Traffic security method and device, computer device and computer readable storage medium

Abstract

The application provides a traffic security method and device, computer equipment and a computer readable storage medium, wherein the method comprises: inputting current traffic into a twice-optimized neural network model to predict the type of the current traffic, wherein the optimized neural network model can extract deep features of the current traffic, and the deep features are used to represent the substantial characteristics of the current traffic; obtaining a security strategy corresponding to the current traffic according to the type of the current traffic; and performing security on the current traffic according to the security strategy. The application can accurately identify illegal traffic and improve the security performance of a network system.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a traffic security method, apparatus, computer device, and computer-readable storage medium. Background Technology

[0002] Traffic attacks often employ legitimate data request techniques, coupled with botnets, making them one of the most difficult cyberattacks to defend against. Current traffic attacks fall into two categories: either overwhelming network devices and servers with massive amounts of data and traffic, or intentionally generating a large number of incomplete requests that cannot be fulfilled to quickly exhaust server resources.

[0003] The key challenge of existing methods for preventing DDoS attacks is the inability to accurately identify illegal traffic from a large volume of traffic. Therefore, there is an urgent need for a traffic security method that can identify illegal traffic with high accuracy, thereby improving the security performance of network systems. Summary of the Invention

[0004] The purpose of this embodiment is to provide a traffic security method, device, computer equipment, and computer-readable storage medium that can identify illegal traffic with high accuracy, thereby improving the security performance of network systems.

[0005] To achieve the above objectives, this embodiment provides a traffic security method, including:

[0006] The current traffic is input into a second-optimized neural network model to predict the type of the current traffic. The optimized neural network model can extract deep features of the current traffic, which are used to characterize the substantive features of the current traffic.

[0007] Based on the type of the current traffic, the corresponding security strategy is obtained;

[0008] The current traffic is protected according to the security strategy.

[0009] Preferably, the method further includes:

[0010] The neural network model is optimized based on some historical traffic data and the actual type of some historical traffic data.

[0011] The neural network model is optimized a second time based on the graph neural network model to obtain the second-optimized neural network model.

[0012] Preferably, the step of optimizing the neural network model based on a portion of historical traffic and the actual type of that historical traffic includes:

[0013] By inputting a portion of historical traffic into a neural network model, the predicted type of some historical traffic can be obtained;

[0014] A loss function is constructed based on the difference between the predicted type and the actual type of the historical traffic.

[0015] The neural network model is optimized once based on the loss function.

[0016] Preferably, the step of performing a second optimization on the first-optimized neural network model based on the graph neural network model to obtain a second-optimized neural network model includes:

[0017] All historical traffic is input into the optimized neural network model, and the feature extractor in the neural network model is used to extract features to obtain the initial features of all historical traffic.

[0018] The initial features are input into a graph neural network model to obtain deep features of all historical traffic.

[0019] After replacing the initial features with the deep features, the deep features adjust the classifier in the neural network model to obtain a second-optimized neural network model.

[0020] Preferably, the step of inputting all historical traffic into the optimized neural network model and using the feature extractor in the neural network model to extract features to obtain the initial features of all historical traffic includes:

[0021] All historical traffic is input into the optimized neural network model. The feature extractor in the neural network model extracts features based on the source address, destination address, and requested service type of the traffic to obtain the initial features of all historical traffic.

[0022] Preferably, the step of inputting the initial features into a graph neural network model to obtain deep features of all historical traffic includes:

[0023] The initial features are input into the graph neural network model;

[0024] The graph neural network model uses the initial features of all historical traffic as multiple nodes, and the similarity value of attributes between two historical traffic as the connection edge between the two nodes, to further extract the initial features to obtain the deep features of all historical traffic; wherein the attributes are any one or more of the following: message protocol, encryption tag, data packet size, traffic transmission duration, and bandwidth.

[0025] On the other hand, this embodiment provides a traffic security device, the device comprising:

[0026] The prediction module is used to input the current traffic into a secondary optimized neural network model to predict the type of the current traffic. The optimized neural network model can extract deep features of the current traffic, which are used to characterize the substantive features of the current traffic.

