Message identification method, device and storage medium

Abstract

This application provides a message identification method, device, and storage medium, relating to the field of communications technology. The method is capable of training and learning attack and non-attack messages to generate a cleaning strategy that accurately identifies attack messages. The method includes: obtaining training data from at least one data cleaning device; the training data includes attack and non-attack messages; determining characteristic values ​​of the training data; inputting the characteristic values ​​into a preset neural network model for iterative training, the preset neural network model being used to identify attack messages; after training is complete, determining characteristic values ​​of the attack messages based on the identified attack messages; and transmitting the characteristic values ​​of the attack messages to at least one data cleaning device. This application is used in the message identification process.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message identification method, device and storage medium. Background Art

[0002] Currently, the primary method for shielding against network attacks is to deploy a large number of data scrubbing devices at various locations on the network. When anomalous traffic is detected, the devices set up a cleaning policy to scrub all attack traffic. However, attack packets and non-attack packets share the same format. This results in the data scrubbing devices being unable to effectively scrub attack packets when they detect anomalous traffic, and even non-attack packets may be scrubbed. Therefore, accurately identifying attack packets has become a pressing technical challenge. Summary of the Invention

[0003] The present application provides a message identification method, device and storage medium that can accurately identify attack messages.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a message identification method, which is applied to a data detection device, and the method includes: obtaining training data from at least one data cleaning device; the training data includes attack messages and non-attack messages; determining the characteristic values ​​of the training data; inputting the characteristic values ​​into a preset neural network model for iterative training, and the preset neural network model is used to identify attack messages; after the training is completed, determining the characteristic values ​​of the attack messages based on the identified attack messages; and sending the characteristic values ​​of the attack messages to at least one data cleaning device.

[0006] In combination with the first aspect above, in a possible implementation method, the characteristic value is input into a preset neural network model for iterative training, including: step 1, inputting the characteristic value into the preset neural network model, identifying the characteristic value corresponding to the attack message, and generating an identification result; step 2, sending the identification result to at least one data cleaning device; step 3, receiving the accuracy of the identification result fed back by at least one data cleaning device; step 4, when the accuracy of the identification result meets the preset conditions, determining that the iterative training of the preset neural network model is completed; step 5, when the accuracy of the identification result does not meet the preset conditions, adjusting the parameters of the preset neural network model, and repeating the above steps 1 to 3 until the accuracy of the identification result meets the preset conditions.

[0007] In combination with the first aspect above, in a possible implementation, sending characteristic values ​​of attack messages to at least one data cleaning device includes: generating an association relationship table between characteristic values ​​of attack messages and attack messages; and sending the association relationship table to at least one data cleaning device.

[0008] In a second aspect, the present application provides a message identification method, which is applied to a data cleaning device, and the method includes: detecting whether the acquired data message includes an attack message; if included, generating training data based on the acquired data message, and sending the training data to the data detection device; if not included, determining whether the current detection time reaches a preset time, and when the preset time is reached, generating training data based on the acquired data message, and sending the training data to the data detection device; receiving a characteristic value of the attack message from the data detection device; the characteristic value of the attack message is the characteristic value of the attack message identified by the data detection device.

[0009] In combination with the second aspect, in one possible implementation, after sending the training data to the data detection device, the method also includes: recording the detection results of the attack messages in the training data; receiving the recognition results from the data detection device; the recognition results include the attack messages identified by the data detection device from the training data; based on the detection results, determining the recognition result accuracy of the attack messages included in the recognition results; and sending the recognition result accuracy to the data detection device.

[0010] In combination with the second aspect, in a possible implementation method, receiving the characteristic value of the attack message from the data detection device includes: receiving an association relationship table from the data detection device; the association relationship is used to characterize the characteristic value of the attack message and the association relationship between the attack messages; obtaining the message to be identified and determining the characteristic value of the message to be identified; and determining whether the message to be identified is an attack message based on the characteristic value of the message to be identified and the association relationship table.

[0011] In a third aspect, the present application provides a message identification device, which is applied to a data detection device, including: a communication unit and a processing unit; the communication unit is used to obtain training data from at least one data cleaning device; the training data includes attack messages and non-attack messages; the processing unit is also used to determine the characteristic values ​​of the training data; the processing unit is also used to input the characteristic values ​​into a preset neural network model for iterative training, and the preset neural network model is used to identify attack messages; the processing unit is also used to determine the characteristic values ​​of the attack messages based on the identified attack messages after the training is completed; the communication unit is also used to send the characteristic values ​​of the attack messages to at least one data cleaning device.

