The network security knowledge base standardizes and integrates network security data,providing a reliable foundation for real-time network security protection solutions.However,current research on network security kn...The network security knowledge base standardizes and integrates network security data,providing a reliable foundation for real-time network security protection solutions.However,current research on network security knowledge bases mainly focuses on their construction,while the potential to optimize intelligent security services for real-time network security protection requires further exploration.Therefore,how to effectively utilize the vast amount of historical knowledge in the field of network security and establish a feedback mechanism to update it in real time,thereby enhancing the detection capability of security services against malicious traffic,has become an important issue.Our contribution is fourfold.First,we design a feedback interface to update the knowledge base with information such as features of attack traffic,detection outcomes from network service functions(NSF),and system resource utilization.Second,we introduce a feature selection method that combines PageRank and RandomForest to identify influential features in the knowledge base and dynamically incorporate them into the NSFs.Third,we propose a path selection method that combines graph attention network(GAT)and deep reinforcement learning(DRL)to learn the local knowledge of the knowledge base and determine the optimal traffic path within the Service Function Chains(SFC).Finally,experimental results demonstrate that the knowledge base can be updated in real time according to feedback information,and the optimized service achieves an accuracy,recall,and F1 score exceeding 96%.Compared to preset paths and paths selected using the deep Q-network(DQN)method,our proposed method increases the malicious traffic detection rate by an average of 12.4%and 4.6%,respectively,enhances the total malicious traffic detection capability(TMTDC)of the path by 18.1%and 11.5%,and significantly reduces path detection delay.It has been verified that the proposed intelligent security optimization method can monitor malicious traffic in real time,update knowledge,and enhance the system’s detection capability against malicious traffic.展开更多
基金supported by the National Key R&D Program of China under Grant No.2018YFA0701604NSFC under Grant No.62341102.
文摘The network security knowledge base standardizes and integrates network security data,providing a reliable foundation for real-time network security protection solutions.However,current research on network security knowledge bases mainly focuses on their construction,while the potential to optimize intelligent security services for real-time network security protection requires further exploration.Therefore,how to effectively utilize the vast amount of historical knowledge in the field of network security and establish a feedback mechanism to update it in real time,thereby enhancing the detection capability of security services against malicious traffic,has become an important issue.Our contribution is fourfold.First,we design a feedback interface to update the knowledge base with information such as features of attack traffic,detection outcomes from network service functions(NSF),and system resource utilization.Second,we introduce a feature selection method that combines PageRank and RandomForest to identify influential features in the knowledge base and dynamically incorporate them into the NSFs.Third,we propose a path selection method that combines graph attention network(GAT)and deep reinforcement learning(DRL)to learn the local knowledge of the knowledge base and determine the optimal traffic path within the Service Function Chains(SFC).Finally,experimental results demonstrate that the knowledge base can be updated in real time according to feedback information,and the optimized service achieves an accuracy,recall,and F1 score exceeding 96%.Compared to preset paths and paths selected using the deep Q-network(DQN)method,our proposed method increases the malicious traffic detection rate by an average of 12.4%and 4.6%,respectively,enhances the total malicious traffic detection capability(TMTDC)of the path by 18.1%and 11.5%,and significantly reduces path detection delay.It has been verified that the proposed intelligent security optimization method can monitor malicious traffic in real time,update knowledge,and enhance the system’s detection capability against malicious traffic.