[0027] The strategy determination module is used to determine the security strategy corresponding to the current traffic based on the type of the current traffic.

[0028] The security module is used to perform security measures on the current traffic according to the security policy.

[0029] Preferably, the device further includes:

[0030] The first optimization module is used to optimize the neural network model based on a portion of historical traffic and the actual type of that historical traffic.

[0031] The secondary optimization module is used to perform secondary optimization on the first-optimized neural network model based on the graph neural network model, so as to obtain the second-optimized neural network model.

[0032] Preferably, the primary optimization module includes:

[0033] The partial prediction submodule is used to input a portion of historical traffic into the neural network model to obtain the predicted type of the portion of historical traffic.

[0034] The loss function construction submodule is used to construct a loss function based on the difference between the predicted type and the actual type of the historical traffic.

[0035] The first optimization submodule is used to perform a first optimization on the neural network model based on the loss function.

[0036] Preferably, the secondary optimization module includes:

[0037] The feature extraction submodule is used to input all historical traffic into the optimized neural network model and use the feature extractor in the neural network model to extract features and obtain the initial features of all historical traffic.

[0038] The deep feature determination submodule is used to input the initial features into the graph neural network model to obtain the deep features of all historical traffic.

[0039] The secondary optimization submodule is used to replace the initial features with the deep features, and then adjust the classifier in the neural network model with the deep features to obtain the secondary optimized neural network model.

[0040] Preferably, the feature extraction submodule is specifically used to input all historical traffic into the optimized neural network model. In the neural network model, the feature extractor performs feature extraction based on the source address, destination address, and requested service type of the traffic to obtain the initial features of all historical traffic.

[0041] Preferably, the deep feature determination submodule is specifically used to: input the initial features into a graph neural network model; the graph neural network model takes the initial features of all historical traffic as multiple nodes, and takes the similarity value of the attributes between two historical traffic as the connection edge between the two nodes, and further extracts the initial features to obtain the deep features of all historical traffic; wherein the attributes are any one or more of the following in the traffic: message protocol, encryption tag, data packet size, traffic transmission duration, and bandwidth.

[0042] In another aspect, embodiments of this document also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the computer program, when executed by the processor, performs instructions of any of the methods described above.

[0043] In another aspect, the embodiments herein also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer device, performs instructions for any of the methods described above.

[0044] As can be seen from the technical solutions provided in the embodiments above, the neural network model optimized in this embodiment can achieve higher prediction accuracy, thereby more accurately identifying the type of current traffic. Compared with existing neural network models, the optimized neural network model can extract deep features of current traffic and determine its type based on the substantial characteristics of the current traffic. This allows for the determination of the corresponding security strategy for the current traffic, enabling security measures to be implemented and improving the security performance of the network system.

[0045] To make the above and other objects, features and advantages of this document more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or prior art described herein, the accompanying drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this article. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a traffic security method provided in the embodiments of this article is shown;

[0048] Figure 2 This document shows another schematic flowchart of a traffic security method provided in an embodiment of the invention;

[0049] Figure 3 This document illustrates a flowchart of an embodiment of the process for optimizing a neural network model based on a portion of historical traffic and the actual type of that historical traffic.

[0050] Figure 4 This document illustrates a flowchart illustrating the process of performing a second optimization on a first-optimized neural network model based on a graph neural network model, as provided in the embodiments of this paper, to obtain a second-optimized neural network model.

[0051] Figure 5 This document illustrates a flowchart of the process provided in this embodiment, in which initial features are input into a graph neural network model to obtain deep features of all historical traffic.

[0052] Figure 6 This document illustrates a flowchart of how a security strategy is derived based on the type of current traffic, as provided in the embodiments of this document.

[0053] Figure 7 This document shows a schematic diagram of the module structure of a traffic security device provided in an embodiment.

[0054] Figure 8 A schematic diagram of the structure of the computer device provided in the embodiments of this article is shown.

