Small sample threat risk warning method and device based on deep learning

Abstract

The embodiment of the present invention provides a small sample threat risk warning method and device based on deep learning, wherein the method includes: collecting Internet threat risk information; obtaining corresponding word sequence data according to the Internet threat risk information; inputting the word sequence data into a fragment semantic extraction model and a semantic matching model respectively, obtaining a first feature vector and a second feature vector respectively, fusing the first feature vector and the second feature vector to obtain deep-level features; inputting the deep-level features into a trained deep neural network model to obtain a warning result of the Internet threat risk information; the trained deep neural network model is trained according to deep-level feature samples and corresponding classification labels. The method uses the extracted deep-level features to perform Internet threat risk information warning, which can make the obtained Internet threat risk information warning result more accurate.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a small sample threat risk early warning method and device based on deep learning. Background Art

[0002] With the rapid development of Internet technology, life has become more and more convenient. At the same time, every company or every organization may become the target of cyber attacks, and network security is also facing higher and higher risks. These risks may be information leakage caused by internal employees intentionally or unintentionally leaking passwords and sensitive information, or they may be intentional attacks or sabotage by Advanced Persistent Threat (APT) organizations using security vulnerabilities. In the face of the growing threats on the Internet, early warning of threat risks has become an important part of corporate and even national network security.

[0003] At present, the main method for early warning of threat risks is to combine strategies or rules to score unknown risks and deal with them accordingly based on the scoring results. However, in actual usage scenarios, the threat risk early warning method combined with strategies or rules has some defects. For example, the scoring and judgment of threat risks based on strategies or rules is easy for malicious organizations to bypass strategies or rules and take advantage of them. The generalization ability is poor, the ability to discover unknown threat risks is relatively weak, and it does not have good versatility. Due to the relatively poor scalability of the combined strategy or rule method, the development or update of a set of threat risk early warning strategies or rules often requires a lot of financial resources or energy, and the threshold requirements for researchers are high. Summary of the invention

[0004] In response to the problems in the prior art, an embodiment of the present invention provides a small sample threat risk warning method and device based on deep learning.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In the first aspect, an embodiment of the present invention provides a small sample threat risk warning method based on deep learning, including: collecting Internet threat risk information; obtaining corresponding word sequence data based on the Internet threat risk information; inputting the word sequence data into a fragment semantic extraction model and a semantic matching model respectively to obtain a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain deep-level features; inputting the deep-level features into a trained deep neural network model to obtain a warning result of the Internet threat risk information; the trained deep neural network model is trained based on deep-level feature samples and corresponding classification labels.

[0007] Furthermore, the fragment semantic extraction model is a modified BERT model, and the step of inputting the word sequence data into the fragment semantic extraction model to obtain a first feature vector includes: inputting the word sequence into the modified BERT model to obtain the first feature vector; the modified BERT model is obtained by training an open source BERT model based on supervised security field data.

[0008] Furthermore, the semantic matching model is a text convolutional neural network model, and the step of inputting the word sequence data into the semantic matching model to obtain a second feature vector includes: inputting the word sequence data into the text convolutional neural network model to obtain the second feature vector.

[0009] Furthermore, the step of inputting the word sequence data into a text convolutional neural network model to obtain a second feature vector includes: training a word2vec model with unsupervised security domain data to obtain a word embedding vector; constructing the text convolutional neural network based on the word embedding vector; and inputting the word sequence data into the text convolutional neural network to obtain the second feature vector.

[0010] Furthermore, the inputting the deep-level features into the deep neural network model to obtain the early warning result of the Internet threat risk information includes: assigning at least one classification label to the output result of the deep neural network model according to the output result of the deep neural network model to obtain a classification result; the classification label includes at least one of a security vulnerability label, a data leakage label, a network black and gray product label, and an advanced persistent threat label; and obtaining the early warning result of the Internet threat risk information according to the classification result.

[0011] Furthermore, based on the classification result, a warning result of the Internet threat risk information is obtained, including: if the classification result does not require rule detection, using the classification result as the warning result; if the classification result requires rule detection, using advanced persistent threat organization data to update the classification result, and using the updated classification result as the warning result.

[0012] Further, the updating of the classification result by using the advanced persistent threat organization data includes: matching the word sequence data corresponding to the classification result with the advanced persistent threat organization data to obtain a matching result; and updating the classification result according to the matching result.

