CN102821002B - Network flow abnormal detecting method and system - Google Patents

Abstract

The invention discloses a method and system for detecting network traffic anomalies. The method includes: monitoring the traffic in the network, extracting basic feature data of the network traffic; determining combined feature data of selected attack behaviors according to the extracted basic feature data, Wherein, the combined feature data is a subset of the basic feature data; input the determined combined feature data into the corresponding flow model of the selected attack behavior to obtain an output result; the flow model is based on the data in the sample feature library The sample data of the selected attack behavior is pre-established; according to the obtained output results, it is determined whether the selected attack behavior exists in the network traffic. It realizes the diversification of traffic detection, more accurate identification and strong scalability.

Description

Network traffic anomaly detection method and system

technical field

The invention relates to the technical field of network information security, in particular to a method and a system for detecting network traffic anomalies suitable for high-speed IP metropolitan area networks.

Background technique

With the development of the Internet and the rapid growth of network traffic, the Internet has become an indispensable information carrier. At the same time, abnormal traffic that deviates from the normal range often occurs in network traffic, which is mainly caused by malicious network attacks such as worm propagation, DOS attacks, DDOS attacks, botnets, network configuration errors, and occasional line interruptions. These abnormal traffic often lead to a sharp decline in the service quality of the entire network, directly paralyzing the victim host and the network. Therefore, how to detect network anomalies and provide early warning information in a large-scale network environment is of great significance to ensure the normal operation of the network.

At the same time, with the continuous improvement of network bandwidth, network traffic anomaly detection is facing new problems: on the one hand, the network transmission rate has increased significantly, the same network attack is very obvious in the local area network, but it may not be easy to find in high-speed lines , requires a high-accuracy network traffic anomaly detection model; on the other hand, the increase in network bandwidth also speeds up the speed of network attacks. Taking the outbreak of network worms as an example, it can infect large Some vulnerable hosts. This requires the anomaly detection system to be able to implement blocking strategies in real time while quickly and efficiently identifying abnormal traffic.

Therefore, the key to anomaly detection is to analyze and discover possible abnormal behaviors in the network or system by describing the normal behavior of network traffic, and to warn the administrator, or take the initiative to respond.

Existing anomaly detection methods mainly include: statistical anomaly detection, threshold-based anomaly detection, wavelet-based anomaly detection, immunology-based anomaly detection, machine learning, data mining and neural network-based anomaly detection And the anomaly detection method based on traffic information entropy, etc.,

But these methods mainly have the following problems:

(1) The meaning of the alarm is not clear. Since the above anomaly detection method only detects one or several eigenvectors in the network traffic, and the selected eigenvectors have no specific attack meaning, when the detection system alarms, it can only know that some eigenvectors in the network are abnormal, but cannot Determine what kind of attack has occurred.

(2) Shared data for collaborative operation cannot be provided. Since the Internet is an interconnected network of multiple management domains without centralized management, anomaly detection requires that the various detection systems operate cooperatively, so the provision of shared data as the main content of collaborative operation is very important.

(3) Poor scalability: Since most of the existing anomaly detection systems use one or several single network feature vectors as the basis for learning and judgment, the anomaly description of network traffic is relatively thin; The selection of less feature vectors in the medium network may affect the scalability of the detection system.

(4) The detection accuracy, real-time performance, comprehensiveness and ability to identify new abnormal behaviors cannot meet the test requirements of abnormal detection.

Detection accuracy, real-time performance, comprehensiveness, and ability to identify new abnormal behaviors are the four key indicators for evaluating anomaly detection systems. However, the current anomaly detection method cannot realize real-time anomaly detection because it cannot load the real-time measurement of high-speed network traffic; and generally adopts the group sampling method to process, because the sampling will inevitably lose the flow information, resulting in a decrease in detection precision and accuracy. Meet the accuracy requirements of high-speed traffic monitoring; in addition, the existing anomaly detection methods are single, the recognition ability is limited, and its detection comprehensiveness and ability to identify new abnormal behaviors are relatively poor.

It can be seen that the existing traffic anomaly detection implementation methods have many factors that lead to poor detection results, such as detection accuracy, real-time performance, comprehensiveness, and unclear alarm meanings; at the same time, due to the detection of a single eigenvector and the single control strategy, the anomaly detection The scalability is poor and the recognition ability is limited. Moreover, due to the low recognition rate of software processing, only an alarm can be sent to the administrator during abnormal detection, and abnormal traffic cannot be blocked.

Contents of the invention

Embodiments of the present invention provide a network traffic anomaly detection method and system to solve the problems of poor traffic anomaly detection effect, poor flexibility and scalability in the prior art.

A network traffic anomaly detection method, comprising:

Monitor the traffic in the network and extract the basic characteristic data of the network traffic;

According to the extracted basic feature data, determine the combined feature data of the selected attack behavior, wherein the combined feature data is a subset of the basic feature data;

Inputting the determined combined feature data into the corresponding traffic model of the selected attack behavior to obtain an output result; the traffic model is pre-established according to the sample data of the selected attack behavior in the sample feature library;

Based on the output obtained, determine whether the selected attack behavior is present in the network traffic.

A network traffic anomaly detection system, comprising: a traffic statistics filtering subsystem and a network management analysis subsystem;

The traffic statistics and filtering subsystem is used to monitor the traffic in the network and extract the basic characteristic data of the network traffic;

The network management analysis subsystem is used to determine the combined feature data of the selected attack behavior according to the extracted basic feature data, wherein the combined feature data is a subset of the basic feature data; input the determined combined feature data into the corresponding According to the traffic model of the selected attack behavior, the output result is obtained; the traffic model is pre-established according to the sample data of the selected attack behavior in the sample feature library; according to the output of the traffic model of the selected attack behavior As a result, it is determined whether the selected attack behavior is present in the network traffic.

The beneficial effects of the present invention are as follows:

The network traffic anomaly detection method and system provided by the embodiments of the present invention monitor the traffic in the network in real time, extract the basic feature data of the network traffic, determine the combined feature data of the selected attack behavior, and input the determined combined feature data into the corresponding The traffic model of the selected attack behavior is obtained to obtain an output result, so as to determine that the selected attack behavior exists in the network traffic. This method establishes models for different attack behaviors, so that the attack behavior can be accurately detected, the alarm meaning is clear, and the detection accuracy is high; the method extracts the basic characteristic data in the network traffic in real time, and is targeted for different attack behaviors. It can comprehensively detect various attack behaviors and facilitate the collaborative management of multiple management domains. This method can easily expand detectable attack behaviors. When there is a new attack behavior, its traffic model can be established to detect it, and the extension is convenient. This method can obtain good detection effect and high detection accuracy.

