Network attack hierarchical detection model training method, detection method and device

Abstract

The application provides a network attack hierarchical detection model training method, a detection method and equipment. The training method comprises: based on a hierarchical label system containing attack scene labels and attack type labels, using a graph attention network to encode the hierarchical relationship; using the encoding result and network traffic data to train a classification model based on prompt learning, outputting a collaborative prediction result of attack scenes and types by calculating the similarity between traffic prompt representation and global label embedding; determining a supervision signal according to real labels, optimizing the classification model through adversarial training, and obtaining a final detection model. The application can realize collaborative identification and hierarchical tracing of attack scenes and types, provide more fine-grained threat perception, significantly improve the robustness, generalization ability and detection stability of the model in a dynamic adversarial environment, thereby improving the network attack identification accuracy, and improving the accuracy and efficiency of network security operation and maintenance.

Description

Technical Field

[0001] This application relates to the field of network security detection technology, and in particular to training methods, detection methods and equipment for hierarchical network attack detection models. Background Technology

[0002] As cyberattacks become increasingly complex and covert, cybersecurity has become crucial for ensuring production continuity and public safety. Deploying detection systems capable of accurately and reliably identifying various cyber threats is essential. However, the real-world network environment is dynamic and adversarial, filled with background noise, constant traffic variations, and a constant stream of unknown threat variants. This places extremely high demands on the fine-grained analytical capabilities and robustness of threat detection models.

[0003] Current mainstream network threat detection methods typically simplify the detection task into a flat, single-label classification problem. For example, a typical existing approach first extracts basic features (such as IP addresses and ports) and statistical features (such as traffic duration) from network traffic, and then uses classifiers such as Support Vector Machines (SVM) to build a model. The core objective of this model is to find the optimal hyperplane that classifies network traffic samples into specific attack types (such as DDoS or port scanning) or normal traffic. During inference, the model outputs the probability that a sample belongs to each attack type and selects the category with the highest probability as the final result. This method essentially only achieves the identification of a single attack type.

[0004] However, the aforementioned existing technical solutions suffer from two main technical shortcomings: First, the threat analysis dimension is too narrow. Existing methods generally ignore the crucial contextual dimension of the attack scenario (such as network environments or dataset sources like IIoT and VPNs), identifying attack types in isolation. This leads to fragmented threat intelligence, making effective attack attribution and contextual correlation analysis difficult. Second, the model's decision boundary is fragile. Traditional models are prone to overfitting to the surface statistical characteristics of the training data. Their decision boundaries are highly unstable when faced with noise disturbances, natural traffic variations, and threat variants not present in the training data, resulting in poor practicality and low reliability in dynamic, adversarial real-world network environments. These shortcomings severely limit the effectiveness of threat detection systems in practical deployments. Summary of the Invention

[0005] In view of this, embodiments of this application provide a training method, detection method and device for a hierarchical network attack detection model, in order to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of this application provides a method for training a hierarchical network attack detection model, comprising: Based on a hierarchical tagging system that includes scenario tags and type tags corresponding to network attacks, a graph model is used to encode the hierarchical relationship between the scenario tags and the type tags to generate a global tag embedding representation; wherein, each type tag belongs to one scenario tag; A classification model based on a cue learning framework is trained using the global label embedding representation and network traffic data as training samples; wherein, the classification model is configured to output a prediction result of the network attack scenario and type to which the network traffic data belongs by calculating the similarity between the cue-based representation of the network traffic data and the global label embedding representation; Based on the scene labels and type labels of the training samples, hierarchical information is determined from the hierarchical labeling system. Using this hierarchical information as a supervision signal, the classification model is optimized through adversarial training to obtain a hierarchical network attack detection model for collaborative identification of network attack scenarios and types.

[0007] In some embodiments of this application, before encoding the hierarchical relationship between the scene label and the type label using a graph model, the method further includes: Each scenario tag corresponding to a network attack is defined as a first-level tag, and each type tag corresponding to a network attack is defined as a second-level tag. The hierarchical tag system is formed by defining the relationship between each type tag and a scenario tag.

[0008] In some embodiments of this application, the step of encoding the hierarchical relationship between the scene tags and the type tags based on a hierarchical tagging system containing scene tags and type tags corresponding to network attacks, and generating a global tag embedding representation using a graph model, includes: Obtain the initial semantic vector representation of each scene label and each type label; The hierarchical tagging system containing scene tags and type tags corresponding to network attacks is modeled as a directed graph; wherein, the node set of the directed graph consists of the nodes corresponding to each scene tag and each type tag, and the types of edges in the directed graph include: parent-child relationship edges pointing from a scene tag to its parent type tag, and same-scene relationship edges connecting different type tags belonging to the same scene tag. Based on the directed graph, the initial semantic vector representations of each scene label and type label are encoded through a graph attention network to generate a global label embedding representation.

[0009] In some embodiments of this application, obtaining the initial semantic vector representations of each scene label and each type label includes: Based on the text names of each scene label and each type label, an initial semantic vector representation corresponding to each scene label and type label is generated through a pre-trained language model; wherein, the pre-trained language model includes: a domain-specific model trained on cybersecurity corpus.

[0010] In some embodiments of this application, the step of encoding the initial semantic vector representations of each of the scene labels and type labels based on the directed graph using a graph attention network to generate a global label embedding representation includes: The initial semantic vector representation of each scene label and type label is used as the initial semantic vector representation of the corresponding node in the directed graph; Based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, the initial semantic vector representation of each node is updated through the graph attention network, and the updated feature representations of each node are combined into a global label embedding representation.

[0011] In some embodiments of this application, the step of updating the initial semantic vector representation of each node through the graph attention network based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, and combining the updated feature representations of each node into a global label embedding representation, includes: Based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, construct the adjacency matrix of the directed graph; The adjacency matrix and the initial semantic vector representation of each node are used as inputs to the graph attention network, and multiple rounds of iterative message passing and feature aggregation are performed to update the feature representation of each node.

[0012] In some embodiments of this application, the adjacency matrix is ​​an N×N matrix, where N represents the total number of nodes in the directed graph; the element in the i-th row and j-th column of the adjacency matrix is ​​used to characterize the connection relationship from the i-th node to the j-th node; For each element in the adjacency matrix, if there is a parent-child relationship edge or a same-scene relationship edge between its corresponding two nodes, the value of the element is set to a first value to indicate that there is a connection; otherwise, it is set to a second value to indicate that there is no connection.

[0013] In some embodiments of this application, the step of using the adjacency matrix and the initial semantic vector representation of each node as input to the graph attention network, and performing multiple rounds of iterative message passing and feature aggregation to update the feature representation of each node, includes: The initial semantic vector representation of each node is used as the input feature of each node in the first layer iteration, and the adjacency matrix and the input features of each node in the first layer iteration are input into the L-layer graph attention network so that the graph attention network updates the input features of each node in the L-layer iteration. In each layer of iterative update process, for each node in the directed graph, its set of neighboring nodes is determined according to the adjacency matrix, and the attention weight between the node and each of its neighboring nodes is calculated through the attention mechanism. Based on the attention weight, the input features from the node itself and its neighboring nodes in the current layer iteration are weighted and aggregated to generate the feature representation of the node in the current layer iteration, and the feature representation is used as the input feature of the node in the next layer iteration.

[0014] In some embodiments of this application, training a classification model based on a cue-based learning framework using the global label embedding representation and network traffic data as training samples includes: Based on a predefined prompt template format containing preset mask markers, construct a prompt-based input sequence for network traffic data; The cueing input sequence is input into a classification model based on a cueing learning framework, so that the classification model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and the classification model calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity. The parameters of the classification model are optimized by minimizing the binary cross-entropy loss between the predicted result and the true label, wherein the true label includes the scene label and the type label.

[0015] In some embodiments of this application, the prompt template further includes one or more continuously learnable virtual tokens; the parameters of the classification model include the vector representations corresponding to the continuously learnable virtual tokens; The method for constructing a prompted input sequence for network traffic data based on a predefined prompt template format containing preset mask markers includes: The vectorized sequence representation of the network traffic data, the continuously learnable virtual token, and the preset mask marker are combined in a preset order to construct the prompting input sequence.

[0016] In some embodiments of this application, the classification model includes: A prompting encoding layer is used to receive the prompting input sequence of the network traffic data, encode the position of the preset mask mark in the prompting input sequence, and output the prompting representation of the network traffic data; The classification decision layer is used to calculate the dot product between the cueing representation of the network traffic data and each label vector in the global label embedding representation to obtain the original similarity score; each original similarity score is converted into an independent probability value through the Sigmoid function to obtain the prediction probability of each scene label and each type label, which is used as the prediction result of the network traffic data.

[0017] In some embodiments of this application, determining hierarchical information from the hierarchical labeling system based on the scene labels and type labels of the training samples includes: For the training sample, based on its scene label and type label, the local hierarchical path information corresponding to the training sample is mapped from the global structure of the hierarchical labeling system as hierarchical information; wherein, the local hierarchical path information is used to characterize the position and membership relationship of the scene label and type label of the training sample in the hierarchical labeling system.

[0018] In some embodiments of this application, the step of using this hierarchical information as a supervision signal to optimize the classification model through adversarial training includes: The classification model is used as a generator in a generative adversarial network framework; wherein, the generative adversarial network framework also includes an encoder and a discriminator; The parameters of the generator are optimized through adversarial training between the generator, encoder, and discriminator, thereby optimizing the classification model. The generator is used to generate a first feature representation as the prediction result based on the network traffic data, and input the first feature representation into the discriminator; The encoder is used to receive the network traffic data and the hierarchical information, and generate a second feature representation that fuses the hierarchical information as a supervision signal; the second feature representation is then input into the discriminator. The discriminator is used to determine the source of the input feature representation, so as to distinguish whether it comes from the first feature representation of the generator or the second feature representation of the encoder.

[0019] In some embodiments of this application, optimizing the parameters of the generator through adversarial training between the generator, encoder, and discriminator to achieve optimization of the classification model includes: The first and second phases are executed alternately. The first stage includes: fixing the parameters of the generator and the encoder, and updating the parameters of the discriminator to minimize the discrimination error of the discriminator between the first feature representation and the second feature representation; The second stage includes: fixing the parameters of the discriminator and the encoder, and updating the parameters of the generator based on a preset optimization objective; the optimization objective includes: minimizing the multi-label classification loss of the generator, and minimizing the adversarial loss used to cause the discriminator to misclassify the first feature representation output by the generator as coming from the encoder.

[0020] In some embodiments of this application, the encoder is used to perform the following: Receive the network traffic data and the hierarchical information; Based on the hierarchical information, the scene label of the training sample, and the type label, the corresponding label vector in the global label embedding representation is subjected to existence-enhanced encoding to obtain an enhanced label representation; The enhanced label representation is fused with the network traffic data representation to generate the second feature representation, and the second feature representation is input into the discriminator.

[0021] In some embodiments of this application, the step of performing existence-enhanced encoding on the corresponding label vector in the global label embedding representation based on the hierarchical information, the scene label of the training sample, and the type label to obtain the enhanced label representation includes: Based on the membership relationship between the scene label and the type label represented by the hierarchical information, the set of label vectors corresponding to the current training sample in the global label embedding representation is determined; For each label vector in the label vector set, determine whether the label vector belongs to the true label of the current training sample based on the hierarchical information; If the label vector belongs to the real label, then a learnable first augmentation vector for representing the existence state is superimposed on the label vector to obtain the augmented representation of the label vector; If the label vector does not belong to the real label, then a learnable second augmentation vector for representing the missing state is superimposed on the label vector to obtain the augmented representation of the label vector; Wherein, the first augmentation vector and the second augmentation vector are trainable parameters in the encoder; the augmented representations of all the label vectors together constitute the augmented label representation.

[0022] The second aspect of this application provides a hierarchical detection method for network attacks, comprising: Based on a predefined prompt template format containing preset mask markers, construct a prompt-based input sequence for network traffic data; The cueing input sequence is input into a hierarchical network attack detection model, which encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data. The classification model then calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs a prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity. The hierarchical network attack detection model is trained using the hierarchical network attack detection model training method described in the first aspect above.

[0023] A third aspect of this application provides a training apparatus for a hierarchical network attack detection model, comprising: The hierarchical tag encoding module is used to encode the hierarchical relationship between the scene tags and the type tags based on a hierarchical tag system containing scene tags and type tags corresponding to network attacks, and generate a global tag embedding representation; wherein each type tag belongs to one scene tag; The cue-based learning classification model building module is used to train a cue-based learning classification model using the global label embedding representation and network traffic data as training samples; wherein, the classification model is configured to output a prediction result of the network attack scenario and type to which the network traffic data belongs by calculating the similarity between the cue-based representation of the network traffic data and the global label embedding representation; The adversarial training module based on hierarchical supervision is used to determine hierarchical information from the hierarchical labeling system based on the scene label and type label of the training samples, and use the hierarchical information as a supervision signal to optimize the classification model through adversarial training, so as to obtain a hierarchical network attack detection model for collaborative identification of network attack scenes and types.

[0024] A fourth aspect of this application provides a hierarchical network attack detection device, comprising: The prompting input building module is used to construct prompting input sequences for network traffic data based on a predefined prompting template format containing preset mask markers; The model detection module is used to input the cueing input sequence into the hierarchical network attack detection model, so that the hierarchical network attack detection model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and enables the classification model to calculate the similarity between the cueing representation and each label vector in the global label embedding representation, and output the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity; wherein, the hierarchical network attack detection model is trained based on the hierarchical network attack detection model training method described in the first aspect above.

