Video conferencing security protection methods, equipment and computer-readable storage media

Abstract

The application provides a video conference security protection method and device and a computer readable storage medium. The video conference security protection method comprises the following steps: obtaining video conference equipment communication information; processing the video conference equipment communication information by using a recurrent neural network model to obtain equipment security state information corresponding to the video conference equipment communication information; and performing a security protection operation when the equipment security state information triggers a security alarm. According to the scheme provided in the embodiment of the application, the video conference equipment communication information is obtained, and the corresponding equipment security state information is obtained by processing the video conference equipment communication information by using a recurrent neural network model. If the equipment security state information triggers a security alarm, it indicates that the video conference equipment is currently attacked or invaded. At this time, a security protection operation can be performed to prevent the information transmitted in the video conference from being leaked or modified, thereby improving the security of the video conference equipment.

Description

Technical Field

[0001] The embodiments of the present invention relate to, but are not limited to, the field of communication technology, and in particular to a video conferencing security protection method, device, and computer-readable storage medium. Background Technology

[0002] Video conferencing technology is widely used by various enterprises, organizations, and teams to hold online meetings, representing a major application of modern communication technology in multi-point interconnected scenarios. With the continuous development of IoT technology, video conferencing is no longer limited to online meetings; it can also be used in many other fields such as intelligent online education, video surveillance networks, and terminal playback platforms. Currently, an increasing number of terminal devices are interconnected through video communication technology, transmitting audio and video data to each other, bringing great convenience to users. However, it is worth noting that this also introduces additional information security risks and privacy breaches.

[0003] Participants in a video conference join the meeting through video conferencing devices, which are interconnected to form a video conference venue. Participants are located in different spatial locations and communicate with each other through these devices. Because these devices have different access methods and system states, if one device is attacked or compromised, the information transmitted throughout the meeting may be leaked or modified. Therefore, strengthening the security of video conferencing devices is of paramount importance. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This invention provides a video conferencing security protection method, device, and computer-readable storage medium, which can improve the security of video conferencing equipment.

[0006] In a first aspect, embodiments of the present invention provide a video conferencing security protection method, comprising:

[0007] Obtain communication information from video conferencing equipment;

[0008] The communication information of the video conferencing device is processed using a pre-trained recurrent neural network model to obtain device security status information corresponding to the communication information of the video conferencing device;

[0009] When the device's security status information triggers a security alarm, security protection operations are performed.

[0010] Secondly, embodiments of the present invention also provide an apparatus, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the video conferencing security protection method described in the first aspect above.

[0011] Thirdly, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions, which are used to execute the video conferencing security protection method described above.

[0012] This invention includes: acquiring communication information of a video conferencing device; processing the communication information using a pre-trained recurrent neural network model to obtain device security status information corresponding to the communication information; and executing security protection operations when the device security status information triggers a security alarm. According to the solution provided by this invention, a video conferencing device acquires communication information and processes it using a pre-trained recurrent neural network model to obtain device security status information corresponding to the communication information. If the device security status information triggers a security alarm, it indicates that the video conferencing device is currently under attack or intrusion. At this time, the video conferencing device can execute security protection operations to prevent the information transmitted during the video conference from being leaked or modified, thereby improving the security of the video conferencing device.

[0013] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0014] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0015] Figure 1 This is a schematic diagram of a system architecture for performing a video conferencing security protection method according to an embodiment of the present invention;

[0016] Figure 2 This is a flowchart of a video conferencing security protection method provided in one embodiment of the present invention;

[0017] Figure 3 This is a flowchart of a video conferencing security protection method provided in another embodiment of the present invention;

[0018] Figure 4This is a schematic diagram of video conferencing communication information received by a video conferencing device according to an embodiment of the present invention;

[0019] Figure 5 This is a schematic diagram of a recurrent neural network model including GRU units provided in an embodiment of the present invention;

[0020] Figure 6 This is a schematic diagram of the structure of a GRU unit provided in one embodiment of the present invention;

[0021] Figure 7 This is a schematic diagram of a many-to-one input-output system formed by a recurrent neural network model according to an embodiment of the present invention;

[0022] Figure 8 This is a flowchart of a video conferencing security protection method provided in another embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0024] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0025] This invention provides a video conferencing security protection method, device, and computer-readable storage medium. The video conferencing device acquires communication information and processes it using a pre-trained recurrent neural network model to obtain device security status information corresponding to the communication information. If the device security status information triggers a security alarm, it indicates that the video conferencing device is currently under attack or intrusion. At this time, the video conferencing device can perform security protection operations to prevent the information transmitted in the video conference from being leaked or modified, thereby improving the security of the video conferencing device.

