A detection method, device, equipment and storage medium

Abstract

The present application discloses a detection method, a detection device, a detection equipment and a computer-readable storage medium, the method comprising: obtaining first data; wherein the first data comprises request information data and operation behavior data; analyzing and processing the first data to extract first difference feature information; wherein the first difference feature information comprises variation information carried in the first data; the variation information comprises quantitative difference information between the first data and other network request operation information, and an association relationship between the request information data and the operation behavior data; based on the first difference feature information, detecting the security status of the first data.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a detection method, a detection device, a detection equipment and a computer-readable storage medium. Background Art

[0002] In the related art, network security status detection usually includes the following process: simply numerically marking network access requests and network behavior data to obtain marking results, then simply reducing the dimension of the marking results to obtain the dimension reduction results, and finally analyzing whether the network access requests and / or network behavior data are safe based on the dimension reduction results. However, the marking results and dimension reduction results in the above detection process cannot reflect the essential differences between various features in the network data, nor can they reflect the substantial correlation between network access requests and network behavior data. Summary of the invention

[0003] Based on the above problems, embodiments of the present application provide a detection method, a detection device, a detection equipment and a computer-readable storage medium.

[0004] The detection method provided in the embodiment of the present application can extract first differential feature information from the first data when obtaining first data including request information data and operation behavior data, and then detect the security status of the first data based on the first differential feature information; and the first differential feature information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data. Therefore, the detection method provided in the embodiment of the present application can obtain the differential feature information of any network request, and can also obtain the correlation relationship between the request information data and the operation behavior data, so that the detection of the network status is more accurate, and the detected security status can be more objective, thereby improving the efficiency of network security status detection.

[0005] The technical solution provided by this application is as follows:

[0006] The present application provides a detection method, which includes:

[0007] Acquire first data; wherein the first data includes request information data and operation behavior data;

[0008] Analyze and process the first data to extract first difference feature information; wherein the first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data;

[0009] Based on the first differential feature information, a security status of the first data is detected.

[0010] The embodiment of the present application further provides a detection device, which includes: an acquisition module, a feature extraction module and a detection module, wherein:

[0011] The acquisition module is used to acquire first data; wherein the first data at least includes network request data;

[0012] The feature extraction module is used to analyze and process the first data to extract first difference feature information; wherein the first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data;

[0013] The detection module is used to detect the security status of the first data based on the first difference feature information.

[0014] An embodiment of the present application also provides a detection device, which includes a processor, a memory, and a communication bus, wherein the communication bus is used to realize a communication connection between the processor and the memory; the processor is used to execute a computer program stored in the memory to implement any of the detection methods described above.

[0015] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of a detection device, it can implement any of the detection methods described above.

[0016] From the above, it can be seen that the detection method provided in the embodiment of the present application, when obtaining the first data including request information data and operation behavior data, can extract the first differential feature information from the first data, and then detect the security status of the first data based on the first differential feature information; and the first differential feature information includes the quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data. Therefore, the detection method provided in the embodiment of the present application can obtain the differential feature information of any network request, and can also obtain the correlation relationship between the request information data and the operation behavior data, so that the detection of the network status is more accurate, and the detected security status can be more objective, thereby improving the efficiency of network security status detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1A schematic diagram of the process of the first detection method provided in the embodiment of the present application;

[0018] Figure 2 A schematic diagram of a second detection method provided in an embodiment of the present application;

[0019] Figure 3 A schematic diagram of a process for extracting first difference feature information provided in an embodiment of the present application;

[0020] Figure 4 A schematic diagram of the structure of the detection network training provided in the embodiment of the present application;

[0021] Figure 5a A statistical diagram of classification results of five types of data using the detection method provided in the embodiment of the present application;

[0022] Figure 5b A schematic diagram of the statistical results of the false detection rate and missed detection rate of five types of data detected by the detection method provided in the embodiment of the present application;

[0023] Figure 5c A statistical diagram of the detection accuracy of five types of data detected by the detection method provided in the embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of a detection device provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structure of a detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0027] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0028] The present application relates to the field of information technology, and in particular to a detection method, a detection device, a detection equipment and a computer-readable storage medium.

[0029] Network intrusion detection is the detection of network intrusion behavior. It collects information from several key points in the network computer system and analyzes the information to determine whether there are any violations of security policies in the network or system, or whether there are signs of attack.

[0030] In practical applications, network intrusion detection is the first step in active network defense. Therefore, intrusion detection has become a research hotspot in network security. Therefore, how to perform intrusion detection efficiently and accurately, or how to detect the network security status through a good performance detection model, has become a major challenge facing the field of network security today.

[0031] In the related art, network security status detection is usually implemented through the following steps: simple numerical labeling of network access requests and network behavior data and the corresponding large amount of feature information to obtain labeling results, and then simple dimensionality reduction of the labeling results to obtain dimensionality reduction results, and finally analyzing whether the network access request and / or network behavior data is safe based on the dimensionality reduction results. However, the above labeling results and dimensionality reduction results cannot reflect the essential differences between various features in the network data, nor can they reflect the substantial correlation between network access requests and network behavior data.

[0032] Based on the above problems, an embodiment of the present application provides a detection method. When obtaining first data including request information data and operation behavior data, the detection method can extract first differential feature information from the first data, and then detect the security status of the first data based on the first differential feature information; and the first differential feature information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data. Therefore, the detection method provided by the embodiment of the present application can obtain the differential feature information of any network request, and can also obtain the correlation relationship between the request information data and the operation behavior data, so that the detection of the network status is more accurate, and the detected security status can be more objective, thereby improving the efficiency of network security status detection.

[0033] It should be noted that the detection method provided in the embodiment of the present application can be implemented by a processor in the detection device, and the above-mentioned processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, and a microprocessor.

[0034] Figure 1 The following is a flow chart of the first detection method provided in the present application. Figure 1 As shown, the method may include steps 101 to 103:

[0035] Step 101: Obtain first data.

[0036] The first data includes request information data and operation behavior data.

[0037] In one implementation, the request information data may include network request data. Exemplarily, the network request data may include a request line, a request header, a blank line, a request body, and the like.

[0038] In one implementation, the request information data may also include request response data. Exemplarily, the request response data may include a status line, a message header, a blank line, a response body, and the like.