[0025] A fifth aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network attack hierarchical detection model training method, and / or to implement the network attack hierarchical detection method.

[0026] A sixth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network attack hierarchical detection model training method, and / or implements the network attack hierarchical detection method.

[0027] The seventh aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the network attack hierarchical detection model training method, and / or implements the network attack hierarchical detection method.

[0028] The hierarchical network attack detection model training method provided in this application is based on a hierarchical labeling system containing scene labels and type labels corresponding to network attacks. It utilizes a graph model to encode the hierarchical relationship between the scene labels and the type labels, generating a global label embedding representation. Each type label belongs to a scene label. By employing a hierarchical labeling system containing attack scenes and attack types, and using a graph attention network to encode their hierarchical relationship, it solves the problems of single-dimensional threat analysis, isolated threat intelligence, and difficulty in tracing the source of attacks in existing technologies. It enables collaborative identification and hierarchical fine-grained tracing of network attack scenes and types, providing crucial contextual information for threat analysis. It can collaboratively output structured results such as whether the attack occurred in an IIoT scenario or was specifically a port scanning attack. This allows Security Operations Center (SOC) analysts to immediately identify the source environment and attack intent of the attack, greatly shortening incident investigation and response time, and enabling an upgrade from isolated alerts to contextualized threat clues, thereby directly improving the accuracy and efficiency of network security operations and maintenance. A classification model based on a cue-based learning framework is trained using the global label embedding representation and network traffic data as training samples. The classification model is configured to calculate the similarity between the cue-based representation of the network traffic data and the global label embedding representation, and output a prediction result of the network attack scenario and type to which the network traffic data belongs. By employing a cue-based learning classification model, the classification task is reconstructed into a mask prediction form familiar to the pre-trained model. This solves the problems of low efficiency and poor stability in transferring pre-trained knowledge to specific threat detection domains, enabling efficient and stable transfer and utilization of pre-trained general knowledge. It significantly reduces the cost and cycle of updating the system as threats evolve, providing key technical support for building a resilient security protection system that can proactively adapt to future threats. Based on the scene and type labels of the training samples, hierarchical information is determined from the hierarchical labeling system. This hierarchical information is used as a supervisory signal to optimize the classification model through adversarial training, resulting in a hierarchical network attack detection model for collaborative identification of network attack scenarios and types. By determining local hierarchical information based on the real labels of the samples and using this as a supervisory signal for adversarial training, the system can solve the problems of fragile decision boundaries and insufficient robustness in the face of noise disturbances and unknown variants in traditional models. This forces the model to learn robust features that are insensitive to noise and conform to hierarchical logic, achieving a significant enhancement in detection stability and generalization ability in dynamic adversarial environments. When there are fluctuations in the production line network or attackers attempt to obfuscate traffic characteristics, the system can maintain a high and stable attack identification accuracy, effectively reducing false negatives (missing real attacks) and false positives (mistaking normal traffic for attacks), ensuring business continuity and the reliability of security protection.

[0029] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0030] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0031] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings: Figure 1 This is a schematic diagram of the first process of a hierarchical network attack detection model training method in one embodiment of this application.

[0032] Figure 2 This is a schematic diagram of the second process of the network attack hierarchical detection model training method in one embodiment of this application.

[0033] Figure 3 This is an example of the architecture of a hierarchical tagging system in one embodiment of this application.

[0034] Figure 4 This is a schematic diagram of the third process of training a hierarchical network attack detection model according to an embodiment of this application.

[0035] Figure 5 This is a flowchart illustrating a hierarchical network attack detection method according to an embodiment of this application.

[0036] Figure 6 This is a schematic diagram of a novel threat detection framework that integrates hierarchical labeling, cue learning, and adversarial training, as illustrated in an application example of this application.

[0037] Figure 7 This is a schematic diagram of the structure of a network attack hierarchical detection model training device in one embodiment of this application.

[0038] Figure 8 This is a schematic diagram of the structure of a network attack hierarchical detection device in one embodiment of this application. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0040] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the solution according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0041] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0042] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0043] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0044] First, it's important to note that existing threat detection methods still face significant challenges. One major issue is the limited dimensionality of threat analysis. Mainstream research often simplifies threat detection into a flat, single-label classification task, identifying only the attack type of traffic while neglecting the crucial contextual dimension of the attack scenario. This leads to isolated threat intelligence and difficulties in tracing its origin. For example, existing techniques using Support Vector Machines (SVM) to classify single attack types essentially simplify network threat detection into a traditional multi-classification task. Specifically, this method first extracts basic features from network traffic data, such as source / target IP addresses, ports, protocol types, and packet sizes. It then uses statistical analysis to obtain higher-level features like traffic duration, transmission rate, and distribution patterns. After feature extraction, an SVM classifier is used to build a threat detection model, dividing the feature space into different attack category regions by finding the optimal hyperplane. During training, the SVM determines the decision boundary by maximizing the margin between samples, thereby classifying network traffic samples into specific attack types (such as DDoS, port scanning, etc.) or normal traffic. During the inference phase, the model performs forward propagation on the input feature vector, outputs the probability distribution of each attack type, and selects the category with the highest probability as the final prediction result, thus achieving single-label classification only for attack types.

[0045] Secondly, there is the problem of fragile model decision boundaries. Real network environments are full of noise, traffic variations, and unknown threat variants, which places extremely high demands on the robustness of the model. Traditional models are prone to overfitting to the surface features of the training data, and their decision boundary stability is insufficient when facing noise disturbances, traffic variations, and unknown threat variants, which seriously affects their practicality and reliability in dynamic adversarial environments.

[0046] In other words, existing threat detection methods mainly have the following problems: First, the problem of limited threat analysis dimensions: mainstream research often simplifies threat detection into a flat, single-label classification task, that is, only identifying the attack type to which the traffic belongs, while ignoring the key contextual dimension of the attack scenario, resulting in isolated threat intelligence and difficulty in tracing its origin.

[0047] Second, the fragility of model decision boundaries is a significant issue. Real-world network environments are filled with noise, traffic variations, and unknown threat variants, placing extremely high demands on the robustness of models. Traditional models are prone to overfitting to the surface features of the training data, and their decision boundary stability is insufficient when facing noise disturbances, traffic variations, and unknown threat variants, severely affecting their practicality and reliability in dynamic adversarial environments.

[0048] Based on this, to solve the aforementioned technical problems, embodiments of this application provide a method for training a hierarchical network attack detection model, a method for detecting hierarchical network attacks, a training device for training the hierarchical network attack detection model, a device for executing the hierarchical network attack detection model, a physical device, a computer-readable storage medium, and a computer program product. It innovatively constructs a hierarchical threat detection framework, encodes label semantics and hierarchical relationships through graph attention networks, and reconstructs the classification task into a masked language modeling problem using cue learning. Furthermore, it introduces an adversarial training mechanism that integrates local hierarchical information, enhancing the model's robustness to noise and rare attacks while achieving efficient transfer of pre-trained knowledge and accurate identification of hierarchical threats.

[0049] The following examples will provide a detailed description.

[0050] Based on this, embodiments of this application provide a method for training a hierarchical network attack detection model that can be implemented by a network attack hierarchical detection model training device. See [link to relevant documentation]. Figure 1 The training method for the hierarchical network attack detection model specifically includes the following: Step 100: Based on a hierarchical tagging system containing scene tags and type tags corresponding to network attacks, the hierarchical relationship between the scene tags and the type tags is encoded using a graph model to generate a global tag embedding representation; wherein each type tag belongs to one scene tag.

[0051] In one or more embodiments of this application, the hierarchical tagging system refers to a tag organization structure with hierarchical relationships used to describe network threats. Specifically, it may include two layers: the first layer is a scenario tag, used to identify the environment in which the network attack occurs or the background of the data source (e.g., an Industrial Internet of Things (IIoT) environment); the second layer is a type tag, used to identify specific attack techniques or behaviors (e.g., distributed denial-of-service (DDoS) attacks). Each type tag uniquely belongs to a scenario tag, thus forming a tree-like or graph-like semantic hierarchy.

[0052] The graph model used for graph encoding of the label structure can include Graph Attention Network (GAT), Graph Isomorphism Network (GIN), or Graph Convolutional Network (GCN), etc. The Graph Attention Network (GAT) is a neural network model used to process graph-structured data. In this application, it is used to encode a hierarchical label system. This network treats each label as a node in a directed graph, constructs edges based on the hierarchical relationships between labels (such as parent-child relationships, sibling relationships), and aggregates information from neighboring nodes through an attention mechanism, thereby learning a vector representation that simultaneously reflects the semantics of the label itself and its positional relationship in the hierarchical structure.

[0053] The global label embedding representation refers to the set of vector representations obtained after encoding all labels in the complete hierarchical labeling system through a graph attention network. It is typically represented as a matrix, where each row corresponds to a dense vector of a label (scene or type). This representation integrates the textual semantics of the labels and global hierarchical structure information.

[0054] Specifically, in step 100, a structured tagging system can be constructed first. This system defines different network environments or data sources as scenario tags (first-level tags), such as Industrial Internet of Things (IIoT) environments and Virtual Private Network (VPN) environments. Specific attack methods are defined as type tags (second-level tags), such as port scanning and Distributed Denial-of-Service (DDoS) attacks. Each type tag must belong to a specific scenario tag, forming a tree-like hierarchical relationship. Then, a graph attention network (GAT) is used to model and encode this hierarchical structure. GAT treats each tag as a node in a directed graph, constructing connections based on parent-child (scenario-type) and sibling (different types within the same scenario) relationships between tags. Through the message passing and aggregation mechanism of a neural network, it learns the vector representation of each tag. Finally, the vector representations of all tags together constitute a matrix containing the semantics of the tags and their hierarchical relationships, representing a global tag embedding representation.

[0055] Furthermore, by adopting a hierarchical tagging system that includes attack scenarios and attack types, and using graph attention networks to encode the hierarchical relationships, this approach addresses the problems of existing threat analysis methods, such as limited dimensions, isolated threat intelligence, and difficulties in tracing the source of attacks. It enables collaborative identification and hierarchical, fine-grained tracing of network attack scenarios and types, providing crucial contextual information for threat analysis. It can also collaboratively output structured results, such as whether an attack occurred in an IIoT scenario or was specifically a port scanning attack. This allows Security Operations Center (SOC) analysts to immediately identify the source environment and intent of an attack, significantly shortening incident investigation and response time. It also enables an upgrade from isolated alerts to contextualized threat clues, directly improving the accuracy and efficiency of network security operations and maintenance.

[0056] Step 200: Using the global label embedding representation and network traffic data as training samples, train a classification model based on a cue learning framework; wherein the classification model is configured to output a prediction result of the network attack scenario and type to which the network traffic data belongs by calculating the similarity between the cue-based representation of the network traffic data and the global label embedding representation.

[0057] It is understood that the aforementioned prompt learning framework is a transfer learning technique. Its core idea is to reconstruct downstream tasks (such as classification) into tasks (such as masked language modeling) performed by a pre-trained model during the pre-training phase by designing specific text templates (i.e., prompts). In this application, the task of classifying network traffic data is reconstructed into a fill-in-the-blank prediction task familiar to the pre-trained language model, so as to more efficiently utilize its prior knowledge.

[0058] The aforementioned cueing representation refers to the process where raw network traffic data, after being numerically processed, is filled into a pre-defined cue template to form a sequence conforming to the input format of a pre-trained model. After this sequence is input into the model, the feature vector generated by the model at a specific location (such as a mask marker) constitutes the cueing representation of the traffic data. It integrates the features of the original data and the contextual information of the cue template.

[0059] Specifically, in step 200, network traffic data containing original packets or flow sequences is acquired as training samples. A prompt learning framework is used to construct a classification model. Specifically, the original traffic data (after necessary numerical processing) is filled into a preset text template, which contains a special mask [MASK] marker, forming a prompted input sequence. This sequence is input into a pre-trained language model (e.g., BERT) for encoding, and the model needs to predict the content to be filled in at the [MASK] position. In this method, the prediction of the [MASK] position is accomplished by calculating the similarity between the feature representation output by the model and each label vector in the global label embedding representation generated in step 100. The model learns and adjusts its parameters through training so that for traffic belonging to a certain scenario and type, the features at the [MASK] position are most similar to the embedding representation of the corresponding label, thereby enabling the simultaneous output of the attack scenario and attack type to which the traffic belongs.

[0060] In other words, by adopting a classification model based on prompting learning, the classification task is reconstructed into a mask prediction form familiar to the pre-trained model. This can solve the problems of low efficiency and poor stability in transferring pre-trained knowledge to specific threat detection domains. It can achieve efficient and stable transfer and utilization of pre-trained general knowledge, significantly reducing the cost and cycle of updating the system as threats evolve. This provides key technical support for building a resilient security protection system that can proactively adapt to future threats.

[0061] Step 300: Based on the scene label and type label of the training samples, determine the hierarchical information from the hierarchical label system, use the hierarchical information as a supervision signal, and optimize the classification model through adversarial training to obtain a hierarchical network attack detection model for collaborative identification of network attack scenes and types.

