Packet detection model training method and device, and computer device

Abstract

The application relates to a training method and device of a message detection model, a computer device, a storage medium and a computer program product, and relates to the technical field of artificial intelligence. The method comprises the following steps: determining a field sequence corresponding to each current sample message, wherein the field sequence comprises target features corresponding to each field; for each field of each current sample message, determining a prediction probability corresponding to the field by using a current detection model of a current iteration according to the target feature corresponding to the field and a neighboring prediction probability corresponding to a neighboring field adjacent to the field; updating the current detection model according to the prediction probabilities corresponding to the current sample messages, obtaining an updated model, entering a next iteration, taking the updated model as a current detection model corresponding to the next iteration, returning to the step of obtaining the multiple current sample messages of the current iteration, and continuing to execute until a training stop condition is reached, and determining a trained detection model to improve the detection accuracy.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device, storage medium, and computer program product for training a message detection model. Background Technology

[0002] With the development of information security technology, in order to ensure the security of resource transaction processes, it is often necessary to perform anomaly detection on the messages generated in resource transactions.

[0003] In existing technologies, anomaly detection is often performed through string matching. However, current technologies rely on partial string matching and can only perform dictionary-based detection, resulting in low accuracy. Summary of the Invention

[0004] Therefore, it is necessary to provide a training method, apparatus, computer equipment, computer-readable storage medium, and computer program product for a message detection model that can improve detection accuracy in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for training a message detection model. The method includes:

[0006] Obtain multiple sample messages for the current iteration and determine the field sequence corresponding to each sample message, wherein the field sequence includes the target features corresponding to each field;

[0007] For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probability corresponding to the adjacent field.

[0008] The detection model is updated based on the predicted probabilities corresponding to each current sample message to obtain the updated model. The process then proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process continues by returning to the step of obtaining multiple current sample messages for the current iteration until the training stop condition is met. The trained detection model is then determined, and it is used to perform anomaly detection on the fields of the message.

[0009] Secondly, this application also provides a training apparatus for a message detection model. The apparatus includes:

[0010] The acquisition module is used to acquire multiple current sample messages in the current iteration and determine the field sequence corresponding to each current sample message, wherein the field sequence includes the target features corresponding to each field.

[0011] The determination module is used to determine the prediction probability corresponding to each field of each current sample message, based on the target feature corresponding to the field and the adjacent prediction probability corresponding to the adjacent field, through the current detection model of the current iteration;

[0012] The iteration module is used to update the current detection model according to the predicted probability corresponding to each current sample message, obtain the updated model, enter the next iteration, and use the updated model as the current detection model corresponding to the next iteration. The step of obtaining multiple current sample messages of the current iteration is returned to continue execution until the training stopping condition is reached, and the trained detection model is determined. The trained detection model is used to perform anomaly detection on the fields of the message.

[0013] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0014] Obtain multiple sample messages for the current iteration and determine the field sequence corresponding to each sample message, wherein the field sequence includes the target features corresponding to each field;

[0015] For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probability corresponding to the adjacent field.

[0016] The detection model is updated based on the predicted probabilities corresponding to each current sample message to obtain the updated model. The process then proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process continues by returning to the step of obtaining multiple current sample messages for the current iteration until the training stop condition is met. The trained detection model is then determined, and it is used to perform anomaly detection on the fields of the message.

[0017] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0018] Obtain multiple sample messages for the current iteration and determine the field sequence corresponding to each sample message, wherein the field sequence includes the target features corresponding to each field;

[0019] For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probability corresponding to the adjacent field.

[0020] The detection model is updated based on the predicted probabilities corresponding to each current sample message to obtain the updated model. The process then proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process continues by returning to the step of obtaining multiple current sample messages for the current iteration until the training stop condition is met. The trained detection model is then determined, and it is used to perform anomaly detection on the fields of the message.

[0021] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0022] Obtain multiple sample messages for the current iteration and determine the field sequence corresponding to each sample message, wherein the field sequence includes the target features corresponding to each field;

[0023] For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probability corresponding to the adjacent field.

[0024] The detection model is updated based on the predicted probabilities corresponding to each current sample message to obtain the updated model. The process then proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process continues by returning to the step of obtaining multiple current sample messages for the current iteration until the training stop condition is met. The trained detection model is then determined, and it is used to perform anomaly detection on the fields of the message.

[0025] The training method, apparatus, computer equipment, storage medium, and computer program product for the above-mentioned message detection model acquire multiple current sample messages for the current iteration and determine the field sequence corresponding to each current sample message. The field sequence includes the target features corresponding to each field. For each field of each current sample message, based on the target features corresponding to the field and the neighboring prediction probabilities corresponding to the adjacent fields, the prediction probability corresponding to the field is determined by the current detection model for the current iteration. In this way, the prediction probability of the current field is inferred by combining the prediction probabilities of adjacent fields, ensuring that the prediction probability of the current field is based on contextual semantic analysis, that is, it can well reflect the contextual correlation and ensure the accuracy of subsequent detection models. The current detection model is updated according to the prediction probabilities corresponding to each current sample message, resulting in an updated model. The next iteration is then performed, and the updated model is used as the current detection model for the next iteration. The process of acquiring multiple current sample messages for the current iteration continues until the training stopping condition is met, thus determining the trained detection model. The trained detection model is used to perform anomaly detection on the fields of the message. In this way, the model is updated iteratively based on the predicted probabilities of each field that reflects the contextual relevance, ensuring that the trained detection model can accurately detect anomalies in messages based on contextual semantics, thus greatly improving the detection accuracy. Attached Figure Description

[0026] Figure 1 This is a diagram illustrating the application environment of a message detection model training method in one embodiment.