Description of drawings

FIG. 1 is a schematic structural diagram of a network traffic anomaly detection system in an embodiment of the present invention;

Fig. 2 is the flow chart of the network traffic anomaly detection method in the embodiment of the present invention;

Fig. 3 is the structural diagram of the traffic model based on quantum wavelet neural network in the embodiment of the present invention;

4 is a deployment diagram of a network traffic anomaly detection system in a metropolitan area network in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a network traffic anomaly detection system in an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a network management analysis subsystem in an embodiment of the present invention.

Detailed ways

Aiming at several problems in the prior art, such as poor network traffic anomaly detection effect, poor flexibility and scalability, the embodiment of the present invention provides a network traffic anomaly detection method, which implements traffic anomaly detection based on the characteristic data of network traffic extracted in real time , due to considering the combination of various characteristic data for different abnormal attack behaviors, the real-time performance, accuracy and comprehensiveness of detection are improved, and the detection flexibility and scalability are also relatively good.

The network traffic anomaly detection method provided by the embodiment of the present invention is implemented by the network traffic anomaly detection system shown in FIG. 1 . The system includes: flow statistics filtering subsystem 1 and network management analysis subsystem 2.

The traffic statistics filtering subsystem 1 is used for the traffic statistics filtering subsystem, which is used to monitor the traffic in the network and extract the basic characteristic data of the network traffic.

The network management analysis subsystem 2 is used to determine the combined feature data of the selected attack behavior according to the extracted basic feature data, wherein the combined feature data is a subset of the basic feature data; the determined combined feature data is input into the corresponding The traffic model of the selected attack behavior is obtained as an output result; the traffic model is pre-established according to the sample data of the selected attack behavior in the sample feature library; according to the traffic model of the selected attack behavior The output confirms that the selected attack behavior exists in the network traffic.

Preferably, the network management analysis subsystem 2 is also used to determine that the selected attack behavior exists in the network traffic, and set flow control parameters according to the attribute information of the selected attack behavior;

The traffic statistics filtering subsystem 1 is also used to filter and control network traffic according to the set traffic control parameters.

The flow process of the above-mentioned network traffic anomaly detection method based on high-speed IP MAN is as shown in Figure 2, including the following steps:

Step S11: monitor the traffic in the network, and extract the basic feature data of the network traffic.

Monitor the traffic in the network in real time, and extract a set amount of feature information from at least one of the following information in the network traffic as basic feature data: traffic-related information, data packet-related information, protocol-related information, port-related information, port traffic-related Information, address-related information, and information about TCP flags.

Specifically, the set quantity feature data is extracted from the above information, specifically including several of the following data: number of flow messages, number of flow bytes, flow start time, flow end time, packet length oscillation frequency, average interval of data packets , average packet length, number of SYN packets, protocol type, source port, destination port, number of data packets sent per second, source address, destination address. These basic feature data can describe the running status of the network traffic in more detail.

For example: the statistical basic feature data can be recorded as a basic feature set X ₁ , X ₂ , ... X _n including n basic feature variables. Wherein, n represents the number of basic feature variables in the basic feature set, preferably, n=256.

Step S12: According to the extracted basic feature data, determine combined feature data of the selected attack behavior, wherein the combined feature data is a subset of the basic feature data.

Perform category cross-entropy between the extracted basic feature data and the selected attack behavior; determine the importance of each basic feature data to the selected attack behavior according to the cross-entropy results; according to the importance of each basic feature data to the selected attack behavior To determine the combined characteristic data of the selected attack behavior from the basic characteristic data.

That is, the selection of combined feature data is carried out for each possible attack behavior. When reducing feature data, use information entropy correlation theory to select important features by calculating the cross-entropy between each basic feature variable X ₁ , X ₂ ,...X _n in the basic feature set and different attack behaviors. The size of the entropy determines the importance λ _i of the basic characteristic variable X _i (i=1, 2, . . . , n).

According to the degree of importance, select important basic feature variables to form a combined feature set X ₁ , X ₂ ,...X _m , where m<n. Then get the combined feature data

Using the theory of information entropy, the important feature data is selected by calculating the extracted basic feature data and the cross-entropy of different attack behaviors. Based on the selected important feature data, a combined feature set that can accurately represent each attack behavior is established to realize the statistical network. Effective reduction of basic characteristic data of traffic.

Step S13: Input the determined combined characteristic data into the traffic model of the corresponding selected attack behavior, and obtain the output result.

For various possible attack behaviors, after extracting the combined feature data, input the extracted combined feature data into the traffic model of the corresponding attack behavior.

The traffic model is pre-established according to the sample data of the selected attack behavior in the sample signature database. Specifically, it is obtained after learning and training the feature data of the attack behavior in the sample feature library based on the quantum wavelet neural network.

The establishment of the traffic model and the process of using the traffic model to process the statistical combined characteristic data to obtain the output result will be described in detail below.

Step S14: According to the output result of the traffic model of the selected attack behavior, determine whether there is an attack behavior and the type of the attack behavior in the network traffic.

According to the obtained output result, determine whether there is an attack behavior in the network traffic and determine the type of the attack behavior, specifically including: according to the traffic model of the attack behavior that outputs the output result, determine the attack behavior corresponding to the traffic model that outputs the output result type; and according to the output value of the output output result, it is determined whether the output value corresponds to an attack or no attack, so as to determine whether there is an attack behavior in the network traffic and the type of the attack behavior.

If the flow model of the attack behavior of outputting the output result is the flow model of DDoS attack, when the output result is the output value of normal flow, it is confirmed that there is no DDoS attack; when the output result is the output value of abnormal flow, it is determined that there is The type of attack behavior is a DDoS attack;

If the flow model of the attack behavior of outputting the output result is the flow model of Trojan horse virus, when the output result is the output value of normal flow, it is confirmed that there is no Trojan horse virus; when its output result is the output value of abnormal flow, it is determined that there is The type of attack behavior is a Trojan horse virus;

If the traffic model of the attack behavior of outputting the output result is the traffic model of malicious code, when the output result is the output value of normal traffic, it is confirmed that there is no malicious code; when the output result is the output value of abnormal traffic, it is determined that there is The type of attack behavior is malicious code;

If the traffic model of the attack behavior of outputting the output result is the traffic model of zombie virus, when the output result is the output value of normal traffic, it is confirmed that there is no zombie virus; when its output result is the output value of abnormal traffic, it is determined that there is The type of attack behavior is a zombie virus.