[0012] In combination with the third aspect, in a possible implementation method, the processing unit is specifically used to: Step 1, input the characteristic value into the preset neural network model, identify the characteristic value corresponding to the attack message, and generate an identification result; Step 2, instruct the communication unit to send the identification result to at least one data cleaning device; Step 3, instruct the communication unit to receive the accuracy of the identification result fed back by at least one data cleaning device; Step 4, when the accuracy of the identification result meets the preset conditions, determine that the iterative training of the preset neural network model is completed; Step 5, when the accuracy of the identification result does not meet the preset conditions, adjust the parameters of the preset neural network model, and repeat the above steps 1 to 3 until the accuracy of the identification result meets the preset conditions.

[0013] In conjunction with the third aspect, in a possible implementation, the processing unit is further configured to generate a correlation table between characteristic values ​​of attack messages and attack messages; and the communication unit is further configured to send the correlation table to at least one data cleaning device.

[0014] In a fourth aspect, the present application provides a message identification device, which is applied to a data cleaning device, and the device includes: a communication unit and a processing unit; the processing unit is used to detect whether the acquired data message includes an attack message; the processing unit is also used to generate training data based on the acquired data message if it is included, and instruct the communication unit to send the training data to the data detection device; the processing unit is also used to determine whether the current detection time reaches a preset time if it is not included, and when the preset time is reached, generate training data based on the acquired data message, and instruct the communication unit to send the training data to the data detection device; the communication unit is also used to receive a characteristic value of the attack message from the data detection device; the characteristic value of the attack message is the characteristic value of the attack message identified by the data detection device.

[0015] In combination with the fourth aspect, in a possible implementation method, the processing unit is specifically used to: record the detection results of the attack messages in the training data; instruct the communication unit to receive the recognition results from the data detection device; the recognition results include the attack messages identified by the data detection device from the training data; based on the detection results, determine the recognition result accuracy of the attack messages included in the recognition result; and instruct the communication unit to send the recognition result accuracy to the data detection device.

[0016] In combination with the fourth aspect, in a possible implementation method, the processing unit is specifically used to: instruct the communication unit to receive an association relationship table from a data detection device; the association relationship is used to characterize the characteristic value of the attack message and the association relationship between the attack messages; instruct the communication unit to obtain the message to be identified and determine the characteristic value of the message to be identified; determine whether the message to be identified is an attack message based on the characteristic value of the message to be identified and the association relationship table.

[0017] In the fifth aspect, the present application provides a message identification device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the message identification device is running, the processor executes the computer execution instructions stored in the memory to enable the message identification device to perform the message identification method described in the first aspect and any possible implementation method of the first aspect.

[0018] In the sixth aspect, the present application provides a message identification device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the message identification device is running, the processor executes the computer execution instructions stored in the memory to enable the message identification device to perform the message identification method described in the second aspect and any possible implementation of the second aspect.

[0019] In the seventh aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions in the computer-readable storage medium are executed by the processor of the message identification device, the message identification device can execute the message identification method described in the first aspect and any possible implementation of the first aspect.

[0020] In an eighth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions in the computer-readable storage medium are executed by a processor of a message identification device, the message identification device is enabled to execute the message identification method described in the second aspect and any possible implementation of the second aspect.

[0021] In the ninth aspect, the present application provides a computer program product comprising instructions, which, when the computer program product runs on a message identification device, enables the message identification device to execute the message identification method as described in the first aspect and any possible implementation of the first aspect.

[0022] In the tenth aspect, the present application provides a computer program product comprising instructions, which, when the computer program product runs on a message identification device, enables the message identification device to execute the message identification method as described in the second aspect and any possible implementation of the second aspect.

[0023] In the eleventh aspect, the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the message identification method described in the first aspect and any possible implementation method of the first aspect.

[0024] In the twelfth aspect, the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the message identification method described in the second aspect and any possible implementation method of the second aspect.

[0025] Specifically, the chip provided in the embodiment of the present application also includes a memory for storing computer programs or instructions.

[0026] In this application, the name of the message identification device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalents.

[0027] These and other aspects of the present application will become more readily apparent from the following description.

