Network security monitoring method, device, equipment and computer storage medium

Abstract

The present application discloses a network security monitoring method, device, equipment and computer storage medium, the method comprising obtaining computer operation behavior data and parameters corresponding to the real network environment corresponding to the computer operation behavior data; using a pre-trained computer operation behavior recognition model to recognize the type of computer operation behavior data, and obtain the computer operation behavior type corresponding to the computer operation behavior data; using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type, to recognize the network environment parameters of the computer operation behavior data, and obtain the parameters corresponding to the standard network environment corresponding to the computer operation behavior data; based on the standard network environment parameters, the real network environment parameters are securely monitored. The network security monitoring method of the present application can improve the accuracy of network security monitoring, thereby improving network security.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a network security monitoring method, device, equipment and computer storage medium. Background Art

[0002] With the rapid development of computer technology, the storage and computing power of computers has been continuously improved, and the explosive growth and continuous acquisition of various data have become possible, and the era of big data has quietly arrived. For big data platforms that store massive amounts of big data, network security issues are extremely important.

[0003] In the prior art, usually only the network environment in which the real-time computer operation behavior or the historical computer operation behavior in the big data platform is located can be monitored to determine whether there is a network security anomaly in the big data platform.

[0004] However, due to the large amount of data on the big data platform and the uncertainty of the network environment, a single method of monitoring the network environment may lead to low accuracy of network security monitoring. Summary of the invention

[0005] The embodiments of the present application provide a network security monitoring method, apparatus, device and computer storage medium, which can improve the accuracy of network security monitoring and thus improve network security.

[0006] In a first aspect, an embodiment of the present application provides a network security monitoring method, which may include:

[0007] Acquire computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment;

[0008] Using a pre-trained computer operation behavior recognition model, the type of the computer operation behavior data is identified to obtain the computer operation behavior type corresponding to the computer operation behavior data;

[0009] Using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type, the network environment parameter of the computer operation behavior data is recognized to obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment;

[0010] Based on the second network environment parameter, security monitoring is performed on the first network environment parameter.

[0011] In one embodiment, the security monitoring of the first network environment parameter based on the second network environment parameter may include:

[0012] Comparing the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result;

[0013] Based on the comparison result, performing security monitoring on the first network environment parameter;

[0014] When it is monitored that the comparison result is less than or equal to a preset threshold, the first network environment parameter is determined as a dangerous network environment parameter.

[0015] In one of the embodiments, after determining the first network environment parameter as a dangerous network environment parameter when the comparison result is detected to be less than or equal to a preset threshold, the method may further include:

[0016] Using a pre-trained network environment danger type identification model, the type of the dangerous network environment parameter is identified to obtain the network environment danger type corresponding to the first network environment parameter;

[0017] A network security processing script corresponding to the network environment risk type is called to adjust the first network environment parameter.

[0018] In one embodiment, the method of using a pre-trained computer operation behavior recognition model to identify the type of the computer operation behavior data and obtaining the computer operation behavior type corresponding to the computer operation behavior data may also include:

[0019] Acquire a first training sample set; wherein the first training sample set includes computer operation behavior data corresponding to a plurality of types;

[0020] Using a machine learning algorithm to train a preset computer operation behavior recognition model based on the first training sample set to obtain a trained computer operation behavior recognition model;

[0021] The trained computer operation behavior recognition model is determined as a pre-trained computer operation behavior recognition model.

[0022] In one embodiment, the method of using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type to recognize the network environment parameter of the computer operation behavior data and obtaining the second network environment parameter corresponding to the computer operation behavior data may also include:

[0023] Acquire a second training sample set; wherein the second training sample set includes a plurality of computer operation behavior data and parameters corresponding to a standard network environment respectively corresponding to the plurality of computer operation behavior data;

[0024] Using a machine learning algorithm to train a preset network environment parameter identification model based on the second training sample set to obtain a trained network environment parameter identification model;

[0025] The trained network environment parameter identification model is determined as a pre-trained network environment parameter identification model.

[0026] In one embodiment, the method of using a pre-trained network environment risk type identification model to identify the type of the dangerous network environment parameter and obtaining the network environment risk type corresponding to the first network environment parameter may further include:

[0027] Obtain characteristic parameters related to network environment dangers;

[0028] Using a machine learning method to train the preset network environment hazard type recognition based on the characteristic parameters to obtain a trained network environment hazard type recognition model;

[0029] The trained network environment hazard type identification model is determined as the pre-trained network environment hazard type identification model.