That is, according to the output result of the traffic model of an attack behavior, it can be judged whether the attack behavior exists in the network traffic. For example: after the combined feature data of a selected attack behavior-Trojan horse attack is input into the traffic model of the attack behavior, the output result is A, indicating that there is no Trojan horse attack, and the output result is B, indicating that there is a Trojan horse attack.

Preferably, the above-mentioned network traffic anomaly detection method also includes:

Step S15: When it is determined that there is a selected attack behavior in the network traffic, set flow control parameters according to the attribute information of the selected attack behavior.

Once an attack behavior is found in the network traffic, the traffic control parameters of the attack behavior, such as port, address or other control parameters, are determined according to the combined characteristic data of the attack behavior extracted from the network traffic.

Preferably, when it is determined that the selected attack behavior exists in the network traffic, alarm display information is provided to the user.

Step S16: Filtering and controlling network traffic according to the set traffic control parameters.

According to the set flow control parameters such as ports and addresses, the network flow is filtered and controlled, and the network flow with the set flow control parameters is intercepted. In this way, the interception and blocking filtering of attack behaviors in network traffic can be realized.

In the above method, the process of establishing the traffic model specifically includes:

1) According to the expected output and actual output of the sample data, determine the model parameter weights of the traffic model based on the quantum wavelet neural network. The adjustment of the model parameter weights enables the input data to correspond to different class spaces.

According to the expected output and actual output of the sample data, the mean square error function of the training sample, where the mean square error function of the sample is:

$\begin{array}{c}{\mathrm{<span\; class="notranslate">\; E.</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}\underset{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; c</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}\\ <span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}\underset{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; 2</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; -</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; u</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; jk</span>}}<span\; class="notranslate">\; (</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}\underset{\mathrm{<span\; class="notranslate">\; q</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\frac{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; ij</span>}}{\mathrm{<span\; class="notranslate">\; \&lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; q</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; b</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}\end{array}$

in, is the expected output of the kth output neuron of the sth batch of samples, is the actual output of the kth output neuron of the sth batch of samples.

Assuming that the wavelet base of the quantum wavelet neural network adopts the binary orthogonal wavelet function, the model parameter weights w _ij , v _jk , a _j , b _j of the traffic model based on the quantum wavelet neural network can be obtained by training according to the above mean square error function , in the quantum wavelet network, these neuron weights w _ij , v _jk , a _j , b _j are all adjustable parameters.

Specifically, the mean square error function E _k can be minimized based on the fast Newton (FN) algorithm based on the sample data, and the neural network training can be performed to obtain the corrections of w _ij , v _jk , a _j , and b _j .

2) Adjust the quantum interval of the quantum wavelet neural network model according to the determined model parameter weights of the traffic model based on the quantum wavelet neural network.

In each training cycle, the connection weights between different layers and the quantum interval of quantum neurons in the hidden layer are updated. Specifically, according to the obtained neuron weights w _ij , v _jk , a _j and b _j , the neural network model is updated by the corresponding algorithm Quantum Intervals of Quantum Wavelet Neurons in Hidden Layer Make adjustments. The idea of the quantum interval adjustment algorithm is to minimize the output change of the hidden layer neurons based on the same type of traffic behavior sample data in the quantum wavelet neural network.

3) Establish a traffic model based on the quantum wavelet neural network according to the determined model parameter weights and the adjusted quantum interval. The established traffic model based on quantum wavelet neural network is:

${\mathrm{<span\; class="notranslate">\; c</span>}}_{\mathrm{<span\; class="notranslate">\; k</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; u</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; jk</span>}}<span\; class="notranslate">\; (</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}\underset{\mathrm{<span\; class="notranslate">\; q</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\frac{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; m</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; w</span>}}_{\mathrm{<span\; class="notranslate">\; ij</span>}}{\mathrm{<span\; class="notranslate">\; \&lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; q</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; b</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1,2</span>}$

in: is the expected output of the kth output neuron of the sth batch of samples;

is the actual output of the kth output neuron of the sth batch of samples;

_Xi is the feature vector in the combined feature data;

λ _{i represents} the importance of feature vector Xi;

w _ij is the connection weight of input layer neuron P _i to hidden layer neuron S _j ;

β is the slope factor;

is the quantum interval;

Hidden layer activation function is a wavelet function containing scale factor a _j and translation factor b _j ;

n ^q is the number of quantum intervals;

The connection weight between v _jk hidden layer neurons and output layer neurons;

By using the quantum wavelet neural network to train and learn the sample data of network traffic, a traffic model based on multi-dimensional feature data is established to detect abnormal traffic in the network.

Since the sample feature library supports online remote upgrade, the detection and identification model of new abnormal behavior can be established in time by using the quantum wavelet neural network, which facilitates real-time update of the abnormal traffic detection and identification model.

The structure of the established traffic model based on quantum wavelet neural network is shown in Figure 3. In this traffic model, the input layer L _in has m nodes, which correspond to the m vectors of the combined feature set; the number of nodes in the hidden layer L _h is u; the output layer L _out has 2 nodes. Each node corresponds to an output result, corresponding to two states of normal and abnormal network traffic. Adjacent layer nodes are fully interconnected, and there is no connection between neurons in each layer.

(1) The input layer can input the combined feature set X ₁ , X ₂ ,...X _m , and the output function of the input layer node used to input the hidden layer is obtained through the calculation of the input layer:

P _i = λ _i X _i i = 1,2,...,m;

(2) Input the output function of the input layer node into the hidden layer, and calculate the hidden layer node output function for the input and output layer through the hidden layer:

${\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}\underset{\mathrm{<span\; class="notranslate">\; q</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; [</span>\mathrm{<span\; class="notranslate">\; \&beta;</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; W</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&theta;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; q</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ]</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1,2</span>}<span\; class="notranslate">\; ,</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; u</span>}<span\; class="notranslate">\; ;</span>$

That is to say, the activation function of the hidden layer is This is a wavelet function with scaling factor _aj and translation factor _bj . β is the slope factor; W ^T P is the input excitation of the quantum wavelet neuron; is the quantum interval (s=1,2,...,n _q ); n _q is the number of quantum intervals. W ^T is a vector including w _ij , which is a network weight vector; P is a vector including P _i =λ _i X _i i=1,2,...,m, which is a network input vector, obtained from the access layer.

