US 2024/0406199 A1Published application

Network attack prediction method, device, computer equipment and storage medium

AssigneeDalian University

InventorsShaoming QIU, Yahui WANG, Yana LV, Fen CHEN, Jiancheng ZHAO

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network attack prediction method, device, computer equipment and storage medium are provided. The network attack prediction method includes: performing preprocessing, time series modeling and data feature analysis on the network traffic data set; dividing the network traffic data set into a normal traffic data set and an attack traffic data set; initializing parameters of the improved grey wolf algorithm; constructing a prediction model and initializing parameters of the prediction model; using the grey wolf optimizer GWO search strategy to obtain a first candidate of the optimal grey wolf; using the hunting DLH search strategy to obtain another candidate of the optimal grey wolf, selecting an optimal candidate; updating Xi(t) with the optimal candidate; judging whether to iterate to the maximum iterations; obtaining an optimal parameter combination of the prediction model and training the prediction model; obtaining an optimized convergent prediction model and identifying anomalies caused by network attacks.

Claims10

Dependent claims

A network attack prediction method, comprising:

S1:
acquiring a network traffic data set;
S2:
preprocessing the network traffic data set to obtain a preprocessed network traffic data set;
S3:
performing time series modeling on the preprocessed network traffic data set to obtain a time series;
S4:
performing data feature analysis on the time series to obtain a feature analysis result;
S5:
based on the feature analysis result, dividing the network traffic data set into a normal traffic data set and an attack traffic data set according to a network traffic;
S6:
initializing parameters of an improved grey wolf algorithm;
S7:
constructing a prediction model and initializing parameters of the prediction model;
S8:
using a grey wolf optimizer (GWO) search strategy to obtain a first candidate XIGWO(t+1) of an optimal grey wolf;
S9:
using a hunting dimension learning hunting (DLH) search strategy to obtain another candidate XIDLH(t+1) of the optimal grey wolf;
S10:
comparing fitness values of the first candidate XIGWO(t+1) and another candidate XIDLH(t+1), and selecting an optimal candidate;
S11:
judging whether the fitness value of the optimal candidate is less than Xi(t) or not;
S12:
when the fitness value of the optimal candidate is less than Xi(t), updating Xi(t) with the optimal candidate;
when the fitness value of the optimal candidate is greater than or equal to Xi(t), keeping Xi(t) unchanged in a matrix Pop;
Xi(t) represents a position of an i-th wolf in a t-th iteration;
the matrix Pop comprises the whole population of wolves;
S13:
judging whether to iterate to maximum iterations;
when not iterating to the maximum iterations, executing a next step;
when iterating to the maximum iterations, increasing the iterations by 1, and jumping to S8;
S14:
obtaining an optimal parameter combination of the prediction model;
S15:
training the prediction model based on the optimal parameter combination, obtaining an optimized convergent prediction model;
S16:
based on the optimized convergent prediction model, identifying anomalies caused by network attacks.

34 more elements

A network attack prediction device, comprising:

a network traffic data set acquisition module, configured to acquire a network traffic data set;
and a processing module, configured to preprocess the network traffic data set to obtain a preprocessed network;
a time series modeling module, configured to perform time series modeling on the preprocessed network traffic data set to obtain a time series;
a feature analysis module, configured to perform data feature analysis on the time series to obtain a feature analysis result;
a network traffic data set dividing module, configured to divide the network traffic data set into a normal traffic data set and an attack traffic data set according to a network traffic based on the feature analysis result;
an initialization module, configured to initialize parameters of an improved grey wolf algorithm;
a prediction model construction module, configured to construct a prediction model and initialize parameters of the prediction model;
a first candidate determination module, configured to obtain a first candidate XIGWO(t+1) of an optimal grey wolf by using a GWO search strategy;
a second candidate determination module, configured to obtain another candidate XIDLH(t+1) of the optimal grey wolf by using a hunting DLH search strategy;
a comparison module, configured to compare fitness values of the first candidate XIGWO(t+1) and another candidate XIDLH(t+1) and select an optimal candidate;
a first judging module, configured to judge whether the fitness value of the optimal candidate is less than Xi(t) or not;
an updating module, wherein when the fitness value of the optimal candidate is less than Xi(t), the updating module is configured to update Xi(t) with the optimal candidate, and when the fitness value of the optimal candidate is greater than or equal to Xi(t), the updating module is configured to keep Xi(t) unchanged in a matrix Pop;
Xi(t) represents a position of an i-th wolf in a t-th iteration;
a second judging module, configured to judge whether to iterate to maximum iterations;
wherein when not iterating to the maximum iterations, a next step is executed;
when iterating to the maximum iterations, the iterations are increased by 1, jumping to the first candidate determination module;
an optimal parameter combination determination module, configured to obtain an optimal parameter combination of the prediction model;
a training module, configured to train the prediction model based on the optimal parameter combination to obtain an optimized convergent prediction model;
a network attack identification module, configured to identify anomalies caused by network attacks based on the optimized convergent prediction model.

16 more elements

Dependencies are inferred from the claim text.