[0027] Figure 2 This is a flowchart illustrating the training method for a message detection model in one embodiment;

[0028] Figure 3 This is a flowchart illustrating the steps for determining the field sequence in one embodiment;

[0029] Figure 4 This is a structural block diagram of a training device for a message detection model in one embodiment;

[0030] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0032] The training method for the message detection model provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 acquires multiple current-iteration sample messages sent by terminal 102 for the current iteration and determines the field sequence corresponding to each current-iteration sample message. This field sequence includes the target features corresponding to each field. For each field of each current-iteration sample message, server 104 determines the prediction probability corresponding to that field based on the target features corresponding to that field and the neighboring prediction probabilities corresponding to adjacent fields, using the current-iteration detection model. Server 104 updates the current-iteration detection model based on the prediction probabilities corresponding to each current-iteration sample message, obtaining an updated model, proceeding to the next iteration, and using this updated model as the current-iteration detection model for the next iteration. The process returns to acquiring multiple current-iteration sample messages and continues until the training stopping condition is met, thus determining the trained detection model. This trained detection model is used for anomaly detection of the message fields. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0033] In one embodiment, such as Figure 2 As shown, a method for training a message detection model is provided, which can be applied to computer devices ( Figure 1 Taking terminal 102 or server 104 as an example, the following steps are included:

[0034] Step S202: Obtain multiple current sample messages for the current iteration and determine the field sequence corresponding to each current sample message. The field sequence includes the target features corresponding to each field.

[0035] A message is a data unit exchanged and transmitted in a network. Optionally, this message can be used in interactive scenarios and is considered an interactive message. A message includes at least one message field. When there are multiple message fields, the message includes multiple message fields arranged in a specific order. For example, message P includes P1, ..., Pn, where Pn is the nth message field. Each message field includes at least one field. When there are multiple fields, the message field includes multiple fields arranged in a specific order. For example, for Pn, the message field includes fields Pn,1, ..., Pn,l, where l is the field length. Message fields include message type, instruction number, service number, related service number, registration date and time, address, account of the user providing the resource, name of the user providing the resource, resource type, resource amount, interest accrual date, and unit code, etc. Furthermore, the message field can be divided into fixed fields and functional fields. The message type belongs to the fixed field, while the resource name, account, address, and resource deduction remarks added or removed during the interaction process belong to the functional field.

[0036] In this embodiment, the detection model is trained using an iterative training method, that is, the model parameters are adjusted through multiple iterations to obtain a trained detection model. Therefore, the messages during the training process are considered as sample messages. Furthermore, each sample message includes a corresponding sample tag, which indicates whether the sample message is an anomalous message. Optionally, the anomalous message can be understood as a blacklist. This sample tag is used for model training. The field sequence is a collection of semantic information; a field can be a character, a word, a short phrase, etc., without specific limitations. The target feature is the input data to the detection model. To ensure the accuracy of the detection model, the target features input to the detection model have undergone feature transformation processing to enhance the information of the features.

[0037] Specifically, the computer device acquires multiple sample messages for the current iteration and determines the feature columns corresponding to each sample message. For each sample message, the computer device determines the field sequence corresponding to each feature column based on the feature columns of that sample message.

[0038] Each message field corresponds to a feature column, and each field that makes up a message field corresponds to a target feature.

[0039] Optionally, the computer device acquires the original dataset for model training. The original dataset includes multiple batches of sub-training datasets, each containing multiple sample messages. For example, the computer device acquires the sample datasets and performs data cleaning on them to obtain the original dataset. This data cleaning includes discrete value removal and missing value imputation. The method for imputing numerical missing values ​​is as follows:

[0040] V x，y =avg(V x，j ), j = 1, ..., n,

[0041] In the above formula, V x，y For the missing values ​​at position (x, y) in the original numerical data, avg(V) x，j ) Represents data V with the same characteristics in multiple messages x，j The average value.

[0042] The imputation method for marker-type missing values ​​is as follows:

[0043] V x，y =F max (V x，y ), j = 1, ..., n

[0044] In the above formula, V x，y For the missing values ​​at position (x, y) in the original data, F max (V x，y This represents the flag value that indicates the highest frequency of data with the same characteristics among multiple messages.

[0045] Step S204: For each field of each current sample message, based on the target feature corresponding to the field and the neighboring prediction probabilities corresponding to the adjacent fields, the prediction probability corresponding to the field is determined by the current detection model of the current iteration.

[0046] The detection model is a neural network model; for example, it is a recurrent neural network model, which includes at least an input layer, a hidden layer, an output layer, a recurrent network, and a loss layer. The recurrent neural network calculation formula is: L:R m ×R n →R n G: R→R. Where R m The input matrix for the model can be understood as being composed of subsets of data from each batch. R0 n This can be understood as a matrix in the model parameters. The detection model uses the softmax activation function, which standardizes the predicted probabilities. For example, the formula for the activation function in this detection model is as follows:

[0047]

[0048] Among them, h t Let b be the predicted probability of a certain field, b be the model bias matrix, and W be the predicted probability of a certain field. yh Let W be the weight matrix. yh h t +b is the non-standardized log probability of the predicted value for each discrete variable.t The predicted probability after standardization. softmax(x) i ) for target feature x i The standard target features obtained after processing are obtained by calculating the target features x. i The index value is obtained as a proportion of the index values ​​of all target features xj.

[0049] Specifically, for each field in each sample message, the computer device obtains the neighboring predicted probabilities corresponding to the neighboring fields of the adjacent fields. Based on the target features corresponding to the field and the neighboring predicted probabilities of the adjacent fields, the computer device determines the predicted probability corresponding to the field using the detection model of the current iteration. The neighboring field can be either a field adjacent to the current field and preceding it, or a field adjacent to the current field and following it; the specific location is not limited.

[0050] Optionally, for each field of the current sample message, the computer device determines a pre-selected field preceding and a pre-selected field following the current field, and identifies adjacent fields from the two pre-selected fields, and determines the adjacent prediction probability corresponding to the adjacent field. Based on the target feature corresponding to the field and the adjacent prediction probabilities corresponding to the adjacent fields, the computer device determines the prediction probability corresponding to the field using the current detection model of the current iteration.