[0013] Furthermore, obtaining corresponding word sequence data according to the Internet threat risk information includes: parsing the Internet threat risk information to obtain text data; cleaning the text data to obtain cleaned text data; and segmenting the cleaned text data to obtain the word sequence data.

[0014] Furthermore, after obtaining the corresponding word sequence data according to the Internet threat risk information, it also includes: upsampling the word sequence data; the upsampling processing includes at least one of randomly replacing synonyms, randomly replacing words, deleting words and inserting words.

[0015] Furthermore, the training of the deep neural network model includes: inputting the deep-level feature samples into the deep neural network model, adjusting the parameters of the deep neural network model according to the corresponding classification labels until the error of the deep neural network model meets the preset conditions, and obtaining the trained deep neural network model.

[0016] In the second aspect, an embodiment of the present invention also provides a small sample threat risk warning device based on deep learning, including: a collection module, used to collect Internet threat risk information; a sequence acquisition module, used to obtain corresponding word sequence data according to the Internet threat risk information; a feature acquisition module, used to input the word sequence data into a fragment semantic extraction model and a semantic matching model respectively, to obtain a first feature vector and a second feature vector respectively, and to fuse the first feature vector and the second feature vector to obtain a deep-level feature; a warning module, used to input the deep-level feature into a trained deep neural network model to obtain a warning result of the Internet threat risk information; the trained deep neural network model is trained according to deep-level feature samples and corresponding classification labels.

[0017] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the small sample threat risk warning method based on deep learning as described in the first aspect are implemented.

[0018] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the small sample threat risk warning method based on deep learning as described in the first aspect.

[0019] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the small sample threat risk warning method based on deep learning described in the first aspect.

[0020] The small sample threat risk warning method and device based on deep learning provided by the embodiment of the present invention collects Internet threat risk information; obtains corresponding word sequence data according to the Internet threat risk information; inputs the word sequence data into the fragment semantic extraction model and the semantic matching model respectively, obtains the first feature vector and the second feature vector respectively, fuses the first feature vector and the second feature vector to obtain deep-level features; inputs the deep-level features into the trained deep neural network model to obtain the warning result of the Internet threat risk information; the trained deep neural network model is trained according to the deep-level feature samples and the corresponding classification labels. By inputting the word sequence data into the fragment semantic extraction model and the semantic matching model respectively, obtains the first feature vector and the second feature vector respectively, fuses the first feature vector and the second feature vector to obtain deep-level features, and inputs the deep-level features into the deep neural network model for warning of Internet threat risk information, the warning result of the Internet threat risk information obtained can be made more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 This is a flow chart of an embodiment of a small sample threat risk early warning method based on deep learning of the present invention;

[0023] Figure 2 A flow chart of an embodiment of a method for obtaining deep-level features of the present invention;

[0024] Figure 3 It is a schematic diagram of the feature fusion process of the present invention;

[0025] Figure 4 This is a flow chart of an embodiment of a method for obtaining early warning results of Internet threat risk information according to the present invention;

[0026] Figure 5 A flow chart for obtaining classification results for the present invention;

[0027] Figure 6 This is a flow chart of another embodiment of a method for obtaining early warning results of Internet threat risk information according to the present invention;

[0028] Figure 7 is a flow chart of the rule detection method of the present invention;

[0029] Figure 8A flow chart of an embodiment of a method for updating Internet threat risk information classification results according to the present invention;

[0030] Fig. 9 A flow chart of an embodiment of a method for obtaining word sequence data according to the present invention;

[0031] Fig.10 It is a schematic diagram of an application scenario of the present invention;

[0032] Fig.11 This is a schematic diagram of the structure of an embodiment of a small sample threat risk early warning device based on deep learning of the present invention;

[0033] Fig.12 It is a schematic diagram of the structure of an electronic device entity embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] Figure 1 This is a flow chart of an embodiment of a small sample threat risk warning method based on deep learning in the present invention. Figure 1 As shown, the small sample threat risk warning method based on deep learning in an embodiment of the present invention includes:

[0036] S101, collect Internet threat risk information.

[0037] In the embodiment of the present invention, Internet threat risk information may include information carrying viruses, information carrying unsafe protocols, and acquired password information and user personal information, etc. The embodiment of the present invention does not limit this. Internet threat risk information can be collected from various channels through web crawlers. Among them, various channels may include Internet public channels such as security information websites, social media websites, security vendor announcements, and security forums, and the embodiment of the present invention does not limit the various channels.

[0038] S102, obtaining corresponding word sequence data according to the Internet threat risk information.

