Adaptive network security situation prediction method based on combined prediction model

Abstract

The present disclosure relates to an adaptive network security situation prediction method based on a combined prediction model, the method comprising: a sub-model training step, extracting a training data sequence from a training data set for adaptive security situation prediction, and training n different sub-models M as constituent elements of the combined prediction model; an initial weight assignment step, for each sub-model M i Initial weights are assigned respectively; in the sub-model online prediction step, for each sub-model M i The prediction results of the sub-models are weighted and summed to output the final result of the network security situation prediction at that time; the sub-model prediction result evaluation step is to evaluate each sub-model M in the time period used for evaluation. i Evaluate the accuracy of its prediction results; and adaptive weight adjustment step, using the evaluation results in the sub-model prediction result evaluation step, for each sub-model M i The weights are adjusted adaptively.

Description

Technical Field

[0001] The present disclosure generally relates to the field of network information security, specifically belongs to the technical field of network security situation awareness, and more specifically relates to an adaptive network security situation prediction method for a combined prediction model. Background Art

[0002] With the rapid development and application of big data, artificial intelligence (AI) and the Internet, the complexity of network structure, the diversification of data and the diversification of network protocols have led to the intensification of multi-level and multi-form network security risks. Network attack behaviors are increasingly developing in the direction of distribution, scale and complexity. Traditional network security defense means such as intrusion detection systems and firewalls can no longer meet the current high-speed, intelligent and multi-source network security needs. More advanced and optimized technical means and methods are needed to prevent the occurrence of network security incidents.

[0003] In 1999, Bass et al. first proposed the concept of Network Security Situation Awareness (NSSA). Security situation awareness was first used in the fields of aviation and military, for example, to make quick decisions and handle complex aviation and military events. Later, it was widely used by researchers in civilian fields, such as network security. Researchers have found that security situation awareness can not only be used for network security situation assessment, but also for network security situation prediction, turning the original passive defense into active defense, which can largely solve the problem of network security defense. Therefore, it has become one of the current hot research directions.

[0004] In terms of network security in-depth detection and situational awareness, in the scenario of large-scale network security situation prediction, due to the large number of unknown changing factors, it is difficult to predict the current or future security situation values. Many scientific research institutions and enterprises often have different prediction models. For example, in the case of common prediction of DDOS (Distributed Denial of Service Attack) attack traffic, multiple prediction models such as linear regression model, decision tree model, local weighted linear regression model, etc. can be used. However, a prediction model usually has different performances in different time windows, and the prediction accuracy (for example, mean square error MSE (Mean Square Error) as an indicator) will fluctuate with the change of time window, showing a "good and bad" situation. The performance of multiple prediction models in the same time window often shows large differences, and the ranking of the prediction accuracy of each prediction model in the multiple prediction models will also change with the change of time window. When evaluating the prediction results of multiple prediction models, including linear regression models, decision tree models, and locally weighted linear regression models, the researchers found that as the time window changes, the prediction accuracy of any of the prediction models may rank first or last.

[0005] Since different prediction models have their own advantages and disadvantages in different time windows, it is difficult to make a fixed choice for a long time. Therefore, researchers consider combining multiple prediction models, adding model coefficients to each prediction model, and then weighting the prediction results of each prediction model to obtain the final prediction result after the combination. However, with such a one-time artificial setting of static weights, the overall performance of the combined model still presents a "random" state. Within a certain period of time, some sub-models perform well, while others perform poorly. The prediction accuracy still fluctuates, and may even fluctuate under certain circumstances. The overall performance will still be unstable and dynamically changing.

[0006] In order to solve the problem of unstable overall performance of the combined model caused by static management of sub-models such as the above-mentioned one-time static configuration, researchers further considered manually intervening in weighted adjustments to the model coefficients of each sub-model in the combined model every certain period of time. However, this method has a long update period and often requires offline training and analysis over a long time window. It is inefficient and consumes a lot of storage and computing resources, and cannot efficiently and timely improve the overall prediction performance of the combined prediction model.

