Cryptographic event classification method and system based on prompt learning

Abstract

Embodiments of the present disclosure provide a prompt learning-based encrypted event classification method and system. Applied to the field of encrypted event classification; the method comprises: according to a preset encrypted event mapping dictionary, mapping each encrypted number in the encrypted event into a Chinese character respectively to obtain an encrypted text with Chinese characters; performing word segmentation on the encrypted text with Chinese characters to obtain a subword sequence; retraining a bert pre-training model by taking the subword sequence and the corresponding mask label as a training set to obtain a retrained bert pre-training model; organizing the encrypted event and the corresponding encrypted event category label in the form of a pre-defined template; further training the retrained bert pre-training model by taking the encrypted event and the corresponding encrypted event category label organized in the form of a template as a training set to obtain an encrypted event classification model. In this way, the classification of encrypted events is realized, and the accuracy of encrypted event classification is improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of natural language processing research, in particular to the field of encrypted event classification. BACKGROUND

[0002] Text classification is one of the important tasks of natural language processing (NLP). With the development of Internet communication and the further promotion of research, pre-training models have also been applied to natural language processing tasks, and great performance improvements have been achieved in text classification tasks.

[0003] Although traditional neural network models and pre-training language models have been relatively maturely applied to text classification and have achieved good classification results. However, it is difficult to use conventional means to learn after the description of the event text is encrypted, and the traditional neural network model usually needs a large amount of labeled or unlabeled data in the training process, and the model parameter quantity is large, and the cost is high when a large amount of data is trained. Therefore, how to realize accurate classification of encrypted events has become a major challenge in practical applications. SUMMARY

[0004] The present disclosure provides an encrypted event classification method and system based on prompt learning.

[0005] According to a first aspect of the present disclosure, a training method of an encrypted event classification model based on prompt learning is provided, comprising:

[0006] According to a preset encrypted event mapping dictionary, each encrypted number in the encrypted event is mapped to a Chinese character, and an encrypted text with Chinese characters is obtained;

[0007] The encrypted text with Chinese characters is segmented to obtain a subword sequence;

[0008] The subword sequence and its corresponding mask label are used as a training set to retrain a bert pre-training model, and a retrained bert pre-training model is obtained;

[0009] The encrypted event and its corresponding encrypted event category label are organized in the form of a pre-defined template T = {|P 0:i |, x, |P i+1:m |, y}; wherein |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the i+1th to mth prompt word in the template T, x is the encrypted event, and y is the encrypted event category;

[0010] The encrypted events organized in the form of the template and the corresponding encrypted event category labels are taken as a training set to further train the retrained BERT pre-training model, to obtain an encrypted event classification model.

[0011] In some implementations of the first aspect, the mask label is obtained by masking the subword sequence.

[0012] In some implementations of the first aspect, the masking the subword sequence comprises:

[0013] The similarity of each subword in the subword sequence to each word in the corpus is calculated respectively, and the calculated similarities are collected to obtain a similarity set {p i ;

[0014] After sorting the similarity set {p i in ascending order, the first quartile is recorded as a threshold N, and the similarity of a subword in the subword sequence to the most similar word in the corpus is recorded as P sim ;

[0015] The similarity P sim of each subword in the subword sequence to the corresponding most similar word in the corpus is compared with the threshold N respectively;

[0016] When P sim >N, the most similar word is used to mask the corresponding subword;

[0017] When P sim <=N, the corresponding subword is randomly replaced and masked.

[0018] In some implementations of the first aspect, the method further comprises:

[0019] The re-pretrained BERT pre-training model is further trained for feature representation by contrastive learning.

[0020] In some implementations of the first aspect, the further training the retrained BERT pre-training model with the encrypted events organized in the form of the template and the corresponding encrypted event category labels as a training set comprises:

[0021] The encrypted events organized in the form of the template and the corresponding encrypted event category labels are mapped through the embedding layer of the retrained BERT pre-training model to obtain a vector {e(|P 0:i |), e(x), e(|P i+1:m |), e(y)};

[0022] each prompt word in the template is regarded as a pseudo character, and the vector {e(|P 0:i |),e(x),e(|P i+1:m |),e(y)} is mapped to obtain a vector {h0,...,h i ,e(x),h i+1 ,...,h m ,e(y)}, wherein h i (0≤i<m) is a prompt vector.

[0023] representations of the prompt vectors h i (0≤i<m) are optimized through Bi-LSTM of the retrained bert pre-training model and a loss function.

[0024] According to a second aspect of the present disclosure, a prompt learning-based encrypted event classification method is provided, which comprises:

[0025] encrypting events are organized in the form of a pre-defined template T = {|P 0:i |,x,|P i+1:m |}; wherein |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the ith+1 to mth prompt word in the template T, and x is an encrypted event.