[0039] In one implementation, the operation behavior data may include data corresponding to a series of operations performed by the detection device after receiving the request information data.

[0040] In one embodiment, the operation behavior data may include at least one of target data for detecting device access behavior or target data for modifying / tampering behavior after responding to the request information data. Exemplarily, the above-mentioned access behavior may include access to the kernel, access to system configuration data, access to system startup data, etc.; the above-mentioned modification / tampering behavior may include modification / tampering of system configuration data, modification / tampering of user data, etc.

[0041] In one implementation, the operation behavior data may be target behavior data that needs to be detected.

[0042] In one implementation, the target behavior data to be detected may be any type of data set manually; or may be any behavior data selected from historical detection results of the detection device.

[0043] In one implementation, the target behavior data to be detected can be flexibly adjusted according to any factor such as the system time of the detection device, the operating status of the detection device, and the operating environment of the detection device.

[0044] In one embodiment, after the detection device receives the request information data, the corresponding operation behavior data may be delayed. For example, after the detection device receives the request information data, if the request information data carries a response delay time, the detection device may perform the operation corresponding to the request information data only when the response delay time arrives.

[0045] In one embodiment, after receiving a request information data, the detection device can perform a variety of different types of operations. Therefore, it is very important to analyze the correlation between the request information data and the operation behavior data.

[0046] In one implementation, after receiving multiple request information data, the detection device may only perform one type of operation.

[0047] In one implementation, the number of the first data may be multiple.

[0048] In one implementation, the first data may be acquired in real time by the detection device; illustratively, after the first data is acquired, the subsequent analysis and detection operation is immediately performed.

[0049] In one implementation, the first data may be historical data acquired by the detection device from a database.

[0050] Step 102: Analyze and process the first data to extract first difference feature information.

[0051] The first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the association relationship between the request information data and the operation behavior data.

[0052] In one implementation, other network request operation information may include any type of network request information data and corresponding operation behavior data.

[0053] In one implementation, the number of other network request operation information may be multiple.

[0054] In one implementation, the quantified difference information may represent difference information that distinguishes the first data from any other type of network request information data and operation behavior data thereof, and the difference information may be a specific numerical value after quantification.

[0055] In one implementation, the quantitative difference information may represent difference information that can distinguish the current request information data from any other request information data.

[0056] In one implementation, there may be multiple pieces of quantified difference information.

[0057] In one implementation, the association relationship between the request information data and the operation behavior data may include that the request information data and the operation behavior data have an association relationship, or that the two do not have an association relationship.

[0058] In one implementation, the association relationship between the request information data and the operation behavior data may include the strength of the association relationship between the request information data and the operation behavior data.

[0059] In one implementation, the association relationship between the request information data and the operation behavior data may include a causal association relationship between the request information data and the operation behavior data.

[0060] In one embodiment, the first differential feature information, in addition to the variation information carried in the first data, may also include other feature information carried in the first data; illustratively, the other feature information may include feature information carried by network request data in a broad sense.

[0061] In one implementation, analyzing and processing the first data to extract the first difference feature information may be implemented in any of the following ways:

[0062] After obtaining any network request, the request information data is obtained from the network request data in real time, and the request information data is analyzed to obtain the first information; then the second information is obtained; and the first difference feature information is extracted from the first information and the second information; wherein the second information includes the response status of the detection device and / or the specific response behavior information of the detection device.

[0063] After obtaining any network request, the network request data is analyzed and processed to obtain all characteristic information carried in the network request data, and the first differential characteristic information is extracted from the third information according to the matching relationship between the third information stored in the detection device and all the characteristic information. Exemplarily, the third information may be stored in a database and is determined after detection based on a large amount of sample data; Exemplarily, the third information may include the corresponding relationship between the network request data and the differential characteristic information.

[0064] Step 103: Detect the security status of the first data based on the first differential feature information.

[0065] In one implementation, the security status of the first data may indicate whether the first data is dangerous data or safe data.

[0066] In one implementation, the security status of the first data may be reflected in the form of a security level or a danger level.

[0067] In one implementation, based on the first difference feature information, detecting the security status of the first data may be implemented in any of the following ways:

[0068] The security status of the first data is detected according to the matching relationship between the first difference feature information and the standard difference feature information. For example, the standard difference feature information can be determined by the detection device through analysis of a large amount of sample data; for example, the standard difference feature information can also be updated in real time according to the analysis results of the detection device on the request information data and the operation behavior data.

[0069] The first difference feature information is further analyzed and processed by a neural network, core feature information is extracted from the first difference feature information, and then the security status of the first data is detected according to the core feature information.

[0070] From the above, it can be seen that the detection method provided in the embodiment of the present application, when obtaining the first data including request information data and operation behavior data, can extract the first differential feature information from the first data, and then detect the security status of the first data based on the first differential feature information; and the first differential feature information includes the quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data. Therefore, the detection method provided in the embodiment of the present application can obtain the differential feature information of any network request, and can also obtain the correlation relationship between the request information data and the operation behavior data, so that the detection of the network status is more accurate, and the detected security status can be more objective, thereby improving the efficiency of network security status detection.

[0071] Based on the above embodiments, the present application also provides a second detection method: Figure 2 The following is a flow chart of the second detection method provided in the present application. Figure 2 As shown, the detection method may include steps 201 to 204:

[0072] Step 201: Obtain first data.

[0073] The first data includes request information data and operation behavior data.

[0074] Step 202: Analyze the first data to obtain second data and third data.

[0075] The second data includes data related to the request information data in the first data; the third data includes data related to the operation behavior data in the first data.

[0076] In one implementation, the second data may be character information or character combination information related to the request information data obtained from the first data. Accordingly, the third data may include character information or character combination information related to the operation behavior obtained from the first data.

[0077] In one implementation, the second data and the third data may be numerical data obtained by digitizing the first data.

[0078] In the embodiment of the present application, step 202 can be implemented by steps A1 to A2:

[0079] Step A1: quantize the first data to obtain a first quantization result.

[0080] In an implementation manner, quantizing the first data may be implemented according to a correspondence relationship between characters and numerical values. For example, in this correspondence relationship, a first character may correspond to a first numerical value, and a second character may correspond to a second numerical value.