[0039] In the embodiment of the present invention, the Internet threat risk information may be parsed and the parsed Internet threat risk information may be extracted to obtain corresponding word sequence data.

[0040] S103, inputting the word sequence data into the segment semantic extraction model and the semantic matching model respectively, obtaining a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain a deep-level feature.

[0041] In an embodiment of the present invention, the segment semantic extraction model can be a modified BERT model. The goal of the BERT model is to obtain a semantic representation of a text containing rich semantic information after modification using a small-scale annotated corpus. Inputting word sequence data into the modified BERT model to learn the word sequence data can obtain multiple segment feature vectors, and then obtain the maximum value of all dimensions of each segment feature vector, and combine the maximum values ​​of all dimensions of each segment feature vector to obtain the first feature vector. For example, a certain word sequence data is input into the modified BERT model to obtain 500 segment feature vectors, each feature vector has 200 dimensions. Obtain the maximum value of each dimension of each segment feature vector. These 500 segment feature vectors can be regarded as a 500 by 200 matrix, and obtaining the maximum value of each dimension of each segment feature vector can be regarded as obtaining the maximum value of each column of the matrix, and the set of the maximum values ​​of each column is the first feature vector. In the above example, the first feature vector is a 1 by 500 feature vector.

[0042] The semantic matching model can be a text convolutional neural network model. The word sequence data is input into the text convolutional neural network model to output a second feature vector. For example, a word sequence data is input into the text convolutional neural network model, and a 1×500 feature vector is obtained as the second feature vector.

[0043] The first eigenvector and the second eigenvector can be concatenated to obtain a deep eigenvector. The concatenation operation can be understood as concatenating the first eigenvector and the second eigenvector. For example, if the first eigenvector is a 1-by-500 eigenvector and the second eigenvector is a 1-by-200 eigenvector, concatenating the first eigenvector and the second eigenvector can obtain a 1-by-700 eigenvector, which is a deep eigenvector. The process of fusing the first eigenvector and the second eigenvector to obtain a deep eigenvector is as follows: Figure 2As shown. BERT is a modified bert model, TextCNN is a text convolutional neural network model, including input layer, convolution layer, pooling layer and fully connected layer, feature vector 1 is the first feature vector, and feature vector 2 is the second feature vector. Inputting word sequence data into the BERT model can obtain several fragment feature vectors, obtain the maximum value in the dimensions of several fragment feature vectors, and the set of the maximum values ​​in the dimensions of several fragment feature vectors is feature vector 1; inputting word sequence fragments into the TextCNN model can obtain feature vector 2; concatenating feature vector 1 and feature vector 2 can obtain a feature vector, that is, a deep feature vector.

[0044] Deep-level features can refer to features that can reflect the characteristics of things most profoundly or essentially. For example, the meaning of each word, each sentence, and the meaning of the entire chapter in an article can all be used as features of the article. Since the meaning of the entire chapter can reflect the most essential meaning of the article, the meaning of the entire chapter can be used as the deep-level feature of the article.

[0045] S104, inputting the deep features into the trained deep neural network model to obtain the early warning results of Internet threat risk information; the trained deep neural network model is trained based on the deep feature samples and the corresponding classification labels.

[0046] In an embodiment of the present invention, the training process of the deep neural network model may include: inputting some deep-level features into the model in batches as training sets, training and optimizing the deep neural network model according to the corresponding classification labels, wherein the optimization process is a model parameter adjustment (or update) process, and after each adjustment of the model parameters, it is determined whether the model error meets the preset conditions (reaches an acceptable level), wherein the preset conditions may be that the error is lower than a threshold or reaches stability; if the error is higher than a threshold or does not reach stability, the model is cyclically trained, and the model is continuously iterated and updated, and if the error is lower than a threshold or reaches stability, the model training is stopped to form an optimal model, which is a trained deep neural network model. By inputting deep-level features into the trained deep neural network model, the early warning results of Internet threat risk information can be obtained according to the output results of the deep neural network model. Among them, the early warning results may include the categories of Internet threat risk information.

[0047] The small sample threat risk warning method based on deep learning provided by the embodiment of the present invention collects Internet threat risk information; obtains corresponding word sequence data according to the Internet threat risk information; inputs the word sequence data into the fragment semantic extraction model and the semantic matching model respectively, obtains the first feature vector and the second feature vector respectively, fuses the first feature vector and the second feature vector to obtain deep-level features; inputs the deep-level features into the trained deep neural network model to obtain the warning result of the Internet threat risk information; the trained deep neural network model is trained according to the deep-level feature samples and the corresponding classification labels. By inputting the word sequence data into the fragment semantic extraction model and the semantic matching model respectively, obtains the first feature vector and the second feature vector respectively, fuses the first feature vector and the second feature vector to obtain deep-level features, and inputs the deep-level features into the deep neural network model for warning of Internet threat risk information, the warning result of the Internet threat risk information obtained can be made more accurate.