(3) The output function of the hidden layer node is input to the output layer, and the output results c1 and c2 are obtained after calculation by the output layer.

The calculation of the comprehensive input layer, hidden layer and output layer is calculated through the following flow model:

$c_k^{\mathrm{the\; s}}=\underset{j=1}{\overset{u}{\mathrm{\&Sigma;}}}{v}_{\mathrm{jk}}\left(\frac{1}{{\mathrm{no}}_q}\underset{q=1}{\overset{{\mathrm{no}}_q}{\mathrm{\&Sigma;}}}h\left(\frac{(\mathrm{\&beta;}\left(\underset{i=1}{\overset{m}{\mathrm{\&Sigma;}}}{w}_{\mathrm{ij}}{\mathrm{\&lambda;}}_i{x}_i\right)-{\mathrm{\&theta;}}_j^q)-b_j}{a_j}\right)\right),k=\mathrm{1,2},$ Finally, an output result can be obtained, that is, the output result satisfies the above formula.

Among them, v _jk is the connection weight between hidden layer neuron S _j and output layer neuron C _k .

The above model adopts the quantum wavelet neural network, in which the hidden layer neurons of the quantum wavelet neural network refer to the idea of quantum state superposition in quantum theory, and use the linear superposition of multiple wavelet basis functions as the excitation function. Each superimposed wavelet function has different quantum intervals.

In steps S13 and S14, the determined combined feature data is sequentially input into the traffic model of the corresponding selected attack behavior, and the process of determining whether the selected attack behavior exists in the network, that is, in the above-mentioned traffic model based on the quantum wavelet neural network The process of inputting combined feature data and finally outputting the result.

The combined feature set X ₁ , X ₂ ,...X _m obtained after information entropy reduction is used as the combined feature data describing the selected attack behavior, and input into the traffic model of the attack behavior to determine whether there is It's time to attack.

Quantum wavelet neural network is a multi-layer feed-forward neural network in structure, similar to BP network. Due to the variety of implementation forms of quantum wavelet neural network, the above-mentioned only enumerates one implementation form. The key of the present invention is to determine whether there is such an attack behavior based on dynamically extracted combination feature data for each attack behavior, and to realize the attack behavior. It is determined that diversified characteristic data can be considered, so the traffic model established by the present invention is not limited to the above traffic model based on quantum wavelet neural network, and can also be an existing mature neural network model based on wavelet theory.

The deployment of the above-mentioned network traffic anomaly detection system in the metropolitan area network is shown in Fig. 4 . Among them, the high-speed IP metropolitan area network includes transmission network, core layer, service access control layer and broadband access network. As can be seen from Fig. 4, the network traffic anomaly detection system provided by the embodiment of the present invention can be deployed on the backbone link of the high-speed IP metropolitan area network, and the abnormal traffic (trojan horse, virus, etc.) on the high-speed backbone link is detected. Real-time identification and control to achieve real-time alarm and real-time filtering of abnormal traffic. For example, it is deployed on the access router of the broadband access network or on the link between the secondary Ethernet switch and the service access control layer.

The specific structure of the above-mentioned network traffic anomaly detection system is shown in FIG. 5 . The system includes a traffic statistics filtering subsystem 1 and a network management analysis subsystem 2 . in:

The traffic statistics filtering subsystem 1 specifically includes: a traffic statistics identification module 11 and an online filtering module 12 . Preferably, the traffic statistics identification module 11 is also connected with a pre-detection flow measurement module 13 , and after the online filtering module 12 is also connected with a post-detection flow measurement module 14 .

The traffic statistics identification module 11 is used to monitor the traffic in the network and extract the basic characteristic data of the network traffic.

The online filter module 12 is used to obtain the network management analysis subsystem when determining that there is a selected attack behavior in the network traffic, according to the attribute information of the selected attack behavior, set the flow control parameter; and according to the flow control parameter obtained. Perform filter control.

The network management analysis subsystem 2 specifically includes: a model building module 21 , a data extraction module 22 , a data analysis module 23 and a traffic identification module 24 .

The model building module 21 is configured to pre-establish a traffic model of the selected attack behavior according to the sample data of the selected attack behavior in the sample signature database.

Preferably, the above-mentioned model building module 21 is specifically used to: determine the model parameter weights of the traffic model based on the quantum wavelet neural network according to the expected output and the actual output of the sample data; The model parameter weight value adjusts the quantum interval of the quantum wavelet neural network model; the flow model based on the quantum wavelet neural network is established according to the determined model parameter weight value and the adjusted quantum interval.

The data extraction module 22 is configured to determine combined feature data of the selected attack behavior according to the extracted basic feature data, wherein the combined feature data is a subset of the basic feature data.

Preferably, the above-mentioned data extraction module 22 is specifically used to perform category cross-entropy on the extracted basic feature data and the selected attack behavior; determine the importance of each basic feature data to the selected attack behavior according to the cross-entropy result. Degree: according to the importance of each basic feature data to the selected attack behavior, determine the combined feature data of the selected attack behavior from the basic feature data.

The data analysis module 23 is configured to input the determined combined feature data into the traffic model corresponding to the selected attack behavior, and obtain an output result.

Preferably, the above-mentioned data analysis module 23 is specifically used for: the input layer input combination feature set X ₁ , X ₂ , ... X _m , the input layer node output function used to input the hidden layer is calculated through the input layer; will be obtained The output function of the input layer node is input into the hidden layer, and the output function of the hidden layer node is obtained through the calculation of the hidden layer; the output function of the hidden layer node is input into the output layer, and the output result is obtained after the calculation of the output layer.

The traffic identification module 24 is configured to determine that the selected attack behavior exists in the network traffic according to the output result of the traffic model of the selected attack behavior.

