A method and device for constructing a distributed botnet model

Abstract

The present invention discloses a distributed botnet model construction method and device, which obtains a computing task graph by setting hyperparameter requirements on a client; sends the computing task graph to a master; obtains a task information set according to the computing task graph; obtains a task instruction according to the task information set, and distributes the task instruction to a corresponding worker; performs model training through the worker based on the task instruction, obtains hyperparameter information, and returns the hyperparameter information to the client; the client formulates the next round of model calculation tasks according to the hyperparameter information; retrains based on the hyperparameter information obtained in the previous round to obtain a model learning decay rate, and stops training when the model learning decay rate meets a preset value. The method solves the technical problems of large time consumption for parameter search, inaccurate establishment of botnet models, and long modeling time in the prior art. The method achieves the technical effect of distributed automatic parameter search, shortening the parameter search time, and finding the optimal hyperparameter to improve the accuracy of the model.

Description

Technical Field

[0001] The present invention relates to the technical field of zombie models, and in particular to a method and device for constructing a distributed zombie network model. Background Art

[0002] With the development of IoT technology, the proportion of network equipment in various industries is also increasing. At the same time, the zombie network formed by zombie virus infection is also growing, and the controllers are constantly updating technical means to create new zombie viruses. At present, there have been many studies on botnet detection based on machine learning, but the existing botnet model takes a lot of time to find parameters, which makes it impossible to quickly build the botnet model and use it for detection, greatly increasing the time to detect botnets. When building a model, the selection of hyperparameters takes a lot of time, especially when multiple hyperparameters are involved, the amount of calculation increases exponentially, and the hyperparameters have a great impact on the accuracy of the model, which directly affects the learning process and prediction performance.

[0003] However, the inventors of this application found that the above technology has at least the following technical problems in the process of implementing the technical solution of the invention in the embodiment of this application:

[0004] The existing technology consumes a lot of time in searching for parameters, and there are technical problems such as inaccurate botnet model establishment and long modeling time. Summary of the invention

[0005] The embodiments of the present application provide a distributed-based botnet model construction method and device, thereby solving the technical problems in the prior art of large time consumption for parameter search, inaccurate botnet model establishment, and long modeling time.

[0006] In view of the above problems, an embodiment of the present application provides a method and device for constructing a botnet model based on distribution.

[0007] In the first aspect, an embodiment of the present application provides a distributed botnet model construction method, including step 1: setting hyperparameter requirements on the client to obtain a computing task graph; step 2: sending the computing task graph to the master; step 3: the master obtains a task information set based on the computing task graph; step 4: obtaining a task instruction based on the task information set, and distributing the task instruction to the corresponding worker; step 5: based on the task instruction, performing model training through the worker to obtain hyperparameter information, and returning the hyperparameter information to the client; step 6: based on the hyperparameter information, the client formulates the next round of model calculation tasks; step 7: based on the hyperparameter information obtained in the previous round, repeating steps 2-6 to obtain the model learning decay rate, and stopping training when the model learning decay rate meets the preset value.

[0008] Preferably, the step 1: setting hyperparameter requirements on the client to obtain a computing task graph includes: obtaining initial parameters according to the hyperparameter requirements; and obtaining the computing task graph according to the initial parameters.

[0009] Preferably, obtaining the computing task graph according to the initial parameters includes: obtaining computing task information according to the initial parameters; converting the computing task information into a graph data stream; and obtaining the computing task graph based on the graph data stream.

[0010] Preferably, step 4: obtaining task instructions according to the task information set, and distributing the task instructions to corresponding workers, includes: obtaining a worker information set; obtaining an allocation relationship according to the task information set and the worker information set, wherein the allocation relationship is an allocation correspondence relationship between task information and workers; obtaining first task information and a first worker, second task information and a second worker, up to the Nth task and the Nth worker, according to the allocation relationship and the task information set, wherein N is a positive integer; obtaining a task instruction according to the first task information, and distributing the task instruction to the first worker, and so on to distribute the task instruction of the Nth task to the Nth worker for execution.

[0011] Preferably, the step 5: based on the task instruction, the model is trained by the worker to obtain hyperparameter information, including: obtaining parameter value information and training data; according to the parameter value information and training data, the task instruction training model is executed, and the parameters are updated by back propagation to obtain training results; according to the training results, the hyperparameter information is obtained.

[0012] Preferably, the preset value is 0.