[0030] In a second aspect, an embodiment of the present application provides a network security monitoring device, which may include:

[0031] A first acquisition module, used to acquire computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment;

[0032] A first identification module, used to identify the type of the computer operation behavior data by using a pre-trained computer operation behavior identification model, and obtain the computer operation behavior type corresponding to the computer operation behavior data;

[0033] A second identification module is used to identify the network environment parameters of the computer operation behavior data by using a pre-trained network environment parameter identification model corresponding to the computer operation behavior type, and obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment;

[0034] A monitoring module is used to perform security monitoring on the first network environment parameter based on the second network environment parameter.

[0035] In one embodiment, the monitoring module may include:

[0036] A comparison submodule, used to compare the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result;

[0037] A monitoring submodule, configured to perform security monitoring on the first network environment parameter based on the comparison result;

[0038] The determination submodule is used to determine the first network environment parameter as a dangerous network environment parameter when it is monitored that the comparison result is less than or equal to a preset threshold.

[0039] In one embodiment, the device may further include:

[0040] A third identification module is used to identify the type of the dangerous network environment parameter by using a pre-trained network environment danger type identification model to obtain the network environment danger type corresponding to the first network environment parameter;

[0041] The adjustment module is used to call a network security processing script corresponding to the network environment risk type to adjust the first network environment parameter.

[0042] In one embodiment, the device may further include:

[0043] A second acquisition module is used to acquire a first training sample set; wherein the first training sample set includes computer operation behavior data corresponding to a plurality of types;

[0044] A first training module, used to train a preset computer operation behavior recognition model based on the first training sample set using a machine learning algorithm to obtain a trained computer operation behavior recognition model;

[0045] The first determination module is used to determine the trained computer operation behavior recognition model as a pre-trained computer operation behavior recognition model.

[0046] In one embodiment, the device may further include:

[0047] A third acquisition module is used to acquire a second training sample set; wherein the second training sample set includes a plurality of computer operation behavior data and parameters corresponding to a standard network environment respectively corresponding to the plurality of computer operation behavior data;

[0048] A second training module is used to train a preset network environment parameter identification model based on the second training sample set using a machine learning algorithm to obtain a trained network environment parameter identification model;

[0049] The second determination module is used to determine the trained network environment parameter identification model as a pre-trained network environment parameter identification model.

[0050] In one embodiment, the device may further include:

[0051] A fourth acquisition module is used to acquire characteristic parameters related to network environment dangers;

[0052] A third training module is used to train the preset network environment risk type recognition based on the characteristic parameters using a machine learning method to obtain a trained network environment risk type recognition model;

[0053] The third determination module is used to determine the trained network environment hazard type identification model as a pre-trained network environment hazard type identification model.

[0054] In a third aspect, an embodiment of the present application provides a network security monitoring device, the device comprising: a processor and a memory storing computer program instructions;

[0055] When the processor executes the computer program instructions, the network security monitoring method as described in the first aspect is implemented.

[0056] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the network security monitoring method as described in the first aspect is implemented.

[0057] In a fifth aspect, when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the network security monitoring method as described in the first aspect.

[0058] The network security monitoring method, apparatus, device and computer storage medium of the embodiments of the present application can accurately identify the acquired computer operation behavior data and the type of computer operation behavior data through a pre-trained computer operation behavior recognition model, and then call the network environment parameter recognition model corresponding to the computer operation behavior type to identify the network environment parameters corresponding to the computer operation behavior data in a standard network environment, and can accurately identify the standard network environment parameters corresponding to the computer operation behavior data, and then use the standard network environment parameters to perform security monitoring on the real network environment parameters corresponding to the real network environment in which the computer behavior data is located. Therefore, different computer operation behaviors and the standard network environment parameters that need to be configured for different computer operation behaviors are fully considered, and the computer operation behavior recognition model and the network environment parameter recognition model are pre-trained based on this. After accurately identifying the computer operation behavior, the standard network environment parameters corresponding to the computer operation behavior can also be accurately identified, and the real network environment parameters can be monitored based on the standard network environment parameters, thereby improving the accuracy of network security monitoring and thereby improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0060] Figure 1 It is a flowchart of a network security monitoring method provided by an embodiment of the present application;

