A neural network processing method and related equipment

Abstract

The embodiment of the present application provides a neural network processing method and related equipment in the field of artificial intelligence, which is used to improve the detection success rate of the detection model during the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model. This method can be applied to the training process of the neural network prediction model. In this method, the server obtains training data, and then the server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; finally, the server uses the first convolution feature to input a preset first training network to train a first detection model.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to a neural network processing method and related equipment. Background Art

[0002] Artificial intelligence (AI) is the theory, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a branch of computer science that seeks to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI also studies the design principles and implementation methods of various intelligent machines, enabling them to possess the capabilities of perception, reasoning, and decision-making. Research in the field of AI includes robotics, natural language processing, computer vision, decision-making and reasoning, human-computer interaction, recommendation and search, and basic AI theory.

[0003] Currently, in the field of AI, the deep neural network (DNN)-based network anomaly traffic detection method is a relatively common solution. In this DNN-based anomaly traffic detection method, a training dataset is first obtained, a DNN model is trained using the training dataset, and then the trained DNN model is used to detect traffic.

[0004] However, in the above-mentioned network abnormal traffic detection method based on deep learning, the feature extraction of data is not sufficient, and there is usually a high false alarm rate, resulting in poor detection effect. Summary of the Invention

[0005] The embodiments of the present application provide a neural network processing method and related equipment for improving the detection success rate of the detection model during the detection process, while reducing the false alarm rate of the detection process and improving the detection effect of the model.

[0006] The first aspect of the embodiment of the present application provides a neural network processing method, which can be applied to the training process of a neural network prediction model. In this method, a server obtains training data, and then the server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; finally, the server uses the first convolution feature to input a preset first training network to train a first detection model. The server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, and inputs the first convolution feature into the preset first training network to train a first detection model, where N is greater than 1, that is, in the first training network, the input data of the first detection model is obtained by training, and the training data is extracted by multiple convolution features, which can obtain more effective information to characterize the training data, so that the feature extraction of the training data is more sufficient, which can improve the detection success rate of the detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0007] In a possible implementation of the first aspect, after the server uses the first convolution feature to input a preset first training network to train a first detection model, the method further includes: the server uses the first convolution feature to input the first detection model, and after processing to obtain an initial detection result, the server uses the initial detection result to input a preset second training network to train to obtain a second detection model.

[0008] In this embodiment, after obtaining the first detection model, the server can input the first convolutional feature into the first detection model to obtain an initial detection result corresponding to the training data, and then input the initial detection result into a preset second training network to train a second detection model. That is, the second detection model is further trained based on the initial detection result corresponding to the first convolutional feature in the first detection model. Because the first convolutional feature is obtained by extracting features from the training data using multiple convolutional features, more effective information representing the training data can be obtained, allowing the second detection model to make a comprehensive judgment on the training data, thereby improving the detection effect of the second detection model.

[0009] In a possible implementation of the first aspect, the method further includes: the server obtains the data to be predicted; then, the server performs feature extraction on the data to be predicted according to the N convolution kernels, and obtains target convolution features corresponding to the data to be predicted; thereafter, the target convolution features are input into the first detection model, and the first detection result is obtained by processing; and the first detection result is further input into the second detection model, and the second detection result is obtained by processing.

[0010] In this embodiment, after obtaining the first detection model and the second detection model, the first detection model and the second detection model can be used to predict the data to be predicted, wherein the input data in the first detection model is the target convolution feature, and the target convolution feature is obtained by extracting features from the training data by multiple convolution features respectively, which can obtain more effective information to characterize the data to be predicted, so that the feature extraction of the data to be predicted is more sufficient, which can improve the detection success rate of the first detection model and the second detection model in the detection process, reduce the false alarm rate of the detection process, and improve the detection effect of the model.

[0011] In a possible implementation of the first aspect, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0012] In this embodiment, the target convolution feature is input into the first detection model, and the first detection result obtained by processing includes the sequence feature corresponding to the target convolution feature, and the detection result corresponding to the target convolution feature, that is, the input of the subsequent second detection model includes the sequence feature corresponding to the target convolution feature and the detection result corresponding to the target convolution feature, so that the second detection model makes a comprehensive judgment on the data to be detected based on the judgment result given by the second detection model for the data to be detected and the learned sequence feature, which can further improve the detection effect of the second detection model on the data to be predicted.

[0013] In a possible implementation of the first aspect, the initial detection result includes a sequence feature corresponding to the first convolution feature and a detection result corresponding to the first convolution feature.

[0014] In this embodiment, the server uses the first convolution feature to input the first detection model, and processes the initial detection result to obtain a sequence feature corresponding to the first convolution feature, and a detection result corresponding to the first convolution feature. That is, the training data input by the server to the second detection model includes a sequence feature corresponding to the first convolution feature, and a detection result corresponding to the first convolution feature, so that the second detection model can comprehensively train the judgment result given for the data to be detected and the learned sequence feature for the data to be detected, which can further improve the detection effect of the subsequent second detection model in the detection process.

[0015] In a possible implementation of the first aspect, the model type of the first detection model is a long short-term memory network (LSTM).

[0016] In this embodiment, the model type of the first detection model can be LSTM, where the main feature of LSTM is to avoid the gradient hour problem of conventional recurrent neural networks through a special network structure design, and is suitable for processing and predicting events with relatively long intervals and delays in time series. That is, the use of LSTM can enable the preset first detection network to learn more sufficient data features of the training data, thereby further improving the detection effect of the first detection model.

[0017] In a possible implementation manner of the first aspect, a model type of the second detection model is a multi-layer perceptron MLP.

[0018] In a possible implementation of the first aspect, the first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; the preset first training network includes N training networks, and the first detection model includes N detection models.

[0019] In this embodiment, when the first convolution feature includes N convolution features corresponding one-to-one to N convolution kernels, the N convolution features can be respectively input into N training networks for training to obtain N detection models, that is, N different convolution features can be trained according to N training networks to obtain corresponding N detection models, which provides a specific implementation method for the first detection model and improves the feasibility of the solution.

[0020] In a possible implementation of the first aspect, the second detection model includes the following:

[0021] o l =σ(W l o l-1 +b l )

[0022] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer.

[0023] In this embodiment, O l-1 The initial value of O0, that is, the value of the first detection result and / or the initial detection result, thereby providing a specific implementation method included in the implementation of the second detection model, improving the feasibility of the solution.

[0024] In a possible implementation of the first aspect, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following method:

[0025] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0026] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0027] In this embodiment, a specific implementation method of the loss function corresponding to the second detection model is provided to improve the feasibility of the solution.

[0028] In a possible implementation manner of the first aspect, the dimension of the first convolution feature is one-dimensional.

[0029] In this embodiment, since there is a certain correlation between similar characters in the data to be detected, the dimension of the first convolution feature can be implemented as one dimension to avoid the situation where the correlation becomes weaker after spanning multiple characters. Similarly, the dimension of the target convolution feature can also be one dimension.

[0030] In a possible implementation manner of the first aspect, the training data includes traffic data packets or traffic logs.

[0031] In this embodiment, the training data can be traffic data packets or traffic logs corresponding to the network traffic detection field, thereby providing a specific implementation method for training data and improving the feasibility of the solution. Similarly, the data to be predicted can also include traffic data packets or traffic logs.

[0032] In a possible implementation manner of the first aspect, the training data includes a payload and / or a message body.

[0033] In this embodiment, the training data may include the payload and / or message body of a traffic data packet, or the payload and / or message body of a traffic log packet. This provides a specific implementation method for training data and improves the feasibility of the solution. Similarly, the data to be predicted may also include the payload and / or message body.

[0034] The second aspect of the embodiment of the present application provides a neural network processing method that can be applied to the prediction process of the neural network. In this method, the server obtains the data to be predicted; then, the server extracts features of the data to be predicted according to N convolution kernels respectively to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1; finally, the server uses the target convolution features to input the first detection model to obtain a first detection result. Among them, the server extracts features of the data to be predicted according to N convolution kernels respectively to obtain target convolution features corresponding to the data to be predicted, and inputs the target convolution features into the first detection model to obtain a first detection result, where N is greater than 1, that is, the input data of the first detection model is obtained by extracting features of the data to be predicted by multiple convolution features respectively, which can obtain more effective information to characterize the data to be predicted, so that the feature extraction of the data to be predicted is more sufficient, which can improve the detection success rate of the first detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0035] In a possible implementation of the second aspect, the server uses the target convolution feature to input the first detection model, and after processing to obtain the first detection result, the method also includes: the server uses the first detection result to input the second detection model, and processing to obtain the second detection result.