[0028] The technical solution provided by this application brings at least the following beneficial effects:

[0029] The data cleaning device generates training data from the acquired data packets and sends it to the data detection device. The data detection device determines the characteristic values ​​of the training data based on the acquired training data sent by the data cleaning device, and inputs the characteristic values ​​into a preset neural network model for iterative training. After the training is completed, the data detection device determines the characteristic values ​​of the attack packets based on the identified attack packets, generates a correlation table between the characteristic values ​​of the attack packets and non-attack packets, and sends the correlation table to multiple data cleaning devices. The data cleaning device can accurately identify attack packets and non-attack packets based on the correlation table received from the data detection device. In this way, the attack packets and non-attack packets are learned and trained by the data detection device, providing the cleaning device with a cleaning strategy that can accurately identify attack packets. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the hardware structure of a message identification device provided in an embodiment of the present application;

[0031] Figure 2 A schematic diagram of a network architecture of a message identification method provided in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of a flow chart of a message identification method provided in an embodiment of the present application;

[0033] Figure 4 A schematic diagram of a flow chart of a message identification method provided in an embodiment of the present application;

[0034] Figure 5A coordinate diagram of a message identification method provided in an embodiment of the present application;

[0035] Figure 6 A schematic diagram of a flow chart of a message identification method provided in an embodiment of the present application;

[0036] Figure 7 A schematic diagram of the structure of a message identification device provided in an embodiment of the present application applied to a data detection device;

[0037] Figure 8 A structural diagram of a message identification device provided in an embodiment of the present application applied to a data cleaning device. DETAILED DESCRIPTION

[0038] The message identification method, device and storage medium provided by the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0039] The term "and / or" in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0040] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0041] Furthermore, the terms "including," "having," and any variations thereof, as used in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to the process, method, product, or apparatus.

[0042] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being more preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0043] Figure 1 This is a structural diagram of a message identification device provided in an embodiment of the present application. Figure 1As shown, the message identification device 100 includes at least one processor 101, a communication line 102, and at least one communication interface 104, and may also include a memory 103. The processor 101, the memory 103 and the communication interface 104 may be connected via the communication line 102.

[0044] The processor 101 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs).

[0045] The communication link 102 may include a pathway for transmitting information between the aforementioned components.

[0046] The communication interface 104 is used to communicate with other devices or communication networks and can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0047] The memory 103 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0048] In one possible design, memory 103 can exist independently of processor 101, that is, memory 103 can be a memory external to processor 101. In this case, memory 103 can be connected to processor 101 via communication line 102 to store execution instructions or application code, and processor 101 controls execution to implement the spatial measurement determination method provided in the following embodiments of this application. In another possible design, memory 103 can also be integrated with processor 101, that is, memory 103 can be internal memory of processor 101. For example, memory 103 is a cache that can be used to temporarily store some data and instruction information.

[0049] As an implementation method, the processor 101 may include one or more CPUs, such as Figure 1 As another implementation, the message identification device 100 may include multiple processors, such as Figure 1 As another implementation, the message identification apparatus 100 may further include an output device 105 and an input device 106.

[0050] Through the description of the above embodiments, those skilled in the art will clearly understand that for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the network node can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-described systems, modules, and network nodes can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0051] Currently, networks are plagued by a variety of attacks, such as Distributed Denial of Service (DDOS) attacks, man-in-the-middle attacks, and botnet worms. In the defense system against network attacks, the network is always the passive party. New attack techniques are constantly updated, but the attacked (such as data centers, servers, and hosts) and the networks connected to them always lag behind. Take DDOS attacks, for example. DDOS attacks are the most common and efficient type of network attack and hacking method. An attacker uses their own host, or remotely logs into someone else's, and uses a program to construct a large number of IP addresses. They then generate packets based on these IP addresses and launch attacks against the same target host. Because interactions between hosts must comply with network protocols, the attacked host is suddenly faced with a large number of access requests without being aware of them, and its resources are no longer able to handle them one by one. Eventually, the attacked host's resources become fully utilized, making it unable to respond to any requests. This results in normal access being disrupted, and legitimate requests being unresponsive. The public services provided by the attacked host are also no longer available.

[0052] In related technologies, the primary method for shielding against network attacks is to deploy a large number of data scrubbing devices at various locations on the network. When anomalous traffic is detected, the devices set a specific scrubbing policy to scrub all attack traffic. However, attack packets and non-attack packets share the same format. This results in the data scrubbing devices being unable to effectively scrub attack packets when anomalous traffic is detected, and may even result in non-attack packets being scrubbed. Therefore, accurately identifying the appropriate scrubbing policy for attack packets has become a pressing technical challenge.

[0053] In order to provide a cleaning strategy for data cleaning equipment to accurately identify attack messages through learning and training attack messages and non-attack messages, Figure 1 The message identification device provided in this application provides a method but is not limited to the following Figure 2A network architecture diagram is shown, comprising: an attacked host 201, a cleaning device 202, a routing and forwarding device 2031, a routing and forwarding device 2032, a routing and forwarding device 2033, a routing and forwarding device 2034, a routing and forwarding device 2035, a routing and forwarding device 2036, and an attacking host 204, wherein a data detection device is set between any two routing and forwarding devices. An embodiment of the present application provides a message identification method, wherein a data cleaning device generates training data from acquired data messages and sends the training data to a data detection device; the data detection device determines characteristic values ​​of the training data based on the acquired training data sent by the data cleaning device, and inputs the characteristic values ​​into a preset neural network model for iterative training; after completing the training, the data detection device determines characteristic values ​​of the attack messages based on the identified attack messages, generates a correlation relationship table between the characteristic values ​​of the attack messages and non-attack messages, and sends the correlation relationship table to multiple data cleaning devices; the data cleaning device can accurately identify attack messages and non-attack messages based on the correlation relationship table received from the data detection device. In this way, attack messages and non-attack messages are learned and trained by the data detection device, providing a cleaning strategy that can accurately identify attack messages for the cleaning device.