[0081] In one implementation, the quantization of the first data may be performed according to a specified quantization algorithm.

[0082] In one implementation, the first quantization result may include only data of a specified type, such as integer data.

[0083] In one implementation, the first quantization result may include floating-point data in addition to integer data.

[0084] In one implementation, for the convenience of subsequent calculations, the data length of each quantization result in the first quantization result may not exceed a length threshold.

[0085] In the embodiment of the present application, step A1 can be implemented through steps B1 to B3:

[0086] Step B1: quantize the first type of data in the first data to obtain a second quantization result.

[0087] Among them, the first type of data includes text data.

[0088] In one implementation, text data may include single character data or character combination data, that is, a character string.

[0089] In one implementation, the first type of data may further include at least one of a combination of characters and numbers, a combination of characters and symbols, etc.; illustratively, the symbols may include punctuation marks, mathematical operation symbols, Greek symbols, etc.

[0090] In one implementation, the first type of data may be words.

[0091] In one implementation, quantizing the first type of data in the first data may be achieved by using equations (1) to (3):

[0092]

[0093]

[0094] TF-IDF*,j=TF*,j×IDF*,j (3)

[0095] In formula (1), k *,j Indicates the number of times the word * appears in the j-th first data obtained; represents the total number of words* in the obtained n first data; TF*,j represents the term frequency (TermFrequency, TF) of the word* in the jth first data.

[0096] In formula (2), M represents the total number of words* in all the first data obtained; m i represents the total number of word * in the i-th first data; IDF*,j represents the inverse document frequency (IDF) of word *.

[0097] In formula (3), TF-IDF*,j can be used to evaluate the importance of word * to the first data, or any first data of n first data.

[0098] Step B2: Obtain second type data from the first data.

[0099] The second type of data includes numerical data.

[0100] In one implementation, the second type of data and the first type of data may constitute the first data.

[0101] In one implementation, the second type of data may also include a combination of numerical values. Exemplarily, the second type of data may include a conditional calculation relationship of several numerical data.

[0102] In one implementation, the data type of the second type of data may be the same as the data type of the first quantization result. Exemplarily, the second type of data and the first quantization result may both be integer data types.

[0103] Step B3: Obtain a first quantization result based on the second quantization result and the second type of data.

[0104] In one implementation, the first quantization result may be obtained by concatenating the second quantization result with the second type of data.

[0105] In one implementation, when the number of the first data is one, the first quantization result may be an array.

[0106] In one implementation, when there are multiple first data, the first quantization result may be a matrix, exemplarily recorded as matrix A; exemplarily, the dimension of matrix A may be determined by the number of elements in the first quantization result and the number of first data.

[0107] In one implementation, the first quantization result may be obtained by concatenating the second quantization result and the second type of data.

[0108] In one implementation, the first quantization result may be an augmented matrix including the second quantization result, and in the matrix, the second quantization result and the second type of data may be set at fixed positions.

[0109] As can be seen from the above, in the detection method provided in the embodiment of the present application, the quantization of the first data is not performed by a simple, subjective manual quantization operation, but an objective quantization operation performed based on the TF value and IDF value of each data in the first data. Therefore, the first quantization result obtained by the above quantization operation can objectively reflect the actual distribution state of the first data or each data in the multiple first data, thereby providing objective conditions for the precise effect of subsequent state detection.

[0110] Step A2: Obtain second data and third data from the first quantization result.

[0111] In one implementation, the combination of the second data and the third data in the first quantization result may be based on certain rules. In this case, the second data and the third data may be obtained from the first quantization result based on the above rules.

[0112] In one implementation, in the first quantization result, the subscript ranges of the second data and the third data may be fixed. In this case, the second data and the third data may be obtained from the first quantization result according to the subscript range of each data.

[0113] From the above, it can be seen that in an embodiment of the present application, before performing a security check on the first data, the first data is first objectively quantified. The first quantization result obtained after quantification is a numerical type of data. The storage and query of this type of data are faster. In this way, in the subsequent detection process, the efficiency of various operations performed on the first quantization result can also be greatly improved.

[0114] Step 203: Analyze and process the second data and the third data by using the Partial Least Squares (PLS) method to extract the first difference feature information.

[0115] In one implementation, the second data and the third data are analyzed and processed by PLS, which may be implemented in the following manner:

[0116] Through PLS, the correlation between the second data and the third data is analyzed and processed to obtain a first analysis result, and a specified number of second data are obtained from the first analysis result as first difference feature information.

[0117] In the embodiment of the present application, step 203 can be implemented through steps C1 to C2:

[0118] Step C1: Analyze and process the second data and the third data through PLS to determine the fitting parameters between the second data and the third data.

[0119] In one implementation, the fitting parameter may indicate whether there is a correlation relationship between the second data and the third data.

[0120] In one implementation, the fitting parameter may indicate the strength of the correlation between the second data and the third data.

[0121] In one implementation, the fitting parameter may be a cross-validity parameter between the second data and the third data.

[0122] In one implementation, analyzing and processing the second data and the third data by PLS to determine the fitting parameters between the second data and the third data may be implemented by any of the following methods:

[0123] Through PLS, the fitting degree of the linear combination between the third data and at least one second data is analyzed and processed to determine the fitting parameters.

[0124] Through PLS, the fitting degree between the linear combination of at least one third data and the linear combination of at least one second data is analyzed and processed, so as to determine the fitting parameters.

[0125] First, the second data and the third data are normalized to obtain a first normalized result and a second normalized result. Then, the degree of fit between the first normalized result and the second normalized result is analyzed by PLS to determine the fitting parameters.

[0126] In one implementation, when the fitting parameter represents a cross-validity parameter, the cross-validity parameter between the second data and the third data can be calculated by formula (4):

[0127]

[0128] In formula (4), It is used to represent the cross validity parameter between the second data and the third data. In formula (4), d is a constant, and 0<d≤h+1; It represents the fitting amount between the second data and the third data after deleting the dth quantitative data when taking h components for regression modeling, which is recorded as the first fitting amount; It represents the fitting amount between the second data and the third data calculated based on all the quantitative data in the first quantitative result when taking h components for regression modeling, which is recorded as the second fitting amount; Indicates the result of normalizing the third data.

[0129] Step C2: extracting first difference feature information from the second data based on the fitting parameters.