[0051] For each sample message, each field corresponds to a time point. When an adjacent field is a field adjacent to and preceding the current field, for the initial field, the time of the initial field is the initial time point, and the adjacent time point of the initial time point is time point 0. The adjacent prediction probability corresponding to the adjacent field of the initial field is set to a preset probability, for example, set to 0. When an adjacent field is adjacent to and following the current field, the field at the starting time point is the ending field. Since there is no field after the starting time point, i.e., there is no field at the adjacent time point, the prediction probability of the next time point (i.e., the adjacent prediction probability) is set to a preset probability.

[0052] It should be noted that by combining the predicted probabilities of adjacent fields with the target features of the field, it can be ensured that the detection model determines the predicted probability of the field in this detection by taking into account the semantic information of the context.

[0053] For each field, the steps for determining the predicted probability of that field include: for each field in each current sample message, the computer device determines the time corresponding to that field, determines the adjacent times of that time, and obtains the adjacent predicted probabilities corresponding to those adjacent times. Based on the target features corresponding to that time and the adjacent predicted probabilities corresponding to that time, the computer device determines the predicted probability corresponding to that field using the current detection model in the current iteration.

[0054] Step S206: Update the current detection model according to the predicted probability corresponding to each current sample message to obtain the updated model, enter the next iteration, and use the updated model as the current detection model corresponding to the next iteration. Return to the step of obtaining multiple current sample messages of the current iteration and continue to execute until the training stopping condition is reached. Determine the trained detection model, which is used to perform anomaly detection on the fields of the message.

[0055] Specifically, for each current sample message, the computer device calculates the current loss value for that iteration based on the predicted probabilities corresponding to each current sample message using cross-entropy loss. If the current loss value is greater than the error threshold, the computer device updates the current detection model based on this current loss value, obtaining an updated model. In the next iteration, the computer device uses this updated model as the current detection model for the next iteration and returns to the steps of obtaining multiple current sample messages for that iteration until the current loss value is less than or equal to the error threshold. This determines the trained detection model, which is then used to perform anomaly detection on the fields of the message.

[0056] Optionally, the computer device determines the prediction probability of each current sample message based on the prediction probability corresponding to each current sample message. The computer device calculates the current loss value for each iteration using cross-entropy loss, based on the sample label and prediction probability of the current sample message. This prediction probability represents the prediction probability of the target feature, and the message prediction probability represents the probability that the current sample message is an anomalous message.

[0057] For example, the calculation process for the current loss value in the current iteration can be performed using the following formula:

[0058]

[0059] Among them, L(y) i f(x) i )) represents the current sample message f(x) i ) and the tag y of the current sample message i The determined cross-entropy loss function value, where n is the number of anomalous message tags and m is the total number of message fields. iThis can be understood as a message field.

[0060] Optionally, if the current loss value is greater than the error threshold, the computer device obtains the hidden layer parameters of the model and determines the gradient of the loss function based on the loss value and the hidden layer parameters. Based on this loss function gradient, the computer device calculates the cumulative plateau gradient of the RMSProp (Root Mean Square propagation gradient descent, an algorithm used for gradient calculation in deep learning) optimizer, and updates the model parameters of the current detection model based on this cumulative plateau gradient and the loss function gradient to obtain the updated model.

[0061] For example, after determining the current loss value, the hidden layer parameters θ, and the number of message fields m, the gradient g of the loss function is determined according to the following formula. k :

[0062]

[0063] After determining the gradient of the loss function g k Then, the cumulative plateau gradient r is determined according to the following formula:

[0064] r←ρr+(1-ρ)g k ·g k

[0065] Where ρ is a hyperparameter of the optimizer, which can take a value of 0.7. The initial value of r is 0.

[0066] After determining the cumulative platform gradient r and the loss function gradient g... k After determining the hidden layer parameters θ of the model and obtaining the update parameter ε, the hidden layer parameters of the model are updated according to the following formula:

[0067]

[0068] Optionally, for each message field in each current sample message, the computer device calculates the mean of the predicted probabilities in that message field and uses the mean as the predicted probability of that message field. For each current sample message, the computer device uses the mean of the predicted probabilities of each message field as the message prediction probability of that current sample message.

[0069] To further evaluate the accuracy of the trained prediction model, an accuracy evaluation value, F1, can be used. Specifically, multiple sample messages are obtained for validation, and each sample message is input into the trained prediction model to obtain the probability corresponding to that sample message. Recall and precision are calculated using the labels of each sample message and the probabilities they correspond to. Then, the accuracy evaluation value F1 is determined based on the recall and precision, as shown in the following formula:

[0070]

[0071] Where Precision is the accuracy rate and Recall is the recall rate. Specifically, the formulas for calculating Precision and Recall are as follows:

[0072]

[0073] Where TP represents the number of true positive samples, FP represents the number of false positive samples, and FN represents the number of false negative samples.

[0074] In the training method of the above-mentioned message detection model, multiple sample messages for the current iteration are acquired, and the field sequence corresponding to each sample message is determined. The field sequence includes the target features corresponding to each field. For each field of each sample message, the prediction probability corresponding to the field is determined by the detection model for the current iteration based on the target features corresponding to the field and the neighboring prediction probabilities of the adjacent fields. In this way, the prediction probability of the current field is inferred by combining the prediction probabilities of the adjacent fields, ensuring that the prediction probability of the current field is based on the contextual semantic analysis, that is, it can well reflect the contextual relevance, and ensure the accuracy of the subsequent detection model. The detection model is updated according to the prediction probabilities corresponding to each sample message, and the updated model is used as the detection model for the next iteration. The process of acquiring multiple sample messages for the current iteration is repeated until the training stopping condition is met, and the trained detection model is determined. The trained detection model is used to detect anomalies in the fields of the message. In this way, the model is updated iteratively based on the predicted probabilities of each field that reflects the contextual relevance, ensuring that the trained detection model can accurately detect anomalies in messages based on contextual semantics, thus greatly improving the detection accuracy.