[0013] On the other hand, the present application also provides a distributed botnet model construction device, the device comprising:

[0014] A first obtaining unit, wherein the first obtaining unit is used to set hyperparameter requirements on the client to obtain a computing task graph;

[0015] A first sending unit, the first sending unit is used to send the computing task graph to a master;

[0016] A second obtaining unit, wherein the second obtaining unit is used by the master to obtain a task information set according to the computing task graph;

[0017] a third obtaining unit, the third obtaining unit being used to obtain a task instruction according to the task information set, and distribute the task instruction to a corresponding worker;

[0018] A first execution unit, the first execution unit is used to perform model training through a worker based on the task instruction, obtain hyperparameter information, and return the hyperparameter information to a client;

[0019] A second execution unit, the second execution unit is used for the client to formulate the next round of model calculation tasks according to the hyperparameter information;

[0020] The third execution unit is used to repeat the training of the worker based on the hyperparameter information obtained in the previous round to obtain the hyperparameter information, and calculate the model learning decay rate through the client, and stop the training when the model learning decay rate meets the preset value.

[0021] In a third aspect, the present invention provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the program.

[0022] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0023] The embodiment of the present application provides a distributed botnet model construction method and device, including step 1: setting hyperparameter requirements on the client to obtain a computing task graph; step 2: sending the computing task graph to the master; step 3: the master obtains a task information set according to the computing task graph; step 4: obtaining a task instruction according to the task information set, and distributing the task instruction to the corresponding worker; step 5: based on the task instruction, performing model training through the worker to obtain hyperparameter information, and returning the hyperparameter information to the client; step 6: based on the hyperparameter information, the client formulates the next round of model calculation tasks; step 7: based on the hyperparameter information obtained in the previous round, repeating steps 2-6 to obtain the model learning decay rate, and stopping the training when the model learning decay rate meets the preset value. The goal is to distribute tasks to multiple execution entities for distributed training, and feed back each training result to the host to guide the next round of parameter generation, so that parameter generation has directionality, realize distributed automatic parameter search, greatly shorten the time for parameter optimization, and use the optimal hyperparameters to improve the accuracy of the zombie model. The technical effect solves the technical problems in the prior art of long parameter search time, inaccurate zombie network model establishment and long modeling time.

[0024] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of a process of constructing a distributed botnet model according to an embodiment of the present application;

[0026] Figure 2 Schematic diagram of the parameter updating process in the embodiment of the present application;

[0027] Figure 3 This is a schematic diagram of the structure of a distributed botnet model building device according to an embodiment of the present application;

[0028] Figure 4 A schematic diagram of the structure of an exemplary computer device according to an embodiment of the present application.

[0029] Explanation of the reference numerals: first obtaining unit 11, first sending unit 12, second obtaining unit 13, third obtaining unit 14, first executing unit 15, second executing unit 16, third executing unit 17, bus 300, receiver 301, processor 302, transmitter 303, memory 304, bus interface 305. DETAILED DESCRIPTION

[0030] The embodiment of the present application provides a distributed botnet model construction method and device to solve the technical problems of long time consumption for parameter search, inaccurate botnet model establishment and long modeling time in the prior art. The task is distributed to multiple execution entities for distributed training, and each training result is fed back to the host to guide the next round of parameter generation, so that the parameter generation has directionality, distributed automatic parameter search is realized, the time for parameter optimization is greatly shortened, and the accuracy of the botnet model is improved by using the optimal hyperparameters.

[0031] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0032] Application Overview

[0033] With the development of Internet of Things technology, the proportion of network equipment in various industries is also increasing. At the same time, the zombie network formed by zombie virus infection is also growing, and the controllers are constantly updating technical means to create new zombie viruses. At present, there have been many studies on botnet detection based on machine learning, but the existing botnet model takes a lot of time to find parameters, resulting in the botnet model cannot be quickly established and used for detection, which greatly increases the time to detect botnets. In the existing technology, the time consumption of finding parameters is large, and there are technical problems such as inaccurate botnet model establishment and long modeling time.