[0026] The embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0027] like Figure 1 As shown, Figure 1 This is a schematic diagram of a system architecture for implementing a video conferencing security protection method according to an embodiment of the present invention. Figure 1 In the example, the system architecture includes a first video conferencing device 110, a second video conferencing device 120, and a server 130, wherein the first video conferencing device 110 and the second video conferencing device 120 are communicatively connected, and the first video conferencing device 110 and the second video conferencing device 120 are communicatively connected to the server 130 respectively.

[0028] Both the first video conferencing device 110 and the second video conferencing device 120 include a system audit module 111, a model loading module 112, a traffic sequence identification module 113, a security status alarm module 114, and a security protection module 115. The model loading module 112, traffic sequence identification module 113, security status alarm module 114, and security protection module 115 are connected sequentially, and the system audit module 111 and security status alarm module 114 are connected. Furthermore, the security status alarm module 114 of the first video conferencing device 110 is communicatively connected to the security protection module 115 of the second video conferencing device 120, and the security protection module 115 of the first video conferencing device 110 is also communicatively connected to the security status alarm module 114 of the second video conferencing device 120.

[0029] Server 130 includes a model learning module 131, which is communicatively connected to the model loading module 112 in each video conferencing device.

[0030] The model learning module 131 utilizes a gated recurrent neural network to construct a classification and prediction model for obtaining equipment security status information. The gated recurrent neural network includes, but is not limited to, Long Short-Term Memory (LSTM) neural networks or Gated Recurrent Unit (GRU) neural networks. This classification and prediction model iteratively learns the weight parameters, bias values, and hyperparameters by optimizing the target loss, and controls the attack categories according to a set protection granularity. The attack categories may include, but are not limited to, Denial of Service (DoS) attacks, man-in-the-middle attacks, and honeypot attacks. The training data used to train the classification and prediction model can be obtained by capturing data generated from simulated actual attack models, or by using attack data obtained in actual engineering implementations; this embodiment does not specifically limit this.

[0031] The system audit module 111 employs system auditing technology to audit the system status of video conferencing equipment, used to determine whether unauthorized local access exists. This system auditing technology includes, but is not limited to, rule set matching and virus database matching.

[0032] The model loading module 112 is used to download the pre-trained classification prediction model from the model learning module 131 of the server 130. In addition, the model loading module 112 can also actively request the server 130 to update the classification prediction model.

[0033] The traffic sequence identification module 113 can acquire the communication information received by the video conferencing device through packet capture technology, and can filter and trim the communication information to form a video conferencing traffic sequence. Furthermore, the traffic sequence identification module 113 can sample the video conferencing traffic sequence and input the sampled data into a classification prediction model, thereby obtaining the corresponding device security status information through the classification prediction model. Here, the video conferencing traffic sequence refers to a data sequence with a certain time interval formed by data information related to the video conferencing arriving at the video conferencing device in a certain order. The sampling methods for the video conferencing traffic sequence can include, but are not limited to, sliding window sampling. The packet capture technologies mentioned above include, but are not limited to, Lippcap technology (a network packet capture function package for Unix or Linux platforms, which can work on most Unix-like platforms) and the Data Plane Development Kit (DPDK) technology.

[0034] The security status alarm module 114 is used to obtain device security status information from the traffic sequence identification module 113 and the system audit module 111. If the device security status information triggers a security alarm, the security status alarm module 114 can notify other video conferencing devices participating in the video conference of the security status or security alarm of the local video conferencing device through a preset security status channel, and trigger the security protection module 115 of the local video conferencing device to respond and perform security protection operations. The security status channel is a transmission channel for video conferencing devices to send device security status information to each other, and can be implemented using methods such as INFO, MESSAGE, or NOTIFY based on the Session Initiation Protocol (SIP).