[0130] In one embodiment, step C2 may be implemented in the following manner:

[0131] A fitting threshold is determined, and first difference feature information is extracted from the second data according to a magnitude relationship between the fitting threshold and the fitting parameter.

[0132] Determine the fitting threshold. If the fitting parameter is less than the fitting threshold, Extract first difference feature information from the second data.

[0133] When the fitting parameter is less than the fitting threshold, PLS extraction That is, the process of extracting the principal component is over. At this time, the number of principal components extracted can be k, and then The k coefficients in are taken in absolute values, and the absolute value calculation results are arranged in descending order, and the quantized values ​​in the k first quantization results corresponding to the k absolute value calculation results after the descending order are used as the first difference feature information.

[0134] Exemplarily, the fitting threshold may be 0.0975.

[0135] Figure 3 A schematic diagram of a process for extracting the first difference feature information provided in an embodiment of the present application. As shown in FIG3 , the process may include steps 203 - 1 to 203 - 7:

[0136] Step 203-1: Determine the characteristic variables to be screened.

[0137] In one implementation, the characteristic variables to be screened may include the request information data and operation behavior data in the aforementioned embodiments.

[0138] In one implementation, the feature variables to be screened may include text data in the request information data and the operation behavior data. For example, the text data may be words.

[0139] Step 203-2: Calculate the word frequency of each feature variable.

[0140] Exemplarily, the TF value of each characteristic variable may be calculated using the formula (1) described in the above embodiment.

[0141] Step 203-3: Calculate the inverse file frequency of each feature variable.

[0142] Exemplarily, the IDF value of each feature variable may be determined by formula (2) in the aforementioned embodiment.

[0143] Step 203-4: Calculate the quantization result of each variable.

[0144] Exemplarily, the quantification result of each variable may be obtained by multiplying the word frequency by the inverse document frequency, that is, by calculating the formula (3) provided in the above embodiment.

[0145] Through the above quantification process, objective quantification of the first data is achieved, and the quantification deviation caused by human subjective quantification is reduced, so that the features related to the intrusion behavior can be better screened out, and the credibility of the final detection result can be improved.

[0146] Exemplarily, the quantization result of each variable may be the first quantization result described in the aforementioned embodiment.

[0147] Step 203-5: Calculate the cross-validity parameter.

[0148] Exemplarily, the cross-validity parameter may be obtained by calculating the second data and the third data in the first quantization result through PLS.

[0149] Step 203-6: Determine the number of variables to be extracted.

[0150] Exemplarily, the number of extracted variables may be extracted from the second data according to a size relationship between a cross-validity parameter and a fitting threshold.

[0151] Step 203-7: extract the first difference feature information.

[0152] Exemplarily, the first difference feature information is the same as the process provided in the aforementioned embodiment, which will not be repeated here.

[0153] In the related art, how to screen out feature variables with high correlation with intrusion behavior from a large number of feature variables is closely related to the accuracy of intrusion behavior detection and the amount of data calculation for subsequent detection; and in the related art, principal component analysis (PCA) is usually used to extract feature information from data.

[0154] Compared with the above-mentioned scheme, the first difference feature information extracted from the second data based on PLS provided in the embodiment of the present application has a reduced dimension relative to the second data; and, the first difference feature information contains the maximized orthogonal feature components in the second data; further, the first difference feature information also carries sufficient correlation between the second data and the third data, thereby providing sufficient feature information guarantee for the subsequent feature detection link, and laying the foundation for efficient and accurate safety status detection.

[0155] In summary, in the detection method provided in the embodiment of the present application, by adopting an objective quantification method and PLS processing means, scientific quantification and accurate extraction of text features are achieved, thereby reducing the amount of calculation in the subsequent detection process, and also providing the accuracy of state detection and improving the adaptability of the detection method.

[0156] Step 204: Detect the security status of the first data based on the first differential feature information.

[0157] In the embodiment of the present application, step 204 can be implemented in the following manner:

[0158] The first difference feature information is detected through the trained detection network to obtain the security status of the first data.

[0159] Among them, the trained detection network is obtained by training the detection network based on the second difference feature information; the second difference feature information is obtained after processing the sample data through PLS; the sample data includes at least one request information data and operation behavior data corresponding to at least one request information data.

[0160] In one implementation, the sample data may be obtained from a database.

[0161] In one implementation, the sample data may include multiple different types of request information data and multiple types of operation behavior data.

[0162] In one implementation, the sample data may include different types of request information data and corresponding operation behavior data initiated to multiple different types of network devices.

[0163] With the continuous development of Internet technology, hundreds of millions of IoT devices continue to access the network. The ever-increasing dimensions and cumbersome network interaction behaviors make the network environment increasingly complex. Therefore, the ubiquity of large-scale heterogeneous networks has further increased the uncertainty of request information data and corresponding operation behavior data in the network system. For example, data packet loss and delay problems during network transmission, or uncertainty factors such as platform differences caused by heterogeneous network environments, also pose huge challenges to intrusion detection methods.

[0164] In order to improve the robustness of the detection network, the sample data may include request information data of known types and corresponding operation behavior data, and the types and quantities of request information data and operation behavior data may be updated and increased in real time.

[0165] In an embodiment of the present application, the process of processing the sample data through PLS to obtain the second difference feature information is the same as the process of determining the fitting parameters between the second data and the third data through PLS in the aforementioned embodiment, and extracting the first difference feature information based on the fitting parameters, and will not be repeated here.

[0166] In one implementation, the detection network may be a neural network with feature extraction capabilities.

[0167] In one implementation, the detection network may be a neural network capable of adaptively performing feature extraction.

[0168] In one implementation, the detection network may be a fuzzy neural network.

[0169] In one implementation, the detection network may be an adaptive fuzzy neural network.

[0170] As the complexity and uncertainty of the network environment become increasingly obvious, the intrusion detection methods in related technologies cannot handle the uncertainty problem well, which directly leads to the low detection accuracy of the intrusion detection method. Fuzzy neural network combines the advantages of neural network and fuzzy system. Using fuzzy neural network for network security status detection can improve the accuracy of nonlinear and uncertainty problems; and adaptive fuzzy neural network can speed up the training speed of fuzzy neural network.

