A bank traffic intrusion detection method, device, system and medium

Abstract

The application provides a bank traffic intrusion detection method, device, system and medium, current bank external channel access traffic data is collected; a training set of an XLNET autoregressive model is obtained, the training set including: historical bank external channel access traffic data and classification of the historical bank external channel access traffic data; a mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data is learned by using the training set; model parameters of the XLNET autoregressive model are determined according to the mapping relationship, so as to obtain a pre-trained XLNET autoregressive model; the current bank external channel access traffic data is input into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs classification of the current bank external channel access traffic data. By using the pre-trained XLNET autoregressive model, timely and accurate detection of intrusion traffic can be realized without manual screening, network attacks can be prevented, and bank network security can be ensured.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, system and medium for detecting bank traffic intrusion. Background Technology

[0002] In the credit sector of commercial banks, access to external channels via the internet is of great significance to the diversity of commercial banking operations.

[0003] However, commercial banks currently have various externally exposed interfaces that have become security vulnerabilities in the entire credit system. They can only rely on the confidentiality of access interfaces by partner institutions and the vulnerability investigation of the credit system. If a network attack is launched against the interface, it will cause losses to commercial banks and also cause losses to credit requests from external channels.

[0004] Therefore, how to accurately and effectively conduct security checks on the external channels of commercial banks, detect intrusion traffic in a timely and accurate manner, effectively prevent unauthorized access to the credit system, and promote the stable and healthy development of commercial bank credit business are technical problems that need to be solved in this field. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a method, device, system and medium for detecting bank traffic intrusion, which can detect intrusion traffic in a timely and accurate manner, effectively prevent the credit system from being illegally accessed, and promote the stable and healthy development of commercial bank credit business.

[0006] To achieve the above objectives, this application provides the following technical solution:

[0007] In a first aspect, embodiments of this application provide a method for detecting bank traffic intrusion, including:

[0008] Collect current external channel access traffic data for the bank;

[0009] Obtain the training set of the XLNET autoregressive model, the training set including: historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data;

[0010] The training set is used to learn the mapping relationship between the historical external channel access traffic data of the bank and the classification of the historical external channel access traffic data of the bank;

[0011] The model parameters of the XLNET autoregressive model are determined based on the mapping relationship to obtain the pre-trained XLNET autoregressive model;

[0012] The current external channel access traffic data of the bank is input into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current external channel access traffic data of the bank.

[0013] In one possible implementation, the collection of current external channel access traffic data includes:

[0014] Collect initial data on current external channel access traffic to the bank;

[0015] The initial data of the current external channel access traffic of the bank is split according to the first preset rule to obtain split data, and the data corresponding to the handshake information in the split data is extracted to obtain extracted data;

[0016] The extracted data is transformed according to the second preset rule to obtain an input vector, and the input vector is used as the current external channel access traffic data of the bank.

[0017] In one possible implementation, the current external channel access traffic data of the bank includes: time-series information contained in the current external channel access traffic of the bank.

[0018] In one possible implementation, before learning the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data using the training set, the method further includes:

[0019] The historical external channel access traffic data of the bank is input into the XLNET autoregressive model so that the XLNET autoregressive model can learn the underlying features of the historical external channel access traffic data of the bank.

[0020] Secondly, embodiments of this application provide a bank traffic intrusion detection device, comprising:

[0021] The data collection unit is used to collect current external channel access traffic data of the bank;

[0022] The acquisition unit is used to acquire the training set of the XLNET autoregressive model, the training set including: historical external bank access traffic data and the classification of the historical external bank access traffic data;

[0023] A learning unit is used to learn the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data using the training set;

[0024] A determining unit is used to determine the model parameters of the XLNET autoregressive model according to the mapping relationship, so as to obtain the pre-trained XLNET autoregressive model;

[0025] The input unit is used to input the current external channel access traffic data of the bank into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current external channel access traffic data of the bank.

[0026] In one possible implementation, the acquisition unit is specifically used for:

[0027] Collect initial data on current external channel access traffic to the bank;

[0028] The initial data of the current external channel access traffic of the bank is split according to the first preset rule to obtain split data, and the data corresponding to the handshake information in the split data is extracted to obtain extracted data;

[0029] The extracted data is transformed according to the second preset rule to obtain an input vector, and the input vector is used as the current external channel access traffic data of the bank.