[0075] In one embodiment, determining the field sequence corresponding to each current sample message includes: for each current sample message, determining multiple feature columns corresponding to the current sample message; and for each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message through information gain processing based on the current sample message and the feature column.

[0076] Specifically, for each message field in each current sample message, the computer device obtains the feature column corresponding to that message field, and the feature column includes at least one feature value. For each feature column in each current sample message, the computer device determines the field sequence corresponding to that feature column in the current sample message through information gain processing based on the current sample message and the feature column. The feature value is a numerical value used to represent the field.

[0077] Optionally, for each message field in each current sample message, the computer device acquires the feature column corresponding to that message field, the feature column including at least one feature value. The computer device acquires the label value and label probability corresponding to each message field. For each message field in each current sample message, based on the current sample message, each feature value in the feature column, the label value and label probability corresponding to the message field, information gain processing is used to determine the field sequence corresponding to the feature column in the current sample message. Here, the label probability represents the probability that the message field is abnormal, i.e., a risk coefficient, and the label value is a numerical value used to characterize whether the message field is sensitive or non-sensitive.

[0078] In this embodiment, for each current sample message, multiple feature columns corresponding to that current sample message are determined. For each feature column in each current sample message, based on the current sample message and the feature column, information gain processing is used to determine the field sequence corresponding to the feature column in the current sample message. In this way, information gain processing can further increase the amount of information in the field sequence, ensuring the effectiveness of subsequent model training.

[0079] In one embodiment, such as Figure 3 As shown, for each feature column in each current sample message, based on the current sample message and the feature column, information gain processing is used to determine the field sequence corresponding to that feature column in the current sample message, including:

[0080] Step S302: For each feature column in each current sample message, determine the label probability of the label value corresponding to the feature column, and obtain the information gain rate corresponding to each feature column by calculating the information gain based on the label probability of the label value corresponding to the feature column, the first initial probability of the feature value corresponding to each feature column before the feature column, and the second initial probability of the feature value corresponding to the feature column.

[0081] Specifically, for each feature column in each current sample message, the label information entropy corresponding to the current sample message is obtained through information gain processing based on the label probability of the label value corresponding to that feature column. The initial information entropy corresponding to that feature column is determined by calculating the information entropy based on the first initial probability of the feature values ​​corresponding to each feature column preceding it and the second initial probability of the feature value corresponding to that feature column. For each feature column in each current sample message, the difference between the initial information entropy and the initial information entropy of that feature column is used as the feature parameter of that feature column. For each feature column in each current sample message, the ratio of the feature parameter corresponding to that feature column to the label information entropy is used as the information gain rate of that feature column.

[0082] It should be noted that a higher information gain ratio indicates a greater influence of the message field corresponding to that feature column on the anomaly detection of the sample message. For example, for a sample message, there are two feature columns, f1 and f2. If the information gain ratio of feature column f1 is greater than that of feature column f2, it means that the message field corresponding to feature column f1 has a greater influence on the anomaly detection of the sample message than the message field corresponding to feature column f2.

[0083] For example, for sample message A, there are three sequentially arranged feature columns: feature column f1, feature column f2, and feature column f3. The number of feature values ​​for each feature column is determined: feature column f1 has one feature value (with a probability of p11), feature column f2 has two feature values ​​(with probabilities p21 and p22 respectively), and feature column f3 has three feature values ​​(with probabilities p31, p32, and p33 respectively). The label value for feature column f1 is l1 (with a label probability of pi1), the label value for feature column f2 is l2 (with a label probability of pi2), and the label value for feature column f3 is l3 (with a label probability of pi3).

[0084] Correspondingly, the tag information entropy E(L) for this sample message is:

[0085] E(L)=-(pi1 log2pi1+pi2 log2pi2+pi3 log2pi3)

[0086] Correspondingly, for feature column f1, there are no feature columns preceding it. In this case, the probability that only the feature values ​​in feature column f1 exist is the second initial probability. At this time, the initial information entropy E(f1) of feature column f1 can be calculated using the following formula:

[0087] E(f1)=-(p11 log2p11)

[0088] For a feature column f2, if a feature column f1 precedes f2, then the first initial probability is the probability corresponding to each feature value in feature column f1, and the probability of the feature values ​​in feature column f2 is the second initial probability. The initial information entropy E(f2) of feature column f2 can then be calculated using the following formula:

[0089] E(f2)=-(p11 log2p11+p21 log2p21+p22 log2p22)

[0090] For feature column f3, which is preceded by feature columns f1 and f2, the first initial probability is the probability corresponding to each feature value in feature column f1 and the probability corresponding to each feature value in feature column f2. The probability of the feature values ​​in feature column f3 is the second initial probability. The initial information entropy E(f3) of feature column f3 can then be calculated using the following formula:

[0091] E(f3)=-(p11 log2p11+p21 log2p21+p22 log2p22+p31 log2p31

[0092] +p32 log2p32+p33 log2p33)

[0093] Furthermore, after determining the initial information entropy of each feature column and the tag information entropy of the sample message, the feature parameter C1 = E(L) - E(f1) for feature column f1, the feature parameter C2 = E(L) - E(f2) for feature column f2, and the feature parameter C3 = E(L) - E(f3) for feature column f3.

[0094] Furthermore, the information gain ratio of feature column f1 is G1 = C1 / E(L), the information gain ratio of feature column f2 is G2 = C2 / E(L), and the information gain ratio of feature column f3 is G3 = C3 / E(L).

[0095] Step S304: For each current sample message, determine the feature set corresponding to each feature column in the current sample message.

[0096] Specifically, for each current sample message, non-linear processing is performed on the current sample message to obtain the feature set corresponding to each feature column in the current sample message. The feature set includes the initial features corresponding to each field.