[0036] In this embodiment, after obtaining the first detection result corresponding to the target convolution feature in the first detection model, the first detection result can be used to process the second detection model to obtain the second detection result. Since the target convolution feature is obtained by extracting features of the data to be predicted by multiple convolution features respectively, more effective information characterizing the data to be predicted can be obtained, so that the second detection model can make a comprehensive judgment on the data to be predicted, thereby improving the detection effect of the second detection model on the data to be predicted.

[0037] In a possible implementation of the second aspect, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0038] In this embodiment, the target convolution feature is input into the first detection model, and the first detection result obtained by processing includes the sequence feature corresponding to the target convolution feature, and the detection result corresponding to the target convolution feature, that is, the input of the subsequent second detection model includes the sequence feature corresponding to the target convolution feature and the detection result corresponding to the target convolution feature, so that the second detection model makes a comprehensive judgment on the data to be detected based on the judgment result given by the second detection model for the data to be detected and the learned sequence feature, which can further improve the detection effect of the second detection model on the data to be predicted.

[0039] In a possible implementation of the second aspect, the model type of the first detection model is a long short-term memory network (LSTM).

[0040] In this embodiment, the model type of the first detection model can be LSTM, where the main feature of LSTM is to avoid the gradient hour problem of conventional recurrent neural networks through a special network structure design, and is suitable for processing and predicting events with relatively long intervals and delays in time series. That is, the use of LSTM can enable the preset first detection network to learn more sufficient data features of the training data, thereby further improving the detection effect of the first detection model.

[0041] In a possible implementation manner of the first aspect, a model type of the second detection model is a multi-layer perceptron MLP.

[0042] In a possible implementation of the second aspect, the target convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; wherein the first detection model includes N detection models.

[0043] In this embodiment, when the first convolution feature includes N convolution features corresponding one-to-one to N convolution kernels, the N convolution features can be respectively input into N training networks for training to obtain N detection models, that is, N different convolution features can be trained according to N training networks to obtain corresponding N detection models, which provides a specific implementation method for the first detection model and improves the feasibility of the solution.

[0044] In a possible implementation of the second aspect, the second detection model includes the following:

[0045] o l =σ(W l o l-1 +b l )

[0046] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer.

[0047] In this embodiment, O l-1 The initial value of O0, that is, the value of the first detection result and / or the initial detection result, thereby providing a specific implementation method included in the implementation of the second detection model, improving the feasibility of the solution.

[0048] In a possible implementation of the second aspect, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following method:

[0049] cross_entropy=-[y i log(y′ i )+(1-y i )1og(1-y′ i )]

[0050] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0051] In this embodiment, a specific implementation method of the loss function corresponding to the second detection model is provided to improve the feasibility of the solution.

[0052] In a possible implementation manner of the second aspect, the dimension of the target convolution feature is one-dimensional.

[0053] In this embodiment, since there is a certain correlation between similar characters in the data to be detected, the dimension of the first convolution feature can be implemented as one dimension, which can avoid the situation where the correlation becomes weak after spanning multiple characters.

[0054] In a possible implementation manner of the second aspect, the data to be predicted includes a traffic data packet or a traffic log.

[0055] In this embodiment, the training data can be traffic data packets or traffic logs corresponding to the network traffic detection field, thereby providing a specific implementation method for training data and improving the feasibility of the solution. Similarly, the data to be predicted can also include traffic data packets or traffic logs.

[0056] A third aspect of the embodiments of the present application provides a neural network processing device, characterized by comprising:

[0057] An acquisition unit, used to acquire training data;

[0058] a feature extraction unit, configured to perform feature extraction on the training data according to N convolution kernels respectively to obtain a first convolution feature corresponding to the training data, where N is greater than 1;

[0059] The training unit is used to use the first convolution feature to input a preset first training network to train and obtain a first detection model.

[0060] In this embodiment, the feature extraction unit performs feature extraction on the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, and inputs the first convolution feature into a preset first training network. The training unit trains to obtain a first detection model, wherein N is greater than 1, that is, in the first training network, training is performed to obtain the input data of the first detection model, and the training data is extracted by multiple convolution features respectively, which can obtain more effective information to characterize the training data, so that the feature extraction of the training data is more sufficient, which can improve the detection success rate of the detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0061] In a possible implementation of the third aspect, the apparatus further includes a processing unit;

[0062] The processing unit is further configured to use the first convolution feature to input the first detection model and process the first convolution feature to obtain an initial detection result;

[0063] The training unit is further configured to utilize the initial detection result to input a preset second training network to obtain a second detection model through training.

[0064] In a possible implementation of the third aspect,

[0065] The acquisition unit is further used to acquire the data to be predicted;

[0066] The feature extraction unit is further configured to perform feature extraction on the data to be predicted according to the N convolution kernels to obtain target convolution features corresponding to the data to be predicted;

[0067] The processing unit is further configured to use the target convolution feature to input the first detection model and process the model to obtain a first detection result;

[0068] The processing unit is further configured to utilize the first detection result to input into the second detection model, and process the result to obtain a second detection result.

[0069] In a possible implementation of the third aspect, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0070] In a possible implementation of the third aspect, the initial detection result includes a sequence feature corresponding to the first convolution feature and a detection result corresponding to the first convolution feature.

[0071] In a possible implementation of the third aspect, the second detection model includes the following:

[0072] o l =σ(W l ol-1 +b l )

[0073] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer.

[0074] In this embodiment, O l-1 The initial value of O0, that is, the value of the first detection result and / or the initial detection result, thereby providing a specific implementation method included in the implementation of the second detection model, improving the feasibility of the solution.

[0075] In a possible implementation of the third aspect, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following method:

[0076] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0077] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, and y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0078] In this embodiment, a specific implementation method of the loss function corresponding to the second detection model is provided to improve the feasibility of the solution.

[0079] In a possible implementation of the third aspect, the model type of the first detection model is a long short-term memory network (LSTM).

[0080] In a possible implementation manner of the third aspect, a model type of the second detection model is a multi-layer perceptron MLP.

[0081] In a possible implementation of the third aspect, the first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels;

[0082] The preset first training network includes N training networks, and the first detection model includes N detection models.

[0083] In a possible implementation manner of the third aspect, the dimension of the first convolution feature is one-dimensional.

[0084] In a possible implementation manner of the third aspect, the training data includes traffic data packets or traffic logs.

[0085] In a possible implementation manner of the third aspect, the training data includes a payload and / or a message body.

[0086] In the third aspect of the present application, the constituent modules of the neural network processing device can also be used to execute the steps performed in various possible implementation methods of the first aspect. For details, please refer to the first aspect and will not be repeated here.

[0087] A fourth aspect of the embodiments of the present application provides a neural network processing device, characterized by comprising:

[0088] An acquisition unit, used for acquiring data to be predicted;

[0089] A feature extraction unit is used to extract features of the data to be predicted according to N convolution kernels respectively to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1;

[0090] The processing unit is used to use the target convolution feature to input a first detection model to obtain a first detection result.

[0091] In this embodiment, the feature extraction unit performs feature extraction on the data to be predicted according to N convolution kernels to obtain target convolution features corresponding to the data to be predicted, and inputs the target convolution features into the first detection model, and the processing unit processes to obtain a first detection result, wherein N is greater than 1, that is, the input data of the first detection model is obtained by performing feature extraction on the data to be predicted by multiple convolution features, and more effective information to characterize the data to be predicted can be obtained, so that the feature extraction of the data to be predicted is more sufficient, which can improve the detection success rate of the first detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0092] In a possible implementation of the fourth aspect, the processing unit is further configured to:

[0093] The first detection result is input into a second detection model and processed to obtain a second detection result.

[0094] In a possible implementation of the fourth aspect, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0095] In a possible implementation of the fourth aspect, the model type of the first detection model is a long short-term memory network (LSTM).

[0096] In a possible implementation manner of the fourth aspect, a model type of the second detection model is a multi-layer perceptron MLP.

[0097] In a possible implementation of the fourth aspect, the target convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels;

[0098] The first detection model includes N detection models.

[0099] In a possible implementation of the fourth aspect, the second detection model includes the following:

[0100] o l =σ(W l o l-1 +b l )

[0101] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer.