[0061] Figure 2 is a flowchart of a network security monitoring method provided by another embodiment of the present application;

[0062] Figure 3 is a flowchart of a network security monitoring method provided by another embodiment of the present application;

[0063] Figure 4 is a structural schematic diagram of a network security monitoring device provided by an embodiment of the present application;

[0064] Figure 5 It is a schematic diagram of the structure of an electronic device for network security monitoring provided by an embodiment of the present application. DETAILED DESCRIPTION

[0065] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0066] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0067] In addition, the acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0068] In the prior art, usually only the network environment where the real-time computer operation behavior or historical computer operation behavior in the big data platform is located can be monitored to determine whether there is a network security anomaly in the big data platform. However, due to the large amount of data in the big data platform and the uncertainty of the network environment, the single method of monitoring the network environment may lead to the problem of low accuracy of network security monitoring.

[0069] In order to solve the problems of the prior art, the embodiments of the present application provide a network security monitoring method, device, equipment and computer storage medium. The network security monitoring method provided by the embodiments of the present application is first introduced below.

[0070] Figure 1 is a flow chart of a network security monitoring method provided by an embodiment of the present application. It should be noted that the network security monitoring method can be applied to a network security monitoring device, such as Figure 1 As shown, the network security monitoring method may include the following steps:

[0071] S110, obtaining computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment;

[0072] S120, using a pre-trained computer operation behavior recognition model to recognize the type of the computer operation behavior data, and obtaining a computer operation behavior type corresponding to the computer operation behavior data;

[0073] S130, using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type, identifying the network environment parameter of the computer operation behavior data, and obtaining a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment;

[0074] S140: Perform security monitoring on the first network environment parameter based on the second network environment parameter.

[0075] Therefore, by pre-training a computer operation behavior recognition model, it is possible to accurately recognize the acquired computer operation behavior data, identify the type of the computer operation behavior data, and then call the network environment parameter recognition model corresponding to the computer operation behavior type to identify the network environment parameters corresponding to the computer operation behavior data in a standard network environment. It is possible to accurately identify the standard network environment parameters corresponding to the computer operation behavior data, and then use the standard network environment parameters to perform security monitoring on the real network environment parameters corresponding to the real network environment in which the computer behavior data is located. Therefore, different computer operation behaviors and the standard network environment parameters that need to be configured for different computer operation behaviors are fully considered, and based on this, the computer operation behavior recognition model and the network environment parameter recognition model are pre-trained. After accurately identifying the computer operation behavior, it is also possible to accurately identify the standard network environment parameters corresponding to the computer operation behavior, and monitor the real network environment parameters based on the standard network environment parameters, thereby improving the accuracy of network security monitoring and thereby improving network security.

[0076] Involving S110, obtaining computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment. The computer operation behavior data can be obtained based on a screen recording module, specifically, the content of the computer operation behavior displayed on the display screen recorded by the screen recording module within a preset time is determined as the computer operation behavior data obtained in real time; and based on a network environment parameter monitoring module, the real network environment in which the computer operation behavior is located can be monitored while recording the screen, and the parameters corresponding to the real network environment corresponding to the computer operation behavior data, i.e., the first network environment parameter, can be obtained.

[0077] Involving S120, a pre-trained computer operation behavior recognition model is used to identify the type of computer operation behavior data, and obtain the computer operation behavior type corresponding to the computer operation behavior data; specifically, the computer operation behavior data acquired in real time in the above S110 is input into the pre-trained computer operation behavior recognition model, and the type of the computer operation behavior data acquired in real time is identified, and the computer operation behavior type corresponding to the computer operation behavior data acquired in real time is obtained.

[0078] Involving S130, using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type, the network environment parameters of the computer operation behavior data are recognized to obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment; specifically, after using the computer operation behavior type corresponding to the computer operation behavior data acquired in real time in the above S120, the network environment parameter recognition model corresponding to the computer operation behavior type is called to recognize the standard network environment parameters of the computer operation behavior data to obtain the standard network environment parameters corresponding to the computer operation behavior data under a standard network environment.