[0035] The security protection module 115 is used to perform security protection operations on the local video conferencing device in response to the trigger signal of the security status alarm module 114. In addition, the security protection module 115 can also receive device security status information shared by other video conferencing devices and perform security protection responses on other video conferencing devices based on the device security status information shared by other video conferencing devices.

[0036] The system architecture and application scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of system architecture and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0037] It will be understood by those skilled in the art that Figure 1 The system architecture shown does not constitute a limitation on the embodiments of the present invention. It may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0038] exist Figure 1 In the system architecture shown, the system audit module 111, model loading module 112, traffic sequence identification module 113, security status alarm module 114, and security protection module 115 in the first video conferencing device 110 and the second video conferencing device 120 can all cooperate to execute the video conferencing security protection method.

[0039] In addition, in one embodiment, the server 130 may also be equipped with a system audit module 111, a model loading module 112, a traffic sequence identification module 113, a security status alarm module 114, and a security protection module 115. Therefore, the system audit module 111, model loading module 112, traffic sequence identification module 113, security status alarm module 114, and security protection module 115 in the server 130 can cooperate with each other to execute the video conferencing security protection method, thereby playing a role in protecting the security of the server 130.

[0040] Based on the above system architecture, various embodiments of the video conferencing security protection method of the present invention are proposed.

[0041] like Figure 2 As shown, Figure 2 This is a flowchart of a video conferencing security protection method provided in an embodiment of the present invention. The video conferencing security protection method includes, but is not limited to, steps S100, S200 and S300.

[0042] Step S100: Obtain communication information from the video conferencing equipment.

[0043] In one embodiment, when the video conferencing device is in the video conferencing access call phase or the video conferencing already connected phase, the video conferencing device will interact with the network side. Therefore, the video conferencing device will receive video conferencing device communication information from the network side, which includes all data information above the physical layer received by the video conferencing device. When the video conferencing device is attacked or intruded upon, the attack or intrusion is often initiated by the network side, and attack data or intrusion data is mixed with normal video conferencing device communication information. If the video conferencing device parses and processes video conferencing device communication information mixed with attack data or intrusion data, it will lead to malicious intrusion of the video conferencing device, resulting in leakage or modification of information transmitted during the video conference. Therefore, by obtaining the video conferencing device communication information, subsequent steps can determine whether the video conferencing device has been attacked or intruded upon based on the communication information, so that corresponding security protection operations can be performed when an attack or intrusion is confirmed, thereby improving the security of the video conferencing device.

[0044] In one embodiment, data packet capture technology can be used to obtain communication information of video conferencing devices. For example, Lippcap technology or DPDK technology can be used to obtain communication information of video conferencing devices. This embodiment does not make specific limitations on this.

[0045] Step S200: The pre-trained recurrent neural network model is used to process the communication information of the video conferencing equipment to obtain the equipment security status information corresponding to the communication information of the video conferencing equipment.

[0046] In one embodiment, a pre-trained recurrent neural network model can be used to simulate the mapping relationship between video conferencing device communication information and device security status information. Therefore, when video conferencing device communication information is obtained, the pre-trained recurrent neural network model can be used to process the video conferencing device communication information to obtain device security status information corresponding to the video conferencing device communication information. This information can then be used to determine the device security status in subsequent steps, so that corresponding security protection operations can be performed when it is determined that an attack or intrusion has occurred, thereby improving the security of the video conferencing device.

[0047] In one embodiment, the recurrent neural network model can be implemented in different ways, such as an LSTM neural network model or a GRU neural network model. This embodiment does not specifically limit the implementation of the model.

[0048] Step S300: When the device safety status information triggers a safety alarm, perform a safety protection operation.

[0049] In one embodiment, when the device security status information triggers a security alarm, it indicates that the video conferencing device is currently under attack or intrusion. Therefore, in order to prevent the information transmitted in the video conference from being leaked or modified, security protection operations need to be performed to ensure the security of the video conferencing device.

[0050] In one embodiment, by employing a video conferencing security protection method including the aforementioned steps S100, S200, and S300, the video conferencing device can obtain communication information and process it using a pre-trained recurrent neural network model to obtain device security status information corresponding to the communication information. If the device security status information triggers a security alarm, it indicates that the video conferencing device is currently under attack or intrusion. At this time, the video conferencing device can perform security protection operations to prevent the information transmitted in the video conference from being leaked or modified. This overcomes the defect of ignoring the device security status of the video conferencing device in existing video conferencing security protection technologies, thereby improving the security of the video conferencing device.