[0048] Figure 3 This is a flow chart of an embodiment of the method for obtaining deep-level features of the present invention. Figure 3 As shown, the method for obtaining the second eigenvector in the embodiment of the present invention includes:

[0049] S301, using unsupervised security domain data to train the word2vec model to obtain a word embedding vector.

[0050] In an embodiment of the present invention, the word2vec model can be understood as a one-layer neural network, through which the sparse word vector in the form of one-hot encoding can be mapped into m n-dimensional dense vectors. Wherein, m is the length of the word sequence, n is the dimension of the dense vector, and the value of n is in units of hundreds, which can be 300 or 500. The training result obtained by the word2vec model is a word embedding vector. A word embedding vector refers to a vector after a high-dimensional word vector is embedded in a low-dimensional space, which can well measure the similarity between words. A word can be converted into a vector representation of a fixed length using a word embedding vector, which is convenient for mathematical processing.

[0051] S302, construct a text convolutional neural network based on word embedding vectors.

[0052] In an embodiment of the present invention, a word embedding vector is used as a parameter of the input layer to construct a convolutional neural network having an input layer, a hidden layer and an output layer, wherein the hidden layer includes a convolutional layer, a pooling layer and a fully connected layer.

[0053] S303, input the word sequence data into the text convolutional neural network to obtain a second feature vector.

[0054] In an embodiment of the present invention, a word sequence is input into a text convolutional neural network constructed based on a word embedding vector. The input word sequence can be converted into a corresponding word embedding vector in the input layer as the input of the hidden layer. After being processed by the hidden layer, the second feature vector is output through the output layer.

[0055] The method for obtaining the second feature vector provided in an embodiment of the present invention constructs a text convolutional neural network through word embedding vectors. Since the word embedding vectors can well reflect the relationship between words, the second feature vector of the word sequence is extracted by using the text convolutional neural network constructed based on the word embedding vectors, which can make the extracted second feature vector more accurate.

[0056] Figure 4 FIG. 1 is a flow chart of an embodiment of a method for obtaining early warning results of Internet threat risk information according to the present invention. Figure 4 As shown, a method for obtaining early warning results of Internet threat risk information according to an embodiment of the present invention includes:

[0057] S401, assigning at least one classification label to the output result of the trained deep neural network model to obtain a classification result; the classification label includes at least one of a security vulnerability label, a data leakage label, a network black and gray industry label, and an advanced persistent threat label.

[0058] In the embodiment of the present invention, the classification labels may include security vulnerability labels, data leakage labels, network black and gray production labels, and advanced persistent threat labels. The embodiment of the present invention does not limit the types of classification labels.

[0059] The process of obtaining classification results is as follows Figure 5 As shown, the process includes two parts: obtaining the optimal model, i.e., the trained deep neural network model, and determining the classification result according to the optimal model. Among them, the process of determining the optimal model may include: inputting some deep-level features into the model as a training set in batches to optimize the model; calculating the model training error to determine whether the error meets the preset conditions (reaches an acceptable level), i.e., whether it is lower than the threshold or reaches stability, and optimizing the model, i.e., updating the model parameters; if the error is higher than the threshold or has not reached stability, the model is cyclically trained and the model is continuously iterated and updated; if the error is lower than the threshold or reaches stability, the model training is stopped to form the optimal model. Determining the classification result according to the optimal model may include: when the model training stops, using the deep-level features as the input of the optimal model, performing multi-label classification on the Internet threat risk information, assigning it a single or multiple classification labels, and then obtaining the classification result.

[0060] The classification result of the Internet threat risk information can be determined by the classification label of the Internet threat risk information. For example, if the classification label of the Internet threat risk information is a security vulnerability label, then the Internet threat risk information belongs to Internet threat risk information with security vulnerabilities.

[0061] S402, obtaining early warning results of Internet threat risk information based on the classification results.

[0062] In an embodiment of the present invention, if the Internet threat risk information is Internet threat risk information with security vulnerabilities, then the Internet threat risk information warning result is displayed as a security vulnerability, indicating the source or type of the threat risk of the Internet threat risk information.

