Training methods, devices, electronic equipment, and storage media for attack information prediction models

Abstract

This invention provides a training method for an attack information prediction model, comprising: acquiring a first training sample set; processing the first training sample set using the attack information prediction model to determine the parameters of a word vector model network in the attack information prediction model; performing binary classification processing on word vectors matching the attack payload information to determine the parameters of a binary classification model network in the attack information prediction model; performing multi-class classification processing on word vectors matching the attack payload information to determine the parameters of a multi-class model network in the attack information prediction model; combining different seed attack payload information to determine the regular expression corresponding to the intrusion prevention system. This invention also provides an attack information prediction method, an electronic device, and a storage medium. This invention can automatically predict attack information, improving the speed and accuracy of prediction.

Description

Technical Field

[0001] This invention relates to network attack information processing technology, and more particularly to training methods for attack information prediction models, attack information prediction methods, devices, systems, equipment, and storage media. Background Technology

[0002] In related technologies, regular expressions in WAFs are an important type of attack data. Analyzing them helps to provide a basis for identifying attack behaviors and developing security defense measures. Specifically, Web injection attacks can be detected by using regular expressions to match attack features in Web application firewalls. That is, feature matching is performed on each specific injection attack feature. However, in existing attack information prediction, the method of manually generating regular expressions is slow and has poor accuracy, which is not conducive to timely detection by intrusion prevention systems. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a training method, an attack information prediction method, an apparatus, an electronic device, and a storage medium for an attack information prediction model, which can combine different seed attack payload information, determine the regular expression corresponding to the intrusion prevention system, automatically predict attack information, and improve the speed and accuracy of prediction.

[0004] The technical solution of this invention is implemented as follows:

[0005] This invention provides a method for training an attack information prediction model, comprising:

[0006] Obtain a first training sample set, wherein the first training sample set includes attack payload information that matches the attack information prediction model and corresponding structured query language keywords;

[0007] The attack information prediction model is used to process the first training sample set to determine the parameters of the word vector model network in the attack information prediction model, so as to output word vectors that match the training samples through the word vector model network.

[0008] The attack information prediction model performs binary classification on word vectors that match the attack payload information to determine the parameters of the binary classification model network in the attack information prediction model, so as to determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0009] The attack information prediction model performs multi-classification processing on word vectors that match the attack payload information to determine the parameters of the multi-classification model network in the attack information prediction model, so as to realize the determination of combination rules relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0010] Based on the seed attack payload information and the combination rules relative to the seed attack payload information, different seed attack payload information is combined to determine the regular expression corresponding to the intrusion prevention system.

[0011] This invention also provides an attack information prediction method, comprising:

[0012] Obtain attack payload information corresponding to the intrusion prevention system;

[0013] The word vector model network of the attack information prediction model is used to determine the word vectors that match the attack payload information.

[0014] The seed attack payload information that matches the word vector is determined by the binary classification model network in the attack information prediction model.

[0015] The attack information prediction model uses a multi-classification model network to determine a combination rule relative to the seed attack payload information;

[0016] Based on the seed attack payload information and the combination rules relative to the seed attack payload information, different seed attack payload information are combined to determine the regular expression corresponding to the intrusion prevention system;

[0017] The intrusion prevention system is tested based on the regular expression.

[0018] This invention also provides a training apparatus for an attack information prediction model, comprising:

[0019] The information transmission module is used to acquire a first training sample set, wherein the first training sample set includes attack payload information that matches the attack information prediction model and corresponding structured query language keywords.

[0020] The model training module is used to process the first training sample set through the attack information prediction model, determine the parameters of the word vector model network in the attack information prediction model, so as to realize the output of word vectors that match the training samples through the word vector model network;

[0021] The model training module is used to perform binary classification processing on word vectors that match the attack payload information through the attack information prediction model, and determine the parameters of the binary classification model network in the attack information prediction model, so as to realize the determination of seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0022] The model training module is used to perform multi-classification processing on word vectors that match the attack payload information through the attack information prediction model, and determine the parameters of the multi-classification model network in the attack information prediction model, so as to realize the determination of the combination rules relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0023] The model training module is used to combine different seed attack payload information based on the seed attack payload information and the combination rules relative to the seed attack payload information to determine the regular expression corresponding to the intrusion prevention system.

[0024] In the above scheme,

[0025] The model training module is used to sample the first training sample set through the word vector model network in the attack information prediction model to determine the positive and negative samples corresponding to the training samples.

[0026] The model training module is used to determine the context sample pairs in the word vector model network based on the positive and negative sample pairs corresponding to the training samples.

[0027] The model training module is used to determine the parameters of the word vector model network in the attack information prediction model based on the context sample pairs in the word vector model network.

[0028] In the above scheme,

[0029] The model training module is used to determine a word segmentation strategy that matches the attack information prediction model;

[0030] The model training module is used to perform word segmentation processing on the attack payload information in the first training sample set;

[0031] The model training module is used to randomly insert the structured query language keywords from the first training sample set into the attack payload information that has undergone word segmentation processing, to form a second training sample set.

[0032] In the above scheme,

[0033] The model training module is used to perform a first binary classification process on word vectors that match the attack payload information through the attack information prediction model, and determine the initial parameters of the attention-based binary classification model network in the attack information prediction model.

[0034] The model training module is used to perform a second binary classification process on word vectors that match the attack payload information based on the initial parameters of the binary classification model network and the attack information prediction model, thereby determining the update parameters of the attention-based binary classification model network in the attack information prediction model.

[0035] The model training module is used to iteratively update the binary classification model of the attention mechanism through the first training sample set according to the update parameters of the binary classification model network, so as to determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0036] In the above scheme,

[0037] The model training module is used to substitute different statement samples in the first training sample set into the loss function corresponding to the autoencoder network composed of the encoder and decoder of the binary classification model network in the attack information prediction model.