Preferably, the above-mentioned network management analysis subsystem 2 also includes: a rule mining module 25, which is used to set flow control parameters according to the attribute information of the selected attack behavior when it is determined that the selected attack behavior exists in the network traffic .

Preferably, the above-mentioned network management analysis subsystem 2 also includes: an information output module, which is used to display the determination result of the traffic identification module 24 to the user for each attack behavior, and the user can know which kind of attack behavior exists and what kind of attack behavior there is according to the output information. Which kind of attack behavior exists, and when there is a selected attack behavior, provide alarm display information to the user.

The above-mentioned traffic statistics and filtering subsystem 1 adopts a high-speed hardware line forwarding engine, which can carry out multi-service parallel identification of network traffic, so that the identification performance of this subsystem will not decrease due to the increase in the number of types of services, and the processing capacity does not depend on users, Complexity of business and strategy. The network traffic statistical identification of this subsystem is based on the identification of various basic characteristics of network traffic, and realizes the statistics of network traffic characteristics based on the overall link, and comprehensively uses Deep Packet Inspection (DPI), Deep Flow Inspection, DFI) and other identification technologies can perform feature statistics on packets one by one, such as: protocol feature identification, traffic behavior analysis, business analysis and statistics, which can realize real-time statistics and Intelligent identification at packet level or flow level.

When the above-mentioned traffic statistics filtering subsystem 1 realizes the network traffic statistics function, it may include the following functions: traffic statistics of various users and services; traffic statistics of various flow control strategies; flexible setting of traffic statistics of policy flows; specified IP Traffic statistics of addresses or user groups; real-time and historical traffic statistics, etc., will not be listed here. When the above traffic statistics and filtering subsystem 1 implements the network traffic service identification function, it may include the following functions: it can realize effective identification and control of encrypted, variant and unknown new business behaviors, etc. List them one by one.

The above flow statistics and filtering subsystem 1 implements flow control according to the flow control parameters set by the network management analysis subsystem 2. The set control parameters can be port, address, etc. When identifying the message online, the string matching engine of the university is used Realize the screening of data content in network traffic, filter and block data streams carrying malicious codes, and cut off the transmission path of Trojan horse viruses. The traffic statistics and filtering subsystem 1 can start online filtering and identification according to the command issued by the network management analysis subsystem 2 .

The above-mentioned network management analysis subsystem 2 is mainly implemented through back-end software design. According to the statistical data reported by the traffic statistics and filtering subsystem 1, the basic characteristic data of the network traffic is obtained, and the combined characteristic data is obtained through information entropy reduction, and then based on the quantum wavelet neural The network traffic model conducts data analysis, detects abnormal traffic in the network, and can determine the attack behavior, and then digs out filtering rules, sets traffic control parameters, and instructs the traffic statistics filtering subsystem 1 to realize the online virus filtering function. The network management analysis subsystem 2 can build multiple traffic models for various attack behaviors. After obtaining the basic characteristic data, it can sequentially reduce and obtain combined characteristic data for various attack behaviors, and input corresponding traffic models in turn to determine whether There are corresponding attacks. In this method, when there is a new attack behavior that needs to be analyzed, a traffic model can be established for analysis, which is convenient for expanding applications.

The specific structure of the network management analysis subsystem is shown in Figure 6. After the traffic statistics and filtering subsystem obtains data from the Internet, it transmits the data to the network management analysis subsystem. When the network management analysis subsystem is actually deployed, several parts such as data storage unit, data analysis unit and application program unit can be deployed.

The data obtained from the Internet is stored in the data storage unit, and multiple databases can be arranged in the data storage unit, such as: traffic statistics database, link layer statistics database, traffic behavior characteristic database, alarm log database, policy rule database and others Database of statistical data. They are respectively used to store various feature data extracted from network traffic, established traffic models, etc., and mined filtering rules, such as traffic control parameters set for a certain attack behavior, and can also store abnormal traffic when abnormal traffic is detected. alarm information, alarm display information, etc. Wherein, the selected attack behavior includes one or more of the following attack behaviors: DDoS attack, Trojan horse virus, malicious code, zombie virus and so on. The alarm display information includes one or more of the following display information: classified alarm display of each attack behavior, graphic display of attack information, and policy rule display of anomaly detection.

The data storage unit mainly completes the storage and processing of all data resources, and realizes the management of data resources through unified data management and maintenance standards. And according to the types of resources and different applications, different storage, processing and access strategies are provided to provide a unified data view for various applications. The data of this unit mainly comes from the traffic statistical data reported by the traffic statistics and filtering subsystem composed of the underlying hardware. The traffic behavior sample feature library in this unit supports online remote upgrade to support the identification of new abnormal behaviors.

The above-mentioned data analysis unit can realize the extraction of combined feature data from the basic feature data, specifically adopting a feature reduction method based on information entropy. And input the combined feature data into the traffic model based on the quantum wavelet neural network for data analysis. Specifically, the data extraction module 22 , the data analysis module 23 and the traffic identification module 24 can be used.

In addition, the data analysis unit can also realize the function of the model building module 21, and establish a traffic model and store it in the data storage unit.

When the data analysis unit analyzes and detects hidden abnormal traffic from a large amount of network traffic data, in order to avoid the problem of poor detection accuracy caused by selecting one or several features, it adopts the idea of hierarchical division of traffic feature data: first The basic feature data that basically covers all the information in the network traffic is extracted from the network traffic, so that the extracted feature data can reflect the running status of the network traffic in detail. However, if all the basic feature data are stored, maintained, analyzed and detected in real time, the complexity is extremely high for a high-speed network environment, and it is extremely difficult to implement. Therefore, different reduced characteristic data are used for analysis according to different attack behaviors.

The above-mentioned data analysis unit reduces the combined feature data from the basic feature data to analyze whether there is abnormal traffic. The set of combined feature data can be changed in real time according to actual needs. For a specific attack behavior, a subset of the basic features involved in the attack behavior is used as combined feature data describing the attack behavior. Through the optimal selection and effective reduction of the basic feature data of network traffic based on the theory of information entropy, the mutual entropy between each basic feature in the selected basic feature data and the selected attack behavior is calculated to realize the selection of important features, so that the selected combined features The data is effective characteristic data that can accurately represent the selected attack behavior. Load these effective feature data into the traffic model based on the quantum wavelet neural network established for the corresponding attack behavior, and then it can be determined whether there is abnormal traffic according to the output results, and it can be determined that the abnormal traffic is caused by the attack behavior.

