Methods and devices for improving risk perception capability based on machine learning, computer equipment and memory medium

Abstract

The invention provides methods and devices for improving risk perception capability based on machine learning, computer equipment and a memory medium. A method comprises the steps of carrying out at least one piece of blacklist and whitelist mechanism processing, regular rule processing and artificial recognition processing on data of a data center, thereby obtaining the data marked with maliciousfeatures; writing the data marked with malicious features into a malicious sample data set for the machine learning; generating a malicious traffic template at least through utilization of the malicious sample data set and through utilization of the a machine learning algorithm; judging matching property of detection data and the malicious traffic template; and determining whether the detection data is malicious data or not according to a matching result. According to the method provided by the invention, the machine learning algorithm for risk perception is continuously optimized, risk perception capability is improved continuously, a conventional attack or a new-type attack can be rapidly perceived in advance, and a corresponding defense scheme or protection measure is established in advance, so the attack of an attacker cannot exert an influence or influenced losses are minimized.

Description

technical field [0001] The embodiments disclosed in the present invention relate to the field of computer network information security, and in particular, to a method and apparatus, computer equipment and storage medium for improving risk perception capability based on machine learning. Background technique [0002] In modern society, computing devices are changing from just a convenience to a necessity. On a global scale, communications are becoming electronically dominated, and these communications often include the transmission of sensitive or confidential information. [0003] The existing protection technology parses the request data of the http protocol through port traffic mirroring and extracts the data header, and uses regular rules to match malicious data to sense and alert directly according to the type of attack. This protection technology has great defects, such as: 1), it is difficult to ensure that the attack surface covered by regular expressions is complete...

AI Technical Summary

Problems solved by technology

This protection technology has great defects, for example: 1), it is difficult to ensure that the attack surface covered by the regular expression is complete; 2), it is laborious to maintain the rules; 3), it is difficult to ensure false negatives and false positives; 4), the performance will be degraded With the increase of regular expressions, it becomes worse and worse; 5), there are bypasses such as automatic algorithms or coding; 6), poor readability, and cumbersome modification; 7), large loading, affecting processing speed

[0004] Existing protection technologies do not have a good risk perception capability for data interaction between cloud applications and clients, so that some attacks cause relatively large damage and losses to cloud applications or clients. Therefore, how to improve risk perception Ability to reduce harm and loss is a technical problem that those skilled in the art need to solve

Images