[0062] It should be noted that adversarial training is a training technique aimed at improving the robustness of a model. Its basic idea is to actively generate and apply difficult-to-discern perturbation samples (adversarial samples) to the model during training, forcing the model to learn smoother and more stable decision boundaries during optimization. In this application, a specific adversarial training strategy using hierarchical information as a supervision signal is referred to, aiming to enable the model to learn features that are insensitive to noise and conform to hierarchical logic.

[0063] In this embodiment, the hierarchical information refers to a structured supervision signal derived from the hierarchical labeling system and associated with a specific training sample. For a given sample, its hierarchical information typically reflects the path or relationship of its true labels (scene and type) within the system. This information is used as a supervision signal to guide the model in generating ideal feature representations during adversarial training.

[0064] The collaborative identification mentioned above refers to the core capability of the detection model in this application: for a single network traffic input, it can simultaneously and correlatedly output prediction results at both the attack scenario and attack type levels, rather than outputting only one of them. This enables the correlation analysis of threat context.

[0065] Specifically, in step 300, during the training process, for each training sample, based on its known true labels (i.e., scene labels and type labels), its specific location path in the aforementioned hierarchical labeling system can be determined. This path represents the hierarchical information unique to that sample. Subsequently, an adversarial training process is initiated. This process introduces an additional encoder that receives the sample's raw data and its true hierarchical information, generating an ideal feature representation that incorporates the correct hierarchical knowledge. Simultaneously, the classification model being trained in step 200 is treated as a generator, generating feature representations solely based on traffic data. A discriminator distinguishes between these two feature representations, forcing the features generated by the generator to be as close as possible to the ideal features generated by the encoder, which contain the correct hierarchical information. This adversarial game process is equivalent to using the true hierarchical logic as a strong supervisory signal to regularize the main model, enabling it to learn feature representations that are robust to noise and interference and conform to hierarchical logic, thereby optimizing a final detection model with more stable performance and stronger generalization ability.

[0066] Therefore, the embodiments of this application, by determining local hierarchical information based on the true labels of samples and using this as a supervisory signal for adversarial training, can solve the problems of fragile decision boundaries and insufficient robustness in the face of noise disturbances and unknown variants in traditional models. This forces the model to learn robust features that are insensitive to noise and conform to hierarchical logic, and can achieve a significant enhancement in detection stability and generalization ability in dynamic adversarial environments. When there are fluctuations in the production line network or when attackers attempt to obfuscate traffic characteristics, the system can maintain a high and stable attack identification accuracy, effectively reducing false negatives (missing real attacks) and false positives (judging normal traffic as attacks), and can ensure the reliability of business continuity and security protection.

[0067] As described above, the network attack hierarchical detection model training method provided in this application can achieve collaborative identification and hierarchical tracing of attack scenarios and types, providing more granular threat perception. By efficiently transferring pre-trained knowledge through prompted learning and utilizing adversarial training supervised by real hierarchical relationships, the model is forced to learn robust features that are insensitive to noise and conform to logic. This significantly improves the model's robustness, generalization ability, and detection stability in dynamic adversarial environments, thereby increasing the accuracy of network attack identification and enhancing the precision and efficiency of network security operations and maintenance.

[0068] To further address the issues of ineffective learning of the correlation between attack scenarios and types due to vague or unclear label system definitions, and the lack of structured supervisory signal sources in adversarial training, this application provides a hierarchical network attack detection model training method, see [link to relevant documentation]. Figure 2 The training method for the hierarchical network attack detection model includes the following steps prior to step 100: Step 010: Define each scenario tag corresponding to the network attack as a first-level tag, define each type tag corresponding to the network attack as a second-level tag, and define the membership relationship between each type tag and a scenario tag to form a hierarchical tag system.

[0069] Step 010 aims to establish a clear and structured knowledge foundation for the entire training method. First, different network environments or data source categories are summarized and abstracted from business logic or existing cybersecurity knowledge bases and datasets, and these are defined as first-level labels (also known as attack scenario labels).

[0070] Specifically, this application constructs a hierarchical tagging system, namely a hierarchical tagging system. Compared with traditional threat detection methods that only classify attack categories, this application's tagging system not only includes specific attack types but also introduces attack scenarios (dataset sources) as upper-level tags, forming a more complete threat description framework, such as... Figure 3As shown, the tagging system uses attack scenarios as direct child nodes of the root node, i.e., Level 1 tags. These attack scenarios correspond to different dataset sources or network environment types, such as specific scenarios like IIoT and VPN. Each attack scenario contains specific attack types as Level 2 tags. These attack types (such as Type A, Type B, Type C, and Type D) exist as child nodes of that scenario in the hierarchical structure.

[0071] For example, from publicly available datasets, terms like "Edge-IIoTset," "Virtual Private Network (VPN)," and "Enterprise Intranet" can be extracted as primary labels. Next, specific network attack techniques or behavior categories are collected and defined as secondary labels (also known as attack type labels), such as "Port Scanning," "Distributed Denial-of-Service Attack (DDoS Attack)," and "Data Injection." Finally, based on professional knowledge or the original annotation information of the dataset, the affiliation of each secondary label to a primary label is clearly established. For example, "Port Scanning" might be defined as belonging to the "Edge-IIoTset" scenario, while "Brute Force" might belong to the "Virtual Private Network (VPN)" scenario. Through these definitions and associations, a hierarchical labeling system with a clear parent-child structure is formed, serving as the common semantic foundation for all subsequent modules (encoding, classification, adversarial training).

[0072] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application constructs a solid and interpretable domain knowledge skeleton for the entire technical solution by pre-defining two-level labels and their hierarchical relationships. This ensures that subsequent graph coding, collaborative classification, and hierarchical adversarial supervision have consistent and accurate semantic goals, thereby guaranteeing the accuracy and rationality of the model's final scene and attack collaborative identification effect from the source.

[0073] To further address the challenge of effectively transforming discrete, hierarchical text tags into numerical vector representations that retain their semantic meaning while encoding rich hierarchical and contextual information, thus providing a high-quality semantic foundation for subsequent similarity-based classification, this application provides a method for training a hierarchical network attack detection model. (See also...) Figure 2 Step 100 in the network attack hierarchical detection model training method specifically includes the following: Step 110: Obtain the initial semantic vector representation of each scene label and each type label.

[0074] Specifically, the initial semantic vector representation refers to a numerical vector generated by a pre-trained model based solely on the textual semantics of the label names, before considering the hierarchical relationships between labels. It captures the lexical meaning of the label names themselves.

[0075] And, step 120: model the hierarchical tagging system containing scene tags and type tags corresponding to network attacks as a directed graph; wherein, the node set of the directed graph consists of the nodes corresponding to each scene tag and each type tag, and the types of edges in the directed graph include: parent-child relationship edges pointing from a scene tag to its parent type tag, and same-scene relationship edges connecting different type tags belonging to the same scene tag.

[0076] Understandably, a directed graph is a graph data structure composed of nodes and edges connecting the nodes. When constructing the graph structure of the Graph Attention Network (GAT), this application first defines the entire hierarchical labeling system as a directed graph G=(V,E). Here, the node set V consists of all labels (including first-level attack scenarios and second-level attack types), while the edge set E precisely encodes two core relationships between labels: hierarchical relationships and sibling relationships. Hierarchical relationships connect parent nodes (attack scenarios) to their direct child nodes (attack types within that scenario), ensuring that semantic dependencies and information flow in the hierarchical structure can be passed down from top to bottom. Sibling relationships connect all sibling nodes sharing the same parent node, i.e., different attack types within the same attack scenario, enabling the model to explicitly learn subtle differences between similar threats.

[0077] Specifically, step 120 transforms the tree-like hierarchical structure into a graph data structure for processing by a graph neural network. Each label (whether first-level or second-level) is treated as a node in a directed graph. Two types of directed edges are constructed based on the semantic relationships between labels: 1) Parent-child relationship edges: pointing from a scene label (parent node) to its directly subordinate attack type label (child node), for example, from the "Edge-IIoTset" node to the "Port Scan" node; 2) Same scene relationship edges: connecting all sibling type label nodes that share the same parent scene label, for example, in the "Edge-IIoTset" scenario, the "Port Scan" node and the "Distributed Denial-of-Service (DDoS Attack)" node are interconnected. All nodes and edges together constitute a directed graph.

[0078] Step 130: Based on the directed graph, the initial semantic vector representations of each scene label and type label are encoded using a graph attention network to generate a global label embedding representation.

[0079] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application, through the progressive processing of semantic vectorization, directed graph modeling and GAT encoding, generates a global label embedding representation that combines lexical semantics and complex structural semantics. This makes the distance between semantically similar or hierarchically related labels closer in the vector space, thereby significantly improving the accuracy and semantic rationality of subsequent classification models in similarity matching.

[0080] To further address the issue that general pre-trained language models lack precise and in-depth semantic understanding of cybersecurity terminology and attack technique naming, leading to domain bias or ambiguity in the initial semantic vector representation of generated labels, this application provides a training method for a hierarchical network attack detection model. (See [link to relevant documentation]). Figure 4 Step 110 in the network attack hierarchical detection model training method specifically includes the following: Step 111: Based on the text names of each scene label and each type label, generate the initial semantic vector representations corresponding to each scene label and type label through a pre-trained language model; wherein, the pre-trained language model includes: a domain-specific model trained on cybersecurity corpus.

[0081] It should be noted that domain-specific models refer to pre-trained language models that have undergone additional training or fine-tuning on corpora of a specific domain (in this case, cybersecurity). Their parameters and representation space are better adapted to the language patterns and knowledge of that domain, enabling them to more accurately understand domain-specific terminology, abbreviations, and contextual relationships. Cybersecurity domain corpora are collections of text data used to train or fine-tune domain-specific models. Their content focuses on the cybersecurity field, including network threat analysis reports, descriptions of common vulnerabilities and exposures (CVEs), intrusion detection system (IDS) rule documents, malware analysis logs, security protocol specifications, and related academic papers.

[0082] Step 111 is a preferred implementation for obtaining the initial semantic vector representation. Taking the tag "Distributed Denial-of-Service (DDoS Attack)" as an example, its text name is used as input. Unlike directly using a general pre-trained model, this step employs a domain-specific model. This model is typically obtained by further training on a large-scale general corpus (e.g., based on the BERT architecture) using massive amounts of cybersecurity-related text, reports, papers, vulnerability descriptions, or code comments (i.e., domain-adaptive pre-training). The tag name is input into this domain-specific model, and its encoding layer obtains a more domain-relevant contextual representation, which is then pooled to generate the initial semantic vector representation of the tag. Compared to a general model, the vector generated in this way has more accurate semantic encoding for security terms such as "injection," "overflow," and "scanning."

[0083] Specifically, this application converts text-based label names into numerical representations that can be processed by machine learning models. Labels initially exist as natural language entities. This application utilizes the pre-trained language model BERT for label semantic encoding, converting each label name y into a distributed representation. Specifically, each label name y is first processed by BERT's tokenizer: The sequence of sub-words after word segmentation. For the k-th sub-word token; This represents the tokenizer used by the BERT pre-trained model, based on the Word Piece algorithm. For example, the tag name "port scanning" is broken down into a sequence of sub-words ["port", "scanning"]. This sub-word segmentation mechanism effectively handles unfamiliar compound words and technical terms, ensuring that the complete semantics of the tag name are fully captured. The token sequence is then converted into a vector representation through BERT's embedding layer. : For token embedding matrix, For the position embedding matrix, For segment embedding matrix, This represents one-hot encoding. The embedding layer integrates lexical semantics, positional information, and paragraph type to generate a context-independent initial representation for each token.

[0084] The initial semantic vector representation of the tag is generated using an average pooling strategy. : Let K be the initial semantic vector representation of the tag, and K be the number of tokens in the sequence. Average pooling can equally consider the contribution of each sub-word, avoid information loss, and is insensitive to changes in sequence length, making it suitable for handling tag names of varying lengths.

[0085] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application, by adopting a pre-trained model specifically for the network security field, can ensure that the initial semantic vectors generated for the labels have higher domain relevance and accuracy, and can provide a higher quality and more realistic threat semantic label representation foundation for subsequent graph coding and classification tasks, thereby improving the entire system's understanding and recognition accuracy of threat descriptions.

[0086] To further address the issue of how to effectively interact and fuse the independent initial semantics of tags through their hierarchical graph structure, thereby dynamically generating a comprehensive vector representation that simultaneously reflects the meaning of the tags themselves and their complex relationships, a network attack hierarchical detection model training method provided in this application embodiment includes the following specific steps in step 130: Step 131: Use the initial semantic vector representation of each scene label and type label as the initial semantic vector representation of the corresponding node in the directed graph.

[0087] Step 132: Based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, update the initial semantic vector representation of each node through the graph attention network, and combine the updated feature representations of each node into a global label embedding representation.

[0088] Step 132 is the core computational process of the Graph Attention Network (GAT). The GAT model takes the previously constructed graph structure (containing nodes and their relational edges) and the initial features of all nodes as input. The model iteratively computes according to the defined number of network layers (e.g., 2 layers). In each layer, for each node in the directed graph (e.g., the "port scan" node), GAT will: 1) identify all its neighboring nodes (e.g., its parent node "edge IoT set" and its sibling nodes in the same scenario, such as "distributed denial-of-service attack") based on the edge connection relationships of the graph (parent-child relationship edges, same-scenario relationship edges); 2) calculate the importance weights between the node and each neighboring node through a learnable attention mechanism; 3) based on these weights, perform a weighted summation and nonlinear transformation on the feature vectors from itself and all neighboring nodes to generate a new feature vector for the node in the current layer. After multiple rounds of such iterations, the final feature representation of each node has deeply aggregated its own semantics, the contextual information of its own scenario, and the comparative or related information of other attack types in the same scenario. Arranging the updated feature representations of all nodes in order constitutes the final global label embedding representation.

