A method, device and apparatus for detecting text data based on machine learning

Abstract

The present invention discloses a text data detection method, device and equipment based on machine learning. A text data detection method based on machine learning includes: extracting features from text data used for training; training a detection algorithm model based on the feature extraction result; training an interpretation algorithm model based on the feature extraction result and the detection algorithm model; detecting the text data to be detected based on the trained detection algorithm model to obtain a detection result; interpreting the text data to be detected based on the trained interpretation algorithm model to obtain an interpretation result; summarizing and outputting the detection result and the interpretation result. The technical solution of this embodiment solves the problem that the detection content of text data is easily bypassed by attackers, and it is difficult to automatically expand the detection range, and a large number of rules need to be maintained, so as to achieve the effect of accurately detecting text data and interpreting the detection results.

Description

Technical Field

[0001] The embodiments of the present invention relate to network security detection technology, and in particular to a text data detection method, device and equipment based on machine learning. Background Art

[0002] As the use of the Internet becomes more and more popular, Internet security is becoming more and more important to information security. Structured Query Language Injection (SQL injection) is a common website attack method. Attackers insert malicious SQL queries or add statements into the input parameters of the application, and then parse and execute the attack on the background SQL server to achieve attack purposes including text data theft. In the prior art, the corresponding rule content is usually configured based on the rule strategy to detect specific SQL injection content in a targeted manner.

[0003] However, the existing technology has the following technical defects: since the rule policy is set manually, it is easy to be bypassed by attackers, and it is difficult to automatically expand the detection range, and a large number of rules need to be maintained. Summary of the invention

[0004] The present invention provides a text data detection method, device and equipment based on machine learning, so as to achieve the effect of accurately detecting text data and explaining the detection results.

[0005] In a first aspect, an embodiment of the present invention provides a text data detection method based on machine learning, comprising:

[0006] Perform feature extraction on text data used for training;

[0007] Train the detection algorithm model based on the feature extraction results;

[0008] Train the interpretation algorithm model based on the feature extraction results and the detection algorithm model;

[0009] Based on the trained detection algorithm model, the text data to be detected is detected to obtain the detection result;

[0010] The text data to be detected is interpreted based on the interpretation algorithm model obtained through training to obtain the interpretation result;

[0011] The detection results and interpretation results are summarized and outputted.

[0012] In a second aspect, an embodiment of the present invention further provides a text data detection device based on machine learning, comprising:

[0013] A feature extraction module, used for extracting features from text data used for training;

[0014] Detection model training module, used to train the detection algorithm model based on feature extraction results;

[0015] An explanation model training module is used to train an explanation algorithm model based on feature extraction results and a detection algorithm model;

[0016] A detection module is used to detect the text data to be detected based on the trained detection algorithm model to obtain the detection result;

[0017] An explanation module is used to explain the text data to be detected based on the trained explanation algorithm model to obtain an explanation result;

[0018] The summary output module is used to summarize and output the detection results and interpretation results.

[0019] In a third aspect, an embodiment of the present invention further provides a device, the device comprising:

[0020] one or more processors;

[0021] a memory for storing one or more programs,

[0022] When the one or more programs are executed by the one or more processors, the one or more processors implement a text data detection method based on machine learning as described in any one of the embodiments.

[0023] In a fourth aspect, an embodiment of the present invention further provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute a text data detection method based on machine learning as described in any one of the embodiments.

[0024] The technical solution of this embodiment is to extract features from text data used for training, train a detection algorithm model based on the feature extraction result, train an interpretation algorithm model based on the feature extraction result and the detection algorithm model, detect the text data to be detected based on the trained detection algorithm model to obtain a detection result, interpret the text data to be detected based on the trained interpretation algorithm model to obtain an interpretation result, and summarize and output the detection result and the interpretation result, thereby solving the problem that the detection content of text data can be easily bypassed by attackers, it is difficult to automatically expand the detection range, and a large number of rules need to be maintained, thereby achieving the effect of accurately detecting text data and explaining the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of a text data detection method based on machine learning provided in Example 1 of the present invention;

[0026] Figure 2 Visualization of detection results and interpretation of results;

[0027] Figure 3 A structural diagram of a text data detection device based on machine learning provided in Embodiment 2 of the present invention;

[0028] Figure 4 A schematic diagram of the structure of a device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0030] Embodiment 1

[0031] Website attackers illegally obtain data in the entire server by embedding SQL injection statements in ordinary HTTP requests, such as nesting SQL injection statements in normal statements. Therefore, the present invention aims to identify illegal SQL injection statements in HTTP requests.