[0102] In this embodiment, O l-1 The initial value of O0, that is, the value of the first detection result and / or the initial detection result, thereby providing a specific implementation method included in the implementation of the second detection model, improving the feasibility of the solution.

[0103] In a possible implementation of the fourth aspect, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following method:

[0104] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0105] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0106] In this embodiment, a specific implementation method of the loss function corresponding to the second detection model is provided to improve the feasibility of the solution.

[0107] In a possible implementation manner of the fourth aspect, the dimension of the target convolution feature is one-dimensional.

[0108] In a possible implementation of the fourth aspect, the data to be predicted includes a traffic data packet or a traffic log.

[0109] In a possible implementation manner of the fourth aspect, the training data includes a payload and / or a message body.

[0110] In the fourth aspect of the present application, the constituent modules of the neural network processing device can also be used to execute the steps performed in various possible implementation methods of the second aspect. For details, please refer to the second aspect and will not be repeated here.

[0111] In a fifth aspect, an embodiment of the present application provides a server, including a processor, the processor and a memory are coupled, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method for acquiring a neural network described in the first or second aspect above is performed.

[0112] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method for acquiring a neural network as described in the first or second aspect above.

[0113] In a seventh aspect, an embodiment of the present application provides a circuit system, which includes a processing circuit, and the processing circuit is configured to execute the neural network acquisition method described in the first aspect or the second aspect above.

[0114] In an eighth aspect, an embodiment of the present application provides a computer program, which, when executed on a computer, enables the computer to execute the method for acquiring a neural network as described in the first or second aspect above.

[0115] In a ninth aspect, the present application provides a chip system, which includes a processor for supporting a server to implement the functions involved in the first or second aspect above, for example, sending or processing the data and / or information involved in the above method. In one possible design, the chip system also includes a memory, which is used to store program instructions and data necessary for the server or communication device. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0116] Among them, the technical effects brought about by the fifth to ninth aspects or any possible implementation methods thereof can refer to the technical effects brought about by the first aspect or different possible implementation methods of the first aspect, or refer to the technical effects brought about by the second aspect or different possible implementation methods of the second aspect, and will not be repeated here.

[0117] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages: the server obtains training data, and then the server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; finally, the server uses the first convolution feature to input a preset first training network to train a first detection model. Among them, the server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, and inputs the first convolution feature into a preset first training network to train a first detection model, where N is greater than 1, that is, in the first training network, the input data of the first detection model is obtained by training, and the training data is extracted by multiple convolution features, which can obtain more effective information to characterize the training data, so that the feature extraction of the training data is more sufficient, which can improve the detection success rate of the detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0118] Figure 1 A schematic diagram of the structure of the artificial intelligence main framework provided in the embodiment of the present application;

[0119] Figure 2-1 A schematic diagram of a network structure of a neural network processing system provided in an embodiment of the present application;

[0120] Figure 2-2 A schematic diagram of another network structure of a neural network processing system provided in an embodiment of the present application;

[0121] Figure 3 A schematic diagram of the structure of a convolutional neural network provided in an embodiment of the present application;

[0122] Figure 4 Another structural diagram of a convolutional neural network provided in an embodiment of the present application;

[0123] Figure 5 A flowchart of a neural network processing method provided in an embodiment of the present application;

[0124] Figure 6 Another flowchart of a neural network processing method provided in an embodiment of the present application;

[0125] Figure 7 Another flowchart of a neural network processing method provided in an embodiment of the present application;

[0126] Figure 8-1 Another flowchart of a neural network processing method provided in an embodiment of the present application;

[0127] Figure 8-2 Another flowchart of a neural network processing method provided in an embodiment of the present application;

[0128] Figure 9 A schematic diagram of a neural network processing device provided in an embodiment of the present application;

[0129] Figure 10 Another schematic diagram of a neural network processing device provided in an embodiment of the present application;

[0130] Figure 11 A schematic diagram of the structure of a server provided in an embodiment of the present application;

[0131] Figure 12 A schematic diagram of the structure of the chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0132] The embodiments of the present application provide a neural network processing method and related equipment in the field of artificial intelligence, which are used to improve the detection success rate of the detection model during the detection process, reduce the false alarm rate of the detection process, and improve the detection effect of the model.

[0133] The following is an illustrative description of some of the terms used in the embodiments of this application:

[0134] Deep learning: A type of machine learning technology based on deep neural network algorithms. Its main feature is the use of multiple nonlinear transformations to process and analyze data. It is mainly used in perception and decision-making scenarios in the field of artificial intelligence, such as image and speech recognition, natural language translation, and computer game theory.

[0135] Convolutional neural networks (CNNs) are a type of feedforward neural network with a deep structure that uses convolutional computations. They are a representative algorithm for deep learning and are capable of representation learning.

[0136] Long short-term memory (LSTM) is a time-recurrent neural network whose main feature is to avoid the gradient shrinkage problem of conventional recurrent neural networks through a special network structure design. It is suitable for processing and predicting events with relatively long intervals and delays in time series.

[0137] Multilayer perceptron (MLP): A feedforward neural network consisting of an input layer, an output layer, and one or more hidden layers. The layers of an MLP are typically fully connected.

[0138] The following will describe the technical solutions in the embodiments of this application in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0139] Figure 1 A schematic diagram of an artificial intelligence main framework is shown, which describes the overall workflow of the artificial intelligence system and is applicable to general artificial intelligence field needs.

[0140] The following explains the above artificial intelligence theme framework from the two dimensions of "intelligent information chain" (horizontal axis) and "IT value chain" (vertical axis).

[0141] The "intelligent information chain" reflects the entire process from data acquisition to processing. For example, it can be a general process of intelligent information perception, intelligent information representation and formation, intelligent reasoning, intelligent decision-making, and intelligent execution and output. In this process, data undergoes a condensed process of "data-information-knowledge-wisdom."

[0142] The "IT value chain" reflects the value that artificial intelligence brings to the information technology industry, from the underlying infrastructure of human intelligence, information (providing and processing technology implementation) to the system's industrial ecological process.

[0143] (1) Infrastructure:

[0144] Infrastructure provides computing power for AI systems, enabling communication with the outside world and supporting this through a foundational platform. External communication occurs through sensors; computing power is provided by intelligent chips (CPUs, NPUs, GPUs, ASICs, FPGAs, and other hardware accelerators). The foundational platform includes a distributed computing framework and network-related platform guarantees and support, including cloud storage and computing, and interconnected networks. For example, sensors communicate with the outside world to acquire data, which is then fed into the intelligent chips within the distributed computing system provided by the foundational platform for computation.

[0145] (2) Data

[0146] Data above the infrastructure layer represents data sources for AI. This data includes graphics, images, voice, and text, as well as IoT data from traditional devices. This includes business data from existing systems and sensor data such as force, displacement, liquid level, temperature, and humidity.

[0147] (3) Data processing

[0148] Data processing generally includes data training, machine learning, deep learning, search, reasoning, decision-making, etc.

[0149] Among them, machine learning and deep learning can symbolize and formalize data for intelligent information modeling, extraction, preprocessing, and training.

[0150] Reasoning refers to the process of simulating human intelligent reasoning in computers or intelligent systems, using formalized information to perform machine thinking and solve problems based on reasoning control strategies. Typical functions are search and matching.

[0151] Decision-making refers to the process of making decisions after intelligent information is reasoned, and usually provides functions such as classification, sorting, and prediction.

[0152] (4) General ability

[0153] After the data has undergone the data processing mentioned above, some general capabilities can be further formed based on the results of the data processing, such as algorithms or a general system, for example, translation, text analysis, computer vision processing, speech recognition, image recognition, etc.

[0154] (5) Smart products and industry applications

[0155] Smart products and industry applications refer to the products and applications of artificial intelligence systems in various fields. They are the encapsulation of the overall artificial intelligence solution, which productizes intelligent information decision-making and realizes practical application. Its application areas mainly include: smart manufacturing, smart transportation, smart home, smart medical care, smart security, autonomous driving, safe cities, smart terminals, etc.