[0089] Specifically, the initial semantic vector representation only contains the semantics of the label itself and fails to capture its position in the hierarchical structure. To address this, this application introduces a Graph Attention Network (GAT) to encode the hierarchical structure as a graph structure.

[0090] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application, through the iterative update mechanism of graph attention network, enables the final vector representation of each label to not only contain its literal semantics, but also deeply encode its subordinate scene context and its association and differences with other related attack types, thereby generating a more informative and discriminative global label embedding, laying a solid foundation for subsequent accurate similarity matching and classification.

[0091] To further address the issues of how to efficiently and normally input non-Euclidean graph structures into neural networks for computation, and how to fully integrate node features with global structural information through a systematic iterative process, this application provides a method for training a hierarchical network attack detection model, see [link to relevant documentation]. Figure 4 Step 132 in the network attack hierarchical detection model training method specifically includes the following: Step 1321: Construct the adjacency matrix of the directed graph based on the parent-child relationship edges and the same-scene relationship edges in the directed graph.

[0092] Specifically, the rows and columns of the adjacency matrix correspond to nodes in the directed graph, and the element values ​​in the matrix represent whether an edge exists between corresponding node pairs and the attribute of the edge (a binary value indicating presence or absence in this application). It serves as the fundamental input for graph attention networks to understand the graph topology and perform message passing computation.

[0093] Step 1322: Using the adjacency matrix and the initial semantic vector representation of each node as input to the graph attention network, perform multiple rounds of iterative message passing and feature aggregation to update the feature representation of each node.

[0094] Specifically, multi-round iteration refers to a graph attention network containing multiple computational layers. Data (node ​​features) starts from the input layer and is calculated and updated layer by layer, with the output of each layer serving as the input for the next. Message passing and feature aggregation are the core operations of graph neural networks. Message passing refers to a node sending its feature information along the edges to its neighboring nodes; feature aggregation refers to a node receiving information from all its neighboring nodes and fusing this information with its own information according to certain rules (such as attention weighting) to form updated features. This process enables nodes to perceive the context of their local graph structure.

[0095] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application standardizes the graph structure input by constructing an adjacency matrix, providing clear connection rules for GAT; through a multi-round iterative message passing mechanism, it can ensure that the features of each node can fully absorb and integrate the semantic information of multi-level and multi-hop neighbors, thereby generating higher quality and more discriminative node feature representations, which can improve the performance of subsequent tasks.

[0096] To further address the challenge of encoding complex label hierarchies and relationships (parent-child, same-scene) into a standard mathematical form directly processable by graph neural networks in the simplest and unambiguous way, and to avoid additional noise or training instability introduced by complex or subjective edge weight definitions, this application provides a network attack hierarchical detection model training method. In this method, the adjacency matrix is ​​an N×N matrix, where N represents the total number of nodes in the directed graph. The element in the i-th row and j-th column of the adjacency matrix represents the connection relationship from the i-th node to the j-th node. For each element in the adjacency matrix, if there is a parent-child relationship edge or a same-scene relationship edge between its corresponding two nodes, the value of the element is set to a first value to indicate the existence of a connection; otherwise, it is set to a second value to indicate the absence of a connection. The first and second values ​​are two specific scalar values ​​used when assigning values ​​to elements in the adjacency matrix, used to binary represent the two states of "connection exists" and "connection does not exist" between nodes. Typically, the first value can be 1, indicating "connection exists" (neighbor), and the second value can be 0, indicating "no connection exists" (not a neighbor). This binary assignment strategy is a common and concise way to construct unweighted graphs or binary adjacency matrices.

[0097] Specifically, in order to transform the directed graph structure into a mathematical form that can be processed by the computation module, this application defines the adjacency matrix A of the directed graph. This matrix is ​​an N×N square matrix (N is the total number of labels), where the elements A ij The value represents the node v i to node v j The connection strength. This application adopts a binary weight strategy: if any of the above-mentioned relation edges exist between two nodes, the corresponding matrix element value is 1; otherwise, it is 0. Specifically, for any two label nodes v i and v j If and only if they satisfy v j It is v i direct subclasses (parent-child relationship), or v i and v j When they have the same direct parent class (same scenario relationship), A ij =1. This adjacency matrix, which combines symmetric and asymmetric relationships, provides rich structural priors for graph attention mechanisms.

[0098] To illustrate with a complete path example, “Edge-IIoTset → port scanning” clearly demonstrates the construction rules of a graph structure. In this example, “Edge-IIoTset” is a parent node as a first-level label (attack scenario), while “port scanning” is a child node as a specific attack type under it, connected by a parent-child edge. Simultaneously, assuming other attack types such as “DDoS attack” exist within the same “Edge-IIoTset” scenario, then “port scanning” and “DDoS attack” will be sibling nodes, connected by a same-scenario edge. In this graph structure, the neighbor set N(i) of the “port scanning” node will include its parent node “Edge-IIoTset” and all sibling nodes within the same scenario. When calculating its representation, the graph attention network simultaneously aggregates scenario context information from the parent node and contrastive information from the sibling nodes, thereby generating a more informative label embedding.

[0099] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application uses binary weights (such as 0 / 1) to construct the adjacency matrix, which makes the graph structure clear and computationally efficient. It provides a stable and easily interpretable topological input for the graph attention network, reduces the complexity of model training, and ensures that information transmission is based entirely on predefined and accurate semantic relationships, thereby enhancing the controllability and reliability of the entire encoding process.

[0100] To further address the challenge of avoiding treating all neighbors equally (i.e., simple averaging) when aggregating neighbor node information, and instead performing differentiated and adaptive feature fusion based on the dynamic importance of semantic relationships between nodes, a network attack hierarchical detection model training method provided in this application embodiment includes the following specific steps in step 1322: The initial semantic vector representation of each node is used as the input feature of each node in the first layer iteration, and the adjacency matrix and the input features of each node in the first layer iteration are input into the L-layer graph attention network so that the graph attention network updates the input features of each node in the L-layer iteration. In each layer of iterative update process, for each node in the directed graph, its set of neighboring nodes is determined according to the adjacency matrix, and the attention weight between the node and each of its neighboring nodes is calculated through the attention mechanism. Based on the attention weight, the input features from the node itself and its neighboring nodes in the current layer iteration are weighted and aggregated to generate the feature representation of the node in the current layer iteration, and the feature representation is used as the input feature of the node in the next layer iteration.

[0101] Specifically, GAT uses a message-passing mechanism to aggregate information from its neighbors (parent and child classes) in the representation of each tag node. Specifically, for the i-th node in the tag hierarchy, the global representation of the i-th node... Iterative updates via a multi-layer graph attention mechanism: in, These are the attention weights of the l-th layer. It is the set of neighbors of the i-th node. It is a transformation matrix. It is an activation function; This is the global representation of the j-th node. This process ensures that semantically similar or hierarchically adjacent labels are located close to each other in the vector space, thereby enhancing the discriminative power and semantic richness of the label representations. Furthermore, GAT's hierarchical encoding ensures that each label representation not only includes its own lexical semantics but also incorporates its structural contextual information within the global hierarchical system. For example, "port scanning" and "uploading injection" both belong to the same scene parent class in the "Edge-IIoTset" dataset. After GAT encoding, their representations will share certain common features while retaining their respective discriminative features.

[0102] After L layers of propagation, this application obtains the final global label embedding matrix, i.e., the global label embedding representation. For a complete tagging system containing N tags, this application obtains a hierarchical representation of each tag through GAT encoding. ∈ , where i∈{1,2,…,N} are the label indices, and d is the embedding dimension. These vectors are combined row-wise to construct the global label embedding matrix: This matrix will serve as the learnable label representation in the classification model in the next section, namely the global label embedding representation, used to calculate the semantic similarity between the input features and all labels.

[0103] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application introduces a learnable attention mechanism for iterative updates, enabling each label node to dynamically and selectively focus on the neighboring nodes that are most semantically relevant or most important when updating its features, thereby generating a hierarchical label embedding representation with stronger discriminative power and more accurate information, which greatly improves the semantic accuracy of similarity matching in subsequent classification tasks.

[0104] To further address the challenge of efficiently transferring the massive knowledge of general pre-trained models to the specialized field of network threat detection, and to design a unified classification model architecture capable of simultaneously outputting prediction results for both scenario and type, this application provides a method for training a hierarchical network attack detection model. (See also...) Figure 2 Step 200 in the training method for the hierarchical network attack detection model specifically includes the following: Step 210: Construct a prompting input sequence for network traffic data based on a predefined prompt template format containing preset mask markers.

[0105] It should be noted that the prompt template format is a pre-designed text string framework containing specific words and placeholders. Its purpose is to reformulate the downstream task (in this case, threat classification) into a task format that the pre-trained model has solved during the pre-training phase (such as a cloze test), thereby more effectively stimulating the model's existing knowledge.

[0106] A preset mask ([MASK]) token is a special token used in the cue learning paradigm to indicate the location where the model needs to make a prediction. In this application, the feature vector output by the model at that location will be used for similarity comparison with all label vectors to complete the classification.

[0107] Step 220: Input the cueing input sequence into a classification model based on a cueing learning framework, so that the classification model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and the classification model calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity.

[0108] Step 230: Optimize the parameters of the classification model by minimizing the binary cross-entropy loss between the predicted result and the true label, wherein the true label includes the scene label and the type label.

[0109] Specifically, the model minimizes the binary cross-entropy loss L between the predicted probability and the true label. clsTo learn the parameters, the model's predicted probabilities gradually approximate the true label distribution: in, Represents the classification loss value, which represents the overall prediction error of the model on the current batch of training data; N is the total number of labels; This represents the true value of the i-th label, which can be either 0 or 1. During training, 1 indicates that the true label of the sample contains this label (e.g., the traffic does indeed belong to a "port scan" attack), and 0 indicates that it does not contain it. This represents network traffic data (also known as raw traffic data). This represents the probability value of the i-th label predicted by the classification model (which can be simply referred to as the model in this embodiment of the application), and represents the confidence level (ranging from 0 to 1) of the model in considering the sample to belong to this label after given input traffic data x.

[0110] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application reconstructs the classification task into mask prediction, which the pre-trained model is good at, through prompt learning, thereby achieving efficient and stable transfer of pre-trained knowledge to downstream tasks. At the same time, by calculating the similarity with all hierarchical labels through a single model, the collaborative and accurate identification of scenarios and attack types is achieved in a unified manner, which can effectively simplify the system architecture and improve analysis efficiency.

[0111] To further address the problem that using fixed natural language vocabulary as cues in cue learning may not optimally stimulate the pre-trained model's knowledge transfer to a specific domain (cyber threat), and the difficulty in finding the most suitable expression for the task context, in a training method for a hierarchical network attack detection model provided in this application embodiment, the cue template further includes one or more continuously learnable virtual tokens; the parameters of the classification model include the vector representation corresponding to the continuously learnable virtual tokens.

[0112] Correspondingly, see Figure 4 Step 210 specifically includes the following: Step 211: Combine the vectorized sequence representation of the network traffic data, the continuously learnable virtual token, and the preset mask marker in a preset order to construct the prompting input sequence.

[0113] Specifically, this application first fills the original network flow data x into a carefully designed cue template T to construct the cueed input sequence of the model. It can be described as: in, These are a series of learnable, continuous virtual tokens. These virtual tokens do not correspond to any natural language words but are optimized during training via gradient descent. Their role is to serve as task-specific context, guiding the pre-trained model to better adapt to downstream threat classification tasks. In this method, the number of virtual tokens is set to 8, a setting that has been evaluated to achieve a good balance between model expressiveness and training efficiency. During initialization, the virtual token embedding matrix is ​​generated by sampling from the word embedding space of the pre-trained model, ensuring its initial distribution is compatible with natural language representations. The word embedding space of the pre-trained model refers to the front-end layer of the BERT model (bert.embeddings.word_embeddings layer), a lookup table that maps discrete word IDs to a continuous vector space. Each word corresponds to a 768-dimensional vector, which is learned during pre-training and captures rich semantic and syntactic information. During training, these virtual tokens, as learnable parameters, are optimized together with other parts of the model, gradually evolving into a specific contextual representation suitable for threat classification tasks. The position of the [MASK] token is crucial to the entire template; the model needs to make predictions at this location.

[0114] For example: [CLS] traffic characteristics are: "{00 0c 29 48 50 c7 00 50 56 c0 00 08 08 00 4500 00 34 fa 58 40 00 80 06 40 95 c0 a8 9f 01 c0 a8 9f 83 2b fe 00 50……}[V1][V2] ... [V8] This attack belongs to [MASK] DDoS [SEP]".

[0115] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application introduces a continuously learnable virtual token as part of the prompt, enabling the model to automatically explore and optimize the context representation most suitable for the network threat detection task during the training process. This allows for more accurate and efficient guidance of the knowledge transfer of the pre-trained model, improving the classification model's ability to understand threat semantics and the final detection performance.