[0030] In one possible implementation, the current external channel access traffic data of the bank includes: time-series information contained in the current external channel access traffic of the bank.

[0031] One possible implementation also includes:

[0032] The initial learning unit is used to input the historical external channel access traffic data of the bank into the XLNET autoregressive model, so that the XLNET autoregressive model can learn the underlying features of the historical external channel access traffic data of the bank.

[0033] Thirdly, embodiments of this application provide a bank traffic intrusion detection system, including:

[0034] Memory, used to store computer programs;

[0035] A processor is used to implement the steps of the bank traffic intrusion detection method described above when executing the computer program.

[0036] Fourthly, embodiments of this application provide a computer-readable medium storing a computer program, which, when processed and executed, implements the steps of the bank traffic intrusion detection method described above.

[0037] Compared with the prior art, the embodiments of this application have the following beneficial effects:

[0038] This application provides a method, apparatus, system, and medium for detecting bank traffic intrusion. The method involves collecting current external channel access traffic data; obtaining a training set for an XLNET autoregressive model, which includes historical external channel access traffic data and its classification; learning a mapping relationship between the historical external channel access traffic data and its classification using the training set; determining the model parameters of the XLNET autoregressive model based on the mapping relationship to obtain a pre-trained XLNET autoregressive model; inputting the current external channel access traffic data into the pre-trained XLNET autoregressive model, which then outputs the classification of the current external channel access traffic data. Using the pre-trained XLNET autoregressive model, timely and accurate detection of intrusion traffic can be achieved without manual screening, preventing network attacks and ensuring bank network security. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart of a bank traffic intrusion detection method provided in an embodiment of this application is shown;

[0041] Figure 2 A schematic diagram of an XLNET autoregressive model provided in an embodiment of this application is shown;

[0042] Figure 3 A schematic diagram of a bank traffic intrusion detection device provided in an embodiment of this application is shown. Detailed Implementation

[0043] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0044] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0045] As described in the background section, in the credit field of commercial banks, network access from external channels is of great significance to the diversity of commercial banking business operations. However, in today's commercial bank network systems, network security issues are rampant, resulting in low system operational efficiency.

[0046] Commercial banks currently have various externally exposed interfaces that pose security vulnerabilities to their entire credit system. They can only rely on partner institutions to keep these interfaces confidential and on the credit system to identify and address vulnerabilities. If a cyberattack targets these interfaces, it will cause losses to commercial banks and also damage credit requests from external channels.

[0047] Existing methods for classifying malicious traffic mainly use traditional machine learning algorithms such as support vector machines. However, these methods require expert knowledge to continuously analyze new types of malicious traffic and extract rules. Furthermore, the prediction accuracy of traditional machine learning methods will continue to decline as different new traffic forms are added. At the same time, traffic information has strong temporal information, which cannot be extracted by traditional machine learning methods.

[0048] Therefore, how to accurately and effectively conduct security checks on the external channels of commercial banks, detect intrusion traffic in a timely and accurate manner, effectively prevent unauthorized access to the credit system, and promote the stable and healthy development of commercial bank credit business are technical problems that need to be solved in this field.

[0049] To address the aforementioned technical issues, this application provides a method, apparatus, system, and medium for detecting bank traffic intrusion. The method involves: collecting current external channel access traffic data; obtaining a training set for an XLNET autoregressive model, which includes historical external channel access traffic data and its classification; using the training set to learn the mapping relationship between the historical external channel access traffic data and its classification; determining the model parameters of the XLNET autoregressive model based on the mapping relationship to obtain a pre-trained XLNET autoregressive model; inputting the current external channel access traffic data into the pre-trained XLNET autoregressive model, which then outputs the classification of the current external channel access traffic data. Using the pre-trained XLNET autoregressive model, timely and accurate detection of intrusion traffic can be achieved without manual screening, preventing network attacks and ensuring bank network security.

[0050] Exemplary methods

[0051] See Figure 1 The flowchart shown is a bank traffic intrusion detection method provided in an embodiment of this application, including:

[0052] S101: Collect current external channel access traffic data for the bank.

[0053] In this embodiment of the application, to achieve intrusion detection of bank traffic, it is first necessary to collect current external channel access traffic data of the bank so that the collected traffic data can be detected in the future.