[0038] The model training module is used to determine the encoder parameters and corresponding decoder parameters of the binary classification model network when the loss function satisfies the first convergence condition, and use them as the update parameters of the binary classification model network.

[0039] In the above scheme,

[0040] The model training module is used to determine the iterative convergence conditions corresponding to the autoencoder network composed of the encoder and decoder of the binary classification model network in the attack information prediction model.

[0041] The model training module is used to iteratively update the encoder and decoder parameters of the binary classification model network based on the update parameters corresponding to the binary classification model network.

[0042] The model training module is used to train the model until the loss function of the autoencoder network consisting of the encoder and decoder of the binary classification model network satisfies the corresponding convergence condition and can determine the seed attack payload information that matches the word vector.

[0043] In the above scheme,

[0044] The model training module is used to perform a first multi-classification process on word vectors that match the attack payload information through the attack information prediction model, and determine the initial parameters of the multi-classification model network in the attack information prediction model.

[0045] The model training module is used to perform a second multi-classification process on word vectors that match the attack payload information based on the initial parameters of the multi-classification model network and through the attack information prediction model, thereby determining the update parameters of the multi-classification model network in the attack information prediction model.

[0046] The model training module is used to iteratively update the multi-classification model using the first training sample set based on the update parameters of the multi-classification model network, so as to realize the determination of the combination rules relative to the seed attack payload information by the multi-classification model network in the attack information prediction model.

[0047] In the above scheme,

[0048] The model training module is used to determine the iterative convergence conditions corresponding to the autoencoder network composed of the encoder and decoder of the multi-classification model network in the attack information prediction model.

[0049] The model training module is used to iteratively update the encoder and decoder parameters of the multi-classification model network based on the update parameters corresponding to the multi-classification model network.

[0050] The model training module is used to train the model until the loss function of the autoencoder network consisting of the encoder and decoder of the multi-classification model network satisfies the corresponding convergence condition and can determine the combination rules relative to the seed attack payload information.

[0051] In the above scheme,

[0052] The model training module is used to combine different seed attack payload information based on the seed attack payload information and the combination rules relative to the seed attack payload information to form a first expression unit.

[0053] The model training module is used to traverse the first expression unit, delete duplicate first expression units, and form the regular expression corresponding to the intrusion prevention system.

[0054] In the above scheme,

[0055] The model training module is used to receive attack information and decompose the attack information.

[0056] The model training module is used to match the decomposed attack information with the attack rules in the attack discrimination database of the intrusion prevention system based on the regular expression, so as to test the intrusion prevention system.

[0057] This invention also provides an attack information prediction device, comprising:

[0058] The information acquisition module is used to acquire attack payload information corresponding to the intrusion prevention system;

[0059] The information processing module is used to determine word vectors that match the attack payload information through the word vector model network of the attack information prediction model.

[0060] The information processing module is used to determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0061] The information processing module is used to determine the combination rules relative to the seed attack payload information through the multi-classification model network in the attack information prediction model;

[0062] The information processing module is used to combine different seed attack payload information based on the seed attack payload information and the combination rules relative to the seed attack payload information, and determine the regular expression corresponding to the intrusion prevention system.

[0063] The information processing module is used to test the intrusion prevention system according to the regular expression.

[0064] This invention also provides an electronic device, the electronic device comprising:

[0065] Memory, used to store executable instructions;

[0066] The processor, when running executable instructions stored in the memory, implements either the training method for the preceding attack information prediction model or the aforementioned attack information prediction method.

[0067] This invention also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement a training method for a preceding attack information prediction model, or implement a preceding attack information prediction method.

[0068] The embodiments of the present invention have the following beneficial effects:

[0069] This invention embodiment obtains a first training sample set, which includes attack payload information matching the attack information prediction model and corresponding structured query language keywords; processes the first training sample set using the attack information prediction model to determine the parameters of the word vector model network in the attack information prediction model, so as to achieve the output of word vectors matching the training samples through the word vector model network; and performs binary classification processing on the word vectors matching the attack payload information using the attack information prediction model to determine the parameters of the binary classification model network in the attack information prediction model, so as to achieve the determination of seed attack payload information matching the word vectors through the binary classification model network in the attack information prediction model. The attack information prediction model performs multi-classification processing on word vectors matching the attack payload information to determine the parameters of the multi-classification model network in the attack information prediction model. This enables the multi-classification model network in the attack information prediction model to determine the combination rules relative to the seed attack payload information. Based on the seed attack payload information and the combination rules relative to the seed attack payload information, different seed attack payload information is combined. Thus, it is possible to combine different seed attack payload information to determine the regular expression corresponding to the intrusion prevention system, automatically predict attack information, improve the speed and accuracy of prediction, and at the same time, the model has stronger generalization ability, improves the training accuracy of the attack information prediction model, and saves model training time. Attached Figure Description

[0070] Figure 1 This is a schematic diagram illustrating the usage environment of the training method for the attack information prediction model provided in this embodiment of the invention;

[0071] Figure 2 A schematic diagram of the composition structure of the training device for the attack information prediction model provided in an embodiment of the present invention;

[0072] Figure 3 This is a schematic diagram of an optional regular expression generation process in an embodiment of the present invention;

[0073] Figure 4 This is a schematic diagram of an optional regular expression generation process in an embodiment of the present invention;

[0074] Figure 5 This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention.

[0075] Figure 6 A schematic diagram of the word vector model network structure of the attack information prediction model provided in this embodiment of the invention;

[0076] Figure 7This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention.

[0077] Figure 8 This is an optional schematic diagram of a binary classification model network in an embodiment of the present invention;

[0078] Figure 9 This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention.

[0079] Figure 10 This is a schematic diagram of the structure of the multi-classification model network in an embodiment of the present invention;

[0080] Figure 11 This is a schematic diagram illustrating the process of determining the input regular expression by combining different seed attack payload information in an embodiment of the present invention;

[0081] Figure 12 This is an optional flowchart illustrating the attack information prediction method provided in an embodiment of the present invention. Detailed Implementation

[0082] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0083] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0084] Before providing a further detailed description of the embodiments of the present invention, the nouns and terms involved in the embodiments of the present invention will be explained, and the nouns and terms involved in the embodiments of the present invention shall be interpreted as follows.