[0097] This non-linear processing is a black-box process, which can be viewed as a feature transformation process to enhance the information of the features. It should be noted that a field corresponds to a feature value, an initial feature, and a target feature. The feature value is the numerical value of the field, used to determine the information gain rate of the feature column containing the feature value. The initial feature is an intermediate feature, used to determine the target feature, which is the feature input into the detection model.

[0098] Step S306: For each feature column in each current sample message, determine the field sequence corresponding to the feature column in the current sample message based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column.

[0099] Specifically, for each feature column in each current sample message, the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column are fused to determine the field sequence corresponding to the feature column in the current sample message. The field sequence includes the target features corresponding to each field.

[0100] In this embodiment, for each feature column in each current sample message, the label probability of the label value corresponding to that feature column is determined. Based on the label probability of the label value corresponding to that feature column, the first initial probability of the feature values ​​corresponding to each feature column preceding that feature column, and the second initial probability of the feature value corresponding to that feature column, information gain is calculated to obtain the information gain ratio corresponding to each feature column. Thus, the influence of each feature column on determining whether a sample message is an anomalous can be estimated based on the information gain ratio. For each current sample message, the feature set corresponding to each feature column in that current sample message is determined. For each feature column in each current sample message, based on the information gain ratio corresponding to that feature column and the feature set corresponding to that feature column, the field sequence corresponding to that feature column in that current sample message is determined. This yields a field sequence carrying anomalous message information, improving the reliability of the field sequence and ensuring that the subsequently trained detection model can accurately and promptly detect anomalies in messages, thereby improving the effectiveness and accuracy of the detection model.

[0101] In one embodiment, the feature set includes initial features derived from each field of the feature column. For each feature column in each current sample message, determining the field sequence corresponding to that feature column in the current sample message based on the information gain ratio and the feature set corresponding to that feature column includes: for each feature column in each current sample message, multiplying each initial feature in that feature column by the information gain ratio corresponding to that feature column to obtain the target features corresponding to each initial feature in that feature column; and for each feature column in each current sample message, determining the field sequence corresponding to that feature column in the current sample message based on each target feature of that feature column.

[0102] Specifically, for each feature column in each current sample message, the initial feature corresponding to each field in the feature column is multiplied by the information gain ratio of the feature column to obtain the target features corresponding to each initial feature in the feature column, that is, to obtain the target features corresponding to each field in the feature column. For each feature column in each current sample message, the target features belonging to the feature column are classified to obtain the field sequence corresponding to the feature column in the current sample message.

[0103] For example, taking feature column f2 in sample A's message as an example, feature column f2 corresponds to feature set {A1, A2}, where A1 and A2 are initial features. The information gain ratio of feature column f2 is G2. Therefore, for this feature column f2, the target feature B1 corresponding to A1 is the product of A1 and G1. The target feature B2 corresponding to A2 is the product of A2 and G2. Therefore, the field sequence corresponding to feature column f2 is (B1, B2).

[0104] In this embodiment, for each feature column in each current sample message, each initial feature in the feature column is multiplied by the information gain ratio corresponding to that feature column to obtain the target feature corresponding to each initial feature in the feature column, that is, to obtain the target feature carrying the abnormal message information. For each feature column in each current sample message, based on each target feature of the feature column, the field sequence corresponding to that feature column in the current sample message is determined, which greatly improves the effectiveness of the field sequence and is beneficial to obtaining an accurate prediction model subsequently.

[0105] In one embodiment, for each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighbor prediction probability corresponding to the adjacent field. This includes: for each field of each current sample message, obtaining the adjacent field that is adjacent to and precedes the current field, and obtaining the neighbor prediction probability and neighbor weight corresponding to the adjacent field. For each field of each current sample message, obtaining the weight corresponding to the field, and determining the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the neighbor prediction probability and neighbor weight corresponding to the adjacent field.

[0106] Specifically, for each field in each current sample message, the computer device obtains the adjacent fields that are adjacent to and precede that field, and obtains the adjacent predicted probabilities and adjacent weights corresponding to those adjacent fields. For each field in each current sample message, the computer device obtains the weight corresponding to that field, and multiplies the weight corresponding to that field with the target feature as the first product. The computer device then multiplies the adjacent predicted probabilities and adjacent weights corresponding to the adjacent fields as the second product. The computer device obtains the model bias matrix and determines the predicted probability corresponding to that field based on the sum of the first product, the second product, and the model bias matrix.

[0107] For example, after obtaining the sum of the first product, the second product, and the model bias matrix, the predicted probability corresponding to the field can be calculated using the tanh (hyperbolic tangent function) function.

[0108] For example, let the input field sequence be (x1, ..., x...). t), where x t Let h be the target feature corresponding to the t-th field, which can also be understood as the target feature at time t. Correspondingly, the predicted probabilities for each field are h1, ..., h2, ..., h3, ... t At this point, the adjacent prediction probabilities of the adjacent fields of the first field are set to 0, i.e., h0 = 0. The specific formula is as follows:

[0109] h t =L(x t h t-1 ) = tanh(W hx h t +W hh h t-1 +b)

[0110] Among them, W hx W is the weight matrix at time t-1, which represents the adjacent weights. hh Let be the weight matrix at time t, which represents the weights of this field. b is the model bias matrix.

[0111] In this embodiment, after determining the target features and weights of a field, the influence of the target features on the prediction probability of that field can be accurately known. Based on this, by combining the adjacent prediction probabilities and weights of the preceding fields, it can be ensured that the prediction probability of that field is obtained based on contextual semantic information, thereby helping the trained prediction model to accurately predict abnormal messages.