[0116] To further address the issues of unclear internal structure of classification models, how to effectively and interpretably match encoded traffic features with hierarchical labels and transform them into intuitive probability outputs, and the difficulty in finding the most suitable representation for the task context, this application provides a method for training a hierarchical network attack detection model. The architecture of the classification model includes: (1) A prompting encoding layer, used to receive the prompting input sequence of the network traffic data, and to encode the position of the preset mask mark in the prompting input sequence, and output the prompting representation of the network traffic data; (2) Classification decision layer, used to calculate the dot product of the hinted representation of the network traffic data and each label vector in the global label embedding representation to obtain the original similarity score; each original similarity score is converted into an independent probability value by activating the Sigmoid function to obtain the prediction probability of each scene label and each type label, which is used as the prediction result of the network traffic data.

[0117] The cue encoding layer is the component in the classification model responsible for mapping the constructed cueed input sequence into a feature representation incorporating deep semantics. Its core task is to locate and output the features at the [MASK] position as the overall representation of the data. The classification decision layer is the component in the classification model that makes multi-label classification decisions based on the feature representation. It achieves collaborative prediction by calculating the similarity between features and all labels and converting it into probabilities.

[0118] The classification model can be implemented using the BERT pre-trained language model.

[0119] Specifically, the BERT pre-trained language model is used to encode the prompted sequence T(x) into a hidden state sequence: Where H represents the hidden state sequence.

[0120] This application retrieves the hidden state corresponding to the [CLS] token or performs a pooling operation on the entire sequence to obtain the aggregate semantic representation of network traffic data (i.e., input data) x. ∈R d : Pooler(·) represents a pooler; This represents the hidden state marked with [CLS]. It refers to the feature vector in the hidden state sequence output by BERT that corresponds to the [CLS] special marker at the beginning of the input sequence. This position is designed to carry the semantic information of the entire sequence.

[0121] This representation integrates raw traffic data with contextual information from learnable cues, where the BERT model captures deep semantic features of the input through a multi-layer Transformer encoder.

[0122] Classification decisions are made by calculating the text representation h. x The global label embedding matrix L generated in the previous section globalThis is achieved by calculating the similarity of each label vector. Specifically, this application uses dot product operations to measure the proximity in the semantic space: in, This represents the original similarity score; This represents the i-th label vector in the global label embedding matrix.

[0123] Then, the similarity score is converted into the predicted probability for each label y using the sigmoid function: in, Indicates the conditional prediction probability; This represents the bias term for the i-th label; (·) represents the Sigmoid function.

[0124] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application decouples feature extraction and matching decision through a two-stage architecture of explicit prompt encoding and classification decision, making the model process clear; it provides an efficient, stable and interpretable similarity calculation and probability transformation mechanism by using dot product and sigmoid function, ensuring the mathematical rationality of the final prediction result and its understandability in practical applications.

[0125] To further address the problem that supervisory signals in adversarial training are too general (such as raw pixels of an image or raw category of text), failing to provide structured domain knowledge that precisely corresponds to the current sample as strong supervision, this application provides a hierarchical network attack detection model training method, see [link to relevant documentation]. Figure 2 Step 300 in the network attack hierarchical detection model training method specifically includes the following: Step 310: For the training sample, based on its scene label and type label, map the local hierarchical path information corresponding to the training sample from the global structure of the hierarchical label system as hierarchical information; wherein, the local hierarchical path information is used to characterize the position and membership relationship of the scene label and type label of the training sample in the hierarchical label system.

[0126] Step 310 generates instance-specific supervision signals for subsequent adversarial training. For a given training sample, its annotation includes a specific "attack scenario label" (e.g., "Edge-IIoTset") and a specific "attack type label" (e.g., "Port Scanning"). Based on the "global structure" (i.e., the complete topology of all labels and their affiliations) of the hierarchical labeling system defined in weight 2, the node positions of these two labels within the system can be located. The path connecting the root node (or first-level label node) to the type label node constitutes the local hierarchical path information of the sample. For example, the path can be represented as "Edge-IIoTset → Port Scanning". This path explicitly characterizes the specific attack type affiliation of the sample and its relationship to the scenario. This information is extracted as unique, structured hierarchical information specific to the sample.

[0127] Local hierarchical path information refers to a specific path or subgraph composed of related label nodes extracted from the global structure of the hierarchical labeling system for a specific sample's real label. It represents the sample's precise location and contextual relationship within the overall threat knowledge graph, and is a concretization of the global structure at the instance level.

[0128] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application generates accurate and structured supervision signals by dynamically extracting the corresponding local hierarchical path for each training sample. This enables adversarial training to be optimized with the hierarchical relationship specific to the sample and conforming to the domain logic as the target, which greatly enhances the pertinence and effectiveness of model regularization.

[0129] To further design an effective training mechanism that utilizes sample-specific, structured hierarchical information as strong supervision to directly regularize and enhance the feature representation space of the main model, rather than simply perturbing the input data, a training method for a hierarchical network attack detection model provided in this application embodiment is described below. Figure 2 Step 300 in the network attack hierarchical detection model training method further includes the following: Step 320: Use the classification model as a generator in a generative adversarial network framework; wherein the generative adversarial network framework also includes an encoder and a discriminator.

[0130] Step 330: Optimize the parameters of the generator through adversarial training between the generator, encoder and discriminator, thereby completing the optimization of the classification model.

[0131] The generator is used to generate a first feature representation as the prediction result based on the network traffic data, and input the first feature representation into the discriminator; The encoder is used to receive the network traffic data and the hierarchical information, and generate a second feature representation that fuses the hierarchical information as a supervision signal; the second feature representation is then input into the discriminator. The discriminator is used to determine the source of the input feature representation, so as to distinguish whether it comes from the first feature representation of the generator or the second feature representation of the encoder.

[0132] The encoder is a neural network with a different structure and independent parameters than the generator. Its core function is to receive additional real-world supervisory information (hierarchical information) and generate a high-quality, ideal feature representation that incorporates correct knowledge, serving as a model for the generator's learning. The discriminator can be a binary classification neural network, responsible for determining whether the input feature representation comes from the encoder's ideal representation or from the generator's generated representation.

[0133] The first feature representation refers to the intermediate feature vector generated by the generator (classification model) during its internal computation process, used for the final classification. In adversarial training, it is considered the generated representation that needs to be optimized. The second feature representation refers to the feature vector generated by the encoder, which incorporates real-level information from the samples. It serves as a standard for the real or ideal representation in adversarial training, providing the generator with a clear learning objective. Source discrimination is the core function of the discriminator, which determines the source category of the received feature vector (whether it comes from the encoder or the generator). This is a binary classification task.

[0134] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application constructs a three-party adversarial framework of generator, encoder and discriminator, uses hierarchical information as a supervision signal for the encoder to generate ideal representations, and forces the feature representations of the generator (main model) to move closer to it, thereby realizing the direct distillation of domain knowledge (hierarchical logic) into the main model, which significantly enhances the robustness and discriminability of the model features.

[0135] To further address the issues of training instability and convergence difficulties caused by simultaneous updates of multiple components (generator, discriminator) in generative adversarial network (GAN) training, and how to balance the performance of the main task (classification) with the adversarial regularization effect, this application provides a training method for a hierarchical network attack detection model, see [link to relevant documentation]. Figure 4 Step 330 in the network attack hierarchical detection model training method specifically includes the following: Step 331: Alternately execute the first stage and the second stage; the first stage includes: fixing the parameters of the generator and the encoder, and updating the parameters of the discriminator to minimize the discrimination error of the discriminator between the first feature representation and the second feature representation; the second stage includes: fixing the parameters of the discriminator and the encoder, and updating the parameters of the generator based on a preset optimization objective; the optimization objective includes: minimizing the multi-label classification loss of the generator, and minimizing the adversarial loss used to cause the discriminator to misclassify the first feature representation output by the generator as coming from the encoder.

[0136] Discriminant error refers to the loss value incurred by the discriminator when determining the source of a feature representation, measuring the degree of its error. Minimizing discriminant error means improving the discriminator's accuracy. Adversarial loss, in generative adversarial training, refers to the loss used to train the generator, which is opposite to the discriminator's objective. By minimizing this loss, the generator makes it difficult for the discriminator to distinguish its source.

[0137] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application ensures that the discriminator and generator are trained in a stable dynamic balance through a two-stage alternating optimization strategy; by jointly optimizing the classification loss and adversarial loss, the generator can improve feature robustness while ensuring that its core classification performance does not degrade, thereby achieving a unity of adversarial training effect and model practicality.

[0138] To further address the issue that when the encoder fuses hierarchical information, simply inputting label text or raw vectors fails to effectively distinguish the specific state of the label within the current sample context, resulting in insufficiently accurate and powerful supervisory signals for the generated ideal feature representations, the encoder in the hierarchical network attack detection model training method provided in this application performs the following: (1) Receive the network traffic data and the hierarchical information.

[0139] (2) Based on the hierarchical information, the scene label of the training sample and the type label, the existence-enhanced encoding is performed on the label vector corresponding to the global label embedding representation to obtain the enhanced label representation.

[0140] (3) The enhanced label representation is fused with the network traffic data representation to generate the second feature representation, and the second feature representation is input into the discriminator.

[0141] Existence-enhanced coding (EENC) is an operation that adds contextual state information to label vectors. It overlays a specific state vector (presence or absence) onto the general vector representation of a label based on whether the label actually appears in the current sample, thus injecting sample-specific prior knowledge into the label representation. The enhanced label representation refers to a set of label vectors processed by EENC. It not only semantically represents relevant labels but also encodes the relevance of these labels to the current specific sample, serving as a supervisory signal carrier richer in sample-specific information.

[0142] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application provides the supervisory signal obtained by the encoder with sample-level precise semantics by performing existence enhancement encoding on the label vector based on the actual occurrence situation. This enables the generation of higher quality and more discriminative ideal feature representations, providing a clearer and more accurate target for the generator's adversarial learning, and greatly improving the effect of knowledge distillation and regularization.

[0143] To further address the issue that when enhancing label representations at the sample level, the enhancement signal is too simple or lacks discriminative power (e.g., using only 0 / 1 masks), failing to allow the encoder to fully learn and utilize the subtle semantic differences between the two key context states of presence and absence, thus limiting the quality of generating "ideal" feature representations, this application provides a network attack hierarchical detection model training method. In this method, the encoder performs presence-enhanced encoding on the corresponding label vector in the global label embedding representation based on the hierarchical information, the scene label of the training samples, and the type label, obtaining the enhanced label representation. The specific execution process is as follows: (1) Based on the membership relationship between the scene label and the type label represented by the hierarchical information, determine the set of label vectors corresponding to the current training sample in the global label embedding representation; (2) For each label vector in the label vector set, determine whether the label vector belongs to the true label of the current training sample based on the hierarchical information; (3) If the label vector belongs to the real label, then a learnable first augmentation vector for representing the existence state is superimposed on the label vector to obtain the augmented representation of the label vector; If the label vector does not belong to the real label, then a learnable second augmentation vector for representing the missing state is superimposed on the label vector to obtain the augmented representation of the label vector; Wherein, the first augmentation vector and the second augmentation vector are trainable parameters in the encoder; the augmented representations of all the label vectors together constitute the augmented label representation.

[0144] The label vector set refers to a specific subset of vectors selected from the global label embedding representation based on the hierarchical information of the current sample. It contains vector representations of all labels directly related to the semantics of the current sample (including the true label and related negative labels), and is the direct object for fine-grained augmentation operations. The first augmentation vector is a trainable parameter vector in the encoder (E) used to represent the state information of a label actually appearing or existing in the context of a sample. This state semantics is injected into it by adding it to the label vector. The augmented representation refers to the new vector representation obtained after a single label vector is superimposed with a state vector (the first or second augmentation vector). This augmented representation integrates the general semantics of the label and its specific state in the current sample. The second augmentation vector is a trainable parameter vector in the encoder (E) used to represent the state information of a label not appearing or missing in the context of a sample. It is independent of the first augmentation vector and is learned together to distinguish between two opposing states.

[0145] As can be seen from the above description, the network attack hierarchical detection model training method provided in this application introduces learnable and independent first and second enhancement vectors, and performs fine-grained enhancement by vector superposition, so that the encoder can generate highly discriminative and information-rich state-aware representations for relevant labels, thereby greatly improving the quality and guiding ability of the generated second feature representation as a supervision signal.

[0146] Based on this, in the specific implementation of step 300, the essence of adversarial training is to allow the model to learn in an "adversarial game," enhancing the smoothness and stability of the decision boundary by generating indistinguishable adversarial samples. The adversarial training framework in this module includes three parts: a generator, an encoder, and a discriminator.

[0147] The generator is the hierarchical classification model trained in the previous section, and its parameters are denoted as θ. G The generator receives network stream data x as input and outputs a hidden representation h that integrates semantic and cue information. mix In adversarial training, the generator's task is to generate representations that are difficult to distinguish from the real data distribution, with the goal of making it difficult for the discriminator to identify their source.

[0148] An encoder is a network with a similar structure to a generator but with independent parameters. The main differences between the encoder and the generator lie in how the input information is utilized and the design of the network parameters. Specifically, the encoder is not structurally identical to the generator; instead, it adds a label-aware encoding module on top of the generator's basic hierarchical classification model to fuse real local hierarchical prior information. The generator only takes the raw data x as input, and its goal is to learn a general representation that can cope with noise; while the encoder additionally receives sample-specific real label information and, through a separate label enhancement layer and hierarchical fusion layer, encodes the strong supervision signal of "the ideal hierarchical structure that the sample should have" into its output oracle representation h. mix Therefore, both share a basic feature extraction backbone network to ensure consistency in the representation space, but the encoder has a separate parameter module focused on fusing prior knowledge of the real labels. This allows the encoder to generate a higher quality, cleaner "ideal" representation as the target that the generator strives to approximate during adversarial training.