[0156] based on Figure 1 The embodiment shown, specifically Figure 1 The artificial intelligence framework in [1] can be applied in the data prediction process. Network service platforms may suffer from various network attacks, such as DDoS attacks, flooding attacks, etc. Since deep learning algorithms have shown good performance in many fields, deep learning methods have been applied to network abnormal traffic detection in recent years in order to improve detection performance. Anomaly detection research based on deep learning methods mainly includes DNN-based methods, RNN-based methods, and CNN-based methods. Figure 2-1The general process of the deep learning-based network traffic anomaly detection solution shown is as follows: first, training data is acquired, followed by data annotation and feature extraction. The training data is then used to train a deep learning model, and finally, network traffic is detected. The data annotation and feature extraction steps begin by annotating packets manually or through automated tools. Feature extraction is then performed on these captured packets, for example, using the frequency of each ASCII character in each packet's payload as a packet feature. The packets are then annotated manually or through tools. A deep learning model is trained using normal and abnormal packets with known labels. Finally, the trained deep learning model is used to make real-time judgments on live network traffic, which has undergone the same feature extraction.

[0157] For example, the DNN-based network abnormal traffic detection method is a commonly used network abnormal traffic detection solution. DNN consists of multiple neuron nodes, and the connection between any two nodes is assigned different weights. This is to show the relationship between the nodes. The deep neural network structure consists of three parts, such as Figure 2-2 As shown in the figure, the first set of nodes is the input layer, the second set of nodes serves as the intermediate hidden layer, and the last set is the output layer. Activation functions are added between layers to control the output, giving the overall structure a nonlinear structure. A DNN-based abnormal traffic detection solution requires network traffic to be represented as feature vectors. First, a training dataset is obtained, a DNN model is trained using the dataset, and then the trained DNN model is used to detect traffic.

[0158] However, in the above-mentioned network abnormal traffic detection method based on deep learning, the feature extraction of data is not sufficient, and there is usually a high false alarm rate, resulting in poor detection effect.

[0159] In order to solve the above problems, the embodiments of the present application provide a neural network processing method and related equipment in the field of artificial intelligence, which are used to improve the detection success rate of the detection model during the detection process, reduce the false alarm rate of the detection process, and improve the detection effect of the model.

[0160] Given that the core steps of the method involved in this application include the processing of convolutional neural networks, the convolutional neural network will be first introduced below. Among them, a convolutional neural network (CNN) is a deep neural network with a convolutional structure and a deep learning architecture. A deep learning architecture refers to multiple levels of learning at different levels of abstraction through machine learning algorithms. As a deep learning architecture, CNN is a feed-forward artificial neural network in which each neuron responds to overlapping areas in the image input to it.

[0161] like Figure 3 As shown, a convolutional neural network (CNN) 100 may include an input layer 110, a convolution layer / pooling layer 120, wherein the pooling layer is optional, and a neural network layer 130. The input layer 110 is used to input training data and / or data to be predicted.

[0162] Convolutional layer / pooling layer 120:

[0163] Convolutional layer:

[0164] like Figure 3The convolution layer / pooling layer 120 shown may include, for example, a convolution layer 121 and a pooling layer 122. In one implementation, the output of the convolution layer may serve as the input of a subsequent pooling layer. The convolution layer 121 may include a plurality of convolution operators, also known as kernels, which function in image processing to be equivalent to a filter that extracts specific information from an input image matrix. The convolution operator may essentially be a weight matrix, which is usually predefined. During the convolution operation on the image, the weight matrix is ​​usually processed horizontally on the input image, one pixel at a time (or two pixels at a time, depending on the value of the stride), thereby extracting specific features from the image. The size of the weight matrix should be related to the size of the image. It should be noted that the depth dimension of the weight matrix is ​​the same as the depth dimension of the input image. During the convolution operation, the weight matrix extends to the entire depth of the input image. Therefore, convolution with a single weight matrix will produce a convolution output with a single depth dimension. However, in most cases, a single weight matrix is ​​not used. Instead, multiple weight matrices of the same dimension are applied. The output of each weight matrix is ​​stacked to form the depth dimension of the convolved image. Different weight matrices can be used to extract different features in the image. For example, one weight matrix is ​​used to extract image edge information, another weight matrix is ​​used to extract specific colors of the image, and another weight matrix is ​​used to blur unwanted noise in the image... The multiple weight matrices have the same dimension, and the feature maps extracted by the multiple weight matrices with the same dimension also have the same dimension. The extracted multiple feature maps with the same dimension are then merged to form the output of the convolution operation.

[0165] The weight values ​​in these weight matrices need to be obtained through a lot of training in practical applications. The weight matrices formed by the weight values ​​obtained through training can extract information from the input image, thereby helping the convolutional neural network 100 to make correct predictions.

[0166] Pooling layer:

[0167] Since it is often necessary to reduce the number of training parameters, a pooling layer is often introduced after the convolution layer, such as Figure 3The pooling layer 122 illustrated in 120 may be a convolution layer followed by a pooling layer. In the image processing process, the sole purpose of the pooling layer is to reduce the spatial size of the image. The pooling layer may include an average pooling operator and / or a maximum pooling operator for sampling the input image to obtain an image of smaller size. The average pooling operator may calculate the pixel values ​​in the image within a specific range to produce an average value. The maximum pooling operator may take the pixel with the largest value within a specific range as the result of maximum pooling. In addition, just as the size of the weight matrix used in the convolution layer should be related to the image size, the operator in the pooling layer should also be related to the size of the image. The size of the image output after processing by the pooling layer may be smaller than the size of the image input to the pooling layer, and each pixel in the image output by the pooling layer represents the average value or maximum value of the corresponding sub-region of the image input to the pooling layer.

[0168] Neural Network Layer 130:

[0169] After being processed by the convolution layer / pooling layer 120, the convolution neural network 100 is not sufficient to output the required output information. As mentioned above, the convolution layer / pooling layer 120 only extracts features and reduces the parameters brought by the input image. However, in order to generate the final output information (the required class information or other related information), the convolution neural network 100 needs to use the neural network layer 130 to generate one or a group of outputs of the required number of classes. Therefore, the neural network layer 130 may include multiple hidden layers (such as Figure 3 131, 132 to 13n) and the output layer 140 shown, the parameters contained in the multiple hidden layers can be pre-trained based on relevant training data of specific task types, for example, the task types may include image recognition, image classification, image super-resolution reconstruction, etc.

[0170] After the multiple hidden layers in the neural network layer 130, that is, the last layer of the entire convolutional neural network 100 is the output layer 140, which has a loss function similar to the classification cross entropy, specifically for calculating the prediction error. Once the forward propagation of the entire convolutional neural network 100 (such as Figure 3 The propagation from 110 to 140 is forward propagation), and the reverse propagation (such as Figure 3 The propagation from 140 to 110 is back propagation) and then starts to update the weight values ​​and biases of the aforementioned layers to reduce the loss of the convolutional neural network 100 and the error between the result output by the convolutional neural network 100 through the output layer and the ideal result.

[0171] It should be noted that if Figure 3The convolutional neural network 100 shown is only an example of a convolutional neural network. In specific applications, the convolutional neural network can also exist in the form of other network models, such as Figure 4 The multiple convolutional layers / pooling layers shown are operated in parallel, and the features extracted from each layer are input to the full neural network layer 130 for processing.

[0172] The following is a detailed description of a neural network processing method in an embodiment of the present application. Figure 5 In one embodiment of the present application, a method for processing a neural network includes:

[0173] S101, obtaining training data;

[0174] In this embodiment, it can be applied to the training process of a neural network prediction model. When the server is training the neural network prediction model, the server obtains training data in step S101.

[0175] During the execution of step S101, the server may obtain the training data through an acquisition device, or by communicating with other devices, or by other means, which are not limited here.

[0176] In one possible implementation, the training data includes traffic data packets or traffic logs. The training data can be traffic data packets or traffic logs corresponding to network traffic detection, thereby providing a specific implementation of training data and improving the feasibility of the solution. Similarly, the data to be predicted in this embodiment and subsequent embodiments can also include traffic data packets or traffic logs.

[0177] Furthermore, the training data includes a payload and / or a message body. Specifically, the training data may include the payload and / or message body in a traffic data packet, or the payload and / or message body in a traffic log packet. This provides a specific implementation of the training data and improves the feasibility of the solution. Similarly, the data to be predicted in this embodiment and subsequent embodiments may also include a payload and / or a message body.

[0178] S102, performing feature extraction on the training data according to N convolution kernels to obtain first convolution features corresponding to the training data;

[0179] In this embodiment, the server performs feature extraction on the training data obtained in step S101 according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1, that is, N is an integer greater than 1.