[0051] It is worth noting that the server in the video conferencing can also execute the above steps S100, S200 and S300 to achieve security protection for the server, thereby improving the security of the video conferencing equipment.

[0052] Additionally, in one embodiment, reference is made to Figure 3 Step S200 may include, but is not limited to, the following steps:

[0053] Step S210: Convert the communication information of the video conferencing equipment into a video conferencing traffic sequence;

[0054] Step S220: Sample the video conferencing traffic sequence to obtain a video conferencing traffic subsequence;

[0055] Step S230: The video conferencing traffic subsequence is processed using a pre-trained recurrent neural network model to obtain the device security status information corresponding to the video conferencing traffic subsequence.

[0056] In one embodiment, the video conferencing device communication information received by the video conferencing device is network data from the network, and the largest unit of the video conferencing device communication information is an Ethernet frame. (See reference) Figure 4 , Figure 4 This is a diagram illustrating the communication information received by the video conferencing equipment. Figure 4Each data frame in the sequence represents an Ethernet frame received by the video conferencing device. The communication information can originate from different video conferencing devices, differing in time and space, and also in frame size. These Ethernet frames arrive at the video conferencing device in a specific order, forming a data sequence. Based on these characteristics of the video conferencing device communication information, it can be converted into a video conferencing traffic sequence. Then, using a pre-trained recurrent neural network model that maps video conferencing device communication information to device security status information, the corresponding device security status information can be obtained from the video conferencing traffic sequence. This security status information can then be used in subsequent steps to determine if an attack or intrusion has occurred, enabling the execution of appropriate security protection measures and thus improving the security of the video conferencing device.

[0057] In one embodiment, to facilitate the processing of input data by the recurrent neural network model, the continuous video conference traffic sequence can be sampled first to obtain a corresponding finite video conference traffic subsequence. Then, the video conference traffic subsequence is input into the recurrent neural network model so that the recurrent neural network model can more easily process the data and obtain the device security status information corresponding to the video conference traffic subsequence.

[0058] It is worth noting that the method for sampling the video conference traffic sequence in step S220 can be implemented in a variety of different ways. For example, it can be sampled using a sliding window, sampled using equal time intervals, or sampled using downsampling interpolation. This embodiment does not specifically limit the method.

[0059] In one embodiment, such as Figure 5 As shown, Figure 5 This is an embodiment of a recurrent neural network model that includes GRU units, wherein the specific structure of the GRU unit is as follows: Figure 6 As shown, the recurrent neural network model can ultimately form as follows: Figure 7 The example shown is a many-to-one input / output system.

[0060] In such Figure 6 The GRU unit shown is primarily used to process data sequences. It iteratively calculates portions of the data sequence, with each calculation constituting a time step. Each calculation is the result of the interaction between the current input data and the hidden state of the previous time step. Figure 6 In the diagram, modules marked with 'z' represent update gate structures for GRU units, modules marked with 'r' represent reset gate structures for GRU units, 't' represents the current time step, and 'x' represents the current time step. th is the input data for the current time step t. t-1 The hidden state value at the previous time step, based on x t and h t-1 The update gate state value z at the current time step can be calculated. t and reset the door status value r t Among them, the door state value r is reset. t It can control h t-1 Calculate the cell state c in the current time step. t Whether to express or update the gate state value z t It can control the cell state c calculated at the current time step. t Is it expressed as the hidden state value h at the current time step? t The formulas for calculating each state value are as follows:

[0061] r t =σ(U r *x t +W r *h t-1 +b r )

[0062] z t =σ(U z *x t +W z *h t-1 +b z )

[0063]

[0064] h t =z t *h t-1 +(1-z t )*c t

[0065] Among them, U r U z and U c These are the input weight parameters W of the corresponding nodes in the GRU unit. r W z and W c These are the hidden weight parameters of the corresponding nodes in the GRU unit, b r b z and b c These represent the bias values ​​of the corresponding nodes in the GRU unit, and σ is the sigmoid activation function. The above weight parameters, which are tanh activation functions, can be obtained by fitting data through backpropagation during the training of the recurrent neural network model.