[0032] Figure 1 The flowchart of a text data detection method based on machine learning provided in the first embodiment of the present invention is applicable to the case where text data is detected. The method can be performed by a text data detection device based on machine learning, and specifically includes the following steps:

[0033] S110: Extract features from text data used for training.

[0034] Wherein, the text data includes SQL injection statements.

[0035] The amount of text data contained in HTTP requests is very large, and not every word contributes to the recognition of SQL injection statements. In addition, the original text data are in different forms, which is not convenient for subsequent training of algorithm models. Therefore, it is necessary to unify different text data into the same form that is easy to count, so that the text data can be processed uniformly in the future.

[0036] Optionally, the extracting features from the text data used for training includes: extracting features from the text data used for training by using a TF-IDF feature extraction method.

[0037] The TF-IDF feature extraction method is used to evaluate the importance of a word to a document in a corpus. Among them, the term frequency (TF) indicates that the importance of a word increases proportionally with the number of times it appears in the document to be evaluated, and the inverse document frequency (IDF) indicates that the word decreases inversely with the frequency of its appearance in the corpus.

[0038] The TF-IDF calculation formula is shown in formula (1):

[0039]

[0040] Among them, d j Indicates a specific document, n i,j is a word i In file d j The number of times it appears in k n k，j The file d j The sum of the number of occurrences of all words in the corpus; |D| represents the total number of documents in the corpus, |{j:t i ∈d j}| means containing the word t i The number of files (i.e. n i,j ≠0 number of files).

[0041] Optionally, use the TFIDF related function method in the open source computing framework sklearn, and define the parameters as follows: min_df = 1, indicating that words with a number of occurrences less than or equal to 1 are not included in the feature vocabulary, max_df = 0.95, indicating that the maximum probability of a feature word appearing in the corpus is not greater than 0.95. If the probability of a word appearing is greater than 0.95, the word will not be included in the feature vocabulary, Max_features = 10000, indicating that the upper limit of the number of words for TF-IDF processing of a text is 10,000 words, that is, the part of the data in a text with more than 10,000 words will not be processed.

[0042] For example, in this embodiment, assuming that there are 1000 texts that can be feature extracted, these 1000 texts constitute a corpus for which the TF-IDF feature extraction method is applied. The words in each of the 1000 texts are processed using the TF-IDF feature extraction method, and words with a number of occurrences less than or equal to 1 and words with a representative document ratio>0.95 are filtered out, where the representative document ratio indicates the proportion of a word appearing in the text of the corpus. For example, in the above 1000 texts, "the" appears in 990 texts, then the representative document ratio of the article "the" = 0.99, that is, the word "the" appears in 99% of the script files. If the representative document ratio is too large, it is considered that the word appears in almost every text, and the frequency of occurrence in the texts with and without SQL injection is very high, so it is not characteristic for indicating SQL injection. Therefore, after performing the above operation, representative feature words are obtained to form a feature word library.

[0043] By using the TF-IDF feature extraction method to process the feature words in the texts in the corpus, each text can be abstracted into a vector. If there are 500 words in the feature word library, each text can generate a vector with 500 components. If a feature word does not appear in a text, the component representing the feature word in the vector of the text is equal to 0.

[0044] S120. Training a detection algorithm model based on the feature extraction results.

[0045] The method of training the detection algorithm model based on the feature extraction result includes: training a lightweight boosting learning algorithm (Light Gradient Boosting Machine, LightGBM) based on the feature extraction result to obtain the detection algorithm model.

[0046] LightGBM supports efficient parallel training, and has the advantages of faster training speed, lower memory consumption, better accuracy, support for distributed and rapid processing of massive data. And as a tree-based ensemble learning method, it has good interpretability and detection accuracy. After obtaining the data features, modeling training or detection is performed according to the task requirements. After the modeling training is completed, the offline model is automatically updated and saved. The LightGBM algorithm model belongs to the ensemble learning algorithm of the GBDT gradient boosting tree. Similar to it is the Xgboost algorithm model. The difference between LightGBM and Xgboost is that the former introduces the histogram algorithm, the gradient-based one-side sampling algorithm (GOSS) and the exclusive feature bundling algorithm (EFB) in the operation to improve the operation efficiency.

[0047] For example, if there are 1,000 texts and the feature extraction result of each text is a vector with 500 components, the LightGBM algorithm can be trained based on the obtained 1,000×500 feature matrix to obtain a detection algorithm model.

[0048] S130, training an interpretation algorithm model based on the feature extraction results and the detection algorithm model.