[0054] Specifically, in one possible implementation, the initial data of the current external channel access traffic of the bank can be collected first. The initial data of the current external channel access traffic of the bank mainly exists in the form of encrypted traffic, which mainly exists in the form of pcap (Process Characteristic Analysis Software Package).

[0055] Therefore, the initial data of the current external channel access traffic of the bank can be split according to the first preset rule to obtain split data, so as to specifically analyze and detect the intrusion traffic.

[0056] For example, a data stream is uniquely identified by a 5-tuple consisting of source IP (Internet Protocol), destination IP, source port, destination port, and transport layer protocol. This means that if the 5-tuple is the same, the data packets belong to the same data stream. A pcap packet can contain multiple data streams. The original pcap needs to be split using the SplitCap tool in the same format as the 5-tuple, and the data packets of each stream are saved as pcap packets in their original chronological order.

[0057] Meanwhile, in order to save system computing resources, in this embodiment of the application, only key data in the split data can be extracted for detection, instead of detecting all of them, thereby saving system computing resources.

[0058] Specifically, the data corresponding to the handshake information can be extracted from the split data to obtain the extracted data. For example, the first n data packets of each data stream can be extracted, and other data packets beyond this part can be discarded. This is consistent with the characteristic that the first part of the data stream is related to the handshake information, while the subsequent information is related to encrypted data.

[0059] In addition, to facilitate subsequent input model detection, the extracted data can be transformed into an input vector according to the second preset rule, and the input vector can be used as the current external channel access traffic data of the bank.

[0060] Specifically, when processing smaller, finer-grained data packets, this paper notes the similarities between encrypted data traffic and natural language processing (NLP). In NLP, text and sentences, along with their corresponding word vectors, are analogous. This paper associates the data traffic stream with sentences in text, and the data packets with word vectors. The types of bytes are similar to the bag-of-words in text data. Therefore, to ensure consistent processing of each data packet, the length is fixed: the first l bytes of each packet are extracted, the rest are discarded, and any insufficient bytes are padded with zeros. Under this data processing method, each data stream is transformed into an n*l two-dimensional matrix.

[0061] In this application embodiment, one-hot encoding format can be used to represent encrypted traffic. The value of each byte may be between 0 and 255, with a total of 256 possible values. Therefore, each byte can be encoded into a 256-dimensional vector for representation.

[0062] In one possible implementation, the current external channel access traffic data collected in this application embodiment may include: time sequence information contained in the current external channel access traffic.

[0063] Specifically, network traffic data packets exhibit distinct temporal characteristics during communication between hosts and servers. The order in which each traffic packet appears is highly distinctive across different applications. In traditional machine learning, the temporal information of traffic packets is a crucial feature with significant model weights. This method utilizes a self-attention mechanism, which is better able to capture long-distance dependencies, to overcome the local dependency characteristics of convolutional neural networks and recurrent neural networks. This enables long-distance information interaction between input sequences, allowing the acquisition of temporal information contained in network traffic.

[0064] The attention mechanism is a resource allocation scheme that, when computational power is limited, allocates computational resources to more important tasks while simultaneously addressing the problem of information overload. In neural network learning, generally speaking, the more parameters a model has, the stronger its expressive power and the greater the amount of information it can store. However, this can lead to information overload. By introducing an attention mechanism, focusing on information more critical to the current task from a large amount of input information, reducing attention to other information, and even filtering out irrelevant information, the problem of information overload can be solved, thereby improving the efficiency and accuracy of task processing.

[0065] S102: Obtain the training set of the XLNET autoregressive model, the training set including: historical external bank access traffic data and the classification of the historical external bank access traffic data;

[0066] S103: Use the training set to learn the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data;

[0067] S104: Determine the model parameters of the XLNET autoregressive model according to the mapping relationship to obtain the pre-trained XLNET autoregressive model.

[0068] S105: Input the current external channel access traffic data of the bank into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current external channel access traffic data of the bank.

[0069] In this embodiment of the application, a training set for the XLNET autoregressive model can be obtained. The training set includes: historical bank external channel access traffic data and classification of historical bank external channel access traffic data.

[0070] Specifically, access traffic from various partner institutions can be sampled from the personal credit management system, and malicious and benign traffic data can be collected through a self-built sandbox to create training and test sets, and the data can be preprocessed.