[0054] The message identification method provided in the embodiment of the present application can be applied to Figure 1 In the message identification device shown in FIG. Figure 3 As shown, the message identification method provided in the embodiment of the present application can be implemented through the following steps 301 to 305.

[0055] Step 301: A data detection device obtains training data from at least one data cleaning device. The corresponding data cleaning device generates training data and sends it to the data detection device.

[0056] The training data includes at least one of an attack message and a non-attack message.

[0057] In a possible implementation, the data detection device obtains training data from at least one data cleaning device, wherein the training data is training data generated by the data cleaning device based on data packets obtained in real time.

[0058] In one example, the training data acquired by the data detection device is generated by the data cleaning device when it detects real-time packet data. Specifically, when the data cleaning device detects a data packet as an attack packet, it generates training data based on the acquired data packet and sends it to the data detection device. If the data cleaning device does not detect the data packet as an attack packet, it randomly generates a time T and generates training data based on non-attack packets acquired during time T and sends it to the data detection device.

[0059] It's important to note that during training, when the host isn't under attack, the data scrubbing device is allowed to capture non-attack packets and send them to the data detection device as training data. The data detection device extracts the feature values ​​of non-attack packets, which it uses to distinguish attack packets. The entire neural network model training process requires attack packets as training data.

[0060] Optionally, the data cleaning device can determine whether the acquired data packets are attack packets or non-attack packets through, but not limited to, network flow detection. The data cleaning device can also classify attack packets into different levels. It should be noted that the training data generated by the data cleaning device to the data detection device is obtained from non-attack packets and high-level attack packets.

[0061] Step 302: The data detection device determines the characteristic values ​​of the training data.

[0062] In a possible implementation, a data detection device extracts feature values ​​from the training data, where the feature values ​​include but are not limited to a sending time interval, location, source address, etc. of the message data.

[0063] As an example, the data detection device can be, but is not limited to, a deep packet inspection DPI (Deep Packet Inspection, DPI) device. Compared with the routing forwarding device (or router) in the traditional forwarding network device, which can only see the data of the network layer (located in the third layer of the TCP / IP protocol) and below (i.e., the fourth layer data link layer and the fifth layer MAC layer), the DIP device in this application can not only analyze the messages below the application layer in the TCP / IP protocol layer, but also adds application layer analysis, which can identify various application types and can see the content of business data. The DPI device is deployed serially between two routing devices and can detect the characteristics of statistical traffic. In this application, the DPI device can also be used to train and learn attack messages.

[0064] Step 303: The data detection device inputs the characteristic value into a preset neural network model for iterative training.

[0065] Among them, the preset neural network model is used to identify attack messages.

[0066] In a possible implementation, the preset neural network model is a pre-trained neural network model, the input parameters of the network model are training data, and the output parameters are feature values ​​of the training data.

[0067] Optionally, when there are multiple data cleaning devices in the real-time example of the present application, the multiple data cleaning devices use federated learning to train the neural network model to ensure that the preset neural network model used by the data cleaning devices is the same, thereby ensuring that the data cleaning devices determine the accuracy of the attack message based on the neural network model.

[0068] Step 304: After the training is completed, the data detection device determines the characteristic value of the attack message based on the identified attack message.

[0069] In one possible implementation, after the preset neural network model training is completed, the data detection device identifies the input training data and determines the characteristic value of the attack message based on the identified attack message.

[0070] Step 305: The data detection device sends the characteristic value of the attack message to at least one data cleaning device. Correspondingly, the data cleaning device receives the characteristic value of the attack message from the data detection device.

[0071] The characteristic value of the attack message is the characteristic value of the attack message identified by the data detection device.

[0072] In a possible implementation, after obtaining the characteristic value of the attack message through a preset neural network model, the data detection device sends the characteristic value of the identified attack message to at least one data cleaning device.