[0180] In one possible implementation, the dimension of the first convolution feature is one-dimensional. Specifically, since there is a certain correlation between similar characters in the data to be detected, the dimension of the first convolution feature can be implemented as one-dimensional to avoid the situation where the correlation weakens after spanning multiple characters. Similarly, the dimension of the target convolution feature can also be one-dimensional.

[0181] S103: Use the first convolutional features to input a preset first training network to train and obtain a first detection model.

[0182] In this embodiment, the server uses the first convolution feature obtained in step S102 as the input of a preset first training network to perform training to obtain a first detection model.

[0183] In one possible implementation, the calculation process in step S102 can obtain that the first convolution feature is obtained by extracting features from the training data according to N convolution kernels, that is, the first convolution feature is the result obtained after separate processing. Therefore, the first convolution feature can include N results (that is, N convolution features), or the N results can be spliced ​​to obtain convolution features less than N. For example, the number of convolution features in the first convolution feature is 1 or other integers less than N, which is not limited here. Correspondingly, in step S103, the number of training networks corresponding to the first training network and the first detection model and the number of monitoring models can also be flexibly configured, which is not limited here. Similarly, in this embodiment and subsequent embodiments, the number of training networks contained in the second training network and the second monitoring model, as well as the number of detection models can also be flexibly configured, which is not limited here.

[0184] Here, the obtained first convolution feature may include N convolution features as an example for explanation. The first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels. At this time, in step S103, the preset first training network includes N training networks, and the first detection model includes N detection models. Among them, when the first convolution feature includes N convolution features corresponding one-to-one to N convolution kernels, the N convolution features can be respectively input into the N training networks for training to obtain N detection models, that is, N different convolution features can be trained according to the N training networks to obtain corresponding N detection models, which provides a specific implementation method for the first detection model and improves the feasibility of the solution.

[0185] In one possible implementation, the model type of the first detection model is RNN, long short-term memory network LSTM or other types of model types, which are not limited here.

[0186] Among them, as a preferred implementation method, the model type of the first detection model can be LSTM, wherein the main feature of LSTM is to avoid the gradient hour problem of conventional recurrent neural networks through a special network structure design, and is suitable for processing and predicting events with relatively long intervals and delays in time series. That is, the use of LSTM can enable the preset first detection network to learn more sufficient data features of the training data, further improving the detection effect of the first detection model.

[0187] In one possible implementation, the model type of the second detection model is a multi-layer perceptron MLP, RNN, long short-term memory network LSTM, or other model types, which are not limited here.

[0188] In this embodiment, the server obtains training data, and then the server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; finally, the server uses the first convolution feature to input a preset first training network to train a first detection model. The server extracts features from the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, and inputs the first convolution feature into the preset first training network to train a first detection model, where N is greater than 1, that is, in the first training network, the input data of the first detection model is obtained by training, and the training data is extracted by multiple convolution features, which can obtain more effective information to characterize the training data, so that the feature extraction of the training data is more sufficient, which can improve the detection success rate of the detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0189] After step S103, corresponding detection results can be further obtained based on the first detection model, and another detection model can be obtained by training using another neural network, which will be introduced below through the implementation of step S104 and step S105.

[0190] S104: Using the first convolutional feature to input the first detection model, and processing to obtain an initial detection result;

[0191] In this embodiment, the server uses the first convolution feature obtained in step S102 as the input of the first detection model to obtain an initial detection result.

[0192] S105: Use the initial detection result to input a preset second training network to train and obtain a second detection model.

[0193] In this embodiment, the server uses the initial detection result obtained in step S104 as the input of the second training network to perform training to obtain the second detection model.

[0194] Specifically, the second detection model can be implemented in various ways. For example, the second detection model can include the following ways:

[0195] o l =σ(W l o l-1 +b l )

[0196] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer. Obviously, the second detection model can be implemented by this formula, or other forms obtained by transformation thereof, which is not limited here.

[0197] In this embodiment, O l-1 The initial value of O0, that is, the value of the first detection result and / or the initial detection result, thereby providing a specific implementation method included in the second detection model implementation, improving the feasibility of the solution.

[0198] In addition, the loss function of the second detection model may include a cross entropy loss function, and the cross entropy loss function includes the following method:

[0199] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0200] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0201] In one possible implementation, the initial detection result obtained in step S104 includes the sequence feature corresponding to the first convolution feature and the detection result corresponding to the first convolution feature. The server uses the first convolution feature to input the first detection model, and the initial detection result obtained by processing includes the sequence feature corresponding to the first convolution feature and the detection result corresponding to the first convolution feature. That is, in step S105, the training data input by the server to the second detection model includes the sequence feature corresponding to the first convolution feature and the detection result corresponding to the first convolution feature, so that the second detection model performs comprehensive training on the judgment result given by the data to be detected and the learned sequence feature on the data to be detected, which can further improve the detection effect of the subsequent second detection model in the detection process. Specifically, the server further trains the second detection model based on the initial detection result corresponding to the first convolution feature in the first detection model. Since the first convolution feature is obtained by extracting features from the training data by multiple convolution features, it can obtain more effective information to characterize the training data, so that the second detection model can make a comprehensive judgment on the training data, thereby improving the detection effect of the second detection model.

[0202] In the embodiment of the present application, the above Figure 5 The embodiment specifically introduces that the input data of the first detection model can be obtained by training in the first training network, and the training data can be extracted by multiple convolution features respectively, so that more effective information representing the training data can be obtained, so that the feature extraction of the training data is more sufficient, and the detection success rate of the detection model in the detection process can be improved. The following will illustrate through specific embodiments that after obtaining the optimized prediction model, the prediction model can be used to optimize the prediction process. Please refer to Figure 6 In one embodiment of the present application, a method for processing a neural network includes:

[0203] S201, obtaining training data;

[0204] In this embodiment, it can be applied to the training process of the neural network prediction model. When the server is training the neural network prediction model, the server obtains the training data in step S201.

[0205] S202, performing feature extraction on the training data according to N convolution kernels to obtain first convolution features corresponding to the training data;

[0206] S203: Use the first convolutional features to input a preset first training network to train and obtain a first detection model.

[0207] S204: Input the first convolutional feature into the first detection model to obtain an initial detection result;

[0208] S205: Input the initial detection result into a preset second training network to obtain a second detection model through training.

[0209] In this embodiment, the implementation of steps S201 to S205 may refer to the implementation process of the aforementioned steps S101 to S105, which will not be repeated here.

[0210] S206, obtaining data to be predicted;

[0211] S207, performing feature extraction on the data to be predicted according to N convolution kernels respectively to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1;

[0212] S208: Use the target convolution feature to input into a first detection model, and process it to obtain a first detection result.

[0213] S209: Use the first detection result to input into a second detection model, and process to obtain a second detection result.

[0214] In this embodiment, after the server obtains the first detection model and the second detection model through steps S201 to S205, it can use the first detection model and the second detection model to predict the data to be predicted in subsequent steps, namely steps S208 and S209.

[0215] Specifically, in step S208 and step S209, the input data in the first detection model is the target convolution feature, and the target convolution feature is obtained by extracting features from the training data using multiple convolution features respectively, which can obtain more effective information to characterize the data to be predicted, so that the feature extraction of the data to be predicted is more sufficient, which can improve the detection success rate of the first detection model and the second monitoring model in the detection process, reduce the false alarm rate of the detection process, and improve the detection effect of the model.

[0216] In one possible implementation, in step S208, the target convolution feature is used to input the first detection model, and the first detection result obtained by processing includes the sequence feature corresponding to the target convolution feature, and the detection result corresponding to the target convolution feature, that is, in the subsequent step S209, the input of the second detection model includes the sequence feature corresponding to the target convolution feature and the detection result corresponding to the target convolution feature, so that the second detection model makes a comprehensive judgment on the data to be detected based on the judgment result given by the second detection model for the data to be detected and the learned sequence feature, which can further improve the detection effect of the second detection model on the data to be predicted.

[0217] In this embodiment, the server obtains the data to be predicted; then, the server performs feature extraction on the data to be predicted according to N convolution kernels to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1; finally, the server uses the target convolution features to input into the first detection model, and processes to obtain a first detection result. Among them, the server performs feature extraction on the data to be predicted according to N convolution kernels to obtain target convolution features corresponding to the data to be predicted, and inputs the target convolution features into the first detection model to obtain a first detection result, where N is greater than 1, that is, the input data of the first detection model is obtained by performing feature extraction on the data to be predicted by multiple convolution features, which can obtain more effective information to characterize the data to be predicted, so that the feature extraction of the data to be predicted is more sufficient, which can improve the detection success rate of the first detection model in the detection process while reducing the false alarm rate of the detection process, thereby improving the detection effect of the model.