[0071] Based on traffic feedback from external channels accessing the personal credit management system, a self-built sandbox can be used to collect malicious traffic while simultaneously tagging it along with benign traffic.

[0072] The labeled dataset is filtered and explored. Statistical analysis is performed on data from different domains that present access risks and normal data. The Easy Ensemble algorithm is used to process imbalanced data. First, the sample with the fewest classes is used as the minimum benchmark. Then, other sample classes are sampled in units of this benchmark, with a similar amount of traffic extracted from the majority class each time, while maintaining sample integrity. These samples are then combined into a training set, on which a weak classifier is learned. This paper decides to train 101 base weak classifiers. Voting ensemble learning is then performed on these weak classifiers, and the class with the most prediction votes is the final class.

[0073] The EasyEnsemble algorithm is an effective method for classifying imbalanced data. It randomly divides the majority class samples into multiple subsets, merges each subset with the minority class samples to obtain multiple new training subsets, trains an AdaBoost base classifier using each training subset, and finally integrates all base classifiers to obtain the final classifier.

[0074] The mapping relationship between historical external channel access traffic data of the bank and the classification of historical external channel access traffic data is learned using the training set; the model parameters of the XLNET autoregressive model are determined based on the mapping relationship to obtain the pre-trained XLNET autoregressive model.

[0075] For details, see Figure 2 The diagram shown illustrates an XLNET autoregressive model provided in this embodiment. The input to the XLNET autoregressive pre-trained model is based on the Transformer input format, requiring the linear addition of position vectors and byte vectors to form the input vector. The core component of the XLNET model, Trm, is the Transformer's Encoder unit. A key feature of the XLNET model is its bidirectional nature; it can learn both forward and backward temporal information, striving to acquire more temporal features. The overall structure of the XLNET designed in this paper consists of 12 Transformer layers, with each Encoder unit containing 8 multi-head self-attention units. Although the number of layers is already quite large, the presence of residual models within the Transformer units prevents gradient vanishing issues. Thus, input E1-EN yields output T1-TN.

[0076] Encoder-Decoder is a very common model framework in deep learning, also known as Sequence to Sequence learning. Encoding involves converting the input sequence into a fixed-length vector; decoding involves converting this fixed vector back into an output sequence. Information is extracted from the data through encoding and decoding.

[0077] In one possible implementation, before learning the mapping relationship between historical bank external channel access traffic data and the classification of historical bank external channel access traffic data using the training set, the method provided in this application embodiment may further include:

[0078] Historical external channel access traffic data of the bank is input into the XLNET autoregressive model so that the XLNET autoregressive model can learn the underlying characteristics of the historical external channel access traffic data of the bank.

[0079] In other words, the embodiments of this application can utilize transfer learning and fine-tuning to reduce the computational resources consumed during model learning. Transfer learning refers to transferring learned model parameters to a new model to aid in its training. Considering that most data or tasks are correlated, transfer learning allows us to share learned model parameters (which can also be understood as the knowledge learned by the model) with the new model in some way, thereby accelerating and optimizing the model's learning efficiency instead of learning from scratch like most networks.

[0080] Fine-tuning refers to the fine-tuning of a pre-trained language model, which is essentially an application of transfer learning. After pre-training an advanced language model on a large-scale corpus, it is fine-tuned on downstream tasks, enabling the pre-trained language model to transfer and fully adapt to the downstream task.

[0081] Specifically, in the embodiments of this application, the density estimation can be performed using the unlabeled commercial bank network dataset on the XLNET-based autoregressive pre-trained model constructed in this paper. Its main task is to estimate the probability distribution of the next byte given a portion of the data stream.

[0082] In this way, XLNET can learn many underlying features of encrypted traffic. These features are specifically in the form of parameters in the XLNET network. In the subsequent fine-tuning, a second round of training is performed using labeled datasets. This is done on the XLNET model from the previous stage. Because the parameters have been adjusted, only a small amount of downstream data is needed to achieve good results on the target task.

[0083] In the embodiments of this application, during the testing process, macro average accuracy, macro average recall, and macro average F1 score can be used to evaluate the performance of the model, and finally the final model effect is obtained on the downstream task.

[0084] Finally, the current external channel access traffic data of the bank is input into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current external channel access traffic data of the bank.