[0007] In the field of network security situation awareness, for the combined prediction model mentioned above, how to flexibly adjust the respective weights according to the recent performance of each model to improve the overall prediction accuracy, that is, how to achieve adaptive network security situation prediction, is still under exploration in the industry. Summary of the invention

[0008] In view of the technical problems that the accuracy and efficiency of static configuration and adjustment of combined prediction models in existing network security situation prediction methods are low and cannot adapt to dynamic and changing network security needs, the purpose of the present invention is to propose an adaptive network security situation prediction method for combined prediction models, which uses a sliding time window mechanism and prediction error evaluation means to dynamically monitor the prediction accuracy of each model; according to the monitoring results, the weights of each prediction model are adaptively adjusted, and finally the accuracy of the combined prediction model for overall situation prediction is improved.

[0009] A brief overview of the disclosure is given below in order to provide a basic understanding of some aspects of the disclosure. However, it should be understood that this overview is not an exhaustive overview of the disclosure. It is not intended to identify the key or important parts of the disclosure, nor is it intended to limit the scope of the disclosure. Its purpose is simply to give some concepts of the disclosure in a simplified form as a prelude to a more detailed description given later.

[0010] According to one aspect of the present disclosure, an adaptive network security situation prediction method for a combined prediction model is provided. The method may include: a sub-model training step, extracting m data sequences in a time period for training from a training data set for adaptive security situation prediction, and training n different sub-models M as constituent elements of the combined prediction model using a gradient descent algorithm; i , using mean square error MSE as the loss function, where m and n are natural numbers and m ≥ 7, n ≥ 3, i ∈ [1, ..., n]; initial weight assignment step, for each sub-model M i Initial weights are assigned respectively; in the sub-model online prediction step, for each sub-model M i The prediction results of the sub-models are weighted and summed to output the final result of the network security situation prediction at that time; the sub-model prediction result evaluation step is to evaluate each sub-model M in the time period used for evaluation. i Evaluate the accuracy of its prediction results; and adaptive weight adjustment step, using the evaluation results in the sub-model prediction result evaluation step, for each sub-model M i The weights are adjusted adaptively.

[0011] According to another aspect of the present disclosure, an adaptive network security situation prediction device based on a combined prediction model is provided, and the device may include: a memory on which instructions are stored; and a processor, configured to execute the instructions stored on the memory to execute the adaptive network security situation prediction method for the combined prediction model described in the above aspects of the present disclosure.

[0012] According to another aspect of the present disclosure, a computer-readable storage medium is provided, which may include computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors execute the adaptive network security situation prediction method for the combined prediction model according to the above aspects of the present disclosure.

[0013] According to another aspect of the present disclosure, a computer program product is provided, which includes a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, the steps of the adaptive network security situation prediction method for the combined prediction model according to the above aspects of the present disclosure are implemented.

[0014] According to the adaptive network security situation prediction method for the combined prediction model disclosed in the present invention, the weights of each sub-model in the combined prediction model can be quickly and automatically adjusted according to the actual operation results, so that the combined prediction model as a whole does not require human intervention. After a period of automatic operation, the weights of each sub-model can be automatically adjusted, thereby effectively improving the accuracy of the combined prediction model in predicting the overall situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0016] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0017] Figure 1 An exemplary flow chart of an adaptive network security situation prediction method 100 for a combined prediction model according to an embodiment of the present disclosure is shown;

[0018] Figure 2 An exemplary configuration of a computing device 200 that can implement an embodiment according to the present disclosure is shown. DETAILED DESCRIPTION

[0019] The following detailed description is made with reference to the accompanying drawings to assist in a comprehensive understanding of the various exemplary embodiments of the present disclosure. The following description includes various details to assist in understanding, but these details are considered to be examples only and not to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are only used to enable a clear and consistent understanding of the present disclosure. In addition, for the sake of clarity and brevity, descriptions of well-known structures, functions, and configurations may be omitted. Those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0020] The techniques, methods and devices known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, the techniques, methods and devices should be considered as part of the specification.The technology of the present disclosure can be applied to various products.