[0034] In response to the above technical problems, the overall idea of ​​the technical solution provided by this application is as follows:

[0035] Step 1: Set hyperparameter requirements on the client to obtain a calculation task graph; Step 2: Send the calculation task graph to the master; Step 3: The master obtains a task information set based on the calculation task graph; Step 4: Obtain task instructions based on the task information set, and distribute the task instructions to the corresponding worker; Step 5: Based on the task instructions, perform model training through the worker to obtain hyperparameter information, and return the hyperparameter information to the client; Step 6: Based on the hyperparameter information, the client formulates the next round of model calculation tasks; Step 7: Based on the hyperparameter information obtained in the previous round, repeat steps 2-6 to obtain the model learning decay rate, and stop training when the model learning decay rate meets the preset value. The distributed training is achieved by distributing tasks to multiple execution entities, and feeding back each training result to the host to guide the next round of parameter generation, so that the parameter generation is directional, and distributed automatic parameter search is realized, which greatly shortens the time for parameter optimization, and uses the optimal hyperparameters to improve the accuracy of the zombie model.

[0036] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically described below in conjunction with the drawings in the specification.

[0037] Embodiment 1

[0038] Figure 1 FIG. 1 is a flow chart of a method for constructing a distributed botnet model according to an embodiment of the present application. Figure 1 As shown, the embodiment of the present application provides a method for constructing a botnet model based on a distributed system, and the method includes:

[0039] Step 1: Set the hyperparameter requirements on the client and obtain the computational task graph;

[0040] Furthermore, the step 1: setting hyperparameter requirements on the client to obtain a computing task graph includes: obtaining initial parameters according to the hyperparameter requirements; and obtaining the computing task graph according to the initial parameters.

[0041] Furthermore, obtaining the computing task graph according to the initial parameters includes: obtaining computing task information according to the initial parameters; converting the computing task information into a graph data stream; and obtaining the computing task graph based on the graph data stream.

[0042] Specifically, the embodiment of the present application is aimed at botnets, using the asynchronous distributed mechanism of TensorFlow, and using the replication and partitioning of graphs to achieve distributed computing. First, the mirror traffic of switches, routers, and sandboxes is collected to determine the object information, which is equivalent to the process of determining the data level in model establishment. The hyperparameter type and range are set on the host client, that is, the parameter requirements are set, and the initial parameters are determined based on the set parameter requirements. The training model is determined, and the client converts the process to be calculated into a graph data stream and creates a computing task graph. Among them, graph is a more interesting data structure. It is more abstract, but it is actually easy to understand. In fact, it is a set to hold some interconnected edges and vertices, and then this set is called a graph. This edge and vertex have a one-to-many relationship, and each vertex has an edge and an abstract relationship with some connection.

[0043] Step 2: Send the computing task graph to the master;

[0044] Specifically, the host client converts the computation process into a graph data stream and transmits it to the master through the session. Session is called "session control" in computers, especially in network applications. The Session object stores the attributes and configuration information required for a specific user session. In this way, when the user jumps between the web pages of the application, the variables stored in the Session object will not be lost, but will continue to exist throughout the user session. The Master has the tasks and functions of task distribution, parameter update, parameter storage, and work monitoring in the asynchronous distributed mechanism of TensorFlow.

[0045] Step 3: The master obtains a task information set according to the computing task graph;

[0046] Step 4: Obtain task instructions according to the task information set, and distribute the task instructions to corresponding workers;

[0047] Furthermore, the step 4: obtaining task instructions according to the task information set, and distributing the task instructions to corresponding workers, includes: obtaining a worker information set; obtaining an allocation relationship according to the task information set and the worker information set, wherein the allocation relationship is an allocation correspondence relationship between task information and workers; obtaining first task information and a first worker, second task information and a second worker, up to the Nth task and the Nth worker, according to the allocation relationship and the task information set, wherein N is a positive integer; obtaining a task instruction according to the first task information, and distributing the task instruction to the first worker, and so on distributing the task instruction of the Nth task to the Nth worker for execution.

[0048] Specifically, the master receives the computing task graph sent by the clinet, decomposes and obtains the tasks therein, obtains a task information set, which includes the computing task content, assigns it to suitable workers according to the task content, and monitors the working status of the workers. The embodiment of the present application utilizes an asynchronous distributed mechanism to assign training tasks to different workers for training, matches the computing task graph with the characteristics of the workers, distributes the tasks in the computing task set to multiple workers for training, assigns N tasks to N workers for processing, and enables different workers to perform synchronous training, greatly improving the training speed.

[0049] Step 5: Based on the task instruction, the worker performs model training to obtain hyperparameter information, and returns the hyperparameter information to the client;

[0050] Step 6: Based on the hyperparameter information, the client formulates the next round of model calculation tasks;

[0051] Furthermore, the step 5: based on the task instruction, the model is trained by the worker to obtain hyperparameter information, including: obtaining parameter value information and training data; according to the parameter value information and training data, the task instruction training model is executed, and the parameters are updated by back propagation to obtain training results; according to the training results, the hyperparameter information is obtained.