[0085] In this embodiment of the application, the processed data can be input into the pre-trained and fine-tuned XLNET model, thereby determining whether the external channel traffic is malicious traffic, and then processing it as either denied access or allowed normal access.

[0086] This application provides a method for detecting bank traffic intrusion. The method involves collecting current external channel access traffic data; obtaining a training set for an XLNET autoregressive model, which includes historical external channel access traffic data and its classification; using the training set to learn the mapping relationship between the historical external channel access traffic data and its classification; determining the model parameters of the XLNET autoregressive model based on the mapping relationship to obtain a pre-trained XLNET autoregressive model; inputting the current external channel access traffic data into the pre-trained XLNET autoregressive model, which then outputs the classification of the current external channel access traffic data. Using the pre-trained XLNET autoregressive model, timely and accurate detection of intrusion traffic can be achieved without manual screening, preventing network attacks and ensuring bank network security.

[0087] This paper presents a secure prediction method for encrypted traffic of credit cooperation institutions based on an XLNET autoregressive pre-trained model. It achieves data preprocessing and corresponding data transformation of external channel network traffic. The model is pre-trained on a large amount of unlabeled data and fine-tuned on labeled data, overcoming the adaptation problem for unknown traffic. Furthermore, the temporal characteristics of network traffic are considered when using the XLNET autoregressive pre-trained model, optimizing the prediction accuracy. This method effectively prevents unauthorized access to the credit system and promotes the stable and healthy development of commercial bank credit business by conducting security checks on external channels.

[0088] Exemplary device

[0089] See Figure 3 The diagram shown is a schematic of a bank traffic intrusion detection device provided in an embodiment of this application, comprising:

[0090] Collection unit 201 is used to collect current external channel access traffic data of the bank;

[0091] The acquisition unit 202 is used to acquire the training set of the XLNET autoregressive model, the training set including: historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data;

[0092] Learning unit 203 is used to learn the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data using the training set;

[0093] The determining unit 204 is used to determine the model parameters of the XLNET autoregressive model according to the mapping relationship, so as to obtain the pre-trained XLNET autoregressive model;

[0094] Input unit 205 is used to input the current external channel access traffic data of the bank into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current external channel access traffic data of the bank.

[0095] In one possible implementation, the acquisition unit is specifically used for:

[0096] Collect initial data on current external channel access traffic to the bank;

[0097] The initial data of the current external channel access traffic of the bank is split according to the first preset rule to obtain split data, and the data corresponding to the handshake information in the split data is extracted to obtain extracted data;

[0098] The extracted data is transformed according to the second preset rule to obtain an input vector, and the input vector is used as the current external channel access traffic data of the bank.

[0099] In one possible implementation, the current external channel access traffic data of the bank includes: time-series information contained in the current external channel access traffic of the bank.

[0100] One possible implementation also includes:

[0101] The initial learning unit is used to input the historical external channel access traffic data of the bank into the XLNET autoregressive model, so that the XLNET autoregressive model can learn the underlying features of the historical external channel access traffic data of the bank.

[0102] This application provides a bank traffic intrusion detection device. The method applied to this device includes: collecting current external channel access traffic data; obtaining a training set for an XLNET autoregressive model, the training set including: historical external channel access traffic data and classifications of historical external channel access traffic data; using the training set to learn the mapping relationship between the historical external channel access traffic data and its classifications; determining the model parameters of the XLNET autoregressive model based on the mapping relationship to obtain a pre-trained XLNET autoregressive model; inputting the current external channel access traffic data into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputting the classifications of the current external channel access traffic data. Using the pre-trained XLNET autoregressive model, timely and accurate detection of intrusion traffic can be achieved without manual screening, preventing network attacks and ensuring bank network security.

[0103] Based on the above embodiments, this application provides a bank traffic intrusion detection system, including:

[0104] Memory, used to store computer programs;

[0105] A processor is used to implement the steps of the bank traffic intrusion detection method described above when executing the computer program.

[0106] Based on the above embodiments, this application also provides a computer-readable medium storing a computer program, which, when processed and executed, implements the steps of the above-described bank traffic intrusion detection method.

[0107] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0108] The aforementioned computer-readable medium may be included in the aforementioned system, or it may exist independently and not assembled into the system.

[0109] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts.