When the above-mentioned data analysis unit detects an attack behavior, it conducts policy rule mining to determine the flow control parameters for filtering and intercepting the attack behavior, and sends it to the traffic statistics and filtering subsystem in time to block abnormal traffic in real time.

The network traffic anomaly detection system provided by the embodiment of the present invention further includes an application program unit for realizing the function of the information output module. For example, the application unit can detect DDoS attacks, malicious code attacks, Trojan horse viruses, and zombie viruses, and display the detection results to users, provide multi-dimensional display of alarm information, and block abnormal traffic. in:

Distributed Denial of Service (DDoS) attacks use reasonable service requests to occupy too many service resources, causing the service to be overloaded and unable to respond to other requests. These service resources include network bandwidth, file system space capacity, open processes or incoming connections. The system mainly monitors DDoS from the following aspects: SYN flood attack, Smurf attack, UDP flood attack, Ping of death attack, TearDrop attack, Land attack ( Land attack), the combined feature data extracted by it can be the destination IP address and the source IP address, and interception and blocking are realized according to the same destination IP address and source IP address of the network traffic data.

The Trojan horse virus exploits the loopholes of Windows to invade the user's computer, control the user's computer, and steal user data. Its harm area is very wide and the degree of harm is very deep. It can use IP address, port number, etc. as combined feature data to detect and filter Trojan horse viruses. The types of Trojans that can be detected include: Trojans linked to websites, hacking Trojans, remote control Trojans, destructive Trojans, denial of service (Denial of Service, DoS) attack Trojans, rebound port Trojans, program killers, proxy Trojans, file Transfer Protocol (File Transfer Protocol, FTP) Trojans and many other types.

Malicious code detection is detected through refinement and correlation analysis of massive network traffic data, and detection is achieved by data analysis of network traffic data packets and comparison with signatures.

Zombie virus, that is, botnet (English name is called Botnet) is a new attack method developed and integrated on the basis of traditional malicious code forms such as network worms, Trojan horses, and backdoor tools on the Internet. It is often used by hackers to launch Large-scale network attacks, such as distributed denial of service attacks (DDoS), mass spam, etc., and the information stored in these computers controlled by hackers can also be "accessed" by hackers at will. Therefore, whether it is for the safe operation of the network or the protection of user data security, botnets are extremely threatening hidden dangers. Botnet detection methods related to protocols and structures can be used to detect botnets. Domain names can be used as characteristic data, combined with log analysis to determine the location, scale, and distribution of Botnets.

The display information of the above-mentioned various attack behaviors can be graphically displayed to the user in the form of charts, including attack source, attacked person, attack time, attack event, filtered event, number of successful attacks, number of failed attacks, etc. Display content within and read with the user.

The alarm information display realizes the function of alerting the user when there is an attack. Classifying alarm logs by various conditions in real time helps administrators quickly discover certain attacks. Generally, the classification of alarm logs can be dynamically switched according to various standards. Each attack log can be highlighted in different colors according to the prior definition.

The application unit can also support the display of policy rules; it supports editing and modification in the form of policy groups, and administrators can quickly modify the rule attributes of the entire group, including whether to activate or not, and various system actions; user-defined policies are provided Rule function, and supports regular expressions.

The traffic statistics filtering subsystem in the above system, based on the "full hardware" processing method, counts, identifies and filters the packets on the designated high-speed link; the network management analysis subsystem will integrate virus rule mining, data analysis, and information display , system operation and maintenance, policy maintenance and other functions, display the security status of the entire network and timely alarm of virus information in various forms such as reports and graphs. This layered intrusion detection system architecture can effectively integrate functions such as 40Gbps line-speed virus rule identification, abnormal traffic filtering, alarm information statistics, and network equipment maintenance. In this way, the front-end hardware platform completes the preprocessing of business traffic information, and the background software system centrally processes the information reported by the front-end subsystems, which greatly reduces the processing time and can quickly, efficiently and accurately identify abnormal traffic in the network .

Taking the SYN FLOOD attack included in the DDoS attack as an example, the specific process of realizing the abnormal detection of network traffic through the network traffic anomaly detection method and system provided by the embodiment of the present invention is described below.

For the SYN FLOOD attack, the combined feature vectors obtained after information entropy reduction are 6, such as the number of flow messages, flow bytes, packet length oscillation frequency, average packet interval, and SYN packet number shown in Table 1 below. 6 combined feature vectors such as number, stream start/end time, etc. The established traffic model based on quantum wavelet neural network for SYN FLOOD attack is shown in Figure 3, where the network topology of the model is 6-12-2. There are 6 neurons in the input layer, corresponding to the 6 combined eigenvectors after effective reduction; 12 neurons in the hidden layer; 2 neurons in the output layer, corresponding to the two states of normal and abnormal traffic, namely When c ₁ c ₂ =10 (c1 is 1, c2 is 0), it indicates a normal flow state, and when c ₁ c ₂ =01 (c1 is 0, c2 is 1), it indicates an abnormal flow state, indicating that there is a SYN FLOOD attack. The learning rate of the weight and threshold of the quantum wavelet neural network is selected as 0.02; the learning rate of the quantum interval is 0.02; the slope factor of the multi-layer wavelet excitation function is selected to be equal to 0.95; When all parameters are set the same, that is, the learning error precision is not set, until the set learning times are completed, the learning rate is 0.02, and the maximum iteration times are set to 580 and 2500 respectively. After training 580 times, the error of the quantum wavelet neural network of this patent is 8.8761×10 ^-4 ; when training 2500 times, the error of the quantum wavelet neural network of this patent is 1.8978×10 ^-5 .

Part of the training sample data (before normalization) is shown in Table 1 below.

Table 1

The network traffic anomaly detection method and system provided by the embodiments of the present invention are suitable for the backbone network environment of a high-speed IP metropolitan area network, and its single-channel processing capacity is not less than 40Gbps, and can be smoothly compatible with a 10Gbps interface while supporting a 40Gbps link interface. It can effectively realize the identification and blocking of abnormal traffic in the network traffic, monitor the attack behavior dynamically in real time, and dynamically update the database to mine online filtering rules, determine the flow control parameters, and timely identify, alarm, and Filter, block.