[0055] Explanation of symbols in the attached drawings:

[0056] 100. Prediction module;

[0057] 200. Strategy Determination Module;

[0058] 300. Security module;

[0059] 802. Computer equipment;

[0060] 804, Processor;

[0061] 806. Memory;

[0062] 808. Drive mechanism;

[0063] 810. Input / Output Module;

[0064] 812. Input devices;

[0065] 814. Output devices;

[0066] 816. Presentation equipment;

[0067] 818. Graphical User Interface;

[0068] 820. Network interface;

[0069] 822. Communication link;

[0070] 824. Communication bus. Detailed Implementation

[0071] The technical solutions in the embodiments described below will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments described herein, and not all of the embodiments. Based on the embodiments described herein, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this document.

[0072] Traffic attacks often employ legitimate data request techniques, coupled with botnets, making them one of the most difficult cyberattacks to defend against. Existing traffic attacks fall into two categories: either overwhelming network devices and servers with massive amounts of data and traffic, or intentionally generating a large number of incomplete requests that cannot be completed to quickly deplete server resources. A key challenge in existing methods for preventing traffic attacks is the inability to accurately identify illegitimate traffic from massive amounts of data.

[0073] To address the aforementioned issues, this paper provides a traffic security method. Figure 1 This is a flowchart illustrating a traffic security method provided in the embodiments of this document. This specification provides the operational steps of the method described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiments or accompanying drawings can be executed sequentially or in parallel.

[0074] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0075] Reference Figure 1 This article provides a traffic security method, including:

[0076] S101: Input the current traffic into the optimized neural network model to predict the type of the current traffic, wherein the optimized neural network model can extract the deep features of the current traffic, and the deep features are used to characterize the substantive features of the current traffic.

[0077] S102: Based on the type of the current traffic, obtain the security strategy corresponding to the current traffic;

[0078] S103: Perform security measures on the current traffic according to the security strategy.

[0079] In this embodiment, "traffic" refers to packet traffic. Compared to existing neural network models, the second-optimized neural network model can extract deep features of the current traffic, which can characterize the substantive features of the current traffic. Existing neural network models cannot extract deep features of the current traffic, resulting in inaccurate predictions when determining the type of the current traffic. However, the second-optimized neural network model obtained through the method in this embodiment can improve prediction accuracy and classify the current traffic more precisely.

[0080] Different types of traffic require different security strategies, and security measures can be implemented for the current traffic based on the corresponding security strategies.

[0081] The secondary optimized neural network model obtained through the method described in this embodiment achieves higher prediction accuracy, thus more accurately identifying the type of current traffic. Compared to existing neural network models, the secondary optimized model can extract deeper features of current traffic and determine its type based on its essential characteristics. This allows for the determination of the corresponding security strategy for the current traffic, enabling security measures to be implemented and improving the security performance of the network system.

[0082] In the embodiments described herein, reference is made to Figure 2 The method further includes:

[0083] S201: Optimize the neural network model based on some historical traffic data and the actual type of some historical traffic data.

[0084] S202: Based on the graph neural network model, perform secondary optimization on the first-optimized neural network model to obtain the second-optimized neural network model.

[0085] As for historical traffic, it can be traffic from the past year or traffic from the past quarter. Generally, there is a large amount of historical traffic. Due to the inherent nature of neural network models, massive amounts of historical traffic do not perform well in a single optimization. However, if only a small portion of historical traffic is selected for optimization of the neural network model, better optimization results can be achieved. Specifically, a small portion of historical traffic can be randomly selected from the massive amount of historical traffic.

[0086] After the first optimization, the optimized neural network model can be further optimized. The second optimization is mainly based on the graph neural network model after the first optimization. The superposition of the first and second optimizations can ensure the prediction accuracy of the neural network model. The features obtained after the second optimization based on the graph neural network model after the first optimization are the deep features.

[0087] In the embodiments described herein, reference is made to Figure 3 The optimization of the neural network model based on a portion of historical traffic and the actual type of that historical traffic includes:

[0088] S301: Input a portion of the historical traffic into the neural network model to obtain the predicted type of the portion of the historical traffic;

[0089] S302: Construct a loss function based on the difference between the predicted type and the actual type of the historical traffic.

[0090] S303: Optimize the neural network model once based on the loss function.

