vulnerability detection and mitigation
Althobiti et al. Machine Learning approach to Secure Software Defined Network: Machine Learning and Artificial Intelligence

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21780588

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 16/02/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21780588

Country of ref document: EP

Kind code of ref document: A1