[0066] In such Figure 5 The recurrent neural network model shown employs a two-layer hidden layer structure, where each hidden layer contains multiple neurons (e.g., 128 neurons). Each neuron is composed of... Figure 6 The GRU unit shown is used in the diagram. Furthermore, the input layer of the recurrent neural network model uses a sequence embedding layer, and the output layer uses a classification representation layer. The classification representation layer can use a Softmax unit to represent the prediction results as a multinomial distribution of the input samples across multiple classes. Therefore, combining the class labels of the training data, the recurrent neural network model can identify the security status of video conferencing equipment and its state under specific attacks. These specific attacks could be, for example, denial-of-service attacks or Address Resolution Protocol (ARP) spoofing attacks. Therefore, when the recurrent neural network model processes subsequences of video conferencing traffic to obtain corresponding equipment security status information, this information can be used to determine the security status in subsequent steps. This allows for the execution of corresponding security protection operations when an attack or intrusion is detected, thereby improving the security of the video conferencing equipment.

[0067] Additionally, in one embodiment, reference is made to Figure 8 Step S210 may include, but is not limited to, the following steps:

[0068] Step S211: Filter and trim the communication information of the video conferencing equipment to obtain preprocessed information;

[0069] Step S212: Normalize and perform one-hot encoding on the preprocessed information to obtain the video conferencing traffic sequence.

[0070] In one embodiment, the communication information of the video conferencing device can be processed to obtain a video conferencing traffic sequence, so that the recurrent neural network model can easily process the video conferencing traffic sequence in subsequent steps.

[0071] In one embodiment, after the video conferencing device obtains the video conferencing device communication information, it can filter and trim the video conferencing device communication information to remove redundant fields and fixed fields (such as protocol version information) in the video conferencing device communication information to obtain preprocessed information. Then, the preprocessed information is normalized and one-hot encoded to transform the preprocessed information with complex data structure into feature information with simple and unified data structure. For example, the application layer protocol is transformed into a simple protocol type and subtype, thereby obtaining a video conferencing traffic sequence that can be easily processed by a recurrent neural network model.

[0072] In one embodiment, since the communication information of video conferencing devices is mainly composed of Ethernet frames, during the filtering, trimming, normalization, and one-hot encoding processes, each valid Ethernet frame can be trimmed into a data packet vector. Each data packet vector corresponds to a sequence time step in the video conferencing traffic sequence. This sequence time step is independent of time measurement and only represents the positional relationship of the data packet vector in the video conferencing traffic sequence. After processing the video conferencing device communication information to obtain continuous data packet vectors, these continuous data packet vectors form the video conferencing traffic sequence. Since the video conferencing traffic sequence can express the current security status of the video conferencing device through a certain mapping relationship, a classifier for identifying the security status of the video conferencing device using the video conferencing traffic sequence can be learned by fitting and modeling this mapping relationship using a recurrent neural network model. Therefore, after obtaining the video conferencing traffic sequence, the corresponding device security status information can be obtained by using the recurrent neural network model to process the video conferencing traffic sequence. This information can then be used to determine the device security status in subsequent steps, so that corresponding security protection operations can be performed when an attack or intrusion is detected, thereby improving the security of the video conferencing device.

[0073] In another embodiment, step S220 may include, but is not limited to, the following steps:

[0074] A sliding window method is used to sample the video conferencing traffic sequence to obtain a video conferencing traffic subsequence.

[0075] In one embodiment, a sliding window approach can be used to sample the video conferencing traffic sequence. The length and step size of the sliding window can be appropriately selected based on the actual application. This embodiment does not impose specific limitations on this. For example, the length of the sliding window can be chosen to be 200, and the step size can be set to half the length of the sliding window. Therefore, a video conferencing traffic subsequence with 200 time steps can be formed. Figure 7 As shown, taking a video conferencing traffic subsequence with 6 time steps as an example, the data packet vectors of the video conferencing traffic subsequence are input into the recurrent neural network model in the order of the sequence to obtain the predicted probability of the device security status information corresponding to the video conferencing traffic subsequence.

[0076] In another embodiment, the security protection operation in step S300 may include, but is not limited to, the following steps:

[0077] When a video conference call is in progress, stop the call and report an alarm to the network manager.