[0079] Involving S140, based on the second network environment parameter, the first network environment parameter is security monitored; specifically, based on the standard network environment parameter corresponding to the computer operation behavior data obtained in real time, the real network environment parameter corresponding to the computer operation behavior data obtained in real time is security monitored.

[0080] In some embodiments, Figure 2 is a flowchart of a network security monitoring method provided by another embodiment of the present application, such as Figure 2 As shown, the above S140, based on the second network environment parameter, performs security monitoring on the first network environment parameter, which may specifically include:

[0081] S1401, comparing the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result;

[0082] S1402, based on the comparison result, perform security monitoring on the first network environment parameter;

[0083] S1403: When it is monitored that the comparison result is less than or equal to a preset threshold, determine the first network environment parameter as a dangerous network environment parameter.

[0084] Specifically, for the computer operation behavior data obtained in real time, the above-identified standard network environment parameters are compared with the obtained real network environment parameters for similarity. Based on the similarity comparison results, the security monitoring of the real network environment parameters is realized. When the similarity between the real network environment parameters and the standard network environment is less than or equal to a preset threshold, it is determined that the real network environment is dangerous, the real network environment parameters are determined as dangerous network environment parameters, and a corresponding network environment danger report is generated.

[0085] In this way, by accurately identifying the standard network environment parameters, the real network environment parameters can be monitored, and based on the monitoring results, it can be judged whether the real network environment is dangerous, thereby improving the accuracy of network security monitoring.

[0086] In some embodiments, Figure 3 FIG. 1 is a flow chart of a network security monitoring method provided by another embodiment of the present application. Figure 3 As shown, the above S1403, when the comparison result is less than or equal to the preset threshold, after determining the first network environment parameter as a dangerous network environment parameter, may further specifically include:

[0087] S310, using a pre-trained network environment risk type identification model to identify the type of dangerous network environment parameters, and obtain a network environment risk type corresponding to the first network environment parameter;

[0088] S320, calling a network security processing script corresponding to the network environment risk type to adjust the first network environment parameter.

[0089] Specifically, after identifying that the real network environment corresponding to the computer operation behavior data is dangerous, the real network environment parameters with danger, that is, the dangerous network environment parameters, are input into a pre-trained network environment danger type identification model to identify the type of the dangerous network environment parameters and obtain the network environment danger type corresponding to the real network environment parameters.

[0090] Furthermore, in order to adjust the parameters of the real network environment where there is danger to a standard and normal state, the network security processing script corresponding to the network environment danger type can be called based on the nearest neighbor classifier to adjust the dangerous network environment parameters, wherein different network environment danger types correspond to different network security processing scripts.

[0091] In this way, after accurately monitoring the existence of dangers in the real network environment parameters corresponding to the computer behavior data, the network security processing script corresponding to the network environment danger type is used to adjust the dangerous real network environment to a standard state, that is, to a standard network environment. While achieving high-accuracy monitoring of network security, it can also improve network security.

[0092] In some embodiments, in the above S120, before the type of the computer operation behavior data is identified by using a pre-trained computer operation behavior recognition model and obtaining the computer operation behavior type corresponding to the computer operation behavior data, the following may be specifically included:

[0093] Acquire a first training sample set; wherein the first training sample set includes computer operation behavior data corresponding to a plurality of types;

[0094] Using a machine learning algorithm to train a preset computer operation behavior recognition model based on a first training sample set to obtain a trained computer operation behavior recognition model;

[0095] The trained computer operation behavior recognition model is determined as the pre-trained computer operation behavior recognition model.

[0096] Specifically, obtaining the first training sample set involves obtaining computer operation behavior data corresponding to different types of computer operation behaviors in the big data platform based on the data acquisition module, thereby generating a computer operation behavior database, that is, the first training sample set of the computer operation behavior database includes computer operation behavior data corresponding to multiple types.

[0097] Based on the first training sample set in the above-mentioned computer operation behavior database, a preset computer operation behavior recognition model is trained based on the first training sample set using a machine learning algorithm to obtain a trained computer operation behavior recognition model. The preset computer operation behavior recognition model can adopt a Bi-LSTM (bidirectional long short-term memory) + Attention model, or other machine learning models.

[0098] In this way, by pre-building a computer operation behavior recognition model, the type of computer operation behavior data can be accurately identified in order to accurately identify the computer operation behavior data acquired in real time in the future.