[0052] Specifically, workers are trained according to the assigned tasks, such as Figure 2As shown, the worker obtains parameter value information, namely the current parameter value and a part of the training data randomly obtained from the training data for model training, wherein the current parameter value is the hyperparameter information updated in the current master. If it is the first training, the current parameter value is the initial parameter. If there are already parameters updated by training, the current parameter value is the hyperparameter information output after training. Since the master distributes tasks to multiple workers, the training calculation speed of each worker is different. The worker that has completed the training calculation trains the data according to the task instruction of the master and returns the training result to the master. The master receives the training result, updates the parameters, and returns the hyperparameter information to the client. The client distributes the model training tasks according to the hyperparameters, and uses the hyperparameter information obtained from the previous round of training to guide the next round of training tasks, so that the generation of parameters is directional, which greatly shortens the time for parameter optimization. After each worker completes a training, it does not need to wait for other nodes and can directly update the parameters of the model. When a worker executes a task, it first uses the current parameter values ​​and a random part of the training data to propagate forward, that is, calculate the network prediction results, and then executes the task instructions to use the back propagation to correct the parameters with the obtained gradients. In each round of iteration, different devices will read the latest parameter values. According to the current parameter values ​​and a small part of the training data obtained randomly, different devices will run the back propagation process and update the parameters independently, and continue training on the results of the previous training to improve the training effect and clarify the direction of parameter training. It should be understood that back propagation is a learning algorithm suitable for multi-layer neural networks, which is based on the gradient descent method. The input-output relationship of the BP network is essentially a mapping relationship: the function performed by a BP neural network with n inputs and m outputs is a continuous mapping from n-dimensional Euclidean space to a finite field in m-dimensional Euclidean space, and this mapping is highly nonlinear. Its information processing ability comes from the multiple compounding of simple nonlinear functions, so it has a strong function reproduction ability. The embodiment of the present application is based on the TensorFlow distributed asynchronous training mechanism, which can update parameters asynchronously, speeding up the automatic generation of parameters. At the same time, it integrates Bayesian, gradient-based optimization methods, evolutionary optimization and other automatic optimization algorithms in the hyperparameter training update process, uses multiple algorithms for parameter optimization and shortens the optimization time.

[0053] Step 7: Based on the hyperparameter information obtained in the previous round, repeat steps 2-6 to obtain the model learning decay rate, and stop training when the model learning decay rate meets the preset value.

[0054] Furthermore, the preset value is 0.

[0055] Specifically, the parameters in the master are updated and stored according to the model training results obtained in the previous round of training, and the hyperparameter information is returned to the client. The client refers to the hyperparameter information of this round to distribute the next round of tasks. In the next round of worker training, the parameters of the previous round are selected to execute and train tasks. Continuous iteration improves the speed of parameter optimization and clarifies the direction. At the same time, after the client receives the feedback hyperparameter information, it will calculate and judge the learning decay rate of the model. When the learning decay rate of the model reaches the preset requirements, the current parameters are the optimal parameters. The preferred learning decay rate is 0. When setting the preset value, it can be other numbers close to 0. When the preset requirements are met, the training is stopped, and the optimal parameters are returned to the master to obtain the optimal parameters and the corresponding botnet model. It can be seen that the embodiment of the present application uses an asynchronous distributed mechanism and uses graph replication and partitioning to achieve distributed computing. The entire system can be regarded as including a master node and several slave nodes. Figure 2 The main node is mainly responsible for task distribution, monitoring tasks, parameter update and storage, i.e., the master. The slave nodes, i.e., each worker, calculate and transmit parameters according to the tasks distributed by the master node, thereby achieving distributed automatic parameter search, effectively shortening the parameter search time and improving the model accuracy by using the optimal hyperparameters. At the same time, it has a framework, simple operation, and low code writing difficulty, and can achieve the technical effect of fast and efficient training of botnet detection models, solving the technical problems in the prior art of large parameter search time consumption, inaccurate botnet model establishment, and long modeling time.