[0078] In one embodiment, when the device security status information triggers a security alarm, causing the video conferencing device to perform security protection operations, if the video conferencing device is in the video conferencing access call phase, the access call can be stopped, and local virus scanning and other security protection operations can also be performed to prevent the attacked or intruded video conferencing device from affecting the normal operation of the entire video conference. In addition, when the video conferencing device stops the access call, it can also report alarm information to the network manager, so that the network manager can send alarm notifications to all participating devices in the video conference based on the alarm information reported by the video conferencing device, thereby preventing the information transmitted in the video conference from being leaked or modified, and achieving the purpose of improving the security of the video conferencing device.

[0079] In another embodiment, the security protection operation in step S300 may include, but is not limited to, the following steps:

[0080] When a video conference is already connected, either hang up the video conference or encrypt the transmitted data during the video conference.

[0081] In one embodiment, when the device security status information triggers a security alarm and causes the video conferencing device to perform security protection operations, if the video conferencing device is in the video conferencing access phase, the current video conferencing can be suspended to prevent the attacked or intruded video conferencing device from affecting the normal operation of the entire video conferencing. In addition, the video conferencing device can also encrypt the transmitted data in the video conferencing, thereby preventing the information transmitted in the video conferencing from being leaked or modified, thus achieving the purpose of improving the security of the video conferencing device.

[0082] In another embodiment, the video conferencing security protection method may also include, but is not limited to, the following steps:

[0083] Send alarm information to the peer device in the video conference.

[0084] In one embodiment, when the local video conferencing device determines that it has been attacked or intruded, in addition to performing local security protection operations, the local video conferencing device can also send alarm information to the peer device in the video conference, so that the peer device in the video conference can hang up the current video conference in a timely manner or encrypt the transmitted data in the video conference, thereby preventing the information transmitted in the video conference from being leaked or modified, and achieving the purpose of improving the security of the video conferencing device.

[0085] In one embodiment, a dedicated signaling channel can be established between the video conferencing device that has been attacked or intruded upon and the peer device in the video conference. This channel enables the transmission of security alarm messages between the various video conferencing devices in the video conference, allowing each device to be promptly notified of any attack or intrusion and to execute corresponding security protection measures in a timely manner. This prevents the leakage or modification of information transmitted during the video conference, thereby improving the security of the video conferencing equipment. It is worth noting that the dedicated signaling channel can be implemented using methods such as INFO, MESSAGE, or NOTIFY based on the SIP protocol; this embodiment does not specifically limit its implementation.

[0086] In another embodiment, the video conferencing security protection method may also include, but is not limited to, the following steps:

[0087] When an alarm message is received from the peer device in a video conference, the corresponding peer device is disconnected, or the transmitted data in the video conference is encrypted.

[0088] In one embodiment, when the local video conferencing device receives an alarm message from the peer device in the video conference, indicating that the peer device has been attacked or intruded, the local video conferencing device can disconnect the corresponding peer device to prevent the peer device from affecting the normal operation of the entire video conference in order to prevent the information transmitted in the video conference from being leaked or modified. In addition, the local video conferencing device can also encrypt the transmitted data in the video conference with the peer device in the video conference, thereby preventing the information transmitted in the video conference from being leaked or modified, and achieving the purpose of improving the security of the video conferencing device.

[0089] In another embodiment, the video conferencing security protection method may also include, but is not limited to, the following steps:

[0090] Download the pre-trained recurrent neural network model from the server.

[0091] In one embodiment, the server may store a pre-trained recurrent neural network model. Therefore, when the video conferencing device needs to use the recurrent neural network model to process the communication information of the video conferencing device, the video conferencing device can directly download the pre-trained recurrent neural network model from the server without training the recurrent neural network model locally. This can save the training time of the recurrent neural network model and improve the efficiency of obtaining device security status information using the recurrent neural network model.

[0092] In one embodiment, when training the recurrent neural network model on the server, data generated by simulating actual attack models can be used as training data, or attack data obtained in actual engineering implementation can be used as training data. Then, a dataset is constructed based on this training data. Next, the dataset is randomly shuffled and divided into a training set, a test set, and a validation set according to a certain ratio (e.g., 8:1:1). Then, the training set is input into a... Figure 5 The recurrent neural network (RNN) model shown employs an iterative learning strategy. Backpropagation along time is used to update the weights and biases of the RNN. After each training iteration, the generated RNN model is validated using a validation set. If the validation error does not significantly improve across multiple consecutive training iterations, iteration stops, and the weights and biases from the last iteration showing improvement are used as the model parameters for the trained RNN. At this point, the training of the RNN model is complete. It's worth noting that the trained RNN model can be saved as an HDF5 file using Keras, an open-source artificial neural network library that can be used for the design, debugging, evaluation, application, and visualization of deep learning models.