[0085] 1) In response to, used to indicate the conditions or states on which the operation performed depends. When the conditions or states on which it depends are met, one or more operations performed may be performed in real time or with a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations are performed.

[0086] 2) Terminals, including but not limited to: ordinary terminals and dedicated terminals, wherein the ordinary terminals maintain a long connection and / or a short connection with the transmission channel, and the dedicated terminals maintain a long connection with the transmission channel.

[0087] 3) Client: The carrier that implements specific functions in the terminal. For example, a mobile client (APP) is a carrier of specific functions in a mobile terminal, such as performing payment and consumption functions or purchasing financial products.

[0088] 4) Web Application Firewall (WAF): Also known as a website application-level intrusion prevention system, it blocks malicious attack requests by detecting characteristics in Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) messages.

[0089] 5) Attack payload: refers to the specific characters or code fragments used to carry out the attack in a malicious attack request.

[0090] 6) Model Training: Multi-class classification learning on the image dataset. This model can be built using deep learning frameworks such as TensorFlow and Torch, employing multiple layers of neural networks like CNNs to form a multi-class classification model. The model input is a three-channel or original-channel matrix generated from images read using tools like OpenCV. The model output is the multi-class probability, ultimately outputting the webpage category through algorithms such as softmax. During training, the model approximates the correct trend using objective functions such as cross-entropy.

[0091] 7) Neural Network (NN): Artificial Neural Network (ANN), also known as neural network or neural network-like network, is a mathematical or computational model in the fields of machine learning and cognitive science that imitates the structure and function of biological neural networks (the central nervous system of animals, especially the brain) and is used to estimate or approximate functions.

[0092] Figure 1 This is a schematic diagram illustrating a usage scenario of the training method for the attack information prediction model provided in this embodiment of the invention. (See attached diagram.) Figure 1The terminals (including terminals 10-1 and 10-2) are equipped with corresponding clients capable of performing different functions. These clients retrieve and browse various information from the corresponding server 200 via network 300. The terminals connect to the server 200 via network 300, which can be a wide area network (WAN), a local area network (LAN), or a combination of both, using a wireless link for data transmission. During this information interaction between the terminals and the network, they may be vulnerable to network attacks. Therefore, a Web Application Firewall (WAF) can be deployed. Specifically, the WAF can perform detection using regular expressions.

[0093] As an example, server 200 is used to deploy the attack information prediction model and train the attack information prediction model, and deploy the trained attack information prediction model in the corresponding terminal, and use the deployed attack information prediction model to predict attack information in the usage environment through the terminal (terminal 10-1 and / or terminal 10-2).

[0094] Of course, before predicting attack information using the attack information prediction model to generate corresponding regular expressions, the attack information prediction model needs to be trained. This specifically includes: obtaining a first training sample set, wherein the first training sample set includes attack payload information matching the attack information prediction model and corresponding structured query language keywords; processing the first training sample set using the attack information prediction model to determine the parameters of the word vector model network in the attack information prediction model, so as to achieve the output of word vectors matching the training samples through the word vector model network; and performing binary classification processing on the word vectors matching the attack payload information using the attack information prediction model to determine... The parameters of the binary classification model network in the attack information prediction model are determined to identify seed attack payload information that matches the word vectors. The attack information prediction model then performs multi-classification processing on the word vectors that match the attack payload information to determine the parameters of the multi-classification model network in the attack information prediction model. This allows the multi-classification model network to determine combination rules that are relative to the seed attack payload information. Based on the seed attack payload information and the combination rules relative to it, different seed attack payload information is combined to determine the regular expression corresponding to the intrusion prevention system.

[0095] The attack information prediction method provided in this application is based on artificial intelligence (AI). AI is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, AI is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to have perception, reasoning, and decision-making functions.

[0096] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0097] In the embodiments of this application, the main artificial intelligence software technologies involved include the aforementioned speech processing technologies and machine learning. For example, it may involve Automatic Speech Recognition (ASR) technology in speech technology, including speech signal preprocessing, speech signal frequency analyzing, speech signal feature extraction, speech signal feature matching / recognition, and speech training.

[0098] For example, this could involve machine learning (ML), a multidisciplinary field encompassing probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning typically includes techniques such as deep learning, which includes artificial neural networks, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and deep neural networks (DNNs).

[0099] The structure of the training device for the attack information prediction model according to embodiments of the present invention will be described in detail below. The training device for the attack information prediction model can be implemented in various forms, such as a dedicated terminal with training device processing function for the attack information prediction model, or a server or server group equipped with training device processing function for the attack information prediction model, such as a honeypot system or firewall system deployed in the target system, for example, a front-end system. Figure 1 Server 200. Figure 2 This is a schematic diagram of the composition of the training device for the attack information prediction model provided in an embodiment of the present invention. It can be understood that... Figure 2 This only shows an exemplary structure of the training device for the attack information prediction model, not the entire structure; implementation is possible as needed. Figure 2 The structure shown may be part or all of the structure.

[0100] The training apparatus for the attack information prediction model provided in this embodiment of the invention includes: at least one processor 201, a memory 202, a user interface 203, and at least one network interface 204. The various components in the training apparatus for the attack information prediction model are coupled together via a bus system 205. It can be understood that the bus system 205 is used to implement communication between these components. In addition to a data bus, the bus system 205 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 2 The general labeled all buses as Bus System 205.

[0101] The user interface 203 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0102] It is understood that memory 202 can be volatile memory or non-volatile memory, or both. In this embodiment of the invention, memory 202 is capable of storing data to support the operation of the terminal (e.g., 10-1). Examples of this data include any computer programs used to operate on the terminal (e.g., 10-1), such as operating systems and applications. The operating system includes various system programs, such as the framework layer, core library layer, driver layer, etc., used to implement various basic services and handle hardware-based tasks. Applications can include various applications.