[0021] For ease of understanding and explanation, as an adaptive network security situation prediction method for a combined prediction model according to an embodiment of the present disclosure, the security situation prediction in various scenarios in the field of network information security is mainly described as an example, including, for example, DDoS attack situation, Web security situation, and 4A account security situation, etc., but the applicable scenarios of the adaptive network security situation prediction method for a combined prediction model according to an embodiment of the present disclosure are not limited to this. The technical subject matter of the present disclosure can be applied not only to any security situation prediction, such as any existing or future network security situation prediction scenario, but also to all security analysis scenarios that require situation prediction, including security situation awareness for the public, security situation awareness for telecom operators' self-operated business systems, and any other suitable scenarios.

[0022] Hereinafter, the overall process of the adaptive network security situation prediction method for the combined prediction model according to the embodiment of the present disclosure is first described. Figure 1 An exemplary flow chart of an adaptive network security situation prediction method 100 for a combined prediction model according to an embodiment of the present disclosure is shown. Preferably, the adaptive network security situation prediction method 100 for a combined prediction model according to an embodiment of the present disclosure may generally include the following steps S110 to S150. The details of each step S110 to S150 are as follows:

[0023] Sub-model training step S110: extracting m data sequences in the time period for training from the training data set for adaptive security situation prediction, and using the gradient descent algorithm to train n different sub-models M as the constituent elements of the combined prediction model. i , with mean square error MSE as the loss function, where m and n are natural numbers and m ≥ 7, n ≥ 3, and i is a natural number from 1 to n, that is, i∈[1,...,n].

[0024] Specifically, in step S110, historical data is extracted from the historical data set as the training data set for offline training, and multiple different prediction models including, for example, a linear regression model, a decision tree model, a LASSO (Least absolute shrinkage and selection operator, lasso algorithm) regression model, etc. can be obtained as constituent elements of the combined prediction model, thereby constructing an overall security situation prediction framework integrating multiple regression prediction models. In one embodiment of the present disclosure, assuming that for a month of monitored situation data, data for a time period (for example, 7 days) is extracted, and three models such as linear regression, decision tree regression, and local weighted linear regression are used for training, and three pre-trained sub-models M1, M2, and M3 can be obtained.

[0025] Initial weight assignment step S120: for each sub-model M i Assign initial weights respectively.

[0026] Preferably, in step S120, for each sub-model M of the trained n sub-models i Mean square error MSE i Calculate the arithmetic mean as the average mean square error MSE0 of the n sub-models.

[0027] Next, for each sub-model M i , the model coefficients in the combined prediction model are calculated as

[0028]

[0029] Then calculate each sub-model M i The initial weight is

[0030]

[0031] in

[0032] Usually, a higher initial weight is assigned to the model with the best first prediction effect. The initial weight can be assigned manually or automatically by the system.

[0033] Specifically, in one embodiment of the present disclosure, the mean square error MSE0=(MSE1+MSE2+MSE3) / 3 can be calculated. i The initial weight is And satisfy

[0034] Sub-model online prediction step S130: for each sub-model M i The prediction results are weighted and summed to output the final result of the network security situation prediction.

[0035] Preferably, after the initial weight assignment step S120 is completed, in the sub-model online prediction step S130, when the sub-model M i The prediction result of network security situation is p i When , the final prediction result of the combined prediction model for the network security situation is:

[0036]

[0037] In addition, for the sake of simplicity, the model M i The weight is set to ω i In the case of And at this time, the final prediction result of the combined prediction model for the network security situation is

[0038]

[0039] Sub-model prediction result evaluation step S140: During the time period used for evaluation, for each sub-model M i Evaluate the accuracy of its prediction results.

[0040] Adaptive weight adjustment step S150: using the evaluation results in the sub-model prediction result evaluation step S140, i The weights are adjusted adaptively.