[0091] For a subset of historical traffic, whose actual type is known, during optimization, this subset of historical traffic is input into the neural network model to obtain the predicted type. A loss function is constructed based on the difference between the predicted and actual types. Gradient descent can be used to optimize the loss function to its minimum. Further determining the biases and weights of the neural network model corresponding to the minimum loss function yields the optimized neural network model. This neural network model can be a convolutional neural network model such as AlexNet, VGG, or ResNet.

[0092] In this embodiment, the step of inputting all historical traffic into the optimized neural network model and using the feature extractor in the neural network model to extract features to obtain the initial features of all historical traffic further includes:

[0093] All historical traffic is input into the optimized neural network model. The feature extractor in the neural network model extracts features based on the source address, destination address, and requested service type of the traffic to obtain the initial features of all historical traffic.

[0094] Generally, in an optimized neural network model, the feature extractor extracts features based only on the source address, destination address, and requested service type of the traffic. This information is carried by the packet traffic during transmission.

[0095] In the embodiments described herein, reference is made to Figure 4 The second optimization of the first-optimized neural network model based on the graph neural network model to obtain the second-optimized neural network model includes:

[0096] S401: Input all historical traffic into the optimized neural network model, and use the feature extractor in the neural network model to extract features to obtain the initial features of all historical traffic.

[0097] S402: Input the initial features into the graph neural network model to obtain the deep features of all historical traffic.

[0098] S403: After replacing the initial features with the deep features, the deep features adjust the classifier in the neural network model to obtain a secondary optimized neural network model. Generally, a neural network model includes a feature extractor and a classifier. All historical traffic is first processed by the feature extractor to extract features, thus obtaining the initial features of all historical traffic. In existing technologies, the initial features of all historical traffic are directly input into the classifier for classification to obtain the type corresponding to all historical traffic.

[0099] However, this paper differs from existing technologies in that it does not input the initial features into the classifier but into a graph neural network model. The graph neural network model can derive deep features from the initial features. Then, the initial features obtained by the feature extractor in the original neural network model are replaced with these deep features. These deep features adjust the classifier in the neural network model, resulting in a secondary optimization and a second-optimized neural network model. This second-optimized model achieves higher classification accuracy. The graph neural network model can be GNN, GCN, GAT, GAE, or similar graph neural network models. In the embodiments described in this paper, refer to... Figure 5 The step of inputting the initial features into a graph neural network model to obtain deep features of all historical traffic includes:

[0100] S501: Input the initial features into the graph neural network model;

[0101] S502: The graph neural network model takes the initial features of all historical traffic as multiple nodes, and takes the similarity value of the attributes between two historical traffic as the connection edge between the two nodes, and further extracts the initial features to obtain the deep features of all historical traffic; wherein the attributes are any one or more of the following in the traffic: message protocol, encryption tag, data packet size, traffic transmission duration and bandwidth.

[0102] For graph neural network models, the task of extracting deep features from initial features is only required. Specifically, the initial features of two historical traffic streams are used as nodes, and the attribute similarity values ​​between the two historical traffic streams are used as connecting edges. The attributes include any one or more of the following: message protocol, encryption token, packet size, transmission duration, and bandwidth. The message protocol, encryption token, and packet size are information carried by the traffic during transmission, while the transmission duration and bandwidth are information obtained through monitoring.

[0103] To achieve the goal of extracting deep features, the graph neural network model further adds one or more of the following to the initial features: message protocol, encryption tag, data packet size, traffic transmission duration, and bandwidth. These attributes are used as the basis for deep feature extraction to characterize the substantive features of the traffic.

[0104] Graph neural network (GNN) technology learns the similarity of vertices in a graph by walking and sampling them using specific strategies. During training, vertices with high similarity are brought closer together, while those with low similarity are moved further apart. After training, the vector representation of these vertices becomes the deep feature. This deep feature not only includes the features extracted from historical traffic at the data level by the feature extractor in the neural network model, but also the distance information of historical traffic at the attribute space level. The data-level features combined with the attribute space-level features constitute the substantial characteristics of historical traffic, where the attribute space-level features can be the distance information of historical traffic obtained through the attribute similarity values ​​between historical traffic instances.