[0073] The above scheme brings at least the following beneficial effects. The data cleaning device generates training data from the acquired data message and sends it to the data detection device; the data detection device determines the characteristic values ​​of the training data based on the acquired training data sent by the data cleaning device, and inputs the characteristic values ​​into the preset neural network model for iterative training; after the training is completed, the data detection device determines the characteristic values ​​of the attack message based on the identified attack message, generates a correlation relationship table between the characteristic values ​​of the attack message and the non-attack message, and sends the correlation relationship table to multiple data cleaning devices; the data cleaning device can accurately identify the attack message and the non-attack message based on the correlation relationship table received from the data detection device. In this way, the data detection device provides a cleaning strategy for the cleaning device that can accurately identify the attack message by learning and training the attack message and the non-attack message.

[0074] In one possible implementation, step 303 may be implemented in the following manner:

[0075] In one example, the process in which the data detection device inputs the feature value into a preset neural network model for iterative training can be implemented by following steps 1 to 5:

[0076] Step 1: The data detection device inputs the feature value into the preset neural network model, identifies the feature value corresponding to the attack message, and generates an identification result;

[0077] Step 2: The data detection device sends the recognition result to at least one data cleaning device;

[0078] Step 3: The data detection device receives the accuracy of the recognition result fed back by at least one data cleaning device;

[0079] Step 4: When the accuracy of the recognition result meets the preset conditions, the data detection device determines that the iterative training of the preset neural network model is completed;

[0080] Step 5: If the accuracy of the recognition result does not meet the preset conditions, the data detection device adjusts the parameters of the preset neural network model and repeats the above steps 1 to 3 until the accuracy of the recognition result meets the preset conditions.

[0081] Combine Figure 3 ,like Figure 4 As shown, after the data cleaning device in the above step 301 generates training data and sends it to the data detection device, the following steps 401 to 404 are also included.

[0082] Step 401: The data cleaning device records the detection results of the attack messages in the training data.

[0083] One possible implementation method is that before cleaning the attack messages, the data cleaning device first collects the attack messages and sends them as training data to the data detection device. At the same time, the data cleaning device will record the detection results of the attack messages in the training data to assist the data detection device in training the preset neural network model.

[0084] Step 402: The data cleaning device receives the recognition result from the data detection device. The corresponding data detection device sends the recognition result to the data cleaning device.

[0085] The identification result includes the attack message identified by the data detection device from the training data.

[0086] In one possible implementation, the data cleaning device receives a recognition result of the training data from the data detection device using a preset neural network model, wherein the recognition result includes at least one of: an attack message and a non-attack message.

[0087] Step 403: The data cleaning device determines the accuracy of the identification result of the attack message included in the identification result based on the detection result.

[0088] In one possible implementation, the data cleaning device compares the detection result recorded in step 401 with the identification result received from the data detection device in step 402 to determine the accuracy of the identification result of the attack message included in the identification result. The accuracy is used to indicate whether the identification result of the data detection device is correct.

[0089] Step 404: The data cleaning device sends the recognition result accuracy to the data detection device, and the corresponding data detection device receives the recognition result accuracy.

[0090] In one possible implementation, the data cleaning device sends the recognition result accuracy to the data detection device based on the recognition result accuracy determined in step 403. After receiving the recognition result accuracy, the data detection device adjusts the parameters of the preset neural network model based on the recognition result accuracy.

[0091] The above solution provides at least the following beneficial effects. The data cleaning device records the detection results of attack messages in the training data. After receiving the recognition results sent by the data detection device, the data cleaning device determines the recognition accuracy of the attack messages included in the recognition results based on the detection results. The data cleaning device then provides feedback on the recognition accuracy to the data detection device. This feedback allows the data cleaning device to further calibrate the preset neural network model trained by the data detection device, enabling the data cleaning device to accurately identify attack messages.

[0092] Combine Figure 3 ,like Figure 5 As shown, the above step 305 can also be specifically implemented through the following steps 501 to 504.

[0093] Step 501: The data detection device generates a table of association relationships between characteristic values ​​of attack messages and attack messages.

[0094] In a possible implementation, the data detection device generates a correlation relationship table between the characteristic values ​​of the attack message and the attributes of the attack message through a preset neural network model.

[0095] An example is shown in Table 1, which shows the correspondence between some characteristic values ​​in the association relationship table between the characteristic values ​​of the attack message generated by the data detection device through the preset neural network model and the attack message attributes. The characteristic values ​​extracted by the data detection device in this application include but are not limited to the following characteristic parameters.

[0096] Table 1 Correlation between attack message feature values ​​and attack message attributes

[0097]

[0098]

[0099] Step 502: The data detection device sends an association relationship table to at least one data cleaning device. Correspondingly, the data cleaning device receives the association relationship table from the data detection device.

[0100] The correlation table is used to represent the characteristic values ​​of attack messages and the correlation between attack messages.