Establish traffic models for different attack behaviors to identify different attack behaviors, so that it can accurately detect what kind of attack behavior exists in the network traffic, the alarm meaning is clear, and the detection accuracy is high.

Using two identification technologies, DPI and DFI, it can perform protocol feature identification, traffic behavior analysis, business analysis and statistics one by one. This method extracts basic feature data in network traffic in real time, and the extracted feature data is relatively comprehensive. , and for different attack behaviors, the combined feature data is determined in a targeted manner, so that various attack behaviors can be detected comprehensively, which is beneficial to the collaborative management of multiple management domains. And because of the real-time extraction of characteristic data in network traffic, it can better meet the requirements of real-time monitoring of high-speed network traffic, and can meet the needs of business application types and application scale. sexual requirements.

The detectable attack behavior can be easily expanded. When there is a new attack behavior, its traffic model can be established and detected, which is convenient for expansion. This method can obtain good detection effect and high detection accuracy. The whole system is implemented by multiple independent functional modules and subsystems, with flexible architecture, unified structure, and good scalability and reconfiguration capabilities.

Since the extracted feature data can fully reflect the actual situation of network traffic, it avoids the problem of poor detection effect caused by using a single feature data as the basis for judgment in the existing method, and can easily add and reduce attacks for different attack behaviors. traffic model to obtain comprehensive and accurate detection results. For a certain attack behavior, by calculating the cross-entropy between each basic feature in the training sample and the attack behavior, the important features are selected to establish a combined feature set, and the quantum wavelet neural network model is used to learn and train the combined feature set to realize traffic behavior. Classification, fast convergence speed, comprehensive and accurate traffic information covered, can effectively improve detection accuracy and identify new abnormal behaviors in real time in a high-speed network environment, making it easier to implement under the entire anomaly detection framework based on network traffic models The detection of different types of abnormal attacks can achieve better detection results.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (17)

1. A method for detecting network traffic anomaly is characterized by comprising the following steps:

monitoring the flow in the network and extracting the basic characteristic data of the network flow; determining the combined characteristic data of the selected attack behaviors according to the extracted basic characteristic data, wherein the combined characteristic data is a subset of the basic characteristic data; inputting the determined combined characteristic data into a flow model of the corresponding attack behavior to obtain an output result; the flow model is pre-established according to sample data of each attack behavior in the sample feature library;

determining whether an attack behavior exists in the network flow and determining the type of the attack behavior according to the obtained output result;

wherein, the determining the combined feature data of the selected attack behavior according to the extracted basic feature data specifically comprises:

carrying out category mutual entropy on the extracted basic characteristic data and the selected attack behavior;

determining the importance degree of each basic characteristic data to the selected attack behavior according to the mutual entropy result;

determining the combined characteristic data of the selected attack behaviors from the basic characteristic data according to the importance degree of each basic characteristic data to the selected attack behaviors;

wherein, the process of establishing a flow model according to the sample data of the selected attack behavior in the sample feature library comprises the following steps:

determining a model parameter weight of a flow model based on a quantum wavelet neural network according to expected output and actual output of sample data;

adjusting the quantum interval of the quantum wavelet neural network model according to the determined model parameter weight of the flow model based on the quantum wavelet neural network;

establishing a flow model based on a quantum wavelet neural network according to the determined model parameter weight and the adjusted quantum interval;

determining a model parameter weight of a flow model based on the quantum wavelet neural network according to the expected output and the actual output of the sample data; the method specifically comprises the following steps:

training the mean square error function of the sample according to the expected output and the actual output of the sample data:

wherein,expected output for the kth output neuron for the sth batch of samples;

actual output for the kth output neuron for the sth batch of samples;

X_ifeature vectors in the combined feature data;

λ_irepresenting a feature vector X_iThe degree of importance of;

w_ijfor input layer neurons P_iTo hidden layer neuron S_jThe connection right of (1);

beta is a slope factor;

is a quantum spacing;

hidden layer excitation functionIs a composite containing a scale factor a_jAnd a translation factor b_jA wavelet function of (a);

n_qis the number of quantum intervals;

v_jkthe connection weight between the hidden layer neuron and the output layer neuron;

m is the number of vectors of the combined feature set;

u is the number of nodes of the hidden layer;

obtaining model parameter weight w by minimizing mean square error function_ij、v_jk、a_j、b_j。

2. The method according to claim 1, wherein the extracting the basic feature data of the network traffic specifically comprises:

extracting a set amount of feature information from at least one of the following information in the network traffic as basic feature data: flow related information, packet related information, protocol related information, port flow related information, address related information, and information related to TCP flag bits.

3. The method according to claim 2, wherein the extracting the set quantity of feature data of the network traffic specifically includes several of the following data:

the number of flow messages, the number of flow bytes, the flow starting time, the flow ending time, the packet length oscillation frequency, the average interval of data packets, the average packet length, the number of SYN packets, the protocol type, the source port, the destination port, the number of data packets sent per second, the source address and the destination address.

4. The method according to claim 1, wherein the adjusting the quantum spacing of the quantum wavelet neural network model according to the determined model parameter weights of the quantum wavelet neural network-based traffic model specifically comprises:

according to the obtained model parameter weight w_ij、v_jk、a_j、b_jAdjusting the quantum spacing of a quantum wavelet neural network model

5. The method of claim 4, wherein the established quantum wavelet neural network-based traffic model is:

6. the method according to claim 1, wherein inputting the determined combined feature data into the corresponding selected traffic model of the attack behavior to obtain an output result, specifically comprising:

input layer input combined feature set X₁,X₂,……X_mThe hidden layer for input is obtained through the calculation of the input layerThe input layer node output function of (1);

inputting the obtained node output function of the input layer into the hidden layer, and obtaining the node output function of the hidden layer through calculation of the hidden layer;

and inputting the obtained hidden layer node output function into an output layer, and obtaining an output result after calculation of the output layer.

7. The method of claim 6, wherein the input layer node output function is P_i＝λ_iX_i ，i＝1,2,…,m；

Wherein: x_iFeature vectors in the combined feature data;

λ_irepresenting a feature vector X_iThe degree of importance of.