[0218] The following is an example implementation of a neural network processing method in this application, using the payload in the traffic data packet as the training data and the data to be predicted. Figure 8-1 , the method comprises the following steps:

[0219] 1) First, extract the packet payload and construct a fixed-length vector of 1600 characters in the American Standard Code for Information Interchange (ASCII) format as the traffic feature. Then, use a one-dimensional convolutional neural network to further extract the above traffic features to obtain a one-dimensional convolutional feature of the traffic.

[0220] It should be noted that the above-mentioned extraction of the payload in the data packet through ASCII is only an exemplary implementation. In the specific implementation process, it can also be implemented through other methods, such as double-byte character set (DBCS), or other implementations, which are not limited here.

[0221] Specifically, in the process of extracting the one-dimensional convolutional features involved in step 1), the data set used contains multiple samples, and each sample contains the payload of a data packet. The payload of each data packet is encoded using ASCII-256 to obtain an encoded string. In order to make the data meet the input requirements, the final string is padded with a fixed length of 1600 (which can be 200 / 400 / 800 or other values) characters (that is, if the encoded string length is less than 1600 characters, empty characters are padded at the end of the sample), and each sample corresponds to a one-hot label (there are two types of labels, namely, packets containing attacks, namely [1,0] and normal packets, namely [0,1]). An example of an encoded sample is as follows:

[0222]

[0223] The characteristic of the data packet Payload encoding is Payload = (p1, p2, ..., p 1600 ), p i Indicates the ASCII code value of the i-th character in the payload of data packet P.

[0224] Use one-dimensional convolution neural network (1D-CNN) to extract one-dimensional convolution features from the encoded traffic features. Figure 7 As shown in the figure, the convolution kernel size of the one-dimensional convolutional neural network used is represented by filter_size, the number of convolution channels is represented by channel_num, the convolution step size is set to 1 (it can also be 2 or other values), and the convolution kernel function adopts a normal distribution.

[0225] The convolution kernel vector is Where m represents the channel number, n (n < 1600) represents the convolution kernel vector number (i.e., the convolution kernel size). Based on the convolution kernel vector F m，n Convolutional features The calculation is as follows:

[0226]

[0227]

[0228]

[0229]

[0230] …

[0231]

[0232] For all channels with a convolution kernel size of n (n < 1600), the convolution kernel vector is calculated to obtain the convolution feature vector set. These feature vectors are concatenated to obtain a convolution feature with a convolution kernel as small as n (n < 1600) as follows:

[0233]

[0234] Let the number of convolution kernels be N. Then, based on N different convolution kernel sizes, N different one-dimensional convolution feature vectors can be obtained, which serve as the input of N deep learning models respectively.

[0235] 2) Training multiple detectors for convolution feature vectors extracted for different convolution kernel sizes, and obtaining the packet judgment results and further features (sequence output) that can be obtained after passing through the detector based on each detector;

[0236] After extracting the convolution features of the data packet, the generated feature vectors are used as inputs of N deep learning models, and the relevant parameters of the models are updated. For each model, the model's judgment label l for the current data packet is output. i And the sequence feature vector H based on the current model i =(h i，1 , h i，2 ,...h i，u ), where u is the length of the sequence feature vector.

[0237] For a data packet P0, by inputting convolution features based on different convolution kernel sizes into different classification models, we can obtain the judgment label set L for P0 based on N different classification models and the sequence feature vector set H based on the current model:

[0238] L=(l1,l2,...,l k )

[0239] H=(h 1，1 , h 1，2 ,…h 1，u , h 2，1 , h 2，2 , h 2，u ,…,h N，1 , h N，2 ,...h N，u )

[0240] The label set L and the sequence feature vector set H based on the current model are concatenated as the input of the multi-layer perceptron for further judgment.

[0241] 3) Use a multi-layer perceptron to calculate the judgment labels and sequence outputs of the above-mentioned multiple detectors for the data packet, and give a comprehensive judgment result for the data packet.

[0242] In order to obtain the final judgment result for the data packet, MLP is used to comprehensively judge the judgment result given by the deep learning model for the same data packet and the sequence features based on the deep learning model. The input of the multi-layer perceptron is:

[0243] [h 1,1 ,h 1,2 ,…h 1,u , h 2,1 ,h 2,2 ,…h 2,u ,…,h N,1 ,h N,2 ,…h N,u ,l1,l2,…,l N ]

[0244] In the MLP model, the hidden elements of each layer satisfy the following formula:

[0245] o l =σ(W l o l-1 +b l )

[0246] Where l represents the lth layer of the model, σ represents the activation function sigmoid, W represents the weight matrix, and b represents the bias vector. The loss function of the model is calculated based on cross entropy, and the cross entropy is defined as follows:

[0247] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )

[0248] Where i represents the number of the data packet in the training data, y′ i represents the final decision label of MLP for the i-th data packet, y i Indicates the true label of the i-th data packet.

[0249] The MLP model maps the sequence features and judgment outputs based on the deep learning model into a two-dimensional vector [K1, K2]: if K1>K2, the sample is marked as abnormal; if K1≤K2, the sample is marked as normal.

[0250] Based on the above Figures 5 to 7 In the embodiment shown, a specific training process and prediction process will be used below to further describe a neural network processing method involved in this application. Figure 8-1 A schematic diagram of a system architecture provided in an embodiment of the present application, based on Figure 8-1 The system structure shown, Figure 8-2 This is the specific method implementation process under this system architecture.

[0251] 1. Data construction process:

[0252] The training dataset is composed of the Mcpad generic attack dataset, the CICIDS2017 attack dataset, 30% of the existing network traffic attack data, and normal traffic captured by Wireshark in a laboratory environment. The test dataset is composed of 70% of the existing network traffic attack data and the captured normal traffic.

[0253] 2. Training process:

[0254] The training dataset is preprocessed to construct a data format suitable for deep learning model input. Based on a convolutional neural network, the ASCII-encoded features of the preprocessed data payload are used to generate a one-dimensional convolutional feature vector. The convolution kernel sizes are set to 1, 2, 3, and 4, resulting in four one-dimensional convolutional feature vectors. These are used to train four LSTM classifiers, respectively, and the trained LSTM models are saved. The MLP model is trained using the outputs of the four trained LSTM classifiers and the resulting sequence feature vectors, and the optimal trained model is saved.

[0255] 3. Testing process:

[0256] The test dataset was preprocessed to construct a data format suitable for deep learning model input. A convolutional neural network was used to generate a one-dimensional convolutional feature vector using the ASCII encoding features of the preprocessed packet payload. The convolution kernel sizes were set to 1, 2, 3, and 4, resulting in four one-dimensional convolutional feature vectors. These were then used as inputs for four LSTM classifiers. The LSTM classifiers generated four preliminary detection results for the packet and the corresponding sets of sequence feature vectors. These four preliminary detection results and the corresponding sets of sequence feature vectors were then fed into the trained MLP model to generate the final anomaly detection results.

[0257] In this embodiment, the beneficial effects that can be obtained include at least:

[0258] 1. Using 1D-CNN for feature extraction can obtain more effective information that can represent network traffic compared to using only ASCII encoding to represent data packets. Furthermore, by extracting 1D-CNN features based on different convolution kernel sizes, we can obtain feature representations from different perspectives of the packet payload.

[0259] 2. Four LSTM classifiers are used to learn four 1D-CNN feature vectors respectively. The trained classification model's judgment results for the same data packet and the learned sequence features are then used to make a comprehensive judgment on the target to be detected, thereby improving the high false alarm rate problem existing in traditional network abnormal traffic detection solutions.

[0260] The present application also provides a neural network processing device, see Figure 9 , Figure 9 A schematic diagram of a structure of a neural network processing device provided in an embodiment of the present application is provided. The neural network processing device 900 includes:

[0261] An acquisition unit 901 is used to acquire training data;

[0262] A feature extraction unit 902 is configured to perform feature extraction on the training data using N convolution kernels to obtain first convolution features corresponding to the training data, where N is greater than 1.

[0263] The training unit 903 is used to use the first convolution feature to input a preset first training network to train and obtain a first detection model.