[0112] In one embodiment, the method further includes: acquiring a message to be detected and determining a sequence of fields to be detected corresponding to the message. Based on the sequence of fields to be detected, a target probability corresponding to the message to be detected is obtained using a trained detection model. If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

[0113] Specifically, the computer equipment acquires the message to be detected and determines multiple feature columns corresponding to the message. For each feature column, it determines the corresponding label value and label probability. Based on the label value and probability, the first initial probability of the feature values ​​of each preceding feature column, and the second initial probability of the feature values ​​of the preceding feature column, information gain is calculated to obtain the information gain ratio for each feature column. A feature set corresponding to each feature column in the message is determined. For each feature column, based on the information gain and feature set, a sequence of fields to be detected is determined. Based on this field sequence, a trained detection model is used to obtain the target probability corresponding to the message. If the target probability is within a preset threshold range, the message is determined to be an abnormal message.

[0114] Furthermore, the computer device divides the preset threshold range into multiple sub-preset threshold ranges. Each sub-preset threshold range corresponds to a level. When a message to be detected is determined to be an abnormal message, the computer device determines the sub-preset threshold range containing the target probability and determines the level of the abnormal message based on the sub-preset probability containing that target probability. In this way, abnormal messages can be classified through each sub-preset threshold range, thereby enabling accurate risk assessment.

[0115] In this embodiment, the trained detection model can perform accurate and precise anomaly detection on messages based on contextual semantics, which greatly improves the detection accuracy.

[0116] To facilitate a clearer understanding of the technical solution of this application, a more detailed embodiment is provided for description. Multiple sample messages from the current iteration are acquired, and a field sequence corresponding to each sample message is determined. This field sequence includes the target features corresponding to each field. For each sample message, multiple feature columns corresponding to that sample message are determined. For each feature column in each current sample message, determine the label probability of the label value corresponding to that feature column. Based on the label probability of the label value corresponding to that feature column, the first initial probability of the feature value corresponding to each feature column preceding that feature column, and the second initial probability of the feature value corresponding to that feature column, calculate the information gain ratio corresponding to each feature column. For each current sample message, determine the feature set corresponding to each feature column in that current sample message. This feature set includes the initial features corresponding to each field originating from that feature column. For each feature column in each current sample message, multiply each initial feature in that feature column by the information gain ratio corresponding to that feature column to obtain the target feature corresponding to each initial feature in that feature column. For each feature column in each current sample message, determine the field sequence corresponding to that feature column in that current sample message based on the target features of that feature column. For each field of each current sample message, obtain the adjacent fields that are adjacent to and precede the current field, and obtain the adjacent predicted probabilities and adjacent weights corresponding to the adjacent fields. For each field of each current sample message, obtain the weight corresponding to the field, and determine the predicted probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent predicted probabilities and adjacent weights corresponding to the adjacent fields. Obtain the message to be detected, and determine the sequence of fields to be detected corresponding to the message to be detected. Based on the sequence of fields to be detected, obtain the target probability corresponding to the message to be detected through the trained detection model. If the target probability is within a preset threshold range, determine that the message to be detected is an abnormal message.

[0117] In this embodiment, multiple sample messages from the current iteration are acquired, and the field sequence corresponding to each sample message is determined. The field sequence includes the target features corresponding to each field. For each field of each sample message, the prediction probability corresponding to the field is determined based on the target features corresponding to the field and the neighboring prediction probabilities of adjacent fields, using the detection model of the current iteration. In this way, the prediction probability of the current field is inferred by combining the prediction probabilities of adjacent fields, ensuring that the prediction probability of the current field is based on contextual semantic analysis, that is, it can well reflect the contextual relevance, and ensure the accuracy of the subsequent detection model. The detection model is updated according to the prediction probabilities corresponding to each sample message, resulting in an updated model. The next iteration is then initiated, and the updated model is used as the detection model for the next iteration. The process returns to the step of acquiring multiple sample messages from the current iteration and continues until the training stopping condition is met, thus determining the trained detection model. The trained detection model is used to perform anomaly detection on the fields of the messages. In this way, the model is updated iteratively based on the predicted probabilities of each field that reflects the contextual relevance, so as to ensure that the trained detection model can accurately detect anomalies in the message according to the contextual semantics, which greatly improves the detection accuracy. That is, it can effectively improve the hit rate of message field detection while reducing the false alarm rate.

[0118] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0119] Based on the same inventive concept, this application also provides a training apparatus for a message detection model to implement the training method for the message detection model described above. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the message detection model training apparatus provided below can be found in the limitations of the message detection model training method described above, and will not be repeated here.

[0120] In one embodiment, such as Figure 4As shown, a training apparatus for a message detection model is provided, comprising: an acquisition module 402, a determination module 404, and an iteration module 406, wherein:

[0121] The acquisition module 402 is used to acquire multiple current sample messages in the current iteration and determine the field sequence corresponding to each current sample message. The field sequence includes the target features corresponding to each field.

[0122] The determination module 404 is used to determine the prediction probability corresponding to each field of each current sample message based on the target feature corresponding to the field and the neighboring prediction probabilities corresponding to the adjacent fields adjacent to the field, through the current detection model of the current iteration.

[0123] The iteration module 406 is used to update the current detection model according to the predicted probability corresponding to each current sample message, obtain the updated model, enter the next iteration, and use the updated model as the current detection model corresponding to the next iteration. The step of obtaining multiple current sample messages of the current iteration continues to be executed until the training stopping condition is reached, and the trained detection model is determined. The trained detection model is used to perform anomaly detection on the fields of the message.

[0124] In one embodiment, the acquisition module is configured to determine multiple feature columns corresponding to each current sample message. For each feature column in each current sample message, based on the current sample message and the feature column, information gain processing is used to determine the field sequence corresponding to the feature column in the current sample message.

[0125] In one embodiment, the acquisition module is configured to, for each feature column in each current sample message, determine the label probability of the label value corresponding to that feature column, and, based on the label probability of the label value corresponding to that feature column, the first initial probability of the feature values ​​corresponding to each feature column preceding that feature column, and the second initial probability of the feature values ​​corresponding to that feature column, calculate the information gain ratio corresponding to each feature column through information gain calculation. For each current sample message, the module determines the feature set corresponding to each feature column in that current sample message. For each feature column in each current sample message, the module determines the field sequence corresponding to that feature column in that current sample message based on the information gain ratio corresponding to that feature column and the feature set corresponding to that feature column.