[0105] Compared to the initial features extracted by general neural network models, deep features contain more information from the attribute space. Containing more information means a better reflection of the essential characteristics of the current traffic, thus leading to better performance in downstream tasks.

[0106] The attribute similarity value between any two historical traffic streams can be determined using the following method:

[0107] Step 1: Normalize the attributes of the two historical traffic flows;

[0108] Step 2: Map the normalized attributes to a high-dimensional space vector to obtain the vectors corresponding to the two historical flows respectively;

[0109] Step 3: Calculate the cosine similarity between the two vectors to obtain the attribute similarity value between the two historical traffic flows.

[0110] The purpose of high-dimensional spatial vector mapping in step 2 is to integrate all normalized attributes of historical traffic to facilitate subsequent calculations. The similarity value calculated in step 3 is 0 or 1, which means that the attribute similarity between two historical traffic is dissimilar or similar.

[0111] In the embodiments described herein, reference is made to Figure 6 The step of obtaining the security strategy corresponding to the current traffic based on its type includes:

[0112] S601: Based on the type of the current traffic, determine the security server corresponding to the current traffic, wherein different types of traffic correspond to different security servers, and the security server is equipped with security policies;

[0113] S602: Send the current traffic to the corresponding security server.

[0114] For example, four security servers can be set up: a security detection and analysis server, a trusted business access server, an encrypted traffic parsing server, and an unknown threat detection and analysis server. The security detection and analysis server handles attack traffic, the trusted business access server handles traffic with high credibility, the encrypted traffic parsing server handles encrypted traffic, and the unknown threat detection and analysis server handles traffic with threats.

[0115] Specifically, attack traffic can be traffic that consumes a large amount of network bandwidth or floods one or more routers, servers, and firewalls with a large number of data packets, or traffic that uses the behavior defined by protocols such as TCP and HTTP to continuously occupy computing resources to prevent them from processing normal transactions and requests; traffic with high credibility can be traffic whose source and destination addresses are both in the whitelist; encrypted traffic can be traffic that is encrypted and transmitted using ASE (symmetric encryption algorithm) or RSA (asymmetric encryption algorithm); threatening traffic can be traffic that is determined to be threatening but does not reveal obvious attack intent.

[0116] For attack-type traffic, a security strategy can be a sandbox solution. Sandboxing is a method within APT attack detection. The principle of sandboxing is to first introduce real-time traffic into a virtual machine or sandbox, and then monitor the sandbox's file system, processes, network behavior, registry, etc., to detect whether the traffic contains malicious code. Compared to traditional signature matching techniques, sandboxing has a better detection capability for unknown malicious program attacks and can also overcome the lag of signature matching in detecting new types of attacks.

[0117] For traffic with high credibility, a security strategy could be to add a trust tag to the traffic, so that the receiving device no longer needs to perform multiple verification steps during the transmission process, thus saving bandwidth.

[0118] For encrypted traffic, a security strategy could be to automatically select the appropriate decryption method based on different encryption methods, and then pass the decrypted information down the chain of command.

[0119] For threatening traffic, the security strategy can be to compare the traffic with information in a pre-set threat intelligence database to determine its threat level. For traffic with a high threat level, the spread of the traffic can be directly blocked.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the acquisition, storage, use, and processing of data in the technical solutions described in the embodiments of this application all comply with the relevant provisions of national laws and regulations.

[0121] Based on the traffic security method described above, this embodiment also provides a traffic security device. The device may include a system (including a distributed system), software (application), module, component, server, client, etc., using the method described in this embodiment, combined with necessary hardware implementation. Based on the same innovative concept, the devices in one or more embodiments provided in this embodiment are as described in the following embodiments. Since the implementation schemes and methods for solving the problem are similar, the implementation of the specific device in this embodiment can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0122] Specifically, Figure 7 This is a schematic diagram of the module structure of one embodiment of the traffic security device provided in this article, with reference to... Figure 7 As shown in the embodiments herein, a traffic security device includes: a prediction module 100, a strategy determination module 200, and a security module 300.