[0103] In some embodiments, the training device for the attack information prediction model provided in this invention can be implemented using a combination of hardware and software. For example, the training device for the attack information prediction model provided in this invention can be a processor in the form of a hardware decoding processor, programmed to execute the network attack information processing method provided in this invention. For instance, the processor in the form of a hardware decoding processor can employ one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0104] As an example of the training device for the attack information prediction model provided in this embodiment of the invention, which adopts a combination of hardware and software, the training device for the attack information prediction model provided in this embodiment of the invention can be directly embodied as a combination of software modules executed by the processor 201. The software modules can be located in a storage medium, which is located in the memory 202. The processor 201 reads the executable instructions included in the software modules in the memory 202 and combines them with necessary hardware (e.g., including the processor 201 and other components connected to the bus 205) to complete the network attack information processing method provided in this embodiment of the invention.

[0105] As an example, processor 201 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0106] As an example of the hardware implementation of the training device for the attack information prediction model provided in this embodiment of the invention, the device provided in this embodiment of the invention can be directly executed by a processor 201 in the form of a hardware decoding processor. For example, it can be executed by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components to implement the network attack information processing method provided in this embodiment of the invention.

[0107] In this embodiment of the invention, the memory 202 is used to store various types of data to support the operation of the training device for the attack information prediction model. Examples of such data include: any executable instructions for operation on the training device for the attack information prediction model, such as executable instructions that can be included in the program implementing the network attack information processing method of this embodiment of the invention.

[0108] In other embodiments, the training device for the attack information prediction model provided in this invention can be implemented in software. Figure 2 A training device for an attack information prediction model stored in memory 202 is shown. This device can be software in the form of programs and plugins, and includes a series of modules. As an example of a program stored in memory 202, it may include the attack information prediction model training device. The attack information prediction model training device includes the following software modules: an information transmission module 2081 and a model training module 2082. When the software modules in the attack information prediction model training device are read into RAM and executed by processor 201, the network attack information processing method provided in this embodiment of the invention will be implemented. The functions of each software module in the attack information prediction model training device include:

[0109] The information transmission module 2081 is used to acquire a first training sample set, wherein the first training sample set includes attack payload information that matches the attack information prediction model and corresponding structured query language keywords.

[0110] The model training module 2082 is used to process the first training sample set through the attack information prediction model, determine the parameters of the word vector model network in the attack information prediction model, so as to output word vectors that match the training samples through the word vector model network.

[0111] The model training module 2082 is used to perform binary classification processing on word vectors that match the attack payload information through the attack information prediction model, and determine the parameters of the binary classification model network in the attack information prediction model, so as to realize the determination of seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0112] The model training module 2082 is used to perform multi-classification processing on word vectors that match the attack payload information through the attack information prediction model, and determine the parameters of the multi-classification model network in the attack information prediction model, so as to realize the determination of the combination rules relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0113] The model training module 2082 is used to combine different seed attack payload information based on the seed attack payload information and the combination rules relative to the seed attack payload information to determine the regular expression corresponding to the intrusion prevention system.

[0114] according to Figure 2 The electronic device shown, in one aspect of this application, also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method provided in various optional implementations of the training method for the attack information prediction model described above.

[0115] Combination Figure 2 The attack information prediction model training device shown illustrates the training method of the attack information prediction model provided in the embodiments of the present invention. Before introducing the training method of the attack information prediction model provided in the embodiments of the present invention, the process of regular expression generation in related technologies is first introduced.

[0116] refer to Figure 3 and Figure 4 , Figure 3 This is a schematic diagram of an optional regular expression generation process in an embodiment of the present invention. Figure 4 This is a schematic diagram of an optional regular expression generation process in an embodiment of the present invention.

[0117] In related technologies, website application-level intrusion prevention systems can model text keywords and their corresponding regular expressions to build classification models, where the generated regular expressions are predetermined. Alternatively, as... Figure 3As shown, natural language instructions are translated into regular expressions through sequence generation techniques, or regular expressions are inferred from a set of sentences using automata.

[0118] However, during the testing phase of a Web Application Firewall (WAF), WAFs typically use regular expressions to block malicious requests, making many web attacks, such as SQL injection, impossible. But if attackers gain access to the WAF's backend rules, they can adjust the payload accordingly to construct attacks that bypass the WAF. Furthermore, for commercial WAF products, good protection rules provide stronger defense capabilities and are a core competitive advantage. If WAF rules are leaked, the website's application-level intrusion prevention system will be vulnerable to attack. Typically, feedback from a Web Application Firewall (WAF) only indicates whether an attack has been blocked. However, by generating a new payload by changing specific characters in the payload, testing it against the WAF, and inferring the regular expression unit based on the feedback, the WAF's defense rules can be reconstructed (e.g., if testing a-zA-Z,0-9, and _ results in a block, while testing other characters results in a pass, this confirms the backend regular expression unit is \w). However, this method has limitations. First, manual probing is time-consuming and labor-intensive, making large-scale deployment difficult. Second, this experience is highly dependent on the attacker's skill level, and details are easily overlooked, ultimately leading to the inferred rules being only a subset of the actual protection rules. Therefore, a more efficient method is needed to predict the behavior of website application-level intrusion prevention systems (APIs) to improve their security by testing the APIs using predicted regular expressions.

[0119] To address the shortcomings in this related technology, see [link to relevant documentation]. Figure 5 , Figure 5 This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention. It can be understood that... Figure 5 The steps shown can be performed by various electronic devices that run attack information prediction model training devices, such as dedicated terminals with attack information prediction capabilities, servers with attack information prediction model training capabilities, or server clusters. The following addresses... Figure 5 The steps shown are explained.

[0120] Step 501: The attack information prediction model training device acquires the first training sample set.