[0063] The method for obtaining early warning results of Internet threat risk information provided by the embodiment of the present invention can provide early warnings for Internet threat risk information from multiple angles by assigning at least one classification label to the output results of a deep neural network model, thereby improving the comprehensiveness of the early warning.

[0064] Figure 6 FIG. 1 is a flow chart of another embodiment of a method for obtaining early warning results of Internet threat risk information according to the present invention. Figure 6 As shown, another method for obtaining early warning results of Internet threat risk information according to an embodiment of the present invention includes:

[0065] S601: If the classification result does not require rule detection, the classification result is used as a warning result.

[0066] S602: If the classification result needs to be checked by rules, the classification result is updated using the advanced persistent threat organization data, and the updated classification result is used as a warning result.

[0067] In the embodiment of the present invention, the basis for judging whether rule detection is needed according to the classification result is the recall rate of the category to which the classification result belongs. For example, if the recall rate of the category to which the classification result belongs is lower than 90%, then the classification result needs to be checked for rules; if the recall rate of the category to which the classification result belongs is higher than 90%, then no rule detection is needed.

[0068] If the classification result needs to be tested by rules, it is necessary to obtain the advanced persistent threat organization data, which is obtained from the dictionary collected and sorted in advance. The classification result is updated according to the advanced persistent threat organization data and the word sequence data corresponding to the classification result.

[0069] The process of updating the classification results according to the rule detection is as follows Figure 7As shown, first determine whether the classification result needs to be combined with rule detection. If the classification result does not need rule detection, the classification result is used as a warning result; if the classification result needs rule detection, use the advanced persistent threat organization data and text sequence, that is, word sequence data to update the classification result, and use the updated classification result as a warning result.

[0070] A low recall rate of a classification result of a certain Internet threat risk information means that the detection rate of classifying the Internet threat risk information into this category is low. In order to correctly classify the Internet threat risk information into this category, the classification result of the Internet threat risk information needs to be updated.

[0071] Another method for obtaining early warning results of Internet threat risk information provided by an embodiment of the present invention can further improve the accuracy of early warning results by updating classification results through rule detection.

[0072] Figure 8 This is a flow chart of an embodiment of the method for updating the classification results of Internet threat risk information of the present invention. Figure 8 As shown, the method for updating the classification result of Internet threat risk information in an embodiment of the present invention includes:

[0073] S801, matching the word sequence data corresponding to the classification result with the advanced persistent threat organization data to obtain a matching result.

[0074] S802: Update the classification result according to the matching result.

[0075] In an embodiment of the present invention, keyword matching is performed on the word sequence data corresponding to the classification result and the advanced persistent threat organization data to obtain a matching result. For example, the advanced persistent threat organization data contains a large number of proprietary terms such as WannaCry and APT-C-35, which are matched one by one with the word sequence data corresponding to the classification result, and the number of successful matches is counted. If the number of successful matches is greater than the preset threshold, then if the original classification result of the word sequence data is network black and gray products, then the original classification result of the word sequence data is updated from network black and gray products to two categories of network black and gray products and APT. Among them, the preset threshold is usually set to 3 to 5 times.

[0076] The method for updating the classification results of Internet threat risk information provided by the embodiment of the present invention performs keyword matching on the word sequence data corresponding to the classification results and the advanced persistent threat organization data, making the matching process fast and easy to operate, thereby improving the efficiency of updating the classification results of Internet threat risk information.

[0077] Fig. 9 This is a flow chart of an embodiment of the method for obtaining word sequence data of the present invention. Figure 8 As shown, the method for obtaining word sequence data in an embodiment of the present invention includes:

[0078] S901, parsing Internet threat risk information to obtain text data.

[0079] In the embodiment of the present invention, the collected Internet threat risk information is parsed by HTML to obtain text data, which is saved in JSON format, and some core fields are shown in Table 1.

[0080] Table 1 Some core fields

[0081] Field English name Field Chinese name Indicator Article ID title title content content url Article URL date Crawling time

[0082] S902, cleaning the text data to obtain cleaned text data.

[0083] In the embodiment of the present invention, the purpose of cleaning is mainly to remove meaningless symbols and stop words in the title and content fields in Table 1.

[0084] S903, segment the cleaned text data to obtain word sequence data.

[0085] In the embodiment of the present invention, the cleaned text data is segmented according to a dictionary and an open source word segmentation tool, and the text data is converted into a sequence of words, that is, word sequence data.