[0101] In a possible implementation, the data detection device sends the association relationship table generated in step 501 to at least one data cleaning device. The data cleaning device receives the association relationship table from the data detection device.

[0102] Step 503: The data cleaning device obtains the message to be identified and determines the characteristic value of the message to be identified.

[0103] In a possible implementation, the data cleaning device detects the acquired data packets in real time and determines the characteristic values ​​of the acquired data packets.

[0104] Step 504: The data cleaning device determines whether the message to be identified is an attack message based on the feature value of the message to be identified and the association relationship table.

[0105] In a possible implementation, the data cleaning device matches the association table received in step 502 according to the characteristic value of the message to be identified obtained in step 503 to determine whether the message to be identified is an attack message.

[0106] The above scheme brings at least the following beneficial effects. The data detection device generates a correlation table between the characteristic values ​​of the attack message and the attack message; the data detection device sends the correlation table to at least one data cleaning device, and accordingly, the data cleaning device receives the correlation table from the data detection device; the data cleaning device obtains the message to be identified and determines the characteristic value of the message to be identified; the data cleaning device determines whether the message to be identified is an attack message based on the characteristic value of the message to be identified and the correlation table. In this way, the data detection device determines the characteristic value of the attack message and the correlation table between the attack message by learning and training the training data sent to multiple cleaning devices. The data cleaning device can more accurately identify whether the message to be identified is an attack message through the correlation table, thereby improving the accuracy of the data cleaning device in cleaning attack messages.

[0107] The following, combined Figure 6 , the overall process of training and learning the message recognition device to identify attack messages is explained:

[0108] Step 601: Data cleaning is performed by randomly generating a preset duration and starting the timing.

[0109] In one possible implementation, when the data cleaning device detects no attack messages, it randomly generates a time duration and starts counting. During the random time duration, the data cleaning device continuously sends training data generated by normal messages to the data detection device.

[0110] Step 602: The data cleaning device detects whether the acquired data message includes an attack message.

[0111] In one possible implementation, the data cleaning device detects in real time whether the acquired data packets contain attack packets through an attack packet identification mechanism or by communicating with the receiving and protected device. If the acquired data packets contain attack packets, step 603 is executed; if not, step 604 is executed.

[0112] Step 603: The data cleaning device sends attack message training data to the data detection device.

[0113] In a possible implementation, if the data cleaning device detects an attack message, it generates attack message training data according to the acquired attack message, and sends the attack message training data to the data detection device.

[0114] Step 604: The data cleaning device detects whether the detection time has reached a preset duration.

[0115] In a possible implementation, if the cleaning device does not detect the attack message, the data cleaning device detects whether the current detection time reaches a preset time period.

[0116] Step 605: The data cleaning device sends non-attack message training data to the data detection device.

[0117] In one possible implementation, if the data cleaning device determines that the current detection duration has not reached the preset duration, the data cleaning device generates non-attack message training data and sends the non-attack message training data to the data detection device. If the data cleaning device determines that the current detection duration has reached the preset duration, the data cleaning device waits for a new preset duration and sends the non-attack message training data to the data detection device.

[0118] Step 606: The data cleaning device identifies the training data and sends the identification result to the data cleaning device.

[0119] The specific implementation process of step 606 is similar to that of the above-mentioned step 402. The specific implementation process can refer to step 402 and will not be repeated here.

[0120] Step 607: The data cleaning device sends the recognition result accuracy to the data detection device.

[0121] The specific implementation process of step 607 is similar to that of the above-mentioned step 404. The specific implementation process can be referred to step 404 and will not be repeated here.

[0122] The above describes in detail the device for service transmission involved in the embodiments of the present application, the functions of each device of the message identification device, and the interaction between the devices.

[0123] It can be seen that the above mainly introduces the technical solutions provided by the embodiments of the present application from the perspective of methods. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the modules and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0124] In the embodiment of the present application, the message identification device can be divided into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical functional division. In actual implementation, other division methods can be used.

[0125] In the embodiment of the present application, the message identification device can be divided into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical functional division. In actual implementation, other division methods can be used.

[0126] The present application provides a message identification device for executing the method required to be executed by any device in the above-mentioned message identification system. The message identification device can be the message identification device involved in this application, or a module in the message identification device; or a chip in the message identification device, or other devices for executing the spatial measurement determination method, which is not limited by this application.

[0127] like Figure 7FIG2 is a schematic diagram of a structure of a message identification device provided in an embodiment of the present application applied to a data detection device. The message identification device, applied to a data detection device, includes: a processing unit 701 and a communication unit 702.