[0126] In one embodiment, the feature set includes initial features derived from each field of the feature column. The acquisition module is configured to, for each feature column in each current sample message, multiply each initial feature in the feature column by the information gain ratio corresponding to the feature column to obtain the target features corresponding to each initial feature in the feature column. For each feature column in each current sample message, the field sequence corresponding to the feature column in the current sample message is determined based on the target features of the feature column.

[0127] In one embodiment, the determining module is configured to, for each field of each current sample message, obtain the adjacent fields that are adjacent to and precede the current field, and obtain the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields. For each field of each current sample message, the module obtains the weight corresponding to the field, and determines the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields.

[0128] In one embodiment, the device further includes a detection module, configured to acquire a message to be detected and determine a sequence of fields to be detected corresponding to the message. Based on the sequence of fields to be detected, a trained detection model is used to obtain a target probability corresponding to the message to be detected. If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

[0129] The modules in the training device for the aforementioned message detection model can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0130] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for training a message detection model.

[0131] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0132] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: acquiring multiple current sample messages for the current iteration, and determining a field sequence corresponding to each current sample message, the field sequence including target features corresponding to each field. For each field of each current sample message, determining the prediction probability corresponding to the field based on the target feature corresponding to the field and the neighbor prediction probabilities corresponding to the adjacent fields of the field, using the current detection model of the current iteration. Updating the current detection model according to the prediction probabilities corresponding to each current sample message to obtain an updated model, proceeding to the next iteration, and using the updated model as the current detection model corresponding to the next iteration, returning to the step of acquiring multiple current sample messages for the current iteration to continue execution until the training stopping condition is reached, and determining the trained detection model, which is used to perform anomaly detection on the fields of the message.

[0133] In one embodiment, when the processor executes the computer program, it further performs the following steps: for each current sample message, determining multiple feature columns corresponding to the current sample message; for each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message through information gain processing based on the current sample message and the feature column.

[0134] In one embodiment, when the processor executes the computer program, it further performs the following steps: For each feature column in each current sample message, determining the label probability of the label value corresponding to the feature column, and calculating the information gain ratio corresponding to each feature column based on the label probability of the label value corresponding to the feature column, the first initial probability of the feature values ​​corresponding to each feature column preceding the feature column, and the second initial probability of the feature values ​​corresponding to the feature column. For each current sample message, determining the feature set corresponding to each feature column in the current sample message. For each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column.

[0135] In one embodiment, when the processor executes the computer program, it further implements the following steps: the feature set includes initial features derived from each field of the feature column. For each feature column in each current sample message, each initial feature in the feature column is multiplied by the information gain ratio corresponding to the feature column to obtain the target feature corresponding to each initial feature in the feature column. For each feature column in each current sample message, the field sequence corresponding to the feature column in the current sample message is determined based on each target feature of the feature column.

[0136] In one embodiment, when the processor executes the computer program, it further performs the following steps: for each field of each current sample message, obtain the adjacent fields that are adjacent to and precede the current field, and obtain the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields. For each field of each current sample message, obtain the weight corresponding to the field, and determine the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields.

[0137] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring a message to be detected, and determining a sequence of fields to be detected corresponding to the message to be detected. Based on the sequence of fields to be detected, and using a trained detection model, obtaining a target probability corresponding to the message to be detected. If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

[0138] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When executed by a processor, the computer program performs the following steps: acquiring multiple current sample messages for the current iteration and determining a field sequence corresponding to each current sample message, the field sequence including target features corresponding to each field. For each field of each current sample message, based on the target feature corresponding to the field and the neighbor prediction probabilities corresponding to the adjacent fields, the prediction probability corresponding to the field is determined using the current detection model for the current iteration. The current detection model is updated based on the prediction probabilities corresponding to each current sample message to obtain an updated model. The process proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process returns to the step of acquiring multiple current sample messages for the current iteration and continues until the training stopping condition is met, thus determining a trained detection model. This trained detection model is used for anomaly detection of fields in the messages.

[0139] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: for each current sample message, determining multiple feature columns corresponding to that current sample message; for each feature column in each current sample message, determining the field sequence corresponding to that feature column in the current sample message through information gain processing based on the current sample message and the feature column.

[0140] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: For each feature column in each current sample message, determining the label probability of the label value corresponding to the feature column, and calculating the information gain ratio corresponding to each feature column based on the label probability of the label value corresponding to the feature column, the first initial probability of the feature values ​​corresponding to each feature column preceding the feature column, and the second initial probability of the feature values ​​corresponding to the feature column. For each current sample message, determining the feature set corresponding to each feature column in the current sample message. For each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column.

[0141] In one embodiment, when the computer program is executed by a processor, it further implements the following steps: the feature set includes initial features derived from each field of the feature column. For each feature column in each current sample packet, each initial feature in the feature column is multiplied by the information gain ratio corresponding to the feature column to obtain the target feature corresponding to each initial feature in the feature column. For each feature column in each current sample packet, the field sequence corresponding to the feature column in the current sample packet is determined based on the target features of the feature column.

[0142] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: for each field of each current sample message, obtain the adjacent fields that are adjacent to and precede the current field, and obtain the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields. For each field of each current sample message, obtain the weight corresponding to the field, and determine the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields.

[0143] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: acquiring a message to be detected, and determining a sequence of fields to be detected corresponding to the message. Based on the sequence of fields to be detected, and using a trained detection model, obtaining a target probability corresponding to the message to be detected. If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

[0144] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: acquiring multiple current sample messages for the current iteration and determining a field sequence corresponding to each current sample message, the field sequence including target features corresponding to each field. For each field of each current sample message, based on the target features corresponding to the field and the neighboring prediction probabilities corresponding to the adjacent fields, the prediction probability corresponding to the field is determined using the current detection model for the current iteration. The current detection model is updated based on the prediction probabilities corresponding to each current sample message to obtain an updated model, proceeding to the next iteration, and using the updated model as the current detection model for the next iteration. The process returns to the step of acquiring multiple current sample messages for the current iteration and continues until the training stopping condition is met, thus determining a trained detection model used for anomaly detection of fields in the messages.