[0086] The method for obtaining word sequence data provided by the embodiment of the present invention can remove meaningless words through cleaning, thereby improving the efficiency of converting text data into word sequence data.

[0087] In some optional embodiments, after obtaining the corresponding word sequence data according to the Internet threat risk information, it also includes: upsampling the word sequence data, and the upsampling processing includes at least one of randomly replacing synonyms, randomly replacing words, deleting words, and inserting words.

[0088] In an embodiment of the present invention, the upsampling process may include four processes of randomly replacing synonyms, randomly replacing words, deleting and inserting the word sequence data, to form a word sequence four times the amount of original data. Taking a word sequence S0 = [x1, x2, x3, x4 ... xi-1, xi] as an example, the specific process is as follows: Step 1, randomly select some words in S0, such as x2, x4, and use the corresponding synonyms x*2, x*4 to replace them respectively, forming S1 = [x1, x*2, x3, x*4 ... xi-1, xi]; Step 2, randomly select some words in S0, such as x2, x4, and use other words in the vocabulary, such as x3, x5 to replace them respectively, forming S2 = [x1, x3, x3, x5 ... xi-1,xi]; Step 3, randomly select some words in S0, such as x2, x4, delete them, and form S3 = [x1, x3, ... xi-1, xi]; Step 4, randomly select some words in S0, such as x2, x4, and use other words in the vocabulary, such as x1, x6, to insert them in front of the words x2 and x4 respectively, to form S4 = [x1, x1, x2, x3, x6, x4 ... xi-1, xi]; Step 5, aggregate S0, S1, S2, S3, and S4 to form new word sequence data.

[0089] The upsampling method provided by the embodiment of the present invention can effectively increase the word sequence data of Internet threat risk information, which is conducive to the application of deep learning models in this small sample scenario.

[0090] In some optional embodiments, training the deep neural network model may include: inputting deep-level feature samples into the deep neural network model, adjusting parameters of the deep neural network model according to corresponding classification labels, and obtaining a trained deep neural network model.

[0091] In the embodiment of the present invention, the process of training the deep neural network model is also the process of determining the optimal model. For a detailed description of the process, see Figure 5 The relevant instructions are not elaborated here.

[0092] The method for training a deep neural network model provided by an embodiment of the present invention can obtain an optimal model.

[0093] Fig.10 This is a schematic diagram of an application scenario of the present invention. Fig.10As shown, the application scenario includes the following steps: Step 1, preprocessing and enhancing the acquired Internet threat information to obtain text sequence data, that is, word sequence data; Step 2, using a large amount of unsupervised security field corpus to train word2vec to learn the word embedding vector of word granularity in the security scenario, using the word embedding vector and the text convolutional neural network model to learn the text sequence data to obtain a feature vector, using the modified BERT model to learn the text sequence data to obtain another feature vector, and fusing the two feature vectors to obtain a deep feature vector; Step 3, inputting the deep feature vector into the deep neural network model and assigning a label to the output result; Step 4, performing rule detection on the output result of the obtained label, and obtaining a warning result according to the result of the rule detection, so as to realize the early warning of Internet threat information.

[0094] Fig.11 Schematic diagram of the structure of the small sample threat risk warning device based on deep learning in the present invention. Fig.11 As shown, the small sample threat risk warning device based on deep learning in an embodiment of the present invention includes:

[0095] A collection module 1101 is used to collect Internet threat risk information;

[0096] A sequence acquisition module 1102 is used to obtain corresponding word sequence data according to Internet threat risk information;

[0097] A feature acquisition module 1103 is used to input the word sequence data into the segment semantic extraction model and the semantic matching model respectively, obtain a first feature vector and a second feature vector respectively, and fuse the first feature vector and the second feature vector to obtain a deep-level feature;

[0098] The early warning module 1104 is used to input the deep features into the trained deep neural network model to obtain the early warning results of Internet threat risk information; the trained deep neural network model is trained based on the deep feature samples and the corresponding classification labels.

[0099] Optionally, the feature acquisition module 1103 is further used to input the word sequence into a modified BERT model to obtain a first feature vector; the modified BERT model is obtained by training an open source BERT model based on supervised security field data.

[0100] Optionally, the feature acquisition module 1103 is further used to input the word sequence data into the text convolutional neural network model to obtain a second feature vector.

[0101] Optionally, the feature acquisition module 1103 includes:

[0102] A first acquisition unit is used to train a word2vec model using unsupervised security field data to obtain a word embedding vector;

[0103] A construction unit for building a text convolutional neural network based on word embedding vectors;

[0104] The second acquisition unit is used to input the word sequence data into the text convolutional neural network to obtain a second feature vector.