[0093] In one embodiment, when the video conferencing device downloads a pre-trained recurrent neural network model from the server, the device can obtain the model file of the recurrent neural network model through the RESTful API interface provided by the server, and then load the model file into the actual recurrent neural network model (i.e., a classification and prediction model). In subsequent steps, the device can directly use the recurrent neural network model to obtain the device's security status information, so that when it is determined that the device has been attacked or intruded based on the security status information, the corresponding security protection operation can be executed in a timely manner, thereby improving the security of the video conferencing device.

[0094] In addition, one embodiment of the present invention provides an apparatus comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0095] The processor and memory can be connected via a bus or other means.

[0096] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0097] It should be noted that the device in this embodiment may include, for example, Figure 1 The system architecture shown in the embodiment, the devices in this embodiment, and such Figure 1 The system architectures in the illustrated embodiments belong to the same inventive concept, therefore these embodiments have the same implementation principles and technical effects, which will not be described in detail here.

[0098] The non-transitory software program and instructions required to implement the video conferencing security protection method of the above embodiments are stored in memory. When executed by a processor, the video conferencing security protection method of the above embodiments is executed, for example, the method described above is executed. Figure 2 Method steps S100 to S300 in the text Figure 3 Method steps S210 to S230 in the text Figure 8 Method steps S211 to S212.

[0099] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0100] Furthermore, one embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions that are executed by a processor or controller, for example, by a processor in the aforementioned terminal embodiment, causing the processor to execute the video conferencing security protection method described above, for example, performing the above-described... Figure 2 Method steps S100 to S300 in the text Figure 3 Method steps S210 to S230 in the text Figure 8 Method steps S211 to S212.

[0101] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0102] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for video conference security protection, comprising: obtaining video conference device communication information; processing the video conference device communication information using a pre-trained recurrent neural network model to obtain device security state information corresponding to the video conference device communication information; triggering a security alarm when it is determined that a video conference device has been attacked or invaded according to the device security state information, and performing a security protection operation according to a current stage of the video conference device.

2. The method of claim 1, wherein, The processing of the video conference device communication information using the pre-trained recurrent neural network model to obtain the device security state information corresponding to the video conference device communication information comprises: converting the video conference device communication information into a video conference traffic sequence; sampling the video conference traffic sequence to obtain a video conference traffic sub-sequence; processing the video conference traffic sub-sequence using the pre-trained recurrent neural network model to obtain device security state information corresponding to the video conference traffic sub-sequence.

3. The method of claim 2, wherein, The conversion of the video conference device communication information into the video conference traffic sequence comprises: filtering and cropping the video conference device communication information to obtain pre-processed information; normalizing and one-hot encoding the pre-processed information to obtain the video conference traffic sequence.

4. The method of claim 2, wherein, The sampling of the video conference traffic sequence to obtain the video conference traffic sub-sequence comprises: sampling the video conference traffic sequence using a sliding window to obtain the video conference traffic sub-sequence.

5. The method of claim 1, wherein, The performing of the security protection operation according to the current stage of the video conference device comprises one of: stopping a call and reporting alarm information to a network manager when the video conference device is in a video conference call access stage; hanging up a video conference or encrypting transmission data in the video conference when the video conference device is in a video conference access stage.

6. The method of claim 5, wherein, The performing of the security protection operation further comprises: sending alarm information to a peer device in the video conference.

7. The method of claim 1, wherein, The method further comprises: hanging up the corresponding peer device or encrypting transmission data in the video conference when alarm information from the peer device in the video conference is obtained.

8. The method according to any one of claims 1 to 7, characterized in that, The method further comprises: downloading the pre-trained recurrent neural network model from a server.

9. An apparatus comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the computer program.

10. A computer readable storage medium storing computer executable instructions for executing the method according to any one of claims 1 to 8.

Images