[0049] The training of the interpretation algorithm model based on the feature extraction results and the detection algorithm model includes: training the interpretation algorithm model based on the feature extraction results and the detection algorithm model in vector form.

[0050] Optionally, the training of the explanation algorithm model based on the feature extraction results and the detection algorithm model includes: training the SHAP interpretable algorithm (SHapley Additive exPlanations) based on the feature extraction results and the LightGBM detection algorithm model to obtain the explanation algorithm model.

[0051] The SHAP interpretable algorithm is a type of post-explanatory method that can explain non-explanatory models or black-box models to obtain the contribution of each feature to the prediction result. SHAP is derived and set based on non-explanatory models or black-box models, so it cannot exist independently.

[0052] SHAP is an interpretable algorithm based on Shapley value, which explains the prediction of instance x by calculating the contribution of each feature to the prediction x. When performing local interpretation, the core of SHAP is to calculate the Shapley value of each feature variable. The calculation of Shapley value needs to meet symmetry, validity, redundancy and additivity. The Shapley value obtained by meeting the above conditions is:

[0053]

[0054] Among them, S i is the set of all subsets of I that contain member i, |s| is the number of elements in set s, w(|s|) is the weighting factor, and

[0055]

[0056] The Shapley value formula can be explained as follows: v(s)-v(s\{i}) is the contribution made by member i in the collaboration s in which he participates. There are a total of (|s|-1)! (n-|s|)! ways for such collaboration to occur, so the probability of each occurrence is w(|s|). In addition to the Shapley value, the construction of the SHAP interpretable algorithm also needs to meet local fidelity, missingness, and continuity.

[0057] In conjunction with the embodiments of the present invention, the LightGBM in the present invention is a non-interpretive model, and the SHAP interpretable algorithm can be used to explain the detection results of the model after LightGBM modeling. The explanation content includes feature words and corresponding weight values. The greater the absolute value of the weight value, the greater the impact on the result. Among them, a positive value indicates a positive impact, that is, there is an SQL injection statement in the text; a negative value indicates a negative impact, that is, there is no SQL injection statement in the text. For example, {"explain": "extractvalue: weight is 4.878; select: weight is-1.643; and: weight is-0.571;"} is the explanation result, which means that the three words "extractvalue", "select" and "and" are explained, wherein the contribution value of "extractvalue" to the presence of SQL injection statements in the text is 4.878, the contribution value of "select" to the absence of SQL injection statements in the text is 1.643, and the contribution value of "and" to the absence of SQL injection statements in the text is 0.571.

[0058] Continuing with the previous example, when there are 1,000 texts and the feature extraction result of each text is a vector with 500 components, the SHAP interpretable algorithm can be trained based on the obtained 1000×500 feature matrix in vector form and the LightGBM detection algorithm model to obtain an explanation algorithm model.

[0059] Optionally, in the present invention, Python's alibi library is called to train the SHAP interpretable algorithm, and the specific settings are as follows: Since the detection algorithm model is LightGBM, Tree Kernel is selected for interpreter training, the input feature is Max-features of TF-IDF, and the task is a classification task.

[0060] S140 , detecting the text data to be detected based on the trained detection algorithm model to obtain a detection result.

[0061] The detection algorithm model trained based on LightGBM is put into use to detect the text data to be detected and obtain the detection result of whether the text data to be detected has SQL injection.

[0062] S150, interpreting the text data to be detected based on the interpretation algorithm model obtained through training to obtain an interpretation result.

[0063] The interpretation algorithm model obtained based on SHAP training is put into use to interpret the text data to be detected, and the characteristic words in the text data to be detected and their corresponding weight values ​​are obtained as the interpretation results.

[0064] S160: Summarize and output the detection results and interpretation results.

[0065] The technical solution of this embodiment is to extract features from text data used for training, train a detection algorithm model based on the feature extraction result, train an interpretation algorithm model based on the feature extraction result and the detection algorithm model, detect the text data to be detected based on the trained detection algorithm model to obtain a detection result, interpret the text data to be detected based on the trained interpretation algorithm model to obtain an interpretation result, and summarize and output the detection result and the interpretation result, thereby solving the problem that the detection content of text data can be easily bypassed by attackers, it is difficult to automatically expand the detection range, and a large number of rules need to be maintained, thereby achieving the effect of accurately detecting text data and explaining the detection results.

[0066] Optionally, the test results and the interpretation results are summarized and outputted, including: summarizing and outputting the test results and the interpretation results in the form of a table; and / or summarizing and outputting the test results and the interpretation results in the form of a visual graph. The advantage of such a setting is that the test results and the interpretation results can be outputted more clearly and intuitively.