[0105] Optionally, the early warning module 1104 includes:

[0106] A classification unit, configured to assign at least one classification label to the output result of the deep neural network model according to the output result of the deep neural network model, so as to obtain a classification result; the classification label includes at least one of a security vulnerability label, a data leakage label, a network black and gray product label, and an advanced persistent threat label;

[0107] The early warning unit is used to obtain early warning results of Internet threat risk information based on the classification results.

[0108] Optionally, the early warning unit comprises:

[0109] A first processing subunit is used to use the classification result as a warning result if the classification result does not need to be checked by rules;

[0110] The second processing subunit is used to update the classification result by using the advanced persistent threat organization data if the classification result needs to be checked by rules, and use the updated classification result as a warning result.

[0111] Optionally, the second subunit includes:

[0112] A matching subunit, used for matching the word sequence data corresponding to the classification result with the advanced persistent threat organization data to obtain a matching result;

[0113] The updating subunit is used to update the classification result according to the matching result.

[0114] Optionally, the sequence acquisition module 1102 includes:

[0115] A parsing unit, used for parsing Internet threat risk information to obtain text data;

[0116] A cleaning unit, used for cleaning the text data to obtain cleaned text data;

[0117] The word segmentation unit is used to segment the cleaned text data and obtain word sequence data.

[0118] Optionally, the small sample threat risk early warning device based on deep learning further includes:

[0119] The upsampling module is used to perform upsampling processing on word sequence data; the upsampling processing includes at least one of random replacement of synonyms, random replacement of words, word deletion processing and word insertion processing.

[0120] Optionally, the small sample threat risk early warning device based on deep learning further includes:

[0121] The training module is used to input deep-level feature samples into the deep neural network model, adjust the parameters of the deep neural network model according to the corresponding classification labels, and obtain a trained deep neural network model.

[0122] Fig.12 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.12 The electronic device may include: a processor 1201, a communication interface 1202, a memory 1203 and a communication bus 1204, wherein the processor 1201, the communication interface 1202 and the memory 1203 communicate with each other through the communication bus 1204. The processor 1201 may call the logic instructions in the memory 1203 to execute the following method: collect Internet threat risk information; obtain corresponding word sequence data according to the Internet threat risk information; input the word sequence data into the fragment semantic extraction model and the semantic matching model respectively, obtain the first feature vector and the second feature vector respectively, fuse the first feature vector and the second feature vector to obtain the deep-level feature; input the deep-level feature into the trained deep neural network model to obtain the early warning result of the Internet threat risk information; the trained deep neural network model is trained according to the deep-level feature samples and the corresponding classification labels.

[0123] In addition, the logic instructions in the above-mentioned memory 1203 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0124] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the small sample threat risk warning method based on deep learning provided by the above embodiments, for example, including: collecting Internet threat risk information; obtaining corresponding word sequence data based on the Internet threat risk information; inputting the word sequence data into a fragment semantic extraction model and a semantic matching model respectively to obtain a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain deep-level features; inputting the deep-level features into a trained deep neural network model to obtain a warning result of the Internet threat risk information; the trained deep neural network model is trained based on deep-level feature samples and corresponding classification labels.

[0125] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the small sample threat risk warning method based on deep learning provided in the above-mentioned embodiments, for example, including: collecting Internet threat risk information; obtaining corresponding word sequence data based on the Internet threat risk information; inputting the word sequence data into a fragment semantic extraction model and a semantic matching model respectively to obtain a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain a deep-level feature; inputting the deep-level feature into a trained deep neural network model to obtain a warning result of the Internet threat risk information; the trained deep neural network model is trained based on the deep-level feature samples and the corresponding classification labels.

[0126] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without paying creative labor.

[0127] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0128] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A small sample threat risk warning method based on deep learning, characterized in that: include: Collect Internet threat risk information; Obtain corresponding word sequence data according to the Internet threat risk information; Inputting the word sequence data into a segment semantic extraction model and a semantic matching model respectively to obtain a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain a deep-level feature; Inputting the deep-level features into a trained deep neural network model to obtain an early warning result of the Internet threat risk information; the trained deep neural network model is trained based on deep-level feature samples and corresponding classification labels; The segment semantic extraction model is a modified BERT model, and the word sequence data is input into the segment semantic extraction model to obtain a first feature vector, including: The word sequence data is input into the modified BERT model to learn the word sequence data to obtain multiple segment feature vectors, the maximum value of all dimensions of each segment feature vector is obtained, and the maximum values ​​of all dimensions of each segment feature vector are combined to obtain the first feature vector; the modified BERT model is obtained by training an open source BERT model based on supervised security field data.