[0149] The encoder's input includes the raw network stream data x and the label representation obtained through local hierarchical perceptual coding. First, the label representation is enhanced for existence: for each label, a learnable existence vector is used based on whether it appears in the sample. and missing vectors Encode to form an enhanced tag representation. This enhancement mechanism assigns a clear semantic meaning to each label within the current sample context.

[0150] The encoder's main structure adopts a layered transformer architecture, comprising a label-aware encoding layer and a hierarchical fusion layer. The label-aware encoding layer uses a multi-head attention mechanism to allow each position in the input sequence to interact with the enhanced label representation. The hierarchical fusion layer utilizes a predefined hierarchical graph, propagating information between labels through a graph attention network to ensure semantic consistency between parent and child nodes. Ultimately, the encoder outputs an oracle representation that incorporates real local hierarchical priors. .

[0151] Its unique feature is that, in addition to the data x, its input also utilizes the label representation obtained by local hierarchical perceptual coding. This generates a high-quality "ideal representation" that incorporates real-world local priors. This representation incorporates real-world local hierarchical information, providing the generator with a clear learning objective and a powerful regularization signal.

[0152] The discriminator employs a binary classification neural network structure based on a multilayer perceptron. Its main task is to distinguish between true and false representations of the input representation vector, differentiating whether it is an ideal representation from the encoder or a representation generated by the generator. The input to the discriminator is either the representation generated by the generator or the oracle representation generated by the encoder. First, a projection layer maps the representation to a uniform dimension. Then, it passes through three fully connected layers equipped with ReLU activation and dropout (a regularization technique to prevent overfitting in neural networks). Finally, a sigmoid activation function outputs a scalar probability value, representing the probability that the input representation is judged to be from the encoder. The discriminator's loss function uses standard binary cross-entropy loss, forcing the generator to learn to produce a representation similar to the oracle representation distribution through adversarial game.

[0153] The discriminator's input dimension is consistent with the output representation dimensions of the generator and encoder. The discriminator's main structure consists of three fully connected layers, each connected by a ReLU activation function and a dropout layer for non-linear transformation and regularization. The first layer maps the 768-dimensional input vector to a 512-dimensional hidden space, followed by a ReLU activation function and a dropout rate of 0.3. The second layer compresses the 512-dimensional input to 128 dimensions, also using ReLU activation and a dropout rate of 0.3. The third layer, the output layer, maps the 128-dimensional vector to a single scalar, which is then converted into a probability value between 0 and 1 by a Sigmoid activation function, representing the confidence level of the input representation as belonging to the encoder.

[0154] During training, the discriminator uses a binary cross-entropy loss function, aiming to maximize its ability to distinguish between real and generated representations. The discriminator's parameter updates are performed in an alternating optimization strategy with the generator and encoder to ensure the stability of adversarial training. This three-layer MLP structure design ensures sufficient discriminative power while avoiding the problems of training instability or mode collapse caused by overly complex networks, achieving effective adversarial balance through a moderate model size.

[0155] To generate a high-quality Oracle representation, i.e., the first feature representation This application first enhances the label representation to include sample-specific existence information: in, This represents the enhanced representation of the y-th label; Let Y represent the global label embedding vector of the y-th label; Y is the set of true labels for the current training sample. and e absent It is a learnable vector. The · sign is an indicator function. This step assigns a clear semantic meaning (presence or absence) to each label within the current sample context. The encoder uses this enhanced set of labels to represent... Using the input data x, the final Oracle representation, i.e., the second feature representation, is generated. This process ensures It is a high-quality reference representation that incorporates real-world local hierarchical knowledge.

[0156] Adversarial training employs an alternating optimization approach. First, the parameters of the generator G and encoder E are fixed, while the parameters θ of the discriminator D are updated. D The goal of the discriminator is to maximize its discriminative power, and its loss function is: in, Indicates discriminator loss; This represents the expected value operator; (·) is the discriminator function, representing the discriminator network. It takes a feature vector as input and outputs a scalar probability value (between 0 and 1), which represents the confidence that the input is judged to be from the encoder.

[0157] Here, the discriminator is trained to correctly identify the “ideal” representation from the encoder and the “generated” representation from the generator.

[0158] Next, with the parameters of the discriminator D and encoder E fixed, the parameters θ of the generator G are updated. G The generator has two objectives: first, to minimize the classification loss. To ensure that the generator's basic classification performance does not degrade; and secondly, to minimize adversarial loss. Encourage the generator to produce a representation h mix This makes it difficult for the discriminator to distinguish its source, making it difficult for it to be associated with... Distinguish them. Adversarial loss is defined as: Therefore, the total loss of the generator for: Here, α is a hyperparameter used to balance the weights of the two losses.

[0159] Through the adversarial game described above, the generator is forced to learn to produce a representation that is similar in distribution to the Oracle representation. This means that the feature representations within the generator implicitly learn and encode the true local hierarchical information of the samples. This mechanism brings significant advantages: (1) Introducing strong regularization: Local hierarchical information is used as a strong regularization term to effectively prevent the model from overfitting to a limited number of training samples, especially for rare attack categories. (2) Smoothing decision boundary: Force the model to learn a smoother decision function near the boundary between real samples and adversarial samples, thereby improving robustness to input perturbations. (3) Knowledge distillation: A knowledge distillation is implemented to distill the “ideal” local hierarchical knowledge of the encoder into the generator (main model).

[0160] Based on the above-described embodiments of the hierarchical network attack detection model training method, this application also provides an embodiment of the hierarchical network attack detection method, see [link to embodiment]. Figure 5 The hierarchical network attack detection method specifically includes the following: Step 400: Construct a prompting input sequence for network traffic data based on a predefined prompt template format containing preset mask markers.

[0161] Step 500: Input the cueing input sequence into the hierarchical network attack detection model, so that the hierarchical network attack detection model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and the classification model calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity; wherein, the hierarchical network attack detection model is trained based on the hierarchical network attack detection model training method.

[0162] The network attack hierarchical detection model training method mentioned in step 500 of the network attack hierarchical detection method provided in this application can adopt the processing flow of the network attack hierarchical detection model training method embodiment in the above embodiments. Its function will not be repeated here, but can be referred to the detailed description of the network attack hierarchical detection model training method embodiment in the above embodiments.

[0163] Specifically, during the inference phase, this application employs an optimized single-model architecture, retaining only the trained generator for efficient forward propagation. For input samples... That is, network traffic data, firstly, its prompting input sequence T is constructed through a prompt template. The model computes the hidden state h[MASK] at the [MASK] position as a data representation, and performs multi-label prediction by comparing its similarity with the global label embedding representation. in, This represents the final prediction result for the i-th label; Represents the conditional prediction probability, indicating the probability given the test input sample. Under the given conditions, the model predicts that it belongs to the i-th label. The probability value (between 0 and 1) is the raw confidence level directly output by the model; This represents the classification decision threshold. A threshold strategy of τ=0.5 is used for the final decision, and a hierarchical consistency constraint is applied to ensure that the prediction results conform to the label architecture.

[0164] To further illustrate the above embodiments, this application also provides an application example of a network attack hierarchical detection model training method, namely, a multi-layer mapping method for network threat behavior based on the collaborative characterization of attack scenarios and attack types, which has the following advantages: 1. Robust threat detection in adversarial environments: Real-world network environments are filled with noise, traffic variations, and unknown threat variants, placing extremely high demands on the robustness of models. Traditional models are prone to overfitting to the surface features of training data, and their decision boundary stability is insufficient when facing noise disturbances, traffic variations, and unknown threat variants, severely affecting their practicality and reliability in dynamic adversarial environments. Therefore, this application proposes a novel threat detection framework that integrates hierarchical labeling, cue learning, and adversarial training. This method first models the hierarchical relationships between attack scenarios and types using graph networks, achieving fine-grained multi-label threat perception and source tracing analysis. Then, cue learning is used to reconstruct the classification task into a mask prediction task familiar to the pre-trained model, improving knowledge transfer efficiency. Finally, this application design employs an adversarial training strategy that integrates hierarchical information. This strategy, through adversarial game supervision based on real hierarchical relationships, forces the model to learn feature representations that are insensitive to noise and conform to hierarchical logic, enhancing the model's robustness against adversarial examples and unknown variants.

[0165] 2. Threat detection that supports collaborative analysis of scenarios and attacks: Mainstream research often simplifies threat detection into a flat, single-label classification task, identifying only the attack type of traffic while neglecting the crucial contextual dimension of the attack scenario. This leads to isolated threat intelligence, difficulty in attribution, and a limited scope of threat analysis. To address this, this application proposes a multi-label classification framework that supports collaborative analysis of scenarios and attacks. This method models the hierarchical relationship between scenarios and attacks through graph networks, inferring the scenario while identifying the attack type, providing crucial contextual information for threat attribution and achieving finer-grained threat awareness. Furthermore, a cue-based classifier construction method is introduced. By refactoring the classification task into a mask language familiar to pre-trained models and optimizing continuous cue tokens, efficient and stable transfer of pre-trained knowledge to the threat detection domain is achieved.

[0166] Based on this, this application proposes a novel threat detection framework that integrates hierarchical labeling, cue learning, and adversarial training. First, this method models the hierarchical relationships between attack scenarios and types using graph networks, achieving fine-grained multi-label threat perception and attribution analysis. Then, cue learning is used to reconstruct the classification task into a mask prediction task familiar to the pre-trained model, improving knowledge transfer efficiency. Finally, an adversarial training mechanism supervised by hierarchical labels is introduced, forcing the model to learn robust features against interference, effectively enhancing the system's generalization and stability in dynamic adversarial environments.

[0167] The execution framework of this method mainly consists of three modules: hierarchical label encoding, a hierarchical classification model based on cue learning, and model optimization based on adversarial training. Figure 6 As shown, this method first constructs a hierarchical labeling system containing attack scenarios and types, and uses a graph attention network to encode the semantic and structural relationships between labels. Then, cue learning is employed to reconstruct the classification task into masked language modeling, and classification is achieved by calculating the similarity between the network flow representation and the label embedding. Finally, an adversarial training mechanism is introduced, using local hierarchical information as a regularization signal to enhance the model's robustness against noise and rare attacks.

[0168] This method achieves hierarchical classification tasks through the tight coupling of three modules: hierarchical label encoding, cue-based learning classification, and adversarial training. Details are as follows: 1. Hierarchical label encoding In the hierarchical label encoding module, the system first loads the global hierarchical structure from the predefined label system file, and encodes the semantic and structural relationships between labels through a graph attention network to generate a label embedding matrix. This static label representation provides a structured semantic foundation for subsequent modules.

[0169] Therefore, this module aims to transform discrete labels into distributed vector representations that simultaneously contain lexical semantics, global hierarchical structure, and local contextual information through a progressive encoding strategy.

[0170] 2. Hierarchical classification model based on cue learning In the cue-based classification module, this module receives the label embedding matrix from the first module and interacts with the network stream data representation. Specifically, the system reconstructs the classification task into a masked language modeling problem using special cue templates (such as inserting label embeddings at the [MASK] position). After the data passes through the BERT encoder, a similarity calculation is performed with the label embeddings to generate a classification score. Notably, the classification model here also acts as a "generator" in adversarial training. During forward propagation, the model saves intermediate representations (such as label_emb and pooled_output), which will serve as input for adversarial training.

[0171] In other words, after obtaining the hierarchical vector representation of the labels, the core task of this module is to construct a classification model that can map the original network traffic data x to the same semantic space, and to achieve hierarchical classification by calculating its similarity to the label representation. This application example adopts the Prompt Learning paradigm, reconstructing the traditional classification task into a masked language modeling task, which is well-suited to pre-trained language models, thereby fully utilizing the knowledge gained during the pre-training stage to achieve efficient and accurate classification.

[0172] 3. Model Optimization Based on Adversarial Training The core objective of this module is to use sample-specific real local hierarchical information as a strong supervision signal to regularize the base model, thereby improving the model's robustness and generalization ability when facing noise interference and out-of-distribution samples.

[0173] In the adversarial training-based model optimization module, the system utilizes local hierarchical information dynamically extracted from the real labels of the current training batch (the label hierarchy path of each instance is calculated in real time using the depth2label dictionary) as a regularization signal. This local information does not directly originate from the static label system of Module 1, but rather is an instance-specific hierarchical constraint obtained by dynamically projecting the real labels of training instances from the global label embedding representation. Adversarial training generates adversarial examples by injecting perturbations into the input, and then requires the generator (i.e., the classification model) to minimize the difference between the original representation and the adversarial representation in the hierarchical space (e.g., calculating the hierarchical consistency loss using multilabel_categorical_crossentropy). The local hierarchical information serves as a supervisory signal for the "ideal representation," and together with the global label embedding representation, constitutes a complete expression of the hierarchical constraints. The entire data flow forms a closed loop from static label system construction and dynamic prompting interaction to hierarchical regularization optimization. The hierarchical classification model module based on prompting learning and the adversarial training-based model optimization module share the same model entity but play different roles. The local hierarchical information of the adversarial training-based model optimization module is a concrete instantiation of the global system of the hierarchical label encoding module at the instance level.