[0171] In an embodiment of the present application, the first differential feature information is detected through a trained adaptive fuzzy neural network, which can improve the detection accuracy and adaptability on the one hand; on the other hand, the detection result, i.e., the security status of the first data, can represent the actual network security status. Even in the event of new types of threat data, it is still possible to rely on the detection rules of the fuzzy system to output continuous fuzzy results.

[0172] In the embodiment of the present application, the trained neural network is obtained through steps D1 to D3:

[0173] Step D1: Perform fuzzy detection on the second difference feature information through the detection network to obtain a detection result.

[0174] In one implementation, the fuzzy detection of the second difference feature information is performed through the detection network, which can be achieved in the following manner:

[0175] A fuzzy detection rule of the detection network is obtained, and based on the fuzzy detection rule, a fuzzy calculation detection is performed on the second difference feature information to obtain a detection result.

[0176] Through the detection network, fuzzy detection is performed on each feature information in the second difference feature information, or designated feature information, to obtain a detection result.

[0177] Step D2: Obtain state labels from sample data.

[0178] In one implementation, the status label may be a label carried in the sample data and used to indicate the security type or security level corresponding to the sample data.

[0179] In one implementation, the status label may include text information and numerical information.

[0180] In one implementation, the state label may be a numerical variable obtained by quantizing using the quantization process described in the above embodiment.

[0181] Step D3: Based on the detection results and state labels, adjust the fuzzy rule parameters to obtain a trained detection network.

[0182] In one implementation, when the first condition is met, the fuzzy rule parameters can be continuously adjusted based on the detection results and the state labels until the second condition is met, and the adjustment operation is stopped to obtain a trained detection network.

[0183] Exemplarily, the first condition may include any of the following:

[0184] The match between the detection results and the state labels is weak;

[0185] The detection result is not equal to the state label;

[0186] The difference between the detection result and the status label is greater than the preset threshold.

[0187] Accordingly, the second condition may include any of the following:

[0188] The match between the detection results and the state labels is strong;

[0189] The detection result is equal to the state label;

[0190] The difference between the detection result and the status label is less than the preset threshold.

[0191] In the embodiment of the present application, the detection network may include an input layer and a detection layer.

[0192] Exemplarily, the input layer can be used to input the second differential feature information; the number of neurons in the input layer can be equal to the number of the second differential feature information. For example, if the number of the second differential feature information is k, then the number of neurons in the input layer can also be k.

[0193] Exemplarily, the detection layer can perform detection and analysis on the data input by the input layer.

[0194] In one embodiment, the detection layer may process the second differential feature information through a radial basis function (RBF). Exemplarily, when the detection layer performs feature detection through RBF, the detection layer may also be referred to as an RBF layer; Exemplarily, the RBF layer may include r neurons, and the output of each neuron may be determined by formula (5):

[0195]

[0196] In formula (5), represents the output result of the jth neuron in the RBF layer; cj =[c 1j ,c 2j ,...,c rj ] is the center vector of the jth RBF layer neuron, where c ij represents the central value of the i-th input neuron to the j-th neuron; σ j represents the width of the jth neuron; x = [x1, x2, …, x k ] T is the output data of the input layer, where x i Represents the i-th input feature variable.

[0197] Exemplarily, the detection network may further include a normalization layer, wherein the normalization layer is used to normalize the output data of the detection layer, as shown in formula (6):

[0198]

[0199] In formula (6), μ j is the output of the jth neuron in the normalization layer.

[0200] Exemplarily, the detection network may further include an output layer, which is used to perform weighted output on the output data of the normalization layer, as shown in formula (7):

[0201]

[0202] In formula (7), ω j represents the connection weight between the jth neuron in the normalized layer and the output neuron; y i Represents the actual output result of the i-th output neuron.

[0203] Exemplarily, the output layer can also implement a type judgment function, which can be implemented by formula (8):

[0204]

[0205] In formula (8), represents the target value, exemplarily, It can be the state label in the aforementioned embodiment; α (0<α≤0.5) represents the error value.

[0206] In the embodiment of the present application, step D3 can be implemented by steps E1 to E2:

[0207] Step E1, determining an error threshold.

[0208] In one implementation, the error threshold may be a fixed value.

[0209] In one embodiment, the error threshold may be an adjustable value. For example, the value of the error threshold may vary with the type of sample data. The error threshold may also vary with the application scenario. For example, in a scenario with stricter security level requirements, the error threshold may be set to a smaller value. In a scenario with looser security level requirements, the error threshold may be set to a larger value.

[0210] In one implementation, the error threshold may be determined during the detection network training process, or may be predetermined.

[0211] Step E2: Determine the detection error of the feature detection module based on the detection result and the state label.

[0212] In one implementation, the detection error may be obtained by calculating the difference between the detection result and the state label.

[0213] In one implementation, the detection error may be obtained by calculating the mean square error between the detection result and the state label.

[0214] For example, the detection error can be calculated by formula (9):

[0215]

[0216] In formula (9), M represents the total number of sample data; y represents the detection result; and y represents the state label.

[0217] Step E3: When the detection error is greater than or equal to the error threshold, the fuzzy rule parameters are adjusted through the parameter adjustment module based on the detection result, the state label and the error threshold to obtain a trained detection network.

[0218] Correspondingly, when the detection error is less than the error threshold, the training process of the detection network can be stopped, the fuzzy rule parameters can be saved, and the trained detection network can be obtained.

[0219] Through the above methods, a complete detection network model can be constructed, and each layer in the detection network can realize relatively independent data processing functions; and, compared with the traditional fuzzy neural network, the detection network provided by the embodiment of the present application introduces an error value, thereby improving the fault tolerance of the detection network, and further improving the adaptive performance of the detection network. In other words, the detection network provided by the embodiment of the present application, which is based on the adaptive fuzzy neural network as a prototype, can better handle uncertainty problems through the learning and adjustment process of fuzzy rule parameters executed by the error threshold.

[0220] From the above, it can be seen that the detection method provided in the embodiment of the present application is ultimately used to detect the fuzzy rule parameters of the trained detection network for detecting the first differential feature information. It can flexibly adjust the processing results, error thresholds and status labels in various types of sample data, thereby laying the foundation for efficient and accurate detection of adaptive fuzzy neural networks.