[0264] In one possible implementation, the apparatus further includes a processing unit 904;

[0265] The processing unit 904 is further configured to use the first convolution feature to input the first detection model and process the first convolution feature to obtain an initial detection result.

[0266] The training unit 903 is further configured to utilize the initial detection result to input a preset second training network to obtain a second detection model through training.

[0267] In one possible implementation,

[0268] The acquisition unit 901 is further configured to acquire data to be predicted;

[0269] The feature extraction unit 902 is further configured to perform feature extraction on the data to be predicted according to the N convolution kernels to obtain target convolution features corresponding to the data to be predicted;

[0270] The processing unit 904 is further configured to use the target convolution feature to input the first detection model to obtain a first detection result;

[0271] The processing unit 904 is further configured to utilize the first detection result to input into the second detection model, and process the result to obtain a second detection result.

[0272] In one possible implementation, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0273] In a possible implementation, the initial detection result includes a sequence feature corresponding to the first convolution feature and a detection result corresponding to the first convolution feature.

[0274] In one possible implementation, the second detection model includes the following:

[0275] o l =σ(W l o l-1 +b l )

[0276] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, O l-1 Represents the output of the previous layer of the current network layer.

[0277] In this embodiment, O l-1 The initial value of , that is, the value of O0, can be the first detection result and / or the initial detection result.

[0278] In one possible implementation, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following:

[0279] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0280] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0281] In one possible implementation, the model type of the first detection model is a long short-term memory network (LSTM).

[0282] In a possible implementation, the first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels;

[0283] The preset first training network includes N training networks, and the first detection model includes N detection models.

[0284] In a possible implementation, the dimension of the first convolution feature is one-dimensional.

[0285] In a possible implementation, the training data includes traffic data packets or traffic logs.

[0286] In one possible implementation, a payload and / or a message body is included.

[0287] It should be noted that the information interaction, execution process, etc. between the modules / units in the neural network processing device 900 are the same as those in the present application. Figure 5 The corresponding method embodiments are based on the same concept. For specific contents, please refer to the description in the method embodiments shown above in this application, which will not be repeated here.

[0288] The present application also provides another neural network processing device, see Figure 10 , Figure 10 A schematic diagram of a structure of a neural network processing device provided in an embodiment of the present application, wherein the neural network processing device 1000 includes:

[0289] An acquisition unit 1001 is used to acquire data to be predicted;

[0290] A feature extraction unit 1002 is configured to extract features of the data to be predicted using N convolution kernels to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1.

[0291] The processing unit 1003 is configured to utilize the target convolution feature to input into a first detection model and process the model to obtain a first detection result.

[0292] In one possible implementation, the processing unit 1003 is further configured to:

[0293] The first detection result is input into a second detection model and processed to obtain a second detection result.

[0294] In one possible implementation, the first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

[0295] In one possible implementation, the second detection model includes the following:

[0296] o l =σ(W l o l-1 +b l )

[0297] Among them, l represents the lth layer of the model, σ represents the activation function, W represents the weight matrix, b represents the bias vector, O l Represents the output of the current network layer, Ol-1 Represents the output of the previous layer of the current network layer.

[0298] In this embodiment, O l-1 The initial value of , that is, the value of O0, can be the first detection result and / or the initial detection result.

[0299] In one possible implementation, the loss function of the second detection model includes a cross entropy loss function, and the cross entropy loss function includes the following:

[0300] cross_entropy=-[y i log(y′ i )+(1-y i )log(1-y′ i )]

[0301] Where i represents the number of the data packet in the training data and / or the data to be predicted, y′ i represents the judgment label of the second detection model for the i-th data packet in the training data and / or the data to be predicted, y i Indicates the true label of the i-th data packet in the training data and / or the data to be predicted.

[0302] In one possible implementation, the model type of the first detection model is a long short-term memory network (LSTM).

[0303] In a possible implementation, the target convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels;

[0304] The first detection model includes N detection models.

[0305] In one possible implementation, the dimension of the target convolution feature is one-dimensional.

[0306] In a possible implementation, the data to be predicted includes traffic data packets or traffic logs.

[0307] It should be noted that the information interaction, execution process, etc. between the modules / units in the neural network processing device 1000 are the same as those in the present application. Figure 6 The corresponding method embodiments are based on the same concept. For specific contents, please refer to the description in the method embodiments shown above in this application, which will not be repeated here.

[0308] The present application also provides a server. Figure 11 , Figure 11 This is a schematic diagram of a server structure provided by an embodiment of the present application. The server 1100 may be deployed with Figure 9The processing device 900 of the neural network described in the corresponding embodiment is used to implement Figure 5 The functions of the server in the corresponding embodiment, or the server 1100 may be deployed with Figure 10 The processing device 1000 of the neural network described in the corresponding embodiment is used to implement Figure 6 The functions of the server in the corresponding embodiment. Specifically, the server 1100 is implemented by one or more servers. The server 1100 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 1123 (for example, one or more processors) and memory 1132, one or more storage media 1130 (for example, one or more massive storage devices) for storing application programs 1142 or data 1144. Among them, the memory 1132 and the storage medium 1130 can be short-term storage or persistent storage. The program stored in the storage medium 1130 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1122 can be configured to communicate with the storage medium 1130 to execute a series of instruction operations in the storage medium 1130 on the server 1100. However, it should be understood that Figure 11 The server shown in the figure is only an example of a server. The server 1100 may not include the memory 1132 and the storage medium 1130. Instead, an external memory may be configured outside the server 1100. That is, the memory 1132 and the storage medium 1130 and the central processing unit 1122 may be independent devices. As an example, an external memory is used in a vehicle-mounted server.

[0309] The server 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input and output interfaces 1158, and / or one or more operating systems 1141, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0310] In the embodiment of the present application, the central processing unit 1122 is used to execute Figure 5 The processing method of the neural network executed by the server in the corresponding embodiment, or for executing Figure 6 The processing method of the neural network executed by the server in the corresponding embodiment. It should be noted that the specific implementation of the processing method of the neural network executed by the central processing unit 1122 can refer to Figure 5 、 Figure 6The descriptions in the corresponding method embodiments will not be repeated here one by one.

[0311] The present application also provides a computer program product which, when executed on a computer, enables the computer to execute the aforementioned Figure 5 The steps executed by the server in the method described in the embodiment shown, or the steps that cause the computer to execute the above Figure 6 The illustrated embodiment describes the steps performed by the server in the method.

[0312] The present application also provides a computer-readable storage medium in which a program for signal processing is stored. When the program is run on a computer, the computer executes the above-mentioned Figure 5 The steps executed by the server in the method described in the embodiment shown, or the steps that cause the computer to execute the above Figure 6 The illustrated embodiment describes the steps performed by the server in the method.

[0313] The execution device, training device, terminal device or communication device provided in the embodiment of the present application can be specifically a chip, which includes: a processing unit and a communication unit. The processing unit can be, for example, a processor, and the communication unit can be, for example, an input / output interface, a pin or a circuit. The processing unit can execute the computer execution instructions stored in the storage unit to enable the chip in the server to execute the above Figure 5 The processing method of the neural network described in the embodiment shown, or, to enable the chip in the server to execute the above Figure 6 The processing method of the neural network described in the illustrated embodiment. Optionally, the storage unit is a storage unit within the chip, such as a register, a cache, etc. The storage unit may also be a storage unit located outside the chip within the wireless access device, such as a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM), etc.

[0314] For details, please refer to Figure 12 , Figure 12 This is a schematic diagram of the structure of a chip provided in an embodiment of the present application. The chip can be represented as a neural network processor NPU 120. NPU 120 is mounted on the host CPU as a coprocessor and is assigned tasks by the host CPU. The core of the NPU is the arithmetic circuit 120, which controls the arithmetic circuit 1203 through the controller 1204 to extract matrix data from the memory and perform multiplication operations.

[0315] In some implementations, the arithmetic circuit 1203 includes multiple processing units (PEs). In some implementations, the arithmetic circuit 1203 is a two-dimensional systolic array. The arithmetic circuit 1203 can also be a one-dimensional systolic array or other electronic circuitry capable of performing mathematical operations such as multiplication and addition. In some implementations, the arithmetic circuit 1203 is a general-purpose matrix processor.

[0316] For example, assume there are input matrix A, weight matrix B, and output matrix C. The arithmetic circuit retrieves the corresponding data of matrix B from weight memory 1202 and caches it on each PE in the arithmetic circuit. The arithmetic circuit retrieves the data of matrix A from input memory 1201 and performs a matrix operation on matrix B. The partial or final matrix result is stored in accumulator 1208.