[0067] As shown in Table 1, the detection results and interpretation results can be summarized and output in the form of a table. For the convenience of display, the selected test text is shorter, where "SQL injection statement" indicates the detection result obtained by the detection algorithm model obtained by LightGBM on the text data to be tested, "√" indicates that there is an SQL injection statement in the text data, and "×" indicates that there is no SQL injection statement in the text data. "SHAP interpretation words and corresponding weights" indicate the interpretation results obtained by the interpretation algorithm model obtained by SHAP on the text to be tested. It should be noted that the setting here is to only display the three words with the largest contribution. Although the words with smaller contributions are not displayed, they are also explained by the SHAP interpretable algorithm.

[0068] Table 1

[0069]

[0070] Figure 2 It is a visualization diagram of the detection results and interpretation results. Figure 2 As shown, the detection results and interpretation results can be summarized and output in the form of a visual graph, each word and its corresponding weight are represented by the length of the bar graph, and the positive or negative coordinate value of the intersection of the bar graphs in opposite directions indicates whether there is an SQL injection statement in the text data.

[0071] Embodiment 2

[0072] Figure 3 This is a structural diagram of a text data detection device based on machine learning provided in Embodiment 2 of the present invention. The device can execute a text data detection method based on machine learning provided in the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0073] A text data detection device based on machine learning, comprising:

[0074] A feature extraction module 310 is used to extract features from text data used for training;

[0075] A detection model training module 320 is used to train a detection algorithm model based on feature extraction results;

[0076] An explanation model training module 330, used for training an explanation algorithm model based on feature extraction results and a detection algorithm model;

[0077] A detection module 340 is used to detect the text data to be detected based on the trained detection algorithm model to obtain a detection result;

[0078] An interpretation module 350 is used to interpret the text data to be detected based on the interpretation algorithm model obtained through training to obtain an interpretation result;

[0079] The summary output module 360 ​​is used to summarize and output the detection results and interpretation results.

[0080] Optionally, the text data includes: SQL structured query language injection statements.

[0081] Optionally, the feature extraction module 310 includes:

[0082] The TF-IDF feature extraction unit is used to extract features from text data used for training by using a TF-IDF feature extraction method.

[0083] Optionally, the detection model training module 320 includes:

[0084] The LightGBM detection training unit is used to train the LightGBM lightweight boosting learning algorithm based on the feature extraction results to obtain the detection algorithm model.

[0085] Optionally, the explanation model training module 330 includes:

[0086] The vector text training unit is used to train the interpretation algorithm model based on the feature extraction results and detection algorithm model in vector form.

[0087] Optionally, the explanation model training module 330 includes:

[0088] The SHAP explanation training unit is used to train the SHAP explainable algorithm based on the feature extraction results and the detection algorithm model to obtain the explanation algorithm model.

[0089] Optionally, the summary output module 360 ​​includes:

[0090] A table output unit, used to summarize and output the test results and interpretation results in the form of a table; and / or

[0091] The visualization graph output unit is used to summarize and output the detection results and interpretation results in the form of a visualization graph.

[0092] The technical solution of this embodiment is to extract features from text data used for training, train a detection algorithm model based on the feature extraction result, train an interpretation algorithm model based on the feature extraction result and the detection algorithm model, detect the text data to be detected based on the trained detection algorithm model to obtain a detection result, interpret the text data to be detected based on the trained interpretation algorithm model to obtain an interpretation result, and summarize and output the detection result and the interpretation result, thereby solving the problem that the detection content of text data can be easily bypassed by attackers, it is difficult to automatically expand the detection range, and a large number of rules need to be maintained, thereby achieving the effect of accurately detecting text data and explaining the detection results.

[0093] Embodiment 3

[0094] Figure 4 A schematic diagram of a device structure provided in Embodiment 3 of the present invention is shown in FIG. Figure 4 As shown, the device includes a processor 410, a memory 420, an input device 430, and an output device 440; the number of processors 410 in the device can be one or more. Figure 4 A processor 410 is taken as an example; the processor 410, memory 420, input device 430 and output device 440 in the device can be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0095] The memory 420, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to a text data detection method based on machine learning in an embodiment of the present invention (for example, a feature extraction module 310, a detection model training module 320, an explanation model training module 330, a detection module 340, an explanation module 350 and a summary output module 360 ​​in a text data detection device based on machine learning). The processor 410 executes various functional applications and text data processing of the device by running the software programs, instructions and modules stored in the memory 420, that is, realizing the above-mentioned text data detection method based on machine learning.