[0121] The first training sample set includes attack payload information that matches the attack information prediction model and corresponding structured query language keywords.

[0122] In some embodiments of the present invention, a word segmentation strategy matching the attack information prediction model can be determined; the attack payload information in the first training sample set is processed by word segmentation; and structured query language keywords from the first training sample set are randomly inserted into the word-segmented attack payload information to form a second training sample set. Specifically, 30,000 payloads and approximately 600 SQL keywords can be collected from SQLMap, and then the payloads are processed by word segmentation. Keywords are then randomly replaced into the payloads for data augmentation to form the second training sample set. For example, "-0" OR 0 = 0#" is an augmented second training sample.

[0123] Step 502: The attack information prediction model training device processes the first training sample set through the attack information prediction model to determine the parameters of the word vector model network in the attack information prediction model, so as to realize the output of word vectors that match the training samples through the word vector model network.

[0124] In some embodiments of the present invention, the parameters of the word vector model network in the attack information prediction model are determined by processing the first training sample set through the attack information prediction model, which can be achieved in the following ways:

[0125] The word vector model network in the attack information prediction model is used to sample the first training sample set to determine the positive and negative samples corresponding to the training samples. Based on the positive and negative samples, context sample pairs in the word vector model network are determined. Based on the context sample pairs, the parameters of the word vector model network in the attack information prediction model are determined. During the training phase, 1) the word vector model network in the attack information processing model can use a skip gram model to predict context window words using the center word, wherein, referencing... Figure 6 , Figure 6 This diagram illustrates the word vector model network structure of the attack information prediction model provided in this embodiment of the invention, where w(t) is the center word, also known as the given input word. It includes a hidden layer that performs a dot product operation between the weight matrix and the input vector w(t). No activation function is used in the hidden layer. The result of the dot product operation in the hidden layer is passed to the output layer, which calculates the dot product between the hidden layer output vector and the output layer weight matrix. Then, a softmax activation function is used to calculate the probability that the word appears in the context of w(t) at a given context position.

[0126] The training process of the skip gram model may include: performing positive and negative sampling on the node sequence to obtain sample context node pairs of the sample nodes, wherein the sample context node pairs include positive example node pairs and / or negative example node pairs of the sample nodes; predicting the context nodes of the sample nodes according to the preset skip gram model to obtain predicted context node pairs; and using the gradient descent algorithm to converge the predicted context node pairs and the sample context node pairs to obtain the trained skip gram model.

[0127] Furthermore, the advantage of using the skip gram model lies in its unsupervised learning nature, making it applicable to any raw text. Compared to other word-to-text representations, skip grams require less memorization of the scattered representations of words in the vector space; in semantic similarity, "cat" and "dog" are closer than "cat" and "apple"; and the vectors in the skip gram model are additive: King – Man + Woman = Queen. It also allows for fully automated feature extraction.

[0128] In some embodiments of the present invention, a skip gram word vector model network is constructed using the gensim library, with an embedding dimension of 32, a vocabulary size of 780, and a context window size of 10. After this step, each word obtains a 32-dimensional vector representation.

[0129] Step 503: The attack information prediction model training device performs binary classification processing on the word vectors that match the attack payload information through the attack information prediction model to determine the parameters of the binary classification model network in the attack information prediction model.

[0130] Therefore, it is possible to determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0131] Among them, reference Figure 7 , Figure 7 This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention. It can be understood that... Figure 7 The steps shown can be performed by various electronic devices that run attack information prediction model training devices, specifically including:

[0132] Step 701: Using the attack information prediction model, perform a first binary classification process on the word vectors that match the attack payload information to determine the initial parameters of the attention-based binary classification model network in the attack information prediction model.

[0133] Step 702: Based on the initial parameters of the binary classification model network, the word vectors that match the attack payload information are subjected to a second binary classification process through the attack information prediction model to determine the update parameters of the attention-based binary classification model network in the attack information prediction model.

[0134] Specifically, when determining the binary classification model network, different statement samples from the first training sample set can be substituted into the loss function corresponding to the autoencoder network composed of the encoder and decoder of the binary classification model network in the attack information prediction model; the parameters of the encoder and the corresponding decoder of the binary classification model network when the loss function satisfies the first convergence condition are determined as the update parameters of the binary classification model network.

[0135] Step 703: Based on the update parameters of the binary classification model network, the binary classification model of the attention mechanism is iteratively updated using the first training sample set, so as to determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0136] Specifically, during iterative updates, the iterative convergence condition for the autoencoder network (composed of the encoder and decoder) of the binary classification model network in the attack information prediction model is first determined. Then, based on the update parameters of the binary classification model network, the encoder and decoder parameters are iteratively updated until the loss function of the autoencoder network satisfies the corresponding convergence condition and can determine the seed attack payload information matching the word vector. The binary classification model network can use an LSTM deep neural network with an attention mechanism, referencing... Figure 8 , Figure 8 This is an optional schematic diagram of a binary classification model network in an embodiment of the present invention. Specifically, after testing the training dataset through a WAF system to obtain block and pass labels, a binary classification model network in the attack information processing model is then used to obtain a trained classification model network. This model network can predict the probability of whether a payload can be blocked. The training data consists of the payload, such as `80`execute\x0bcollation`having-sa, and the label is 1 for WAF-blocked payloads and 0 for others.

[0137] During the training phase, a loss function matching the binary classification model network in the attack information processing model can be determined. Based on the loss function, the network parameters of the binary classification model network in the attack information processing model are adjusted until the loss function corresponding to the binary classification model network in the attack information processing model reaches the corresponding convergence condition. The calculation of the attention distribution α is performed using Formula 1:

[0138]

[0139] Based on α, the weighted average of the input information can be calculated using Formula 2:

[0140]

[0141] s(x n ,q) Scoring function: An additive model is used here, i.e., Formula 3:

[0142] s(x,q)=v T Formula 3 for tanh(wx+uq)

[0143] Therefore, seed payloads such as select, 0=0, and 0 can be generated through the attention mechanism (LSTM+Attention Model).