[0041] like Figure 1 As shown, according to the adaptive network security situation prediction method 100 based on the combined prediction model according to the embodiment of the present disclosure, after a period of automatic operation, the weights of each sub-model can be automatically adjusted, thereby effectively improving the accuracy of the combined prediction model for the overall situation prediction.

[0042] The following describes in detail the specific application of the model deviation calculation method, weight adjustment algorithm and model elimination algorithm unique to the present invention in the implementation of the present invention, especially the application in the sub-model prediction result evaluation step S140 and the adaptive weight adjustment step S150.

[0043] Preferably, in the sub-model prediction result evaluation step S140, it is assumed that there are q prediction results and actual results in the predetermined time period for evaluation, and each sub-model M i The k-th prediction result Yi i,k The actual result Y i,k The difference is |Y i,k -Y′i,k |, where q and k are natural numbers and q≥m, and k is a natural number from 1 to q, that is, k∈[1,...,q]. Here, the predetermined time period for evaluation usually corresponds to a data set of the most recent time window in actual online prediction.

[0044] Specifically, in step S140, the average difference of n sub-models in a predetermined time period is calculated by using the model deviation calculation method.

[0045]

[0046] Then calculate each sub-model M i The model deviation in the predetermined time period is

[0047]

[0048] Among them, the sub-model M i Model deviation ΔY i The smaller the sub-model M i The higher the accuracy of the first to q predictions in the predetermined time period for evaluation, the higher the accuracy of the predictions in the first to q predictions in the predetermined time period for evaluation. i , increase its weight ω in the combined prediction model i For sub-models M with large deviations from the actual results i , reduce its weight ω i The value of .

[0049] In order to realize the above-mentioned inventive concept, the present disclosure further adopts adaptive weight adjustment based on the evaluation results. i Model deviation ΔY i Perform normalization calculation, and then calculate the sub-model M on this basis i The weight adjustment coefficient e i Then calculate the sub-model M i The weight adjustment value Δω i .

[0050] Specifically, it is preferred that in the adaptive weight adjustment step S150, the model deviation calculation method unique to the present disclosure is further used to calculate the model deviation of each sub-model M calculated in the sub-model prediction result evaluation step S140. i Model deviation ΔY in a predetermined time period i , to calculate each sub-model M i The normalized model deviation ΔY′ i , where the highest value of the model deviation among the n sub-models is set to max(ΔY i), the minimum value of the model deviation is set to min(ΔY i ), calculate each sub-model M i The normalized model deviation of

[0051]

[0052] Next, in the adaptive weight adjustment step S150, the weight adjustment algorithm unique to the present disclosure is further used to calculate the weights of each sub-model M i The weight adjustment coefficient e i , and then calculate each sub-model M i The weight adjustment value Δω i ,in

[0053] According to the normalized model deviation ΔY′ i Calculate each sub-model M i The weight adjustment value Δω i ,in

[0054] Calculate each sub-model M i The weight adjustment coefficient is

[0055]

[0056] Calculate each sub-model M i The weight adjustment value is

[0057]

[0058] Calculate the average weight adjustment value of n sub-models

[0059]

[0060] Calculate each sub-model M i The updated weight of

[0061]

[0062] Which meets

[0063] After the adaptive weight adjustment step S150 is completed, in the sub-model online prediction step S130, i The prediction result for network security situation prediction is p i When , the final prediction result of the combined prediction model for network security situation prediction is

[0064]

[0065] By using the updated weights, it is possible to obtain more accurate prediction results that are more in line with the current actual network conditions based on the most recent prediction accuracy of each sub-model.