[0110] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0111] The above description is merely a preferred embodiment of this application. Although this application has disclosed preferred embodiments above, it is not intended to limit this application. Any person skilled in the art can make many possible variations and modifications to the technical solutions of this application using the methods and techniques disclosed above, or modify them into equivalent embodiments with equivalent changes, without departing from the scope of the technical solutions of this application. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of this application without departing from the content of the technical solutions of this application shall still fall within the protection scope of the technical solutions of this application.

Claims

1. A method of bank traffic intrusion detection, characterized by, The method comprises the following steps: collecting current bank external channel access traffic data; obtaining a training set of an XLNET autoregressive model, wherein the training set comprises historical bank external channel access traffic data and classification of the historical bank external channel access traffic data, and the obtaining process of the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data comprises the following steps: after the historical bank external channel access personal credit management system traffic feedback, using the labeled malicious traffic data and benign traffic data collected by the self-built sand; inputting the historical bank external channel access traffic data into the XLNET autoregressive model, so that the XLNET autoregressive model learns the underlying features of the historical bank external channel access traffic data; wherein the process of the XLNET autoregressive model learning the underlying features of the historical bank external channel access traffic data comprises the following steps: using the unlabeled commercial bank network data set to perform density estimation on the XLNET autoregressive pre-training model, and estimating the probability distribution of the next byte under the premise of given data stream byte; learning the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data by using the training set; determining the model parameters of the XLNET autoregressive model according to the mapping relationship, so as to obtain the pre-trained XLNET autoregressive model; inputting the current bank external channel access traffic data into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current bank external channel access traffic data.

2. The method of claim 1, wherein, The collecting current bank external channel access traffic data comprises: collecting current bank external channel access traffic initial data; splitting the current bank external channel access traffic initial data according to a first preset rule to obtain split data, extracting data corresponding to handshake information in the split data to obtain extraction data; transforming the extraction data according to a second preset rule to obtain an input vector, and taking the input vector as the current bank external channel access traffic data.

3. The method of claim 1, wherein, The current bank external channel access traffic data comprises time sequence information contained in the current bank external channel access traffic data.

4. A bank traffic intrusion detection apparatus, characterized by, The method comprises the following steps: a collecting unit configured to collect current bank external channel access traffic data; an obtaining unit configured to obtain a training set of an XLNET autoregressive model, wherein the training set comprises historical bank external channel access traffic data and classification of the historical bank external channel access traffic data, and the obtaining process of the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data comprises the following steps: after the historical bank external channel access personal credit management system traffic feedback, using the labeled malicious traffic data and benign traffic data collected by the self-built sand; The initial learning unit is configured to input the historical bank external channel access traffic data into the XLNET autoregressive model, so that the XLNET autoregressive model learns the underlying features of the historical bank external channel access traffic data; wherein the process of learning the underlying features of the historical bank external channel access traffic data by the XLNET autoregressive model comprises: using a label-free commercial bank network data set to perform density estimation on the XLNET autoregressive pre-training model, and estimating the probability distribution of the occurrence of the next byte under the premise of a given data stream byte; The learning unit is configured to learn the mapping relationship between the historical bank external channel access traffic data and the classification of the historical bank external channel access traffic data by using the training set; The determining unit is configured to determine the model parameters of the XLNET autoregressive model according to the mapping relationship, so as to obtain the pre-trained XLNET autoregressive model; The input unit is configured to input the current bank external channel access traffic data into the pre-trained XLNET autoregressive model, and the pre-trained XLNET autoregressive model outputs the classification of the current bank external channel access traffic data.

5. The apparatus of claim 4, wherein, The collection unit is specifically configured to: Collect current bank external channel access traffic initial data; Split the current bank external channel access traffic initial data according to a first preset rule to obtain split data, extract data corresponding to handshake information in the split data, and obtain extracted data; Transform the extracted data according to a second preset rule to obtain an input vector, and use the input vector as the current bank external channel access traffic data.

6. The apparatus of claim 4, wherein, The current bank external channel access traffic data includes time sequence information contained in current bank external channel access traffic.

7. A bank traffic intrusion detection system characterized by, Comprise: A memory for storing a computer program; A processor for executing the computer program to implement the steps of the bank traffic intrusion detection method according to any one of claims 1-3.

8. A computer readable medium characterized by The computer readable medium stores a computer program, and the computer program is executed by the processor to implement the steps of the bank traffic intrusion detection method according to any one of claims 1-3.

Images