[0123] The prediction module 100 is used to input the current traffic into the secondary optimized neural network model to predict the type of the current traffic. The optimized neural network model can extract the deep features of the current traffic, and the deep features are used to characterize the substantive features of the current traffic.

[0124] The strategy determination module 200 is used to obtain the security strategy corresponding to the current traffic based on the type of the current traffic.

[0125] The security module 300 is used to perform security measures on the current traffic according to the security policy.

[0126] In this embodiment, the device further includes:

[0127] The first optimization module is used to optimize the neural network model based on a portion of historical traffic and the actual type of that historical traffic.

[0128] The secondary optimization module is used to perform secondary optimization on the first-optimized neural network model based on the graph neural network model, so as to obtain the second-optimized neural network model.

[0129] In this embodiment, the primary optimization module includes:

[0130] The partial prediction submodule is used to input a portion of historical traffic into the neural network model to obtain the predicted type of the portion of historical traffic.

[0131] The loss function construction submodule is used to construct a loss function based on the difference between the predicted type and the actual type of the historical traffic.

[0132] The first optimization submodule is used to perform a first optimization on the neural network model based on the loss function.

[0133] In this embodiment, the secondary optimization module includes:

[0134] The feature extraction submodule is used to input all historical traffic into the optimized neural network model and use the feature extractor in the neural network model to extract features and obtain the initial features of all historical traffic.

[0135] The deep feature determination submodule is used to input the initial features into the graph neural network model to obtain the deep features of all historical traffic.

[0136] The secondary optimization submodule is used to replace the initial features with the deep features, and then adjust the classifier in the neural network model with the deep features to obtain the secondary optimized neural network model.

[0137] In this embodiment, the feature extraction submodule is specifically used to input all historical traffic into the optimized neural network model. In the neural network model, the feature extractor extracts features based on the source address, destination address, and requested service type of the traffic to obtain the initial features of all historical traffic.

[0138] In this embodiment, the deep feature determination submodule is specifically used to: input the initial features into a graph neural network model; the graph neural network model uses the initial features of all historical traffic as multiple nodes, and the similarity value of attributes between two historical traffic as the connection edge between the two nodes, to further extract the initial features to obtain the deep features of all historical traffic; wherein the attributes are any one or more of the following in the traffic: message protocol, encryption tag, data packet size, traffic transmission duration, and bandwidth.

[0139] Reference Figure 8 As shown, based on the traffic security method described above, one embodiment of this document also provides a computer device 802, wherein the above method runs on the computer device 802. The computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs) or graphics processing units (GPUs), each processing unit may implement one or more hardware threads. The computer device 802 may also include any memory 806 for storing any kind of information such as code, settings, data, etc. In one specific embodiment, a computer program is stored on the memory 806 and can run on the processor 804. When the computer program is run by the processor 804, it can execute instructions according to the above method. Non-limitingly, for example, the memory 806 may include any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 802. In one scenario, when processor 804 executes associated instructions stored in any memory or combination of memories, computer device 802 can perform any operation of the associated instructions. Computer device 802 also includes one or more drive mechanisms 808 for interacting with any memory, such as hard disk drive mechanisms, optical disk drive mechanisms, etc.

[0140] Computer device 802 may also include an input / output module 810 (I / O) for receiving various inputs (via input device 812) and providing various outputs (via output device 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface 818 (GUI). In other embodiments, the input / output module 810 (I / O), input device 812, and output device 814 may be omitted, and the device may function solely as a computer device within a network. Computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0141] Communication link 822 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0142] Corresponding to Figures 1-6 In addition to the methods described above, this embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the above-described methods.

[0143] This embodiment also provides a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to perform the following: Figures 1 to 6 The method shown.

[0144] It should be understood that in the various embodiments of this document, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0145] It should also be understood that, in the embodiments herein, the term "and / or" is merely a description of the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following associated objects have an "or" relationship.

[0146] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this document.

[0147] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0148] In the embodiments provided herein, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0149] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described herein, depending on actual needs.