[0066] It can be seen from the above detailed description that in the adaptive network security situation prediction method based on the combined prediction model of the present disclosure, since a model deviation calculation method for each sub-model is adopted, it is possible to evaluate the effects of different regression prediction sub-models in different time windows according to the evaluation requirements of each model. Next, since a weight adjustment algorithm based on model deviation is adopted to automatically calculate the adjustment value of the weight, the corresponding weights can be automatically optimized and adjusted according to the specific performance of each sub-model in different time windows, which can effectively promote the automatic optimization of the overall security situation prediction framework. In other words, in the case of constructing an overall security situation prediction framework integrating multiple regression prediction sub-models, according to the embodiments of the present disclosure, the dynamic adaptive tuning of the security situation prediction function is effectively achieved with the initialized weight setting and the deviation calculation method based on the time window unique to the present disclosure.

[0067] In addition, in the actual prediction of the combined prediction model, as time goes by, it is necessary to automatically retain the sub-models with better prediction effects, eliminate the sub-models with poor prediction effects, and evaluate the newly added sub-models, so as to simplify the combined prediction model and improve the prediction accuracy of the model.

[0068] In this regard, it is further preferred that in the adaptive weight adjustment step S150, a model elimination algorithm is also used to eliminate sub-models with poor prediction effects among the n sub-models.

[0069] Specifically, in the model elimination algorithm, for the sub-model M i , can be set as the model deviation ΔY in a predetermined time period i When the deviation is greater than the allowable threshold β, the sub-model M i Eliminate from n sub-models, where

[0070]

[0071] E(σ 2 ) represents the actual result Y in the predetermined time period i,k The expected variance of the data itself. c can be flexibly set according to the accuracy requirements of the model. Preferably, for example, it can be selected as any real number from 3 to 5 according to actual engineering practice. Of course, this is only an example and not a limitation, and any other suitable value can also be selected.

[0072] From the above description, it can be seen that in the adaptive network security situation prediction method based on the combined prediction model of the present invention, in addition to the above-mentioned unique model deviation calculation method and weight adjustment algorithm for sub-models of the present invention, a model elimination algorithm based on the allowable deviation threshold can be further adopted, so that the combined prediction model can eliminate the regression prediction sub-model with long-term poor performance while maintaining the stability of the overall security situation prediction performance; it can also accurately evaluate and smoothly introduce new regression prediction sub-models, and finally realize the adaptive iterative optimization of the overall security situation prediction framework.

[0073] The adaptive network security situation prediction method based on the combined prediction model according to the embodiment of the present disclosure has good scalability and can ensure stable and sustainable optimization of the overall security situation prediction framework with less human intervention in various situation prediction scenarios.

[0074] Through testing, after a period of operation comparison (e.g., about a week, etc.), according to measurement indicators such as mean square error MSE, the prediction results of the adaptive network security situation prediction method based on the combined prediction model of the embodiment of the present disclosure are significantly better than the prediction results without the method. For example, when predicting the number of malicious domain name events, the adaptive network security situation prediction method based on the combined prediction model of the embodiment of the present disclosure is more stable overall than the case where the method is not used, and the prediction accuracy is improved by about 30%.

[0075] Furthermore, according to an embodiment of the present disclosure, an adaptive network security situation prediction device based on a combined prediction model may be provided, comprising: a memory on which instructions are stored; and a processor configured to execute the instructions stored on the memory to execute an adaptive network security situation prediction method 100 based on a combined prediction model according to an embodiment of the present disclosure.

[0076] According to an embodiment of the present disclosure, a computer-readable storage medium may also be provided, comprising computer-executable instructions, which, when executed by one or more processors, enable the one or more processors to execute an adaptive network security situation prediction method 100 based on a combined prediction model according to an embodiment of the present disclosure.

[0077] According to an embodiment of the present disclosure, a computer program product may also be provided, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, the steps of the adaptive network security situation prediction method 100 based on the combined prediction model according to the embodiment of the present disclosure are implemented.

[0078] Figure 2 An exemplary configuration diagram of a computing device 200 capable of implementing an embodiment of the present disclosure is shown.

[0079] The computing device 200 is an example of a hardware device to which the above aspects of the present disclosure can be applied. The computing device 200 can be any machine configured to perform processing and / or computing. The computing device 200 can be, but is not limited to, a workstation, a server, a desktop computer, a laptop computer, a tablet computer, a personal data assistant (PDA), a smart phone, a vehicle-mounted computer, or a combination thereof.