[0221] In the embodiment of the present application, step D3 can be implemented by steps F1 to F2:

[0222] Step F1, determining an adaptive learning rate parameter based on the state label, the detection result and the fuzzy rule parameter.

[0223] In one implementation, the adaptive learning rate parameter may be determined based on each detection result, a state label corresponding to the detection result, and a fuzzy rule parameter.

[0224] In one embodiment, the adaptive learning rate parameter may be changed with each change of the sample data.

[0225] In one embodiment, the adaptive learning rate parameter can maintain a slight change range in the detection network for the same type of sample data.

[0226] Exemplarily, the adaptive learning rate parameter can be determined by formula (9):

[0227]

[0228] In formula (10), η(t) represents the adaptive learning rate parameter of the t-th training; In formula (10), Λ(t) can be obtained by Calculated; represents the state label of the t-th sample data; y(t) can be the detection result corresponding to the t-th sample data; ω=[ω1,ω2,…,ω r ] represents the connection weight vector;.

[0229] The adaptive learning rate calculated by formula (10) can change with the change of error α. In the early stage of detection network training, the learning rate is large, which can accelerate the convergence speed of the detection network; while in the later stage of detection network training, the learning rate is small, so that the detection network can converge to the global optimal state.

[0230] Step F2: adjusting the fuzzy rule parameters based on the adaptive learning rate parameters, the detection results, the state labels and the initial fuzzy rule parameters.

[0231] In one implementation, the initial fuzzy rule parameters may include parameters of the detection network in an initial state.

[0232] In one implementation, the initial fuzzy rule parameters may include fuzzy rule parameters obtained after the i-th detection network training, which may be used as initial fuzzy rule parameters for the i+1-th fuzzy rule parameter adjustment.

[0233] In the embodiment of the present application, the fuzzy rule parameters include a first fuzzy rule parameter and a second fuzzy rule parameter; accordingly, the detection network includes an output module and a feature detection module.

[0234] Among them, the feature detection module is used to detect the second difference feature information based on the first fuzzy parameter to obtain the first result; the output module is used to classify the first result into types based on the second fuzzy parameter to obtain the detection result.

[0235] Accordingly, adjusting the fuzzy rule parameters can be achieved in the following ways:

[0236] Based on the detection result and the adaptive learning rate parameter, the first fuzzy parameter and the second fuzzy parameter are adjusted.

[0237] In one implementation, the output module may include the output layer described in the foregoing embodiment.

[0238] In one implementation, the feature detection module may include the detection layer and the normalization layer described in the aforementioned embodiment; illustratively, the feature detection module may also include the input layer described in the aforementioned embodiment.

[0239] Accordingly, the first fuzzy parameter may include the center vector of the RBF layer neuron and the width of the RBF layer neuron described in the aforementioned embodiment; the second fuzzy parameter may include the connection weight vector described in the aforementioned embodiment.

[0240] Exemplarily, the first fuzzy parameter and the second fuzzy parameter may be calculated by equations (11) to (13):

[0241]

[0242]

[0243]

[0244] From equations (11) to (13), we can see that the first fuzzy parameter of the jth neuron of the feature detection module during the t+1th training is c j (t+1) and σ j (t+1), the adaptive learning rate parameter of the t-th training, i.e., η(t), the first fuzzy parameter of the t-th training, i.e., c j(t) and σ j (t), and the detection result obtained by the t-th training, i.e., y(t), are calculated; accordingly, the second fuzzy parameter of the j-th neuron of the output module during the t+1-th training, i.e., ω j (t+1), the detection result of the t-th training, i.e., y(t), the adaptive learning rate parameter of the t-th training, i.e., η(t), and the second fuzzy parameter ω of the t-th training can be obtained. j (t) is calculated.

[0245] In the related art, the adjustment of neural network parameters is usually achieved by using error back propagation (BP). However, the BP algorithm has the disadvantages of being easily trapped in local minima and having a slow convergence speed. Based on the above problems, the detection algorithm provided in the embodiment of the present application can speed up the learning speed of the detection network through an adaptive back propagation (ABP) learning algorithm, thereby indirectly improving the detection efficiency.

[0246] From the above, it can be seen that the ABP strategy provided in the embodiment of the present application can overcome the problems of the fixed learning rate in the traditional BP algorithm, the slow convergence speed caused by it, and the easy falling into the local minimum, thereby accelerating the learning speed of the detection network while also improving the learning performance of the detection network.

[0247] Figure 4 A schematic diagram of the structure of the detection network training provided in an embodiment of the present application.

[0248] like Figure 4 As shown, the detection network training structure may include three parts: a collaborative feature selection module 401, an adaptive fuzzy neural network 402, and an adaptive parameter adjustment module 403. Among them:

[0249] The collaborative feature selection module 401 can implement the function of the collaborative feature selection algorithm (Cooperate Feature Selection Algorithm, CFSA); illustratively, CFSA can implement the functions of quantizing the sample data to obtain the sample quantization result and extracting the second difference feature information from the sample quantization result as described in the above-mentioned embodiment.

[0250] The adaptive fuzzy neural network 402 may include the detection network described in the aforementioned embodiment, which is used to analyze and process the second difference feature information to obtain a sample detection result; it can also receive the parameter adjustment result of the adaptive parameter adjustment module 403, and update its own first fuzzy parameter and second fuzzy parameter according to the parameter adjustment result.

[0251] The adaptive parameter adjustment module 403 is used to adjust the fuzzy rule parameters according to the output data of the adaptive fuzzy neural network 402, the state label and the preceding fuzzy rule parameters, and send the parameter adjustment results to the self-use fuzzy neural network.

[0252] In the embodiment of the present application, since an objective quantification method is adopted in the collaborative feature selection module 401, and PLS is used to extract the second differential feature information, the adaptive fuzzy neural network 402 can more intelligently infer the rules between sample data, reduce human participation factors, and make the detection process more objective and controllable.

[0253] In the related art, there are also solutions that use deep belief networks for feature screening. Although the recognition accuracy of this method has been improved, the training process of these networks consumes a lot of computing resources and requires a long training time. In the detection network training method provided in the embodiment of the present application, the dimension of the second difference feature information is effectively reduced through PLS, thereby reducing the amount of calculation in the detection network training process; in addition, the adaptive fuzzy neural network can also improve the stability of the detection network.