[0144] Step 504: The attack information prediction model training device uses the attack information prediction model to perform multi-classification processing on word vectors that match the attack payload information, and determines the parameters of the multi-classification model network in the attack information prediction model.

[0145] Therefore, it is possible to determine the combination rules that are relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0146] Among them, reference Figure 9 , Figure 9 This is an optional flowchart illustrating the attack information prediction model training method provided in this embodiment of the invention. It can be understood that... Figure 9 The steps shown can be performed by various electronic devices that run attack information prediction model training devices, specifically including:

[0147] Step 901: Using the attack information prediction model, perform a first multi-classification process on the word vectors that match the attack payload information to determine the initial parameters of the multi-classification model network in the attack information prediction model.

[0148] Step 902: Based on the initial parameters of the multi-classification model network, the attack information prediction model performs a second multi-classification process on the word vectors that match the attack payload information to determine the updated parameters of the multi-classification model network in the attack information prediction model.

[0149] Step 903: Based on the update parameters of the multi-classification model network, iteratively update the multi-classification model using the first training sample set to achieve the determination of combination rules relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0150] In some embodiments of the present invention, during iterative updates, the iterative convergence condition corresponding to the autoencoder network composed of the encoder and decoder of the multi-classification model network in the attack information prediction model can be determined; based on the update parameters corresponding to the multi-classification model network, the encoder parameters and decoder parameters of the multi-classification model network are iteratively updated until the loss function corresponding to the autoencoder network composed of the encoder and decoder of the multi-classification model network satisfies the corresponding convergence condition and the combination rule relative to the seed attack payload information can be determined. Figure 10 This is a schematic diagram of the structure of the multi-classification model network in an embodiment of the present invention. The w words to the left and w words to the right of the detection position are taken as input, encoded by a two-layer LSTM, and then subjected to a pooling operation. Then, a linear layer is applied to map to the vocabulary size, and the word probabilities are output after passing through the softmax function.

[0151] Specifically, taking the payload: 1”and 1=1 as an example, we use a window size w of 5. In order to detect the position, the input on the left is [ <pad> , <pad> , <pad> , <pad>,1],The input on the right is [ <space>After the words are mapped to numbers, they are further converted into embedding matrices through pre-trained word vectors, and then input into an LSTM network. Features are extracted through Maxpooling, and after passing through a linear layer, they are mapped to a vocabulary size of 38. The probabilities of the 38 words at this position are output, and the rule units are determined based on the corresponding probabilities.

[0152] Step 505: The attack information prediction model training device combines different seed attack payload information based on the seed attack payload information and the combination rules relative to the seed attack payload information to determine the regular expression corresponding to the intrusion prevention system.

[0153] in, Figure 11 This is a schematic diagram illustrating the process of determining the input regular expression by combining different seed attack payload information in an embodiment of the present invention, wherein...

[0154] The attack information prediction model recommends words to be probed, which can be represented as: "',`,),…”

[0155] By using a multi-classification network in the attack information prediction model, possible words for each position in each seed payload can be recommended. The corresponding regular expression unit for that position can be deduced based on whether these words are blocked or passed. For example, if "aA0_" is blocked and "(*,?." is passed at a certain position, then the corresponding rule unit for that position can be determined as "\w". Specifically, the multi-classification network consists of a two-layer LSTM structure, with a linear layer at the top mapping the model output dimension to the vocabulary size. Finally, a softmax function outputs the probability of each word appearing at that position. Predicted words with probabilities greater than a threshold are sorted and then sequentially probed through an online system. Incremental learning can also be used to fully utilize feedback results to iteratively optimize the attack information prediction model.

[0156] Finally, after adding or deleting the obtained rule units, such as \s\s=>\s+, the rule expression form is optimized through online feedback. Ultimately, each seed payload will correspond to one protection rule.

[0157] {

[0158] "pg_sleep(":"(?i)\\bpg[^\\dA-Za-z]sleep[^a-zA-Z\\d_]*['\"`\\(]+"

[0159] }

[0160] See Figure 12 , Figure 12 This is an optional flowchart illustrating the attack information prediction method provided in this embodiment of the invention. It can be understood that... Figure 12 The steps shown can be performed by various electronic devices running the attack information prediction model, such as dedicated terminals with attack information prediction capabilities, servers with attack information prediction model training capabilities, or server clusters. The following section addresses... Figure 12 The steps shown are explained.

[0161] Step 1201: Obtain the attack payload information corresponding to the intrusion prevention system.

[0162] During testing, attacks on terminals or servers can be simulated. The essence of a web injection attack is injecting malicious code into the request packets of the target network traffic, even though the request packets themselves may not contain any code. The malicious code is injected at a specific injection point. In this embodiment, the target injection point can include any or more possible injection points for injecting code. The target injection point can be a pre-set detection location; common web injection attack code injection locations can be set as target injection points. This embodiment can also update the target injection point during the detection of web injection attacks. The target injection point can exist anywhere in the request line, request header, and request data of the request packet; no limitation is imposed here. The injection point text can include Uniform Resource Locator (URL) parameter values ​​or cookie values.

[0163] Step 1202: Determine the word vectors that match the attack payload information through the word vector model network of the attack information prediction model.

[0164] Step 1203: Determine the seed attack payload information that matches the word vector through the binary classification model network in the attack information prediction model.

[0165] Step 1204: Determine the combination rules that are relative to the seed attack payload information through the multi-classification model network in the attack information prediction model.

[0166] Step 1205: Based on the seed attack payload information and the combination rules relative to the seed attack payload information, combine different seed attack payload information to determine the regular expression corresponding to the intrusion prevention system.

[0167] Step 1206: Test the intrusion prevention system according to the regular expression.