[0317] Unified memory 1206 is used to store input and output data. Weight data is directly transferred to weight memory 1202 through the Direct Memory Access Controller (DMAC) 1205. Input data is also transferred to unified memory 1206 through the DMAC.

[0318] BIU stands for Bus Interface Unit, i.e., bus interface unit 1210 , which is used for interaction between the AXI bus, DMAC, and instruction fetch buffer (IFB) 1209 .

[0319] The bus interface unit 1210 (BIU) is used for the instruction fetch memory 1209 to obtain instructions from the external memory, and is also used for the storage unit access controller 1205 to obtain the original data of the input matrix A or the weight matrix B from the external memory.

[0320] DMAC is mainly used to transfer input data in the external memory DDR to the unified memory 1206 or transfer weight data to the weight memory 1202 or transfer input data to the input memory 1201.

[0321] The vector calculation unit 1207 includes multiple operation processing units. When necessary, it further processes the output of the operation circuit, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, etc. It is mainly used for non-convolutional / fully connected layer network calculations in neural networks, such as batch normalization, pixel-level summation, and upsampling of feature planes.

[0322] In some implementations, the vector calculation unit 1207 can store the processed output vector to the unified memory 1206. For example, the vector calculation unit 1207 can apply a linear function and / or a nonlinear function to the output of the operation circuit 1203, such as linear interpolation of the feature plane extracted by the convolution layer, or accumulate a vector of values ​​to generate an activation value. In some implementations, the vector calculation unit 1207 generates a normalized value, a pixel-level summed value, or both. In some implementations, the processed output vector can be used as an activation input to the operation circuit 1203, for example, for use in a subsequent layer in a neural network.

[0323] An instruction fetch buffer 1209 connected to the controller 1204 is used to store instructions used by the controller 1204;

[0324] Unified memory 1206, input memory 1201, weight memory 1202, and instruction fetch memory 1209 are all on-chip memories. External memories are private to the NPU hardware architecture.

[0325] Among them, when the first neural network, skill, new skill or skill selected by the second neural network is specifically expressed as a neural network, the operations of each layer in the neural network can be performed by the operation circuit 1203 or the vector calculation unit 1207.

[0326] The processor mentioned in any of the above places can be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the above-mentioned first aspect method.

[0327] It should also be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided in this application, the connection relationship between the modules indicates that there is a communication connection between them, which can be specifically implemented as one or more communication buses or signal lines.

[0328] Through the description of the above embodiments, it is clear to those skilled in the art that the present application can be implemented by means of software plus necessary general-purpose hardware, and of course it can also be implemented by means of dedicated hardware including application-specific integrated circuits, dedicated CPUs, dedicated memories, dedicated components, etc. In general, all functions performed by computer programs can be easily implemented with corresponding hardware, and the specific hardware structures used to implement the same function can also be various, such as analog circuits, digital circuits, or dedicated circuits, etc. However, for the present application, software program implementation is a better implementation method in most cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer's floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0329] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0330] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, a computer, a server, or a data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode to another website, a computer, a server, or a data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium can be a magnetic medium, (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state drive (SSD)).

Claims

1. A method for processing a neural network, characterized in that: include: Get training data; Feature extraction is performed on the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; the first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; the first convolution feature is input into a preset first training network to obtain a first detection model through training; the preset first training network includes N training networks, and the N convolution features are input into the N training networks to obtain N detection models through training, and the first detection model includes the N detection models.

2. The method according to claim 1, characterized in that After the first convolutional feature is input into a preset first training network to obtain a first detection model through training, the method further includes: Using the first convolutional feature to input the first detection model, and processing to obtain an initial detection result; The initial detection results are input into a preset second training network to train and obtain a second detection model.

3. The method according to claim 2, characterized in that The method further comprises: Obtain the data to be predicted; Performing feature extraction on the data to be predicted according to the N convolution kernels to obtain target convolution features corresponding to the data to be predicted; Using the target convolution feature to input the first detection model, and processing to obtain a first detection result; The first detection result is input into the second detection model, and the second detection result is obtained through processing.

4. The method according to claim 3, characterized in that The first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

5. The method according to any one of claims 2 to 4, characterized in that The initial detection result includes a sequence feature corresponding to the first convolution feature and a detection result corresponding to the first convolution feature.

6. The method according to any one of claims 1 to 4, characterized in that The model type of the first detection model is a long short-term memory network LSTM.

7. The method according to any one of claims 1 to 4, characterized in that The dimension of the first convolution feature is one dimension.

8. A method for processing a neural network, characterized in that: include: Obtain the data to be predicted; Performing feature extraction on the data to be predicted according to N convolution kernels to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1; the target convolution features include N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; The target convolution feature is input into a first detection model, and a first detection result is obtained by processing; the first detection model includes N detection models, and the N detection models are obtained by training by inputting N convolution features into N training networks respectively.

9. The method according to claim 8, characterized in that After inputting the target convolution feature into a first detection model and processing to obtain a first detection result, the method further includes: The first detection result is input into a second detection model and processed to obtain a second detection result.

10. The method according to claim 9, characterized in that The first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

11. The method according to any one of claims 8 to 10, characterized in that The model type of the first detection model is a long short-term memory network LSTM.

12. The method according to any one of claims 8 to 10, characterized in that The dimension of the target convolution feature is one-dimensional.

13. A neural network processing device, characterized in that: include: An acquisition unit, used to acquire training data; a feature extraction unit, configured to perform feature extraction on the training data according to N convolution kernels to obtain a first convolution feature corresponding to the training data, where N is greater than 1; the first convolution feature includes N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; A training unit is used to use the first convolution feature to input a preset first training network to train a first detection model; the preset first training network includes N training networks, and the N convolution features are respectively input into the N training networks to train N detection models, and the first detection model includes the N detection models.

14. The device according to claim 13, characterized in that The device further comprises a processing unit; The processing unit is further configured to use the first convolutional feature to input the first detection model and process the first convolutional feature to obtain an initial detection result; The training unit is further configured to utilize the initial detection result to input a preset second training network to train and obtain a second detection model.

15. The device according to claim 14, characterized in that The acquisition unit is further configured to acquire data to be predicted; The feature extraction unit is further configured to perform feature extraction on the data to be predicted according to the N convolution kernels to obtain target convolution features corresponding to the data to be predicted; The processing unit is further configured to use the target convolution feature to input the first detection model and process the model to obtain a first detection result; The processing unit is further configured to utilize the first detection result to input into the second detection model, and process the result to obtain a second detection result.

16. The device according to claim 15, characterized in that The first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

17. The device according to any one of claims 14 to 16, characterized in that The initial detection result includes a sequence feature corresponding to the first convolution feature and a detection result corresponding to the first convolution feature.

18. The device according to any one of claims 13 to 16, characterized in that The model type of the first detection model is a long short-term memory network LSTM.

19. The device according to any one of claims 13 to 16, characterized in that The dimension of the first convolution feature is one dimension.

20. A neural network processing device, characterized in that: include: An acquisition unit, used for acquiring data to be predicted; a feature extraction unit, configured to extract features of the data to be predicted according to N convolution kernels, respectively, to obtain target convolution features corresponding to the data to be predicted, where N is greater than 1; the target convolution features include N convolution features, and the N convolution features correspond one-to-one to the N convolution kernels; A processing unit is used to use the target convolution feature to input the first detection model to obtain a first detection result; the first detection model includes N detection models, and the N detection models are obtained by training by inputting N convolution features into N training networks respectively.

21. The device according to claim 20, characterized in that The processing unit is further configured to: The first detection result is input into a second detection model and processed to obtain a second detection result.

22. The device according to claim 21, characterized in that The first detection result includes a sequence feature corresponding to the target convolution feature and a detection result corresponding to the target convolution feature.

23. The device according to any one of claims 20 to 22, characterized in that The model type of the first detection model is a long short-term memory network LSTM.

24. The device according to any one of claims 20 to 22, characterized in that The dimension of the target convolution feature is one-dimensional.

25. A server, characterized in that: The computer comprises a processor coupled to a memory, wherein the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method according to any one of claims 1 to 7 is implemented, or the computer is caused to execute the method according to any one of claims 8 to 12.

26. A computer-readable storage medium comprising a program, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 7, or causes the computer to execute the method according to any one of claims 8 to 12.

Images