[0056] Embodiment 2

[0057] Based on the same inventive concept as the distributed botnet model construction method in the aforementioned embodiment, the present invention also provides a distributed botnet model construction device, such as Figure 3 As shown, the device comprises:

[0058] A first obtaining unit 11, wherein the first obtaining unit 11 is used to set hyperparameter requirements on the client to obtain a computing task graph;

[0059] A first sending unit 12, the first sending unit 12 is used to send the computing task graph to a master;

[0060] A second obtaining unit 13, wherein the second obtaining unit 13 is used by the master to obtain a task information set according to the computing task graph;

[0061] A third obtaining unit 14, the third obtaining unit 14 is used to obtain a task instruction according to the task information set, and distribute the task instruction to a corresponding worker;

[0062] A first execution unit 15, the first execution unit 15 is used to perform model training through a worker based on the task instruction, obtain hyperparameter information, and return the hyperparameter information to the client;

[0063] A second execution unit 16, the second execution unit 16 is used for the client to formulate the next round of model calculation tasks according to the hyperparameter information;

[0064] The third execution unit 17 is used for the worker to repeat the training based on the hyperparameter information obtained in the previous round, obtain the hyperparameter information, and calculate the model learning decay rate through the client, and stop the training when the model learning decay rate meets the preset value.

[0065] Furthermore, the device also includes:

[0066] A fourth obtaining unit, wherein the fourth obtaining unit is used to obtain initial parameters according to the hyperparameter requirements;

[0067] A fifth obtaining unit, wherein the fifth obtaining unit is used to obtain the computing task graph according to the initial parameters.

[0068] Furthermore, the device also includes:

[0069] A sixth obtaining unit, the sixth obtaining unit being used to obtain computing task information according to the initial parameters;

[0070] A first conversion unit, the first conversion unit is used to convert the computing task information into a graph data stream;

[0071] A seventh obtaining unit, wherein the seventh obtaining unit is used to obtain the computing task graph based on the graph data flow.

[0072] Furthermore, the device also includes:

[0073] An eighth obtaining unit, the eighth obtaining unit being used to obtain a worker information set;

[0074] A ninth obtaining unit, the ninth obtaining unit is used to obtain an allocation relationship according to the task information set and the worker information set, wherein the allocation relationship is an allocation correspondence relationship between the task information and the worker;

[0075] a tenth obtaining unit, the tenth obtaining unit being used to obtain, according to the allocation relationship and the task information set, the first task information and the first worker, the second task information and the second worker, up to the Nth task and the Nth worker, where N is a positive integer;

[0076] The eleventh obtaining unit is used to obtain a task instruction according to the first task information, and distribute the task instruction to the first worker, and so on to distribute the task instruction of the Nth task to the Nth worker for execution.

[0077] Furthermore, the device also includes:

[0078] A twelfth obtaining unit, the twelfth obtaining unit is used to obtain parameter value information and training data;

[0079] A thirteenth obtaining unit, the thirteenth obtaining unit is used to execute the task instruction training model according to the parameter value information and the training data, update the parameters by back propagation, and obtain the training result;

[0080] A fourteenth obtaining unit, the fourteenth obtaining unit is used to obtain the hyperparameter information according to the training result.

[0081] Furthermore, the preset value is 0.

[0082] The foregoing Figure 1 The various variations and specific examples of the distributed botnet model construction method in Embodiment 1 are also applicable to the distributed botnet model construction device in this embodiment. Through the above detailed description of the distributed botnet model construction method, those skilled in the art can clearly understand the implementation method of the distributed botnet model construction device in this embodiment, so for the sake of brevity of the specification, it will not be described in detail here.

[0083] Exemplary Electronic Devices

[0084] Reference below Figure 4 To describe the computer device of the embodiment of the present application.

[0085] Figure 4 The figure shows a schematic diagram of the structure of a computer device according to an embodiment of the present application.

[0086] Based on the inventive concept of a distributed botnet model building method in the aforementioned embodiment, the present invention also provides a computer device on which a computer program is stored, and when the program is executed by a processor, the steps of any method of the distributed botnet model building method described above are implemented.

[0087] Among them, Figure 4In the embodiment of the present invention, a bus architecture (represented by bus 300) is shown, which may include any number of interconnected buses and bridges, and bus 300 links together various circuits including one or more processors represented by processor 302 and memory represented by memory 304. Bus 300 may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. Bus interface 305 provides an interface between bus 300 and receiver 301 and transmitter 303. Receiver 301 and transmitter 303 may be the same element, namely a transceiver, which provides a unit for communicating with various other systems over a transmission medium.

[0088] The processor 302 is responsible for managing the bus 300 and general processing, while the memory 304 may be used to store data used by the processor 302 when performing operations.