[0168] Taking the decomposed SQL injection attack request as an example, when determining the attack string, the decomposed SQL injection attack request is matched against the attack rules in the attack discrimination database to determine the matching position. During the matching process, each type of attack has a corresponding attack matching pattern, which can be a set of characteristic regular expressions. By matching each decomposed part against the attack matching pattern in the attack discrimination database, the matching position is returned, and the parameter corresponding to that matching position is the attack string.

[0169] As a result, testers can accurately determine whether the current intrusion prevention system meets the anti-attack requirements and adjust the intrusion prevention system in a timely manner based on the predicted successful attack information.

[0170] In this invention, embodiments can be implemented using cloud technology. Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. It can also be understood as a general term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies based on cloud computing business models. The backend services of network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites; therefore, cloud technology needs cloud computing as its support.

[0171] It's important to note that cloud computing is a computing model that distributes computing tasks across a resource pool comprised of numerous computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" appear infinitely scalable, readily available, on-demand, and expandable, with payment based on usage. As the foundational providers of cloud computing capabilities, they establish cloud resource pool platforms, often referred to as cloud platforms or Infrastructure as a Service (IaaS). These platforms deploy various types of virtual resources within the resource pool for external customers to choose from. The cloud resource pool primarily includes: computing devices (which can be virtualized machines containing operating systems), storage devices, and network devices.

[0172] Combined with the preceding sequence Figure 1 As shown, the attack information prediction method provided in this embodiment of the invention can be implemented through corresponding cloud devices. For example, terminals (including terminals 10-1 and 10-2) connect to a server 200 located in the cloud via a network 300. The network 300 can be a wide area network (WAN), a local area network (LAN), or a combination of both. It is worth noting that the server 200 can be a physical device or a virtualized device. The attack information prediction model deployed in the cloud server is used to detect the intrusion prevention system in the cloud server.

[0173] Beneficial effects:

[0174] This invention embodiment obtains a first training sample set, which includes attack payload information matching the attack information prediction model and corresponding structured query language keywords; processes the first training sample set using the attack information prediction model to determine the parameters of the word vector model network in the attack information prediction model, so as to achieve the output of word vectors matching the training samples through the word vector model network; and performs binary classification processing on the word vectors matching the attack payload information using the attack information prediction model to determine the parameters of the binary classification model network in the attack information prediction model, so as to achieve the determination of seed attack payload information matching the word vectors through the binary classification model network in the attack information prediction model. The attack information prediction model performs multi-classification processing on word vectors matching the attack payload information to determine the parameters of the multi-classification model network in the attack information prediction model. This enables the multi-classification model network in the attack information prediction model to determine the combination rules relative to the seed attack payload information. Based on the seed attack payload information and the combination rules relative to the seed attack payload information, different seed attack payload information is combined. Thus, it is possible to combine different seed attack payload information to determine the regular expression corresponding to the intrusion prevention system, automatically predict attack information, improve the speed and accuracy of prediction, and at the same time, the model has stronger generalization ability, improves the training accuracy of the attack information prediction model, and saves model training time.

[0175] The above description is merely an embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.< / space> < / pad> < / pad> < / pad> < / pad>

Claims

1. A method for training an attack information prediction model, characterized in that, The method comprises: obtaining a first training sample set, wherein the first training sample set comprises attack payload information matched with an attack information prediction model and corresponding structured query language keywords; processing the first training sample set through the attack information prediction model to determine parameters of a word vector model network in the attack information prediction model, so as to realize outputting word vectors matched with the training sample through the word vector model network; performing binary classification processing on the word vectors matched with the attack payload information through the attack information prediction model, to determine parameters of a binary classification model network in the attack information prediction model, so as to realize determining seed attack payload information matched with the word vectors through the binary classification model network in the attack information prediction model; performing multi-classification processing on the word vectors matched with the attack payload information through the attack information prediction model, to determine parameters of a multi-classification model network in the attack information prediction model, so as to realize determining combination rules opposite to the seed attack payload information through the multi-classification model network in the attack information prediction model; combining different seed attack payload information based on the seed attack payload information and the combination rules opposite to the seed attack payload information, to determine regular expressions corresponding to an intrusion prevention system.

2. The method of claim 1, wherein, The processing of the first training sample set through the attack information prediction model to determine parameters of a word vector model network in the attack information prediction model comprises: sampling the first training sample set through the word vector model network in the attack information prediction model, to determine positive samples and negative samples corresponding to the training sample; determining context sample pairs in the word vector model network according to the positive samples and the negative samples corresponding to the training sample; determining parameters of the word vector model network in the attack information prediction model according to the context sample pairs in the word vector model network.

3. The method of claim 2, wherein, The method further comprises: determining a word segmentation strategy matched with the attack information prediction model; performing word segmentation processing on the attack payload information in the first training sample set; randomly inserting structured query language keywords in the first training sample set into the attack payload information subjected to the word segmentation processing, to form a second training sample set.

4. The method of claim 1, wherein, The binary classification processing on the word vectors matched with the attack payload information through the attack information prediction model to determine parameters of a binary classification model network in the attack information prediction model comprises: performing first binary classification processing on the word vectors matched with the attack payload information through the attack information prediction model, to determine initial parameters of a binary classification model network based on an attention mechanism in the attack information prediction model; performing second binary classification processing on the word vectors matched with the attack payload information through the attack information prediction model based on the initial parameters of the binary classification model network, to determine updated parameters of the binary classification model network based on the attention mechanism in the attack information prediction model; According to the update parameter of the binary classification model network, the binary classification model of the attention mechanism is iteratively updated through the first training sample set, so as to realize the determination of the seed attack payload information matched with the word vector through the binary classification model network in the attack information prediction model.

5. The method of claim 4, wherein, According to the initial parameter of the binary classification model network, the attack information prediction model is used to perform first binary classification processing on the word vector matched with the attack payload information, and the update parameter of the binary classification model network based on the attention mechanism in the attack information prediction model is determined, including: The different sentence samples in the first training sample set are substituted into the loss function corresponding to the auto-encoding network composed of the encoder and the decoder of the binary classification model network in the attack information prediction model; When the loss function satisfies the first convergence condition, the parameters of the encoder and the corresponding decoder parameters of the binary classification model network are determined as the update parameters of the binary classification model network.