[0099] In some implementations, in the above S130, before the network environment parameter recognition model corresponding to the computer operation behavior type that is pre-trained is used to recognize the network environment parameter of the computer operation behavior data and obtaining the second network environment parameter corresponding to the computer operation behavior data, the following may be specifically included:

[0100] Acquire a second training sample set; wherein the second training sample set includes a plurality of computer operation behavior data and parameters corresponding to a standard network environment respectively corresponding to the plurality of computer operation behavior data;

[0101] Using a machine learning algorithm to train a preset network environment parameter recognition model based on a second training sample set to obtain a trained network environment parameter recognition model;

[0102] The trained network environment parameter identification model is determined as the pre-trained network environment parameter identification model.

[0103] Specifically, obtaining the second training sample set involves configuring corresponding standard network environment parameters for each computer operation behavior on a big data platform based on a data mining module, obtaining a standard network environment parameter database, and constructing an association between computer operation behaviors and standard network environment parameters, so that the second training sample set in the network environment parameter database includes multiple computer operation behavior data and parameters corresponding to the standard network environment corresponding to the multiple computer operation behavior data.

[0104] Then, a machine learning algorithm is used to train the preset network environment parameter identification model based on the above-mentioned computer operation behavior database, the above-mentioned network environment parameter database, and the correlation between the computer operation behavior and the standard network environment parameter to obtain a trained network environment parameter identification model. Among them, the preset network environment parameter identification model is preferably an infinite depth network model, and other machine learning models can also be used.

[0105] In this way, by pre-constructing a network environment parameter recognition model corresponding to the type of computer operation behavior, the trained network environment parameter recognition model can accurately identify the standard network environment parameters corresponding to different types of computer operation behavior data, thereby achieving accurate monitoring of the real network environment.

[0106] In some implementations, the above S310, using a pre-trained network environment risk type identification model to identify the type of dangerous network environment parameters, before obtaining the network environment risk type corresponding to the first network environment parameter, may also include:

[0107] Obtain characteristic parameters related to network environment dangers;

[0108] Using a machine learning method based on characteristic parameters, a preset network environment danger type recognition is trained to obtain a trained network environment danger type recognition model;

[0109] The trained network environment hazard type identification model is determined as the pre-trained network environment hazard type identification model.

[0110] Specifically, characteristic parameters related to network environment hazards are obtained on the big data platform, and the characteristic parameters related to network environment hazards are sorted out based on machine learning and artificial intelligence to sort out the characteristic parameters corresponding to different types of network environment hazards.

[0111] Then, a machine learning method is used to train the preset network environment danger type recognition based on the characteristic parameters corresponding to different network environment danger types, and a trained network environment danger type recognition model is obtained. Among them, the preset network environment danger type recognition model is preferably a Bi-LSTM+Attention model, and other machine learning models can also be used.

[0112] Furthermore, corresponding network security processing scripts are set for different types of network environment risks, and the network security processing script is called based on the nearest neighbor classifier, so that the network security processing script can be driven to adjust the real network environment with risks to a standard and safe state.

[0113] In this way, by pre-building a network environment hazard type identification model, the types of dangerous network environment parameters can be accurately identified, and corresponding network security processing scripts can be set for different types of dangerous network environment parameters to adjust the dangerous network environment parameters and improve the security of the network environment.

[0114] In one example, a computer operation behavior database is pre-built, and a computer operation behavior recognition model is constructed; corresponding network environment parameters are configured for each computer operation behavior, and a network environment parameter recognition model is constructed; based on the computer operation behavior recognition model and the network environment parameter recognition model, network security analysis is implemented according to the user's computer operation behavior and network environment parameters collected in real time, and the analysis results are output; a network environment hazard type recognition model is constructed, and a hazard report of the current network environment is generated based on the network environment hazard type recognition model; based on the hazard report of the current network environment, the corresponding network security processing script is called to implement network environment adjustment.

[0115] Based on the same inventive concept, the present application embodiment also provides a network security monitoring device. Figure 4 The network security monitoring device provided in the embodiment of the present application is described in detail.

[0116] Figure 4 It is a structural schematic diagram of a network security monitoring device provided by an embodiment of the present application.