[0096] The memory 420 may mainly include a program storage area and a text data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the text data storage area may store text data created according to the use of the terminal, etc. In addition, the memory 420 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 420 may further include a memory remotely arranged relative to the processor 410, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0097] The input device 430 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 440 may include a display device such as a display screen.

[0098] Embodiment 4

[0099] Embodiment 4 of the present invention further provides a storage medium containing computer executable instructions, wherein the computer executable instructions are used to execute a text data detection method based on machine learning when executed by a computer processor, the method comprising:

[0100] Perform feature extraction on text data used for training;

[0101] Train the detection algorithm model based on the feature extraction results;

[0102] Train the interpretation algorithm model based on the feature extraction results and the detection algorithm model;

[0103] Based on the trained detection algorithm model, the text data to be detected is detected to obtain the detection result;

[0104] The text data to be detected is interpreted based on the interpretation algorithm model obtained through training to obtain the interpretation result;

[0105] The detection results and interpretation results are summarized and outputted.

[0106] Of course, the storage medium containing computer executable instructions provided in an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in a text data detection method based on machine learning provided in any embodiment of the present invention.

[0107] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0108] It is worth noting that in the embodiment of the above-mentioned search device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0109] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A text data detection method based on machine learning, characterized in that: include: Perform feature extraction on text data used for training; Train the detection algorithm model based on the feature extraction results; Train the interpretation algorithm model based on the feature extraction results and the detection algorithm model; Based on the trained detection algorithm model, the text data to be detected is detected to obtain the detection result; The text data to be detected is interpreted based on the interpretation algorithm model obtained through training to obtain the interpretation result; Summarizing and outputting the detection results and interpretation results; Among them, the method of summarizing and outputting includes: summarizing and outputting the detection results and the interpretation results in the form of a visualization graph, and the visualization graph is expressed as follows: each text and the corresponding weight in the text data to be detected are represented by the length of a bar graph, and the positive and negative coordinate values ​​of the intersection of the bar graphs in opposite directions indicate whether there is an SQL injection statement in the text data to be detected.

2. The text data detection method based on machine learning according to claim 1, characterized in that: The text data includes: SQL Structured Query Language injection statement.

3. The text data detection method based on machine learning according to claim 1, characterized in that: The feature extraction of the text data used for training includes: The TF-IDF feature extraction method is used to extract features from the text data used for training.

4. The text data detection method based on machine learning according to claim 1 is characterized in that: The detection algorithm model is trained based on the feature extraction result, including: Based on the feature extraction results, the LightGBM lightweight boosting learning algorithm is trained to obtain the detection algorithm model.

5. The text data detection method based on machine learning according to claim 1 is characterized in that: The method of training the interpretation algorithm model based on the feature extraction result and the detection algorithm model includes: Based on the feature extraction results in vector form and the detection algorithm model, the interpretation algorithm model is trained.

6. The text data detection method based on machine learning according to claim 1 is characterized in that: The method of training the interpretation algorithm model based on the feature extraction result and the detection algorithm model includes: Based on the feature extraction results and the detection algorithm model, the SHAP interpretable algorithm is trained to obtain the interpretation algorithm model.

7. The text data detection method based on machine learning according to claim 1 is characterized in that: The detection results and interpretation results are summarized and outputted, including: The detection results and interpretation results are summarized and output in a table form.

8. A text data detection device based on machine learning, characterized in that: include: A feature extraction module, used for extracting features from text data used for training; Detection model training module, used to train the detection algorithm model based on feature extraction results; An explanation model training module is used to train an explanation algorithm model based on feature extraction results and a detection algorithm model; A detection module is used to detect the text data to be detected based on the trained detection algorithm model to obtain the detection result; An explanation module is used to explain the text data to be detected based on the trained explanation algorithm model to obtain an explanation result; A summary output module, used for summarizing and outputting the detection results and interpretation results; Among them, the method of summarizing and outputting includes: summarizing and outputting the detection results and the interpretation results in the form of a visualization graph, and the visualization graph is expressed as follows: each text and the corresponding weight in the text data to be detected are represented by the length of a bar graph, and the positive and negative coordinate values ​​of the intersection of the bar graphs in opposite directions indicate whether there is an SQL injection statement in the text data to be detected.

9. A device, characterized in that: The device comprises: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement a text data detection method based on machine learning as described in any one of claims 1-7.

10. A storage medium comprising computer executable instructions, wherein the computer executable instructions, when executed by a computer processor, are used to perform a text data detection method based on machine learning as described in any one of claims 1 to 7.

Images