[0174] Therefore, the above application examples in this application propose a multi-label classification framework that supports collaborative analysis of scenarios and attacks. This method models the hierarchical relationship between the two through graph networks, inferring the scenario to which an attack belongs while identifying the attack type, providing crucial contextual information for threat attribution and achieving more granular threat perception. A cue-based classifier construction method is introduced. By reconstructing the classification task into a mask language familiar to the pre-trained model and optimizing continuous cue tokens, efficient and stable transfer of pre-trained knowledge to the threat detection domain is achieved. An adversarial training strategy incorporating hierarchical information is designed. This strategy forces the model to learn feature representations that are insensitive to noise and conform to hierarchical logic through adversarial game supervision based on real hierarchical relationships, enhancing the model's robustness against adversarial examples and unknown variants. Furthermore, it addresses the problem that existing threat detection methods can only detect attack categories and cannot collaboratively detect attack scenarios.

[0175] In summary, this application innovatively constructs a hierarchical threat detection framework. It encodes the semantics and hierarchical relationships of labels using a graph attention network and refactors the classification task into a masked language modeling problem using cue learning. Furthermore, it introduces an adversarial training mechanism that integrates local hierarchical information, enhancing the model's robustness to noise and rare attacks while achieving efficient transfer of pre-trained knowledge and accurate identification of hierarchical threats.

[0176] To further illustrate the technical effects achievable by the methods provided in the above application examples, this application also provides corresponding evaluation experimental data, as detailed below: 1. Evaluate the construction 1) Dataset This application example validates the method using four public datasets: Kitsune, Edge-IIoTset, MSCAD, and USTC-TFC2016. Kitsune is a network attack dataset for IoT and Industrial IoT environments. This dataset was collected from real-world commercial IP video surveillance systems and contains nine different attack types. Edge-IIoTset is a large-scale and comprehensive IoT security dataset, collected from a multi-layered architecture test platform. The dataset contains 14 different types of network attacks. MSCAD is a multi-step network attack dataset. This dataset contains five attacks and normal traffic; the attack data is generated through two multi-stage network attack scenarios. USTC-TFC2016 is a dataset containing both encrypted and unencrypted traffic, including ten malicious traffic types from eight applications, such as Zeus, Virus, and Tinba (a banking Trojan).

[0177] 2) Parameter settings Unless otherwise specified, the results reported in this application instance are based on the following parameter settings: Training uses the AdamW optimizer for parameter updates, with a base learning rate of 3e-5. In adversarial training, the adversarial loss weight α is set to 1.0. The discriminator learning rate is 1e-4, updated every 5 generator training steps, with a gradient penalty coefficient of 10.0. A classification threshold of 0.5 is used during the inference and prediction phase. All datasets are allocated as follows: 64% training set, 16% validation set, and 20% test set.

[0178] 3) Evaluation Indicators The application examples in this application use accuracy (ACC), precision (PRE), recall (REC), macro F1 score, and micro F1 score to evaluate the classification ability of the proposed method.

[0179] 2. Experimental Results (1) Overall Experiment To comprehensively evaluate the effectiveness of the proposed method in this application example, a multi-scenario cross-validation experiment was designed to verify the model's performance on the two core tasks of attack scenario detection and attack category detection. The application example conducted combined tests on four public network threat datasets, constructing 10 different experimental configurations ranging from 2 to 4 scenarios.

[0180] Table 1 shows the attack scenario and attack category detection performance of this method. This method achieves good attack scenario and attack category detection performance under various combination patterns of different scenarios. This indicates that through hierarchical label encoding and cue learning, the model successfully captures highly distinguishable feature patterns between these macro-level scenarios. Furthermore, network traffic from different sources does indeed carry unique scenario fingerprints. In addition, due to significant class imbalance in various datasets, the macro F1 score is systematically lower than the micro F1 score, indicating that the model's ability to identify a few attack categories with few samples still has room for improvement compared to common categories.

[0181] Table 1 shows the detection performance of this method in attack scenarios and attack categories when applied to different dataset combinations. Furthermore, this application example compares the proposed method with other state-of-the-art network threat detection methods based on four scenario-integrated datasets: Kitsune, Edge-IIoTset, MSCAD, and USTC-TFC2016, evaluating the detection performance for attack categories. Other state-of-the-art methods included in the evaluation are Kitsune, Whisper, Rosetta, ERFS, and SmartDetector. Kitsune is an online network intrusion detection method based on autoencoder ensembles. It learns characteristic patterns of normal network traffic through a set of autoencoders and detects anomalies in real time based on reconstruction errors. Whisper is a method for real-time robust malicious traffic detection through frequency domain analysis. It transforms network traffic data to the frequency domain, analyzes its frequency characteristics to identify malicious patterns, and has a certain detection capability for certain types of encrypted or obfuscated traffic. Rosetta is a robust method focused on TLS encrypted traffic classification. It generates diverse training data through TCP-aware traffic augmentation techniques to improve the model's classification accuracy in different network environments (such as those with packet loss or out-of-order delivery). ERFS is an efficient feature map representation intrusion detection method based on flow semantics. It models network flows and their semantic information as a graph structure and utilizes efficient graph representation learning techniques to capture complex attack patterns, making it suitable for semantic-based threat detection. SmartDetector is a method that uses contrastive learning to achieve robust malicious encrypted traffic detection. It enhances the model's ability to discriminate malicious traffic features, especially in encrypted traffic scenarios, by learning the contrast between positive and negative samples in the feature space of traffic representations.

[0182] As shown in Table 2, compared with traditional statistical threat detection methods such as Kitsune, Whisper, and Roset, the cue learning and hierarchical labeling mechanism adopted in this method can more effectively capture semantic features and contextual information in network traffic. Traditional statistical methods mainly rely on traffic statistical features, frequency domain features, or time series features, and their generalization ability in complex threat scenarios is limited.

[0183] Compared with semantic context-based threat detection methods such as ERFS and SmartDetector, this method introduces a generative adversarial training mechanism, combined with hierarchical label encoding and cue learning, which can better handle the class imbalance problem. While maintaining high accuracy, it improves the Macro F1 score, indicating that this method has a stronger ability to identify rare attack categories and better generalization performance.

[0184] Table 2 Comparison of attack category detection performance between our method and other advanced methods (2) Local ablation experiment To thoroughly evaluate the contributions of each core component in the hierarchical threat detection framework proposed in this application example, a local ablation experiment was designed for the system. The experiment sequentially removed three key modules from the complete model: Graph Attention Network (GAT) label hierarchical encoding, cue learning, and adversarial training. The detection performance for attack categories was evaluated on unified four-scenario fusion datasets: Kitsune, Edge-IIoTset, USTC-TFC2016, and MSCAD.

[0185] Referring to Table 3, the results show that the adversarial training module contributes the most to improving the ability to identify rare attack categories; removing it reduces the Macro F1 score by 4.14%. The GAT label hierarchical encoding module contributes the second most, validating the importance of hierarchical semantic modeling. Although the cue learning module contributes relatively little, it effectively demonstrates the feasibility of utilizing pre-trained knowledge through task reconstruction. When the three modules work synergistically, the model achieves optimal performance across all metrics.

[0186] Table 3 Local ablation assessment using this method (3) Generalization and inductive performance experiment Generalization: To evaluate the model's generalization ability, this section conducted cross-testing on datasets from different network environments, topologies, and business scenarios. As shown in Table 4, the model achieves a detection rate of over 80% in most cross-scenario scenarios, capturing certain common features among different data in different scenarios and demonstrating a certain degree of generalization ability.

[0187] Table 4. Experimental data on the generalization and inductive performance of this method. Inductiveity: To test the adaptability of this method under inductive conditions, this application uses a four-scenario fusion dataset, adjusting the percentage of training data sequentially to simulate real-world threat detection environments with varying concentrations. As shown in Table 5, this method demonstrates a certain degree of adaptability under inductive conditions where training data is scarce. Even when using only 10% of the training data, it still maintains an F1 score of over 70% on the fusion dataset.

[0188] Table 5. Test performance of this method under different percentages of training data. (4) Robustness test 1) Evaluation of model robustness based on low-rate strategy To evaluate the model's robustness to low-rate attacks, this section simulates an attacker's low-rate strategy. A delay sequence with long periodicity and low-density statistical characteristics (base delay of 5 seconds plus ±30% random jitter) is generated using a Poisson process and injected into network traffic at an injection ratio of 0.1% to 0.5%. As shown in Table 6, this method exhibits good robustness. Although low-rate attacks can alter the temporal distribution of traffic, they do not change the semantic features of packet payloads or the flow-level interaction logic, ensuring the effectiveness of semantic features based on hierarchical label encoding and cue learning. Furthermore, the adversarial training mechanism allows the model to learn essential features insensitive to temporal perturbations through adversarial examples, further enhancing detection stability under low-rate attacks.

[0189] Table 6. Experimental data evaluating the robustness of the model against low-rate attacks. 2) Evaluation of model robustness based on time-series noise interference This section simulates the attacker's temporal interference strategy and compares this method with other robust methods such as Whisper[1]. The experiment uses a Gaussian distribution to generate random delays (mean 0.5 seconds, standard deviation 0.2 seconds) to inject into network traffic, with the injection ratio gradually increasing from 0.1% to 0.5%. As shown in Tables 7 and 8, this method has better robustness than Whisper when facing temporal noise interference. Whisper relies on frequency domain features that are sensitive to temporal structure and is susceptible to noise interference; while this method is based on hierarchical semantic coding and adversarial training, which can extract deep features that are not sensitive to temporal perturbations, thereby maintaining more stable detection performance in noisy environments.

[0190] Table 7. Detection performance of this method under temporal noise interference. Table 8. Whisper's detection performance under temporal noise interference. 3) Evaluation of model robustness based on load-filling disturbance This section simulates an attacker's payload padding obfuscation strategy and compares our method with the Whisper method. This strategy obfuscates features by inserting cryptographically secure random HEX data (0.1%-0.5%), accounting for 20% of the original length, into the middle of the packet payload, while dynamically updating the protocol header to maintain compatibility. As shown in Tables 9 and 10, our method outperforms the frequency-domain analysis-based Whisper method in the face of payload padding obfuscation. While random HEX data injection disrupts the frequency-domain feature structure relied upon by Whisper, our method, through cue learning and hierarchical encoding, can extract deep semantic features insensitive to content perturbation. Combined with adversarial training, this further enhances the model's robustness and adaptability under payload obfuscation.

[0191] Table 9. Detection performance of this method under load-filling interference. Table 10. Detection performance of this method under load-filling interference. (4) Evaluation of the robustness of models based on network phenomena To evaluate the impact of network-induced phenomena on the model, this section utilizes the scapy library to manipulate PCAP packets, simulating three typical network anomalies: packet loss (Rl), retransmission (Rr), and out-of-order delivery (Ro) by deleting, copying, and exchanging packets. As shown in Tables 11 to 13, out-of-order delivery has the most significant impact on model performance because it disrupts flow-level temporal dependencies and the protocol state machine. The hierarchical semantic encoding and cue learning in this method are relatively sensitive to such disturbances. In contrast, packet loss and retransmission mainly cause information loss or redundancy but do not change the relative temporal order of the remaining packets, thus their impact is relatively smaller.

[0192] Table 11. Detection accuracy of this method under packet loss network conditions. Table 12. Detection accuracy of this method under retransmission network conditions. Table 13 shows the detection accuracy of this method under disordered network phenomena. From a software perspective, this application also provides a network attack hierarchical detection model training apparatus for performing all or part of the network attack hierarchical detection model training method, see [link to relevant documentation]. Figure 7 The network attack hierarchical detection model training device specifically includes the following components: The hierarchical label encoding module 10 is used to encode the hierarchical relationship between the scene labels and the type labels based on a hierarchical label system containing scene labels and type labels corresponding to network attacks, and generate a global label embedding representation; wherein each type label belongs to one scene label.

[0193] The cue-based classification model building module 20 is used to train a cue-based classification model using the global label embedding representation and network traffic data as training samples; wherein, the classification model is configured to output a prediction result of the network attack scenario and type to which the network traffic data belongs by calculating the similarity between the cue-based representation of the network traffic data and the global label embedding representation.

[0194] The hierarchical supervision-based adversarial training module 30 is used to determine hierarchical information from the hierarchical labeling system based on the scene label and type label of the training samples, and use the hierarchical information as a supervision signal to optimize the classification model through adversarial training, thereby obtaining a hierarchical network attack detection model for collaborative identification of network attack scenes and types.

[0195] The embodiments of the network attack hierarchical detection model training device provided in this application can be used to execute the processing flow of the network attack hierarchical detection model training method embodiments described above. Its functions will not be repeated here, but can be referred to the detailed description of the network attack hierarchical detection model training method embodiments described above.

[0196] The network attack hierarchical detection model training device can perform the training of the network attack hierarchical detection model in either a server or a client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are performed in the client device, the client device may further include a processor for the specific processing of the network attack hierarchical detection model training.

[0197] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0198] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0199] As described above, the network attack hierarchical detection model training device provided in this application can achieve collaborative identification and hierarchical tracing of attack scenarios and types, providing more granular threat perception. By efficiently transferring pre-trained knowledge through prompted learning and utilizing adversarial training supervised by real hierarchical relationships, the model is forced to learn robust features that are insensitive to noise and conform to logic. This significantly improves the model's robustness, generalization ability, and detection stability in dynamic adversarial environments, thereby increasing the accuracy of network attack identification and enhancing the precision and efficiency of network security operations and maintenance.