[0117] like Figure 4 As shown, the network security monitoring device may include:

[0118] A first acquisition module 401 is used to acquire computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment;

[0119] A first identification module 402 is used to identify the type of the computer operation behavior data using a pre-trained computer operation behavior identification model to obtain the computer operation behavior type corresponding to the computer operation behavior data;

[0120] The second identification module 403 is used to identify the network environment parameters of the computer operation behavior data by using a pre-trained network environment parameter identification model corresponding to the computer operation behavior type, and obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment;

[0121] The monitoring module 404 is used to perform security monitoring on the first network environment parameter based on the second network environment parameter.

[0122] In some implementations, the monitoring module 404 may specifically include:

[0123] A comparison submodule, used to compare the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result;

[0124] A monitoring submodule, configured to perform security monitoring on the first network environment parameter based on the comparison result;

[0125] The determination submodule is used to determine the first network environment parameter as a dangerous network environment parameter when it is monitored that the comparison result is less than or equal to a preset threshold.

[0126] In some embodiments, the device may further include:

[0127] A third identification module is used to identify the type of the dangerous network environment parameter by using a pre-trained network environment danger type identification model to obtain the network environment danger type corresponding to the first network environment parameter;

[0128] The adjustment module is used to call a network security processing script corresponding to the network environment risk type to adjust the first network environment parameter.

[0129] In some embodiments, the device may further include:

[0130] A second acquisition module is used to acquire a first training sample set; wherein the first training sample set includes computer operation behavior data corresponding to a plurality of types;

[0131] A first training module, used to train a preset computer operation behavior recognition model based on the first training sample set using a machine learning algorithm to obtain a trained computer operation behavior recognition model;

[0132] The first determination module is used to determine the trained computer operation behavior recognition model as a pre-trained computer operation behavior recognition model.

[0133] In some embodiments, the device may further include:

[0134] A third acquisition module is used to acquire a second training sample set; wherein the second training sample set includes a plurality of computer operation behavior data and parameters corresponding to a standard network environment respectively corresponding to the plurality of computer operation behavior data;

[0135] A second training module is used to train a preset network environment parameter identification model based on the second training sample set using a machine learning algorithm to obtain a trained network environment parameter identification model;

[0136] The second determination module is used to determine the trained network environment parameter identification model as a pre-trained network environment parameter identification model.

[0137] In some embodiments, the device may further include:

[0138] A fourth acquisition module is used to acquire characteristic parameters related to network environment dangers;

[0139] A third training module is used to train the preset network environment risk type recognition based on the characteristic parameters using a machine learning method to obtain a trained network environment risk type recognition model;

[0140] The third determination module is used to determine the trained network environment hazard type identification model as a pre-trained network environment hazard type identification model.

[0141] Figure 5 It is a schematic diagram of the structure of an electronic device for network security monitoring provided by an embodiment of the present application.

[0142] like Figure 5 As shown, the electronic device 5 is a structural diagram of an exemplary hardware architecture of an electronic device that can implement the network security monitoring method and network security monitoring device in the embodiments of the present application. The electronic device may refer to the electronic device in the embodiments of the present application.

[0143] The electronic device 5 may include a processor 501 and a memory 502 storing computer program instructions.

[0144] Specifically, the processor 501 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0145] The memory 502 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 502 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 502 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 502 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 502 is a non-volatile solid-state memory. In a specific embodiment, the memory 502 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Therefore, typically, the memory 502 includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present application.

[0146] The processor 501 implements any one of the network security monitoring methods in the above embodiments by reading and executing computer program instructions stored in the memory 502 .

[0147] In one example, the electronic device may further include a communication interface 503 and a bus 504. Figure 5 As shown, the processor 501, the memory 502, and the communication interface 503 are connected via a bus 504 and communicate with each other.

[0148] The communication interface 503 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0149] Bus 504 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 504 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0150] The electronic device can execute the network security monitoring method in the embodiment of the present application, thereby realizing the combination Figures 1 to 4 Described is a network security monitoring method and device.

[0151] In addition, in combination with the network security monitoring method in the above embodiment, the embodiment of the present application can provide a computer storage medium to implement. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the data processing methods in the above embodiment is implemented.