[0128] Communication unit 702 is used to obtain training data from at least one data cleaning device; the training data includes attack messages and non-attack messages; processing unit 701 is used to determine the characteristic values ​​of the training data; processing unit 701 is also used to input the characteristic values ​​into a preset neural network model for iterative training, and the preset neural network model is used to identify attack messages; processing unit 701 is also used to determine the characteristic values ​​of the attack messages based on the identified attack messages after the training is completed; communication unit 702 is used to send the characteristic values ​​of the attack messages to at least one data cleaning device.

[0129] Optionally, the processing unit 701 is specifically used to: Step 1, input the characteristic value into the preset neural network model, identify the characteristic value corresponding to the attack message, and generate an identification result; Step 2, instruct the communication unit 702 to send the identification result to at least one data cleaning device; Step 3, instruct the communication unit 702 to receive the accuracy of the identification result fed back by at least one data cleaning device; Step 4, when the accuracy of the identification result meets the preset conditions, determine that the iterative training of the preset neural network model is completed; Step 5, when the accuracy of the identification result does not meet the preset conditions, adjust the parameters of the preset neural network model, and repeat the above steps 1 to 3 until the accuracy of the identification result meets the preset conditions.

[0130] Optionally, the processing unit 701 is further configured to generate a correlation table between characteristic values ​​of attack messages and attack messages; and the communication unit 702 is further configured to send the correlation table to at least one data cleaning device.

[0131] like Figure 8 FIG2 is a schematic diagram of a structure of a message identification device provided in an embodiment of the present application and applied to a data cleaning device. The message identification device, applied to the data cleaning device, includes: a processing unit 801 and a communication unit 802.

[0132] The processing unit 801 is used to detect whether the acquired data message includes an attack message; if so, the processing unit 801 is also used to generate training data based on the acquired data message, and instruct the communication unit 802 to send the training data to the data detection device; if not, the processing unit 801 is also used to determine whether the current detection duration reaches a preset duration, and if the preset duration is reached, generate training data based on the acquired data message, and instruct the communication unit 802 to send the training data to the data detection device; the communication unit 802 is also used to receive a characteristic value of the attack message from the data detection device; the characteristic value of the attack message is the characteristic value of the attack message identified by the data detection device.

[0133] Optionally, the processing unit 801 is specifically used to: record the detection results of the attack messages in the training data; instruct the communication unit 802 to receive the recognition results from the data detection device; the recognition results include the attack messages identified by the data detection device from the training data; based on the detection results, determine the recognition result accuracy of the attack messages included in the recognition result; and instruct the communication unit 802 to send the recognition result accuracy to the data detection device.

[0134] Optionally, the processing unit 801 is specifically used to: instruct the communication unit 802 to receive an association relationship table from a data detection device; the association relationship is used to characterize the characteristic value of the attack message and the association relationship between the attack messages; instruct the communication unit 802 to obtain the message to be identified and determine the characteristic value of the message to be identified; determine whether the message to be identified is an attack message based on the characteristic value of the message to be identified and the association relationship table.

[0135] The present application provides a message identification device for executing the method required to be executed by any device in the aforementioned data integrity determination system. The message identification device may be the message identification device involved in this application, or a module within the message identification device; or a chip within the message identification device, or other device for executing the spatial measurement determination method, which is not limited in this application.

[0136] An embodiment of the present application further provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

[0137] An embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the message identification method in the above method embodiment.

[0138] An embodiment of the present application provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the message identification method in the above method embodiment.

[0139] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any other form of computer-readable storage medium in a suitable combination of the above, or a numerical value in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0140] Since the apparatus, equipment, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.

[0141] The above is only a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A message identification method, characterized in that: Applied to a data detection device, the method includes: Obtaining training data from at least one data cleaning device; the training data includes attack messages and non-attack messages; Determining characteristic values ​​of the training data; Inputting the characteristic value into a preset neural network model for iterative training, wherein the preset neural network model is used to identify attack messages; After the training is completed, the characteristic value of the attack message is determined based on the identified attack message; Sending the characteristic value of the attack message to the at least one data cleaning device; The step of sending the characteristic value of the attack message to the at least one data cleaning device includes: Generate a correlation table between characteristic values ​​of attack packets and attack packets; The association relationship table is sent to the at least one data cleaning device.

2. The method according to claim 1, characterized in that The step of inputting the characteristic value into a preset neural network model for iterative training includes: Step 1: Input the characteristic value into the preset neural network model, identify the characteristic value corresponding to the attack message, and generate an identification result; Step 2: Sending the recognition result to the at least one data cleaning device; Step 3: receiving the accuracy of the recognition result fed back by the at least one data cleaning device; Step 4: When the accuracy of the recognition result meets the preset conditions, determining that the iterative training of the preset neural network model is completed; Step 5: If the accuracy of the recognition result does not meet the preset conditions, adjust the parameters of the preset neural network model and repeat the above steps 1 to 3 until the accuracy of the recognition result meets the preset conditions.