[0145] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: for each current sample message, determining multiple feature columns corresponding to that current sample message; for each feature column in each current sample message, determining the field sequence corresponding to that feature column in the current sample message through information gain processing based on the current sample message and the feature column.

[0146] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: For each feature column in each current sample message, determining the label probability of the label value corresponding to the feature column, and calculating the information gain ratio corresponding to each feature column based on the label probability of the label value corresponding to the feature column, the first initial probability of the feature values ​​corresponding to each feature column preceding the feature column, and the second initial probability of the feature values ​​corresponding to the feature column. For each current sample message, determining the feature set corresponding to each feature column in the current sample message. For each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column.

[0147] In one embodiment, when the computer program is executed by a processor, it further implements the following steps: the feature set includes initial features derived from each field of the feature column. For each feature column in each current sample packet, each initial feature in the feature column is multiplied by the information gain ratio corresponding to the feature column to obtain the target feature corresponding to each initial feature in the feature column. For each feature column in each current sample packet, the field sequence corresponding to the feature column in the current sample packet is determined based on the target features of the feature column.

[0148] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: for each field of each current sample message, obtain the adjacent fields that are adjacent to and precede the current field, and obtain the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields. For each field of each current sample message, obtain the weight corresponding to the field, and determine the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent prediction probabilities and adjacent weights corresponding to the adjacent fields.

[0149] In one embodiment, when the computer program is executed by a processor, it further performs the following steps: acquiring a message to be detected, and determining a sequence of fields to be detected corresponding to the message. Based on the sequence of fields to be detected, and using a trained detection model, obtaining a target probability corresponding to the message to be detected. If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

[0150] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0151] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0152] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0153] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for training a message detection model, characterized in that, The method includes: Obtain multiple sample messages for the current iteration and determine the field sequence corresponding to each sample message, wherein the field sequence includes the target features corresponding to each field; For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probability corresponding to the adjacent field. The detection model is updated based on the predicted probabilities corresponding to each current sample message to obtain the updated model. The process then proceeds to the next iteration, and the updated model is used as the current detection model for the next iteration. The process continues by returning to the step of obtaining multiple current sample messages for the current iteration until the training stop condition is met. The trained detection model is then determined, and it is used to perform anomaly detection on the fields of the message.

2. The method according to claim 1, characterized in that, Determining the field sequence corresponding to each current sample message includes: For each current sample message, determine multiple feature columns corresponding to the current sample message; For each feature column in each current sample message, the field sequence corresponding to the feature column in the current sample message is determined by information gain processing based on the current sample message and the feature column.

3. The method according to claim 2, characterized in that, For each feature column in each current sample message, based on the current sample message and the feature column, information gain processing is used to determine the field sequence corresponding to the feature column in the current sample message, including: For each feature column in each current sample message, determine the label probability of the label value corresponding to the feature column, and obtain the information gain rate corresponding to each feature column by calculating the information gain based on the label probability of the label value corresponding to the feature column, the first initial probability of the feature value corresponding to each feature column before the feature column, and the second initial probability of the feature value corresponding to the feature column. For each current sample message, determine the feature set corresponding to each feature column in the current sample message; For each feature column in each current sample message, the field sequence corresponding to the feature column in the current sample message is determined based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column.

4. The method according to claim 3, characterized in that, The feature set includes initial features derived from each field of the feature column. For each feature column in each current sample message, determining the field sequence corresponding to the feature column in the current sample message based on the information gain ratio corresponding to the feature column and the feature set corresponding to the feature column includes: For each feature column in each current sample message, multiply each initial feature in the feature column by the information gain rate corresponding to the feature column to obtain the target feature corresponding to each initial feature in the feature column. For each feature column in each current sample message, the field sequence corresponding to the feature column in the current sample message is determined based on each target feature of the feature column.

5. The method according to claim 1, characterized in that, For each field of each current sample message, the prediction probability corresponding to the field is determined by the current detection model of the current iteration, based on the target feature corresponding to the field and the neighboring prediction probabilities corresponding to the adjacent fields. This includes: For each field of each current sample message, obtain the adjacent fields that are adjacent to the field and located before the field, and obtain the adjacent prediction probability and adjacent weight corresponding to the adjacent fields; For each field of each current sample message, obtain the weight corresponding to the field, and determine the prediction probability corresponding to the field based on the weight corresponding to the field, the target feature, the adjacent prediction probability corresponding to the adjacent field, and the adjacent weight.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the message to be detected and determine the sequence of fields to be detected corresponding to the message to be detected; Based on the sequence of fields to be detected, the target probability corresponding to the message to be detected is obtained through the trained detection model; If the target probability is within a preset threshold range, the message to be detected is determined to be an abnormal message.

7. A training device for a message detection model, characterized in that, The device includes: The acquisition module is used to acquire multiple current sample messages in the current iteration and determine the field sequence corresponding to each current sample message, wherein the field sequence includes the target features corresponding to each field. The determination module is used to determine the prediction probability corresponding to each field of each current sample message, based on the target feature corresponding to the field and the adjacent prediction probability corresponding to the adjacent field, through the current detection model of the current iteration; The iteration module is used to update the current detection model according to the predicted probability corresponding to each current sample message, obtain the updated model, enter the next iteration, and use the updated model as the current detection model corresponding to the next iteration. The step of obtaining multiple current sample messages of the current iteration is returned to continue execution until the training stopping condition is reached, and the trained detection model is determined. The trained detection model is used to perform anomaly detection on the fields of the message.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images