[0152] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0153] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0154] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0155] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0156] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A network security monitoring method, characterized in that: include: Acquire computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment; Using a pre-trained computer operation behavior recognition model, the type of the computer operation behavior data is identified to obtain the computer operation behavior type corresponding to the computer operation behavior data; Using a pre-trained network environment parameter recognition model corresponding to the computer operation behavior type, the network environment parameter of the computer operation behavior data is recognized to obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment; Based on the second network environment parameter, performing security monitoring on the first network environment parameter; The performing security monitoring on the first network environment parameter based on the second network environment parameter includes: Comparing the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result; Based on the comparison result, performing security monitoring on the first network environment parameter; When it is monitored that the comparison result is less than or equal to a preset threshold, determining the first network environment parameter as a dangerous network environment parameter; After determining the first network environment parameter as a dangerous network environment parameter when the comparison result is less than or equal to a preset threshold, the method further includes: Using a pre-trained network environment danger type identification model, the type of the dangerous network environment parameter is identified to obtain the network environment danger type corresponding to the first network environment parameter; A network security processing script corresponding to the network environment risk type is called to adjust the first network environment parameter.

2. The method according to claim 1, characterized in that Before the type of the computer operation behavior data is identified by using the pre-trained computer operation behavior recognition model to obtain the computer operation behavior type corresponding to the computer operation behavior data, the method further includes: Acquire a first training sample set; wherein the first training sample set includes computer operation behavior data corresponding to a plurality of types; Using a machine learning algorithm to train a preset computer operation behavior recognition model based on the first training sample set to obtain a trained computer operation behavior recognition model; The trained computer operation behavior recognition model is determined as a pre-trained computer operation behavior recognition model.

3. The method according to claim 1, characterized in that Before the network environment parameter recognition model corresponding to the computer operation behavior type is used to recognize the network environment parameter of the computer operation behavior data and obtain the second network environment parameter corresponding to the computer operation behavior data, the method further includes: Acquire a second training sample set; wherein the second training sample set includes a plurality of computer operation behavior data and parameters corresponding to a standard network environment respectively corresponding to the plurality of computer operation behavior data; Using a machine learning algorithm to train a preset network environment parameter identification model based on the second training sample set to obtain a trained network environment parameter identification model; The trained network environment parameter identification model is determined as a pre-trained network environment parameter identification model.

4. The method according to claim 1, characterized in that: Before the pre-trained network environment danger type identification model is used to identify the type of the dangerous network environment parameter to obtain the network environment danger type corresponding to the first network environment parameter, the method further includes: Obtain characteristic parameters related to network environment dangers; Using a machine learning method to train the preset network environment hazard type recognition based on the characteristic parameters to obtain a trained network environment hazard type recognition model; The trained network environment hazard type identification model is determined as the pre-trained network environment hazard type identification model.

5. A network security monitoring device, characterized in that: The device comprises: A first acquisition module, used to acquire computer operation behavior data and a first network environment parameter corresponding to the computer operation behavior data; wherein the first network environment parameter is a parameter corresponding to a real network environment; A first identification module, used to identify the type of the computer operation behavior data by using a pre-trained computer operation behavior identification model, and obtain the computer operation behavior type corresponding to the computer operation behavior data; A second identification module is used to identify the network environment parameters of the computer operation behavior data by using a pre-trained network environment parameter identification model corresponding to the computer operation behavior type, and obtain a second network environment parameter corresponding to the computer operation behavior data; wherein the second network environment parameter is a parameter corresponding to a standard network environment; A monitoring module, configured to perform security monitoring on the first network environment parameter based on the second network environment parameter; The performing security monitoring on the first network environment parameter based on the second network environment parameter includes: Comparing the similarity between the second network environment parameter and the first network environment parameter to obtain a comparison result; Based on the comparison result, performing security monitoring on the first network environment parameter; When it is monitored that the comparison result is less than or equal to a preset threshold, determining the first network environment parameter as a dangerous network environment parameter; After determining the first network environment parameter as a dangerous network environment parameter when the comparison result is less than or equal to a preset threshold, the method further includes: Using a pre-trained network environment danger type identification model, the type of the dangerous network environment parameter is identified to obtain the network environment danger type corresponding to the first network environment parameter; A network security processing script corresponding to the network environment risk type is called to adjust the first network environment parameter.

6. A network security monitoring device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the network security monitoring method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the network security monitoring method according to any one of claims 1 to 4 is implemented.

8. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the network security monitoring method as described in any one of claims 1 to 4.

Images