6. The method of claim 4, wherein, According to the update parameter of the binary classification model network, the binary classification model of the attention mechanism is iteratively updated through the first training sample set, so as to realize the determination of the seed attack payload information matched with the word vector through the binary classification model network in the attack information prediction model. The iterative convergence condition corresponding to the auto-encoding network composed of the encoder and the decoder of the binary classification model network in the attack information prediction model is determined; Based on the update parameter corresponding to the binary classification model network, the encoder parameters and the decoder parameters of the binary classification model network are iteratively updated, Until the loss function corresponding to the auto-encoding network composed of the encoder and the decoder of the binary classification model network satisfies the corresponding convergence condition and can determine the seed attack payload information matched with the word vector.

7. The method of claim 1, wherein, The attack information prediction model is used to perform multi-classification processing on the word vector matched with the attack payload information, and the parameter of the multi-classification model network in the attack information prediction model is determined, including: The attack information prediction model is used to perform first multi-classification processing on the word vector matched with the attack payload information, and the initial parameter of the multi-classification model network in the attack information prediction model is determined; Based on the initial parameter of the multi-classification model network, the attack information prediction model is used to perform second multi-classification processing on the word vector matched with the attack payload information, and the update parameter of the multi-classification model network in the attack information prediction model is determined; According to the update parameter of the multi-classification model network, the multi-classification model is iteratively updated through the first training sample set, so as to realize the determination of the combination rule opposite to the seed attack payload information through the multi-classification model network in the attack information prediction model.

8. The method of claim 7, wherein, According to the update parameter of the multi-classification model network, the multi-classification model is iteratively updated through the first training sample set, so as to realize the determination of the combination rule opposite to the seed attack payload information through the multi-classification model network in the attack information prediction model. The iterative convergence condition corresponding to the auto-encoding network composed of the encoder and the decoder of the multi-classification model network in the attack information prediction model is determined; Based on the update parameter corresponding to the multi-classification model network, the encoder parameters and the decoder parameters of the multi-classification model network are iteratively updated, Until the loss function corresponding to the auto-encoding network composed of the encoder and the decoder of the multi-classification model network meets the corresponding convergence condition and the combination rule opposite to the seed attack payload information can be determined.

9. The method of claim 1, wherein, The method comprises: combining different seed attack payload information based on the seed attack payload information and the combination rule opposite to the seed attack payload information to determine the regular expression corresponding to the intrusion prevention system; combining different seed attack payload information based on the seed attack payload information and the combination rule opposite to the seed attack payload information to form a first expression unit; 10. The method of claim 1, wherein, traversing the first expression unit and deleting the repeated first expression unit to form the regular expression corresponding to the intrusion prevention system. The method further comprises: receiving attack information and decomposing the attack information; 11. An attack information prediction method characterized by comprising: based on the regular expression, matching the decomposed attack information with the attack rules in the attack discrimination database of the intrusion prevention system to test the intrusion prevention system. The method comprises: obtaining attack payload information corresponding to an intrusion prevention system; determining a word vector matching the attack payload information through a word vector model network of an attack information prediction model; determining seed attack payload information matching the word vector through a binary classification model network in the attack information prediction model; determining the combination rule opposite to the seed attack payload information through a multi-classification model network in the attack information prediction model; combining different seed attack payload information based on the seed attack payload information and the combination rule opposite to the seed attack payload information to determine the regular expression corresponding to the intrusion prevention system; 12.A training apparatus of an attack information prediction model, comprising: testing the intrusion prevention system according to the regular expression. The training device comprises: an information transmission module configured to obtain a first training sample set, wherein the first training sample set comprises attack payload information matching an attack information prediction model and corresponding structured query language keywords; a model training module configured to process the first training sample set through the attack information prediction model to determine parameters of a word vector model network in the attack information prediction model, so as to output a word vector matching the training sample through the word vector model network; the model training module is configured to perform binary classification processing on the word vector matching the attack payload information through the attack information prediction model to determine parameters of a binary classification model network in the attack information prediction model, so as to determine seed attack payload information matching the word vector through the binary classification model network in the attack information prediction model; the model training module is configured to perform multi-classification processing on the word vector matching the attack payload information through the attack information prediction model to determine parameters of a multi-classification model network in the attack information prediction model, so as to determine the combination rule opposite to the seed attack payload information through the multi-classification model network in the attack information prediction model; The model training module is configured to combine different seed attack payload information based on the seed attack payload information and the combination rule opposite to the seed attack payload information, and determine a regular expression corresponding to the intrusion prevention system.

13. An attack information prediction apparatus characterized by comprising: The device comprises: An information acquisition module is configured to acquire attack payload information corresponding to an intrusion prevention system; An information processing module is configured to determine a word vector matched with the attack payload information through a word vector model network of an attack information prediction model; The information processing module is configured to determine seed attack payload information matched with the word vector through a binary classification model network in the attack information prediction model; The information processing module is configured to determine a combination rule opposite to the seed attack payload information through a multi-classification model network in the attack information prediction model; The information processing module is configured to combine different seed attack payload information based on the seed attack payload information and the combination rule opposite to the seed attack payload information, and determine a regular expression corresponding to the intrusion prevention system; The information processing module is configured to test the intrusion prevention system according to the regular expression.

14. An electronic device, comprising: The electronic device comprises: A memory is configured to store executable instructions; A processor is configured to run the executable instructions stored in the memory, and implement the training method of the attack information prediction model according to any one of claims 1 to 10, or implement the attack information prediction method according to claim 11.

15. A computer-readable storage medium storing executable instructions, the method comprising: The executable instructions are executed by the processor to implement the training method of the attack information prediction model according to any one of claims 1 to 10, or implement the attack information prediction method according to claim 11.

Images