[0080] like Figure 2 As shown, the computing device 200 may include one or more elements that can be connected or communicated with the bus 202 via one or more interfaces. The bus 202 may include, but is not limited to: an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus, etc. The computing device 200 may include, for example, one or more processors 204, one or more input devices 206, and one or more output devices 208. The one or more processors 204 may be any kind of processor, and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). The processor 204 may be configured to implement the adaptive network security situation prediction method 100 based on the combined prediction model described in the above aspects of the present disclosure. The input device 206 may be any type of input device capable of inputting information to the computing device, and may include, but is not limited to, a mouse, a keyboard, a touch screen, a microphone, and / or a remote controller. The output device 208 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer.

[0081] The computing device 200 may also include or be connected to a non-transitory storage device 214, which may be any non-transitory storage device that can implement data storage, and may include, but is not limited to, a disk drive, an optical storage device, a solid-state memory, a floppy disk, a flexible disk, a hard disk, a tape or any other magnetic medium, a compressed disk or any other optical medium, a cache memory and / or any other storage chip or module, and / or any other medium from which a computer can read data, instructions and / or code. The computing device 200 may also include a random access memory (RAM) 210 and a read-only memory (ROM) 212. The ROM 212 may store programs, utilities or processes to be executed in a non-volatile manner. The RAM 210 may provide volatile data storage and store instructions related to the operation of the computing device 200. The computing device 200 may also include a network / bus interface 216 coupled to a data link 218. The network / bus interface 216 may be any type of device or system capable of enabling communication with an external device and / or network, and may include but is not limited to a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth TM equipment, 802.11 equipment, WiFi equipment, WiMax equipment, cellular communication facilities, etc.).

[0082] The present disclosure may be implemented as any combination of an apparatus, a system, an integrated circuit, and a computer program on a non-transitory computer-readable medium. One or more processors may be implemented as an integrated circuit (IC), an application specific integrated circuit (ASIC), or a large scale integrated circuit (LSI), a system LSI, a super LSI, or a super LSI component that performs some or all of the functions described in the present disclosure.

[0083] The present disclosure includes the use of software, applications, computer programs, or algorithms. The software, applications, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to enable a computer such as one or more processors to perform the above steps and the steps described in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors may associate a set of instructions to execute the software or algorithm to provide various functions according to the embodiments described in the present disclosure.

[0084] Software and computer programs (which may also be referred to as programs, software applications, applications, components or code) include machine instructions for a programmable processor and may be implemented in a high-level procedural language, an object-oriented programming language, a functional programming language, a logic programming language, or an assembly language or a machine language. The term "computer-readable medium" refers to any computer program product, apparatus or device for providing machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0085] For example, computer readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store the desired computer readable program code in the form of instructions or data structures and can be accessed by a general or special purpose computer or a general or special purpose processor. As used herein, disk or disc includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically by laser. Combinations of the above are also included in the scope of computer readable media.

[0086] The subject matter of the present disclosure is provided as an example of devices, systems, methods and programs for performing the features described in the present disclosure. However, in addition to the above features, other features or variations may also be expected. It is expected that the implementation of the components and functions of the present disclosure may be accomplished with any emerging technology that may replace any of the above-mentioned implementation technologies.

[0087] In addition, the above description provides examples without limiting the scope, applicability or configuration set forth in the claims. Without departing from the spirit and scope of the present disclosure, the functions and arrangements of the elements discussed may be changed. Various embodiments may appropriately omit, replace or add various processes or components. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0088] In addition, in the description of the present disclosure, although operations are depicted in a particular order in the drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a sequential order, or requiring that all illustrated operations be performed to achieve the desired results. In some cases, multitasking and parallel processing can be advantageous.