2. The small sample threat risk early warning method based on deep learning according to claim 1 is characterized in that: The semantic matching model is a text convolutional neural network model, and the word sequence data is input into the semantic matching model to obtain a second feature vector, including: The word sequence data is input into a text convolutional neural network model to obtain the second feature vector.

3. The small sample threat risk early warning method based on deep learning according to claim 2 is characterized in that: The step of inputting the word sequence data into a text convolutional neural network model to obtain the second feature vector comprises: Use unsupervised security domain data to train the word2vec model and obtain word embedding vectors; Constructing the text convolutional neural network based on the word embedding vector; The word sequence data is input into the text convolutional neural network to obtain the second feature vector.

4. The small sample threat risk early warning method based on deep learning according to claim 1 is characterized in that: The step of inputting the deep-level features into a trained deep neural network model to obtain an early warning result of the Internet threat risk information includes: Assigning at least one classification label to the output result of the trained deep neural network model to obtain a classification result; the classification label includes at least one of a security vulnerability label, a data leakage label, a network black and gray product label, and an advanced persistent threat label; According to the classification result, an early warning result of the Internet threat risk information is obtained.

5. The small sample threat risk early warning method based on deep learning according to claim 4 is characterized in that: Obtaining a warning result of the Internet threat risk information according to the classification result includes: If the classification result does not need to be checked by rules, the classification result is used as the warning result; If the classification result needs to be tested by the rule, the classification result is updated using the advanced persistent threat organization data, and the updated classification result is used as a warning result.

6. The small sample threat risk early warning method based on deep learning according to claim 5 is characterized in that: The updating of the classification result by using the advanced persistent threat organization data includes: Matching the word sequence data corresponding to the classification result with the advanced persistent threat organization data to obtain a matching result; The classification result is updated according to the matching result.

7. The small sample threat risk early warning method based on deep learning according to any one of claims 1 to 6, characterized in that: The obtaining corresponding word sequence data according to the Internet threat risk information includes: Parsing the Internet threat risk information to obtain text data; Cleaning the text data to obtain cleaned text data; The cleaned text data is segmented to obtain the word sequence data.

8. The small sample threat risk early warning method based on deep learning according to any one of claims 1 to 6, characterized in that: After obtaining the corresponding word sequence data according to the Internet threat risk information, the method further includes: The word sequence data is subjected to upsampling processing; the upsampling processing includes at least one of random replacement of synonyms, random replacement of words, word deletion processing and word insertion processing.

9. The small sample threat risk early warning method based on deep learning according to claim 1 is characterized in that: Training of deep neural network models, including: The deep-level feature samples are input into the deep neural network model, and the parameters of the deep neural network model are adjusted according to the corresponding classification labels until the error of the deep neural network model meets the preset conditions, thereby obtaining the trained deep neural network model.

10. A small sample threat risk warning device based on deep learning, characterized in that: include: A collection module, used to collect Internet threat risk information; A sequence acquisition module, used to obtain corresponding word sequence data according to the Internet threat risk information; A feature acquisition module, used for inputting the word sequence data into a segment semantic extraction model and a semantic matching model respectively, obtaining a first feature vector and a second feature vector respectively, and fusing the first feature vector and the second feature vector to obtain a deep-level feature; An early warning module is used to input the deep-level features into a trained deep neural network model to obtain an early warning result of the Internet threat risk information; the trained deep neural network model is trained based on deep-level feature samples and corresponding classification labels; The segment semantic extraction model is a modified BERT model, and the feature acquisition module is also used for: The word sequence data is input into the modified BERT model to learn the word sequence data to obtain multiple segment feature vectors, the maximum value of all dimensions of each segment feature vector is obtained, and the maximum values ​​of all dimensions of each segment feature vector are combined to obtain the first feature vector; the modified BERT model is obtained by training an open source BERT model based on supervised security field data.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the small sample threat risk warning method based on deep learning are implemented as described in any one of claims 1 to 9.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the small sample threat risk warning method based on deep learning are implemented as described in any one of claims 1 to 9.

13. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the small sample threat risk warning method based on deep learning are implemented as described in any one of claims 1 to 9.

Images