[0254] Through the above manner, in the neural network training method provided in the embodiment of the present application, after the sample data is quantized, the second differential feature information is extracted from the sample data quantization result through PLS, and based on the second differential feature information, the state label of the sample data and the initial fuzzy rule parameters, the fuzzy rule parameters of the adaptive fuzzy neural network are adjusted, thereby improving the accuracy of the sample data feature extraction; in the adaptive fuzzy neural network training process, an error threshold and an adaptive learning rate parameter are also introduced, thereby accelerating the speed of the adaptive fuzzy neural network, improving the convergence state of the adaptive fuzzy neural network, and laying the foundation for the subsequent efficient and accurate detection of the first data.

[0255] Figure 5a This is a statistical diagram of the classification results of five types of data using the detection method provided in the embodiment of the present application.

[0256] Figure 5b The figure is a schematic diagram of the statistical results of the false detection rate and missed detection rate of five types of data detected by the detection method provided in the embodiment of the present application.

[0257] Figure 5c The figure is a statistical diagram of the detection accuracy of five types of data detected by the detection method provided in the embodiment of the present application.

[0258] It should be noted that in Figure 5a to Figure 5cThe results shown in are obtained by testing and counting five types of data using the detection method provided in the embodiment of the present application. The above five types of data are obtained from the KDDCup99 intrusion detection database; after obtaining the five types of data, the CFAS provided in the embodiment of the present application is used to screen out 5 characteristic variables with high correlation from 41 input variables, and then the characteristic variables screened are tested using the detection network provided in the embodiment of the present application, and finally the results are obtained by statistical analysis based on the test results.

[0259] The above five types of data include Normal, Probing, Dos (Denial-Of-Service), U2R (Unauthorized Access To Local Superuser Privileges), and R2L (Unauthorized Access From a Remote Machine).

[0260] exist Figure 5a In the above data, the five types of data were classified into 990 Normal type data, 790 Probbing type data, 980 Dos type data, about 30 U2R type data and about 200 R2L data. The above classification results are comparable to the number of each type of data obtained in the KDDCup99 intrusion detection database. In other words, the detection method provided in the embodiment of the present application has a high accuracy in the classification of the above five data types.

[0261] exist Figure 5b In the embodiment of the present application, after the detection method provided in the detection results is used to detect five types of data, the false detection rates and missed detection rates corresponding to the detection results are (0, 0.001), (0.006, 0.005), (0.006, 0.004), (0.03, 0.02) and (0.018, 0.014), respectively.

[0262] exist Figure 5c In the embodiment of the present application, after the detection method provided in the detection method embodiment of the present application is used to detect five types of data, the detection accuracies corresponding to the detection results are 1, 0.99, 0.98, 0.95 and 0.97 respectively.

[0263] From the above, it can be seen that after using the detection method provided in the embodiment of the present application to detect five types of data, the false detection rate and missed detection rate corresponding to the detection results are lower than the false detection rate and missed detection rate of the network detection method in the related art, and the detection accuracy is greatly improved compared with the detection accuracy of the detection method in the related art.

[0264] Based on the above embodiments, the present application also provides a detection device 6. Figure 6 This is a schematic diagram of the structure of a detection device 6 provided in an embodiment of the present application. Figure 6 As shown, the detection device 6 may include an acquisition module 601, a feature extraction module 602 and a detection module 603; wherein:

[0265] The acquisition module 601 is used to acquire first data; wherein the first data at least includes network request data;

[0266] The feature extraction module 602 is used to analyze and process the first data to extract first difference feature information; wherein the first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data;

[0267] The detection module 603 is used to detect the security status of the first data based on the first difference feature information.

[0268] In some implementations, the feature extraction module 602 is used to analyze the first data to obtain the second data and the third data; wherein the second data includes data related to the request information data in the first data; the third data includes data related to the operation behavior data in the first data;

[0269] The feature extraction module 602 is used to analyze and process the second data and the third data by using the partial least square method PLS to extract the first difference feature information.

[0270] In some implementations, the feature extraction module 602 is used to analyze and process the second data and the third data through PLS to determine the fitting parameters between the second data and the third data;

[0271] The feature extraction module 602 is used to extract first difference feature information from the second data based on the fitting parameters.

[0272] In some implementations, the feature extraction module 602 is used to quantize the first data to obtain a first quantization result; and obtain the second data and the third data from the first quantization result.

[0273] In some implementations, the feature extraction module 602 is used to quantify the first type of data in the first data to obtain a second quantization result; wherein the first type of data includes text data;

[0274] The feature extraction module 602 is used to obtain the second type of data from the first data; wherein the second type of data includes numerical data;

[0275] A first quantization result is obtained based on the second quantization result and the second type of data.

[0276] In some embodiments, the detection module 603 is used to detect the first differential feature information through a trained detection network to obtain a security status of the first data; wherein the trained detection network is obtained by training the detection network based on the second differential feature information; the second differential feature information is obtained by processing the sample data through PLS; the sample data includes at least one request information data and operation behavior data corresponding to the at least one request information data.

[0277] In some embodiments, the detection module 603 is used to perform fuzzy detection on the second difference feature information through the detection network to obtain a detection result; obtain a state label from the sample data; and adjust the fuzzy rule parameters based on the detection result and the state label to obtain a trained detection network.

[0278] In some embodiments, the detection module 603 is used to determine the adaptive learning rate parameters based on the state label, the detection result and the fuzzy rule parameters; and adjust the fuzzy rule parameters based on the adaptive learning rate parameters, the detection result, the state label and the initial fuzzy rule parameters.

[0279] In some embodiments, the fuzzy rule parameters include a first fuzzy parameter and a second fuzzy parameter; the detection network includes an output module and a feature detection module; the feature detection module is used to detect the second difference feature information based on the first fuzzy parameter to obtain a first result; the output module is used to classify the first result based on the second fuzzy parameter to obtain a detection result; the detection module 603 is used to adjust the first fuzzy parameter and the second fuzzy parameter based on the detection result and the adaptive learning rate parameter.

[0280] In some embodiments, the detection module 603 is used to determine an error threshold; based on the detection result and the state label, determine the detection error of the feature detection module; when the detection error is greater than or equal to the error threshold, based on the detection result, the state label and the error threshold, adjust the fuzzy rule parameters through the parameter adjustment module to obtain a trained detection network.