[0150] Furthermore, the functional units in the various embodiments of this document can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0151] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this paper, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this paper. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0152] This document uses specific embodiments to illustrate the principles and implementation methods of this document. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this document. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this document. Therefore, the content of this specification should not be construed as a limitation of this document.

Claims

1. A traffic security method, characterized by, The method comprises the following steps: performing one-time optimization on a neural network model according to part of historical traffic and a true type to which the part of historical traffic belongs; performing secondary optimization on the one-time optimized neural network model based on a graph neural network model to obtain a secondary optimized neural network model; the secondary optimization comprises the following steps: inputting all historical traffic into the one-time optimized neural network model, performing feature extraction on the all historical traffic by using a feature extractor in the neural network model to obtain initial features of the all historical traffic; inputting the initial features into the graph neural network model to obtain deep features of the all historical traffic; after the deep features are used to replace the initial features, the deep features are used to adjust a classifier in the neural network model to obtain the secondary optimized neural network model; inputting current traffic into the secondary optimized neural network model to predict a type to which the current traffic belongs, wherein the optimized neural network model can extract deep features of the current traffic, and the deep features are used to represent substantial characteristics of the current traffic; obtaining a security strategy corresponding to the current traffic according to the type to which the current traffic belongs; performing security on the current traffic according to the security strategy.

2. The flow security method of claim 1, wherein, The one-time optimization on the neural network model according to part of historical traffic and a true type to which the part of historical traffic belongs comprises the following steps: inputting the part of historical traffic into the neural network model to obtain a predicted type to which the part of historical traffic belongs; constructing a loss function according to a difference between the predicted type and a true type to which the part of historical traffic belongs; performing one-time optimization on the neural network model according to the loss function.

3. The flow security method of claim 1, wherein, The inputting of the all historical traffic into the one-time optimized neural network model and the performing of feature extraction on the all historical traffic by using the feature extractor in the neural network model to obtain initial features of the all historical traffic comprises the following steps: inputting the all historical traffic into the one-time optimized neural network model, and performing feature extraction on the all historical traffic by using the feature extractor in the neural network model according to a source address, a destination address and a requested service type of the traffic to obtain the initial features of the all historical traffic.

4. The flow security method of claim 1, wherein, The inputting of the initial features into the graph neural network model to obtain deep features of the all historical traffic comprises the following steps: inputting the initial features into the graph neural network model. The graph neural network model takes the initial features of the all historical traffic as a plurality of nodes, takes a similarity value of attributes between two historical traffics as a connection edge between two nodes, and further extracts the initial features to obtain the deep features of the all historical traffic; wherein the attributes are any one or more of a packet protocol, an encryption mark, a data packet amount, a traffic transmission time length and a bandwidth in the traffic.

5. A flow security device, characterized in that The device comprises: a one-time optimization module configured to perform one-time optimization on a neural network model according to part of historical traffic and a true type to which the part of historical traffic belongs; The secondary optimization module is configured to perform secondary optimization on the once-optimized neural network model based on the graph neural network model to obtain a twice-optimized neural network model; the secondary optimization module comprises: a feature extraction submodule configured to input all historical traffics into the once-optimized neural network model, and perform feature extraction on the once-optimized neural network model by using a feature extractor in the neural network model to obtain initial features of the all historical traffics; a deep feature determination submodule configured to input the initial features into the graph neural network model to obtain deep features of the all historical traffics; and a secondary optimization submodule configured to adjust a classifier in the neural network model by using the deep features after the initial features are replaced by the deep features, and obtain the twice-optimized neural network model. The prediction module is configured to input a current traffic into the twice-optimized neural network model to predict a type to which the current traffic belongs, wherein the twice-optimized neural network model can extract deep features of the current traffic, and the deep features are used to represent substantive characteristics of the current traffic. The policy determination module is configured to obtain a security policy corresponding to the current traffic according to the type to which the current traffic belongs. The security module is configured to perform security on the current traffic according to the security policy.

6. A computer device comprising a memory, a processor, and a computer program stored on the memory, wherein, The computer program is executed by the processor to execute the instructions of the method according to any one of claims 1-4.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor of the computer device to execute the instructions of the method according to any one of claims 1-4.

Images