3. A message identification method, characterized in that: Applied to a data cleaning device, the method includes: Check whether the acquired data packets contain attack packets; If included, generating training data according to the acquired data message and sending the training data to the data detection device; If not, determining whether the current detection duration reaches a preset duration, and if the preset duration is reached, generating training data according to the acquired data message, and sending the training data to the data detection device; receiving a characteristic value of an attack message from the data detection device; the characteristic value of the attack message is a characteristic value of the attack message identified by the data detection device; The receiving of the characteristic value of the attack message from the data detection device includes: Receiving an association relationship table from the data detection device; the association relationship is used to characterize the association relationship between the characteristic value of the attack message and the attack message; Obtaining a message to be identified, and determining a characteristic value of the message to be identified; Determine whether the message to be identified is an attack message based on the feature value of the message to be identified and the association relationship table.

4. The method according to claim 3, characterized in that After sending the training data to the data detection device, the method further includes: Recording detection results of attack messages in the training data; receiving a recognition result from the data detection device; the recognition result including the attack message recognized by the data detection device from the training data; Determining, based on the detection result, an accuracy of an identification result of the attack message included in the identification result; The recognition result accuracy is sent to the data detection device.

5. A message identification device, characterized in that: Applicable to data detection equipment, including: a communication unit and a processing unit; The communication unit is configured to obtain training data from at least one data cleaning device; the training data includes attack messages and non-attack messages; The processing unit is used to determine the characteristic value of the training data; The processing unit is further configured to input the characteristic value into a preset neural network model for iterative training, wherein the preset neural network model is used to identify attack messages; The processing unit is further configured to determine a characteristic value of the attack message based on the identified attack message after the training is completed; The communication unit is further configured to send the characteristic value of the attack message to the at least one data cleaning device; The processing unit is further configured to generate a correlation table between characteristic values ​​of attack messages and attack messages; The communication unit is further configured to send the association relationship table to the at least one data cleaning device.

6. The device according to claim 5, characterized in that The processing unit is specifically configured to: Step 1: Input the characteristic value into the preset neural network model, identify the characteristic value corresponding to the attack message, and generate an identification result; Step 2: instructing the communication unit to send the recognition result to the at least one data cleaning device; Step 3: instructing the communication unit to receive the accuracy of the recognition result fed back by the at least one data cleaning device; Step 4: When the accuracy of the recognition result meets the preset conditions, determining that the iterative training of the preset neural network model is completed; Step 5: If the accuracy of the recognition result does not meet the preset conditions, adjust the parameters of the preset neural network model and repeat the above steps 1 to 3 until the accuracy of the recognition result meets the preset conditions.

7. A message identification device, characterized in that: Applied to data cleaning equipment, the device comprises: a communication unit and a processing unit; The processing unit is configured to detect whether the acquired data message includes an attack message; The processing unit is further configured to, if included, generate training data based on the acquired data message and instruct the communication unit to send the training data to the data detection device; The processing unit is further configured to determine whether the current detection duration reaches a preset duration if the detection duration is not included, and if the preset duration is reached, generate training data based on the acquired data message, and instruct the communication unit to send the training data to the data detection device; The communication unit is further configured to receive a characteristic value of an attack message from the data detection device; the characteristic value of the attack message is a characteristic value of the attack message identified by the data detection device; The processing unit is specifically configured to: Instructing the communication unit to receive an association relationship table from the data detection device; the association relationship is used to characterize the association relationship between the characteristic values ​​of the attack message and the attack message; Instructing the communication unit to obtain a message to be identified and determine a characteristic value of the message to be identified; Determine whether the message to be identified is an attack message based on the feature value of the message to be identified and the association relationship table.

8. The device according to claim 7, characterized in that The processing unit is specifically configured to: Recording detection results of attack messages in the training data; Instructing the communication unit to receive a recognition result from the data detection device; the recognition result includes an attack message recognized by the data detection device from the training data; Determining, based on the detection result, an accuracy of an identification result of the attack message included in the identification result; The communication unit is instructed to send the recognition result accuracy to the data detection device.

9. A message identification device, characterized in that: include: A processor and a communication interface; the communication interface is coupled to the processor, and the processor is used to run a computer program or instruction to implement the message identification method as described in any one of claims 1-4.

10. A computer-readable storage medium storing instructions, characterized in that: When a computer executes the instruction, the computer executes the message identification method described in any one of claims 1 to 4.

Images