[0089] The above one or more technical solutions in the embodiments of the present application have at least one or more of the following technical effects:

[0090] The embodiment of the present application provides a distributed botnet model construction method and device, including step 1: setting hyperparameter requirements on the client to obtain a computing task graph; step 2: sending the computing task graph to the master; step 3: the master obtains a task information set according to the computing task graph; step 4: obtaining a task instruction according to the task information set, and distributing the task instruction to the corresponding worker; step 5: based on the task instruction, performing model training through the worker to obtain hyperparameter information, and returning the hyperparameter information to the client; step 6: based on the hyperparameter information, the client formulates the next round of model calculation tasks; step 7: based on the hyperparameter information obtained in the previous round, repeating steps 2-6 to obtain the model learning decay rate, and stopping the training when the model learning decay rate meets the preset value. The goal is to distribute tasks to multiple execution entities for distributed training, and feed back each training result to the host to guide the next round of parameter generation, so that parameter generation has directionality, realize distributed automatic parameter search, greatly shorten the time for parameter optimization, and use the optimal hyperparameters to improve the accuracy of the zombie model. The technical effect solves the technical problems in the prior art of long parameter search time, inaccurate zombie network model establishment and long modeling time.

[0091] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0093] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0095] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A distributed botnet model construction method. in, The method comprises: Step 1: Set the hyperparameter requirements on the client and obtain the computational task graph; Step 2: Send the computing task graph to the master; Step 3: The master obtains a task information set according to the computing task graph; Step 4: Obtain task instructions according to the task information set, and distribute the task instructions to corresponding workers; Step 5: Based on the task instruction, the worker performs model training to obtain hyperparameter information, and returns the hyperparameter information to the client; Step 6: Based on the hyperparameter information, the client formulates the next round of model calculation tasks; Step 7: Based on the hyperparameter information obtained in the previous round, repeat steps 2-6 to obtain the model learning decay rate, and stop training when the model learning decay rate meets the preset value.

2. The method according to claim 1, in, The step 1: setting hyperparameter requirements on the client to obtain a computing task graph includes: According to the hyperparameter requirements, initial parameters are obtained; According to the initial parameters, the computing task graph is obtained.

3. The method according to claim 2, in, The step of obtaining the computing task graph according to the initial parameters includes: According to the initial parameters, obtaining computing task information; Convert the computing task information into a graph data stream; Based on the graph data flow, the computing task graph is obtained.

4. The method according to claim 1, in, The step 4: obtaining a task instruction according to the task information set, and distributing the task instruction to a corresponding worker, includes: Get the worker information set; According to the task information set and the worker information set, an allocation relationship is obtained, where the allocation relationship is an allocation correspondence relationship between the task information and the worker; According to the allocation relationship and the task information set, obtain the first task information and the first worker, the second task information and the second worker, and so on until the Nth task and the Nth worker, where N is a positive integer; According to the first task information, a task instruction is obtained, and the task instruction is distributed to the first worker, and so on, the task instruction of the Nth task is distributed to the Nth worker for execution.

5. The method according to claim 1, in, The step 5: based on the task instruction, the worker performs model training to obtain hyperparameter information, including: Obtain parameter value information and training data; According to the parameter value information and training data, the task instruction training model is executed, and the parameters are updated by back propagation to obtain training results; The hyperparameter information is obtained according to the training result.

6. The method according to claim 1, in, The preset value is 0.

7. A distributed botnet model construction device, in, The device comprises: A first obtaining unit, wherein the first obtaining unit is used to set hyperparameter requirements on the client to obtain a computing task graph; A first sending unit, the first sending unit is used to send the computing task graph to a master; A second obtaining unit, wherein the second obtaining unit is used by the master to obtain a task information set according to the computing task graph; a third obtaining unit, the third obtaining unit being used to obtain a task instruction according to the task information set, and distribute the task instruction to a corresponding worker; A first execution unit, the first execution unit is used to perform model training through a worker based on the task instruction, obtain hyperparameter information, and return the hyperparameter information to a client; A second execution unit, the second execution unit is used for the client to formulate the next round of model calculation tasks according to the hyperparameter information; The third execution unit is used to repeat the training of the worker based on the hyperparameter information obtained in the previous round to obtain the hyperparameter information, and calculate the model learning decay rate through the client, and stop the training when the model learning decay rate meets the preset value.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, in, When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

Images