[0200] This application also provides a network attack hierarchy detection apparatus for performing all or part of the network attack hierarchy detection method described above. See [link to relevant documentation]. Figure 8 The network attack hierarchical detection device specifically includes the following components: The prompting input building module 40 is used to construct a prompting input sequence for network traffic data based on a predefined prompting template format containing preset mask markers.

[0201] The model detection module 50 is used to input the cueing input sequence into the hierarchical network attack detection model, so that the hierarchical network attack detection model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and makes the classification model calculate the similarity between the cueing representation and each label vector in the global label embedding representation, and output the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity; wherein, the hierarchical network attack detection model is trained based on the hierarchical network attack detection model training method described in the first aspect above.

[0202] The embodiments of the network attack hierarchical detection device provided in this application can be used to execute the processing flow of the network attack hierarchical detection method embodiments described above. Its functions will not be repeated here, but can be referred to the detailed description of the network attack hierarchical detection method embodiments described above.

[0203] The network attack hierarchical detection model training device can perform the training of the network attack hierarchical detection model in either a server or a client device. The choice can be made based on the processing power of the client device and the limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are performed in the client device, the client device may further include a processor for the specific processing of the network attack hierarchical detection model training.

[0204] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the network attack hierarchical detection model training method and / or network attack hierarchical detection method mentioned in the above embodiments. The processor and memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and memory via wired or wireless means.

[0205] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0206] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the network attack hierarchical detection model training method and / or the program instructions / modules corresponding to the network attack hierarchical detection method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the network attack hierarchical detection model training method and / or the network attack hierarchical detection method in the above method embodiments.

[0207] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0208] The one or more modules are stored in the memory, and when executed by the processor, they execute the network attack hierarchical detection model training method and / or network attack hierarchical detection method in the embodiment.

[0209] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0210] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0211] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0212] This application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the aforementioned network attack hierarchical detection model training method and / or network attack hierarchical detection method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0213] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the aforementioned network attack hierarchical detection model training method and / or network attack hierarchical detection method.

[0214] In the research and development and implementation of the technical solutions involved in this application, all user personal information (if any) was processed in strict accordance with the principles of legality, legitimacy, necessity, and good faith. Specifically, the relevant data was obtained through one or more of the following compliant methods: 1) Before collecting users' personal information, the purpose, method, and scope of the collection have been clearly communicated to the users, and the users' individual and explicit authorization and consent have been obtained; 2) The personal data used comes from publicly available datasets permitted by laws and regulations, and the personal data has undergone necessary anonymization or de-identification processing during use to ensure that no specific individual can be identified and the information is irretrievable; 3) The use of personal data is limited to the technical research and development, model training and verification purposes described in this application, and strict technical and management measures have been taken to protect data security and prevent information leakage, abuse and unauthorized access.

[0215] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0216] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0217] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0218] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for training a hierarchical network attack detection model, characterized in that, include: Based on a hierarchical tagging system that includes scenario tags and type tags corresponding to network attacks, a graph model is used to encode the hierarchical relationship between the scenario tags and the type tags to generate a global tag embedding representation; wherein, each type tag belongs to one scenario tag; A classification model based on a cue learning framework is trained using the global label embedding representation and network traffic data as training samples; wherein, the classification model is configured to output a prediction result of the network attack scenario and type to which the network traffic data belongs by calculating the similarity between the cue-based representation of the network traffic data and the global label embedding representation; Based on the scene labels and type labels of the training samples, hierarchical information is determined from the hierarchical labeling system. Using this hierarchical information as a supervision signal, the classification model is optimized through adversarial training to obtain a hierarchical network attack detection model for collaborative identification of network attack scenarios and types.

2. The network attack hierarchical detection model training method according to claim 1, characterized in that, Before encoding the hierarchical relationship between the scene labels and the type labels using a graph model, the method further includes: Each scenario tag corresponding to a network attack is defined as a first-level tag, and each type tag corresponding to a network attack is defined as a second-level tag. The hierarchical tag system is formed by defining the relationship between each type tag and a scenario tag.

3. The network attack hierarchical detection model training method according to claim 1, characterized in that, The hierarchical tagging system based on scene tags and type tags corresponding to network attacks utilizes a graph model to encode the hierarchical relationship between the scene tags and the type tags, generating a global tag embedding representation, including: Obtain the initial semantic vector representation of each scene label and each type label; The hierarchical tagging system containing scene tags and type tags corresponding to network attacks is modeled as a directed graph; wherein, the node set of the directed graph consists of the nodes corresponding to each scene tag and each type tag, and the types of edges in the directed graph include: parent-child relationship edges pointing from a scene tag to its parent type tag, and same-scene relationship edges connecting different type tags belonging to the same scene tag. Based on the directed graph, the initial semantic vector representations of each scene label and type label are encoded through a graph attention network to generate a global label embedding representation.

4. The network attack hierarchical detection model training method according to claim 3, characterized in that, The process of obtaining the initial semantic vector representations of each scene label and each type label includes: Based on the text names of each scene label and each type label, an initial semantic vector representation corresponding to each scene label and type label is generated through a pre-trained language model; wherein, the pre-trained language model includes: a domain-specific model trained on cybersecurity corpus.

5. The network attack hierarchical detection model training method according to claim 3, characterized in that, Based on the directed graph, the initial semantic vector representations of each scene label and type label are encoded using a graph attention network to generate a global label embedding representation, including: The initial semantic vector representation of each scene label and type label is used as the initial semantic vector representation of the corresponding node in the directed graph; Based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, the initial semantic vector representation of each node is updated through the graph attention network, and the updated feature representations of each node are combined into a global label embedding representation.

6. The network attack hierarchical detection model training method according to claim 5, characterized in that, The initial semantic vector representation of each node is updated using the graph attention network based on the parent-child relationship edges and the same-scene relationship edges in the directed graph. The updated feature representations of each node are then combined into a global label embedding representation, including: Based on the parent-child relationship edges and the same-scene relationship edges in the directed graph, construct the adjacency matrix of the directed graph; The adjacency matrix and the initial semantic vector representation of each node are used as inputs to the graph attention network, and multiple rounds of iterative message passing and feature aggregation are performed to update the feature representation of each node.

7. The network attack hierarchical detection model training method according to claim 6, characterized in that, The adjacency matrix is ​​an N×N matrix, where N represents the total number of nodes in the directed graph; the element in the i-th row and j-th column of the adjacency matrix is ​​used to represent the connection relationship from the i-th node to the j-th node; For each element in the adjacency matrix, if there is a parent-child relationship edge or a same-scene relationship edge between its corresponding two nodes, the value of the element is set to a first value to indicate that there is a connection; otherwise, it is set to a second value to indicate that there is no connection.

8. The method for training a hierarchical network attack detection model according to claim 6, characterized in that, The process of using the adjacency matrix and the initial semantic vector representation of each node as input to the graph attention network, and performing multiple rounds of iterative message passing and feature aggregation to update the feature representation of each node, includes: The initial semantic vector representation of each node is used as the input feature of each node in the first layer iteration, and the adjacency matrix and the input features of each node in the first layer iteration are input into the L-layer graph attention network so that the graph attention network updates the input features of each node in the L-layer iteration. In each layer of iterative update process, for each node in the directed graph, its set of neighboring nodes is determined according to the adjacency matrix, and the attention weight between the node and each of its neighboring nodes is calculated through the attention mechanism. Based on the attention weight, the input features from the node itself and its neighboring nodes in the current layer iteration are weighted and aggregated to generate the feature representation of the node in the current layer iteration, and the feature representation is used as the input feature of the node in the next layer iteration.

9. The method for training a hierarchical network attack detection model according to claim 1, characterized in that, The step of training a classification model based on a cue-based learning framework using the global label embedding representation and network traffic data as training samples includes: Based on a predefined prompt template format containing preset mask markers, construct a prompt-based input sequence for network traffic data; The cueing input sequence is input into a classification model based on a cueing learning framework, so that the classification model encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data, and the classification model calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs the prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity. The parameters of the classification model are optimized by minimizing the binary cross-entropy loss between the predicted result and the true label, wherein the true label includes the scene label and the type label.

10. The network attack hierarchical detection model training method according to claim 9, characterized in that, The prompt template also includes one or more continuously learnable virtual tokens; the parameters of the classification model include the vector representations corresponding to the continuously learnable virtual tokens; The method for constructing a prompted input sequence for network traffic data based on a predefined prompt template format containing preset mask markers includes: The vectorized sequence representation of the network traffic data, the continuously learnable virtual token, and the preset mask marker are combined in a preset order to construct the prompting input sequence.

11. The training method for a hierarchical network attack detection model according to claim 9, characterized in that, The classification model includes: A prompting encoding layer is used to receive the prompting input sequence of the network traffic data, encode the position of the preset mask mark in the prompting input sequence, and output the prompting representation of the network traffic data; The classification decision layer is used to calculate the dot product between the cueing representation of the network traffic data and each label vector in the global label embedding representation to obtain the original similarity score; each original similarity score is converted into an independent probability value through the Sigmoid function to obtain the prediction probability of each scene label and each type label, which is used as the prediction result of the network traffic data.

12. The network attack hierarchical detection model training method according to claim 1, characterized in that, The step of determining hierarchical information from the hierarchical labeling system based on the scene labels and type labels of the training samples includes: For the training sample, based on its scene label and type label, the local hierarchical path information corresponding to the training sample is mapped from the global structure of the hierarchical labeling system as hierarchical information; wherein, the local hierarchical path information is used to characterize the position and membership relationship of the scene label and type label of the training sample in the hierarchical labeling system.

13. The network attack hierarchical detection model training method according to claim 1, characterized in that, The step of using this level of information as a supervisory signal to optimize the classification model through adversarial training includes: The classification model is used as a generator in a generative adversarial network framework; wherein, the generative adversarial network framework also includes an encoder and a discriminator; The parameters of the generator are optimized through adversarial training between the generator, encoder, and discriminator, thereby optimizing the classification model. The generator is used to generate a first feature representation as the prediction result based on the network traffic data, and input the first feature representation into the discriminator; The encoder is used to receive the network traffic data and the hierarchical information, and generate a second feature representation that fuses the hierarchical information as a supervision signal; the second feature representation is then input into the discriminator. The discriminator is used to determine the source of the input feature representation, so as to distinguish whether it comes from the first feature representation of the generator or the second feature representation of the encoder.

14. The network attack hierarchical detection model training method according to claim 13, characterized in that, The optimization of the classification model through adversarial training between the generator, encoder, and discriminator to improve the generator's parameters includes: The first and second phases are executed alternately. The first stage includes: fixing the parameters of the generator and the encoder, and updating the parameters of the discriminator to minimize the discrimination error of the discriminator between the first feature representation and the second feature representation; The second stage includes: fixing the parameters of the discriminator and the encoder, and updating the parameters of the generator based on a preset optimization objective; the optimization objective includes: minimizing the multi-label classification loss of the generator, and minimizing the adversarial loss used to cause the discriminator to misclassify the first feature representation output by the generator as coming from the encoder.

15. The network attack hierarchical detection model training method according to claim 13, characterized in that, The encoder is used to perform the following: Receive the network traffic data and the hierarchical information; Based on the hierarchical information, the scene label of the training sample, and the type label, the corresponding label vector in the global label embedding representation is subjected to existence-enhanced encoding to obtain an enhanced label representation; The enhanced label representation is fused with the network traffic data representation to generate the second feature representation, and the second feature representation is input into the discriminator.

16. The network attack hierarchical detection model training method according to claim 15, characterized in that, The step of performing existence-enhanced encoding on the corresponding label vector in the global label embedding representation based on the hierarchical information, the scene label of the training samples, and the type label to obtain the enhanced label representation includes: Based on the membership relationship between the scene label and the type label represented by the hierarchical information, the set of label vectors corresponding to the current training sample in the global label embedding representation is determined; For each label vector in the label vector set, determine whether the label vector belongs to the true label of the current training sample based on the hierarchical information; If the label vector belongs to the real label, then a learnable first augmentation vector for representing the existence state is superimposed on the label vector to obtain the augmented representation of the label vector; If the label vector does not belong to the real label, then a learnable second augmentation vector for representing the missing state is superimposed on the label vector to obtain the augmented representation of the label vector; Wherein, the first augmentation vector and the second augmentation vector are trainable parameters in the encoder; the augmented representations of all the label vectors together constitute the augmented label representation.

17. A hierarchical detection method for network attacks, characterized in that, include: Based on a predefined prompt template format containing preset mask markers, construct a prompt-based input sequence for network traffic data; The cueing input sequence is input into a hierarchical network attack detection model, which encodes the cueing input sequence to generate a cueing representation corresponding to the network traffic data. The classification model calculates the similarity between the cueing representation and each label vector in the global label embedding representation, and outputs a prediction result of the network attack scenario and type to which the network traffic data belongs based on the similarity. The hierarchical network attack detection model is trained based on the hierarchical network attack detection model training method according to any one of claims 1 to 16.

18. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the network attack hierarchical detection model training method as described in any one of claims 1 to 16, and / or implements the network attack hierarchical detection method as described in claim 17.

19. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the network attack hierarchical detection model training method as described in any one of claims 1 to 16, and / or implements the network attack hierarchical detection method as described in claim 17.

20. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the network attack hierarchical detection model training method as described in any one of claims 1 to 16, and / or implements the network attack hierarchical detection method as described in claim 17.

Images