8. The method of claim 7, wherein the output result satisfies the following formula:

wherein,

actual output for the kth output neuron for the sth batch of samples;

X_ifeature vectors in the combined feature data;

λ_irepresenting a feature vector X_iThe degree of importance of;

w_ijfor input layer neurons P_iTo hidden layer neuron S_jThe connection right of (1);

beta is a slope factor;

is a quantum spacing;

hidden layer excitation functionIs a composite containing a scale factor a_jAnd a translation factor b_jA wavelet function of (a);

n_qis the number of quantum intervals;

v_jkthe connection weights between hidden layer neurons to output layer neurons.

9. The method of claim 1, wherein the selected aggression comprises one or more of the following aggressions: DDoS attacks, trojan horse viruses, malicious code, and dead viruses.

10. The method according to claim 9, wherein the determining whether there is an attack behavior in the network traffic and determining the type of the attack behavior according to the obtained output result specifically includes:

if the flow model of the attack behavior of the output result is the flow model of the DDoS attack, when the output result is the output value of the normal flow, confirming that the DDoS attack does not exist; when the output result is the output value of the abnormal flow, determining the type of the existing attack behavior as DDoS attack;

if the flow model of the attack behavior outputting the output result is the flow model of the Trojan horse virus, when the output result is the output value of the normal flow, determining that the Trojan horse virus does not exist; when the output result is the output value of the abnormal flow, determining that the type of the existing attack behavior is Trojan horse virus;

if the flow model of the attack behavior outputting the output result is a flow model of a malicious code, when the output result is an output value of normal flow, determining that the malicious code does not exist; when the output result is the output value of the abnormal flow, determining that the type of the existing attack behavior is a malicious code;

if the flow model of the attack behavior outputting the output result is the flow model of the dead virus, when the output result is the output value of the normal flow, confirming that the dead virus does not exist; and when the output result is the output value of the abnormal flow, determining that the type of the existing attack behavior is the dead virus.

11. The method of any of claims 1-10, further comprising:

and when the selected attack behavior exists in the network flow, setting flow control parameters according to the attribute information of the selected attack behavior, and filtering and controlling the network flow.

12. The method of claim 11, further comprising, upon determining that the selected aggression exists in network traffic, providing alert presentation information to a user;

the alarm display information comprises one or more of the following display information: and performing classified alarm display of various attack behaviors, chart display of attack information and strategy rule display of anomaly detection.

13. A system for detecting network traffic anomalies, comprising: the flow statistics filtering subsystem and the network management analysis subsystem;

the flow statistics and filtration subsystem is used for monitoring the flow in the network and extracting the basic characteristic data of the network flow;

the network management analysis subsystem is used for determining the combined characteristic data of the selected attack behavior according to the extracted basic characteristic data, wherein the combined characteristic data is a subset of the basic characteristic data; inputting the determined combined characteristic data into the corresponding flow model of the selected attack behavior to obtain an output result; the flow model is pre-established according to the sample data of the selected attack behavior in the sample feature library; determining whether the attack behavior exists in the network flow and determining the type of the attack behavior according to the output result of the selected flow model of the attack behavior;

the flow statistics filtering subsystem specifically comprises:

the flow statistics and identification module is used for monitoring the flow in the network and extracting the basic characteristic data of the network flow;

the online filtering module is used for setting flow control parameters according to the attribute information of the selected attack behavior when the network management analysis subsystem determines that the selected attack behavior exists in the network flow; filtering and controlling the network flow according to the acquired flow control parameters;

the network management analysis subsystem specifically comprises:

the model establishing module is used for establishing a flow model of the selected attack behavior in advance according to the sample data of the selected attack behavior in the sample characteristic library; determining a model parameter weight of a flow model based on a quantum wavelet neural network according to expected output and actual output of sample data;

determining a model parameter weight of a flow model based on the quantum wavelet neural network according to the expected output and the actual output of the sample data; the method specifically comprises the following steps:

training the mean square error function of the sample according to the expected output and the actual output of the sample data:

wherein,expected output for the kth output neuron for the sth batch of samples;

actual output for the kth output neuron for the sth batch of samples;

X_ifeature vectors in the combined feature data;

λ_irepresenting a feature vector X_iThe degree of importance of;

w_ijfor input layer neurons P_iTo the hidden layer spiritJingyuan S_jThe connection right of (1);

beta is a slope factor;

is a quantum spacing;

hidden layer excitation functionIs a composite containing a scale factor a_jAnd a translation factor b_jA wavelet function of (a);

n_qis the number of quantum intervals;

v_jkthe connection weight between the hidden layer neuron and the output layer neuron;

m is the number of vectors of the combined feature set;

u is the number of nodes of the hidden layer;

obtaining model parameter weight w by minimizing mean square error function_ij、v_jk、a_j、b_j；

The data extraction module is used for determining the combined characteristic data of the selected attack behaviors according to the extracted basic characteristic data, wherein the combined characteristic data is a subset of the basic characteristic data;

the data analysis module is used for inputting the determined combined characteristic data into the corresponding flow model of the selected attack behavior to obtain an output result;

and the flow identification module is used for determining that the selected attack behavior exists in the network flow according to the output result of the flow model of the selected attack behavior.

14. The system of claim 13, wherein the data extraction module is specifically configured to:

carrying out category mutual entropy on the extracted basic characteristic data and the selected attack behavior; determining the importance degree of each basic characteristic data to the selected attack behavior according to the mutual entropy result; and determining the combined characteristic data of the selected attack behaviors from the basic characteristic data according to the importance degree of each basic characteristic data to the selected attack behaviors.

15. The system of claim 13, wherein the model building module is specifically configured to:

adjusting the quantum interval of the quantum wavelet neural network model according to the determined model parameter weight of the flow model based on the quantum wavelet neural network;

and establishing a flow model based on the quantum wavelet neural network according to the determined model parameter weight and the adjusted quantum interval.

16. The system of claim 13, wherein the data analysis module is specifically configured to:

input layer input combined feature set X₁,X₂,……X_mObtaining an input layer node output function for inputting the hidden layer through input layer calculation;

inputting the obtained node output function of the input layer into the hidden layer, and obtaining the node output function of the hidden layer through calculation of the hidden layer;

and inputting the obtained hidden layer node output function into an output layer, and obtaining an output result after calculation of the output layer.

17. The system of any one of claims 13-16, wherein the network management analysis subsystem further comprises:

and the information output module is used for displaying the determined result of the flow identification module to the user aiming at each attack behavior and providing alarm display information to the user when the selected attack behavior exists.