[0281] It should be noted that in actual applications, the acquisition module 601, the feature extraction module 602 and the detection module 603 can be implemented using a processor in the detection device, and the above processor can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0282] From the above, it can be seen that the detection device 6 provided in the embodiment of the present application, when obtaining the first data including request information data and operation behavior data, can extract the first differential feature information from the first data, and then detect the security status of the first data based on the first differential feature information; and the first differential feature information includes the quantitative difference information between the request information data in the first data, and the correlation relationship between the request information data and the operation behavior data. Therefore, the detection device 6 provided in the embodiment of the present application can obtain the differential feature information of any network request, and can also obtain the correlation relationship between the request information data and the operation behavior data, so that the detection of the network status is more accurate, and the detected security status can be more objective, thereby improving the efficiency of network security status detection.

[0283] Based on the foregoing embodiments, the present application also provides a detection device 7. Figure 7 This is a schematic diagram of the structure of a detection device 7 provided in an embodiment of the present application. Figure 7 As shown, the detection device 7 includes a processor 701, a memory 702 and a communication bus.

[0284] The communication bus is used to realize the communication connection between the processor 701 and the memory 702; the processor 701 is used to execute the computer program stored in the memory 702 to realize the detection method as described in any of the previous embodiments.

[0285] The processor 701 may be at least one of an application specific integrated circuit ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. It is understandable that the electronic device used to implement the functions of the processor may also be other, which is not specifically limited in the embodiments of the present application.

[0286] The memory 702 may be a volatile memory, such as a RAM; or a non-volatile memory, such as a ROM, a flash memory, a hard disk (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the processor.

[0287] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, which can be executed by a processor to implement the detection method as described in any of the foregoing embodiments.

[0288] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0289] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0290] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0291] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0292] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0293] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0294] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0295] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0296] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0297] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0298] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0299] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A detection method, characterized in that: The method comprises: Acquire first data; wherein the first data includes request information data and operation behavior data; the operation behavior data is adjusted according to any one of the system time, operation state and operation environment of the detection device; Analyze and process the first data to extract first difference feature information; wherein the first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the request information data and the operation behavior data; Based on the first differential feature information, a security status of the first data is detected.

2. The method according to claim 1, characterized in that The analyzing and processing the first data to extract first difference feature information includes: Analyze the first data to obtain second data and third data; wherein the second data includes data related to the request information data in the first data; and the third data includes data related to the operation behavior data in the first data; The second data and the third data are analyzed and processed by partial least squares method PLS to extract the first difference feature information.

3. The method according to claim 2, characterized in that The analyzing and processing the second data and the third data by using the partial least squares method PLS to extract the first difference feature information includes: By means of the PLS, the second data and the third data are analyzed and processed to determine fitting parameters between the second data and the third data; Based on the fitting parameters, the first difference feature information is extracted from the second data.

4. The method according to claim 2, characterized in that: The analyzing the first data to obtain the second data and the third data includes: quantizing the first data to obtain a first quantization result; The second data and the third data are obtained from the first quantization result.

5. The method according to claim 4, characterized in that The quantizing the first data to obtain a first quantization result includes: quantizing first type data in the first data to obtain a second quantization result; wherein the first type data includes text data; Acquire second type data from the first data; wherein the second type data includes numerical data; The first quantization result is obtained based on the second quantization result and the second type of data.

6. The method according to claim 1, characterized in that The detecting the security status of the first data based on the first difference feature information includes: The first differential feature information is detected through a trained detection network to obtain the security status of the first data; wherein the trained detection network is obtained by training the detection network based on the second differential feature information; the second differential feature information is obtained by processing the sample data through PLS; the sample data includes at least one request information data and operation behavior data corresponding to the at least one request information data.

7. The method according to claim 6, characterized in that The trained detection network is obtained in the following way: Performing fuzzy detection on the second difference feature information through the detection network to obtain the detection result; Obtaining a state label from the sample data; Based on the detection result and the state label, the fuzzy rule parameters are adjusted to obtain the trained detection network.

8. The method according to claim 7, characterized in that Adjusting the fuzzy rule parameters based on the detection result and the state label includes: Determining an adaptive learning rate parameter based on the state label, the detection result and the fuzzy rule parameter; The fuzzy rule parameters are adjusted based on the adaptive learning rate parameters, the detection results, the state labels and the initial fuzzy rule parameters.

9. The method according to claim 8, characterized in that The fuzzy rule parameters include a first fuzzy parameter and a second fuzzy parameter; the detection network includes an output module and a feature detection module; The feature detection module is used to detect the second difference feature information based on the first fuzzy parameter to obtain a first result; The output module is used to classify the first result into types based on the second fuzzy parameter to obtain the detection result; The adjusting of the fuzzy rule parameters comprises: Based on the detection result and the adaptive learning rate parameter, the first fuzzy parameter and the second fuzzy parameter are adjusted.

10. The method according to claim 7, characterized in that The step of adjusting the fuzzy rule parameters based on the detection result and the state label to obtain the trained detection network includes: Determine the error threshold; Determining a detection error of a feature detection module based on the detection result and the state label; In the case where the detection error is greater than or equal to the error threshold, the fuzzy rule parameters are adjusted through a parameter adjustment module based on the detection result, the state label and the error threshold to obtain the trained detection network.

11. A detection device, characterized in that: The detection device comprises: an acquisition module, a feature extraction module and a detection module, wherein: The acquisition module is used to acquire first data; wherein the first data at least includes network request data and operation behavior data; the operation behavior data is adjusted according to any one of the system time, operation state and operation environment of the detection device; The feature extraction module is used to analyze and process the first data to extract first difference feature information; wherein the first difference feature information includes variation information carried in the first data; the variation information includes quantitative difference information between the first data and other network request operation information, and the correlation relationship between the network request data and the operation behavior data; The detection module is used to detect the security status of the first data based on the first difference feature information.

12. A detection device, characterized in that: The detection device includes a processor, a memory and a communication bus, wherein the communication bus is used to realize the communication connection between the processor and the memory; the processor is used to execute the computer program stored in the memory to realize the detection method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor of the detection device, it can implement the detection method according to any one of claims 1 to 10.

Images