Claims

1. An adaptive network security situation prediction method based on a combined prediction model, the method comprising: The sub-model training step extracts m data sequences in the training time period from the training data set for adaptive security situation prediction, and uses the gradient descent algorithm to train n different sub-models M as the components of the combined prediction model. i , using mean square error MSE as the loss function, where m and n are natural numbers and m ≥ 7, n ≥ 3, i ∈ [1,…, n]; Initial weight assignment step, for each sub-model M i Assign initial weights respectively; Sub-model online prediction step, for each sub-model M i The prediction results are weighted and summed, and the final result of the network security situation prediction is output; The sub-model prediction result evaluation step is to evaluate each sub-model M based on the model deviation during the evaluation period. i Evaluate the accuracy of its prediction results, where sub-model M i Model deviation ΔY i The smaller the sub-model M i The higher the accuracy of multiple forecasts over the time period used for evaluation; and The adaptive weight adjustment step uses the evaluation results in the sub-model prediction result evaluation step to adjust each sub-model M i The weights are adaptively adjusted, including: Calculate each sub-model M i The normalized model deviation is Among them, max(ΔY i ) is the highest value of the model deviation among the n sub-models, min(ΔY i ) is the lowest value of the model deviation among the n sub-models; Calculate each sub-model M i The weight adjustment coefficient is Calculate each sub-model M i The weight adjustment value is Calculate the average weight adjustment value of n sub-models Calculate each sub-model M i The updated weight of Which meets 2. The adaptive network security situation prediction method based on the combined prediction model according to claim 1, wherein: In the initial weight assignment step, for each sub-model M in the trained n sub-models i Mean square error MSE i Calculate the arithmetic mean as the average mean square error MSE0 of n sub-models, For each sub-model M i , the model coefficients in the combined prediction model are calculated as Calculate each sub-model M i The initial weight is in After the initial weight assignment step is completed, in the sub-model online prediction step, when the sub-model M i The prediction result of network security situation is p i When , the final prediction result of the combined prediction model for the network security situation is 3. The adaptive network security situation prediction method based on the combined prediction model according to claim 1, wherein: In the sub-model prediction result evaluation step, it is assumed that there are q prediction results and actual results in the predetermined time period for evaluation, and each sub-model M i The k-th prediction result Y′ i,k The actual result Y i,k The difference is |Y i,k -Y′ i,k |, where q and k are natural numbers and q ≥ m, k ∈ [1,…,q], Using the model deviation calculation method, the average difference of n sub-models in the predetermined time period is calculated as Calculate each sub-model M i The model deviation in the predetermined time period is 4. The adaptive network security situation prediction method based on the combined prediction model according to claim 1, wherein: After the adaptive weight adjustment step is completed, in the sub-model online prediction step, i The prediction result for network security situation prediction is p i When , the final prediction result of the combined prediction model for network security situation prediction is 5. The adaptive network security situation prediction method based on the combined prediction model according to claim 3, wherein: In the adaptive weight adjustment step, a model elimination algorithm is also used to eliminate sub-models with poor prediction effects among the n sub-models. In the model elimination algorithm, for the sub-model M i , when the model deviation ΔY in a predetermined time period i When the deviation is greater than the allowable threshold β, the sub-model M i Eliminate from n sub-models, where E(σ 2 ) represents the actual result Y in the predetermined time period i,k The expected variance of the data itself, and c is a constant that is flexibly set according to the accuracy requirements of the model.

6. An adaptive network security situation prediction device based on a combined prediction model, comprising: a memory having instructions stored therein; as well as A processor is configured to execute instructions stored on the memory to perform the adaptive network security situation prediction method based on the combined prediction model according to any one of claims 1 to 5.

7. A computer-readable storage medium, comprising computer-executable instructions, which, when executed by one or more processors, enable the one or more processors to execute the adaptive network security situation prediction method based on a combined prediction model according to any one of claims 1 to 5.

8. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the adaptive network security situation prediction method based on a combined prediction model described in any one of claims 1 to 5 are implemented.

Images