[0026] encrypting events organized in the form of the template are input into the encrypted event classification model obtained by the method according to the first aspect of the present disclosure, and the corresponding encrypted event category is output.

[0027] According to a third aspect of the present disclosure, a prompt learning-based encrypted event classification model training system is provided, which comprises:

[0028] An initial module is configured to map each encrypted number in an encrypted event to a Chinese character according to a pre-set encrypted event mapping dictionary, to obtain an encrypted text with Chinese characters.

[0029] A word segmentation module is configured to perform word segmentation on the encrypted text with Chinese characters to obtain a sub-word sequence.

[0030] A pre-training module is configured to retrain a bert pre-training model by taking the sub-word sequence and its corresponding mask label as a training set, to obtain a retrained bert pre-training model.

[0031] A prompt module is configured to organize encrypted events and their corresponding encrypted event category labels in the form of a pre-defined template T = {|P 0:i |,x,|P i+1:m |,y}; wherein |P0:i |P i+1:m |P

[0032] The training module is configured to further train the retrained BERT pre-training model by taking the encryption events and the corresponding encryption event category labels organized in the form of the template as a training set, so as to obtain an encryption event classification model.

[0033] According to a fourth aspect of the present disclosure, there is provided an encryption event classification system based on prompt learning, which comprises:

[0034] The input module is configured to organize the encryption events in the form of a predefined template T = { |P 0:i |P i+1:m |P 0:i |P i+1:m |P

[0035] The output module is configured to input the encryption events organized in the form of the template into the encryption event classification model obtained by the method according to the first aspect of the present disclosure, and output the corresponding encryption event category.

[0036] According to a fifth aspect of the present disclosure, there is provided an electronic device. The electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method as described above.

[0037] According to a sixth aspect of the present disclosure, there is provided a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the method according to the first aspect and / or the second aspect of the present disclosure.

[0038] The present disclosure first re-trains the Chinese BERT pre-training model to make it learn the knowledge of encryption events sufficiently, and then uses prompt learning to organize the training set required for further training of the BERT pre-training model in the form of a predefined template, and obtains an encryption event classification model by further training the BERT pre-training model. Then, the encryption events are input into the trained encryption event classification model to obtain the encryption event category. In this way, the encryption events are classified to a certain extent, and the accuracy of encryption event classification is improved.

[0039] It is to be understood that the description in the summary is not intended to identify key or essential features of embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will be apparent from review of the description below. BRIEF DESCRIPTION OF DRAWINGS

[0040] The above and other features, advantages and aspects of embodiments of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings in which:

[0041] Figure 1 A flowchart of a training method of an encrypted event classification model is shown according to an embodiment of the present disclosure;

[0042] Figure 2 A flowchart of an encrypted event classification method is shown according to an embodiment of the present disclosure;

[0043] Figure 3 A block diagram of a training system of an encrypted event classification model is shown according to an embodiment of the present disclosure;

[0044] Figure 4 A block diagram of an encrypted event classification system is shown according to an embodiment of the present disclosure;

[0045] Figure 5 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0046] In order to make the purposes, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present disclosure.

[0047] In addition, the term "and / or" herein is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0048] In the present disclosure, the Chinese BERT pre-training model is retrained to fully learn the knowledge of encrypted events, and then the training set required for further training of the BERT pre-training model is organized in the form of a pre-defined template by using prompt learning, and an encrypted event classification model is obtained by further training the BERT pre-training model; then, the encrypted event is input into the trained encrypted event classification model to obtain the encrypted event category. In this way, by retraining the pre-training model and using prompt learning to make the model learn the appropriate prompt template, the model can classify encrypted events, and the accuracy of encrypted event classification is improved while realizing encrypted event classification.

[0049] Figure 1 A flowchart of a training method of an encrypted event classification model according to an embodiment of the present disclosure is shown in FIG. 1. Figure 1 The training method 100 of the encrypted event classification model includes the following steps.

[0050] S101: According to a pre-set encrypted event mapping dictionary, each encrypted number in the encrypted event is mapped into a Chinese character respectively to obtain encrypted text with Chinese characters;

[0051] S102: The encrypted text with Chinese characters is segmented to obtain a subword sequence;

[0052] S103: The subword sequence and its corresponding mask label are used as a training set to retrain a BERT pre-training model to obtain a retrained BERT pre-training model;

[0053] S104: The encrypted event and its corresponding encrypted event category label are organized in the form of a pre-defined template T = {|P 0:i |, x, |P i+1:m |, y}; wherein |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the i+1th to mth prompt word in the template T, x is the encrypted event, and y is the encrypted event category;

[0054] S105: The encrypted event and its corresponding encrypted event category label organized in the form of the template are used as a training set to further train the retrained BERT pre-training model to obtain an encrypted event classification model.

[0055] In S101, according to a pre-set encrypted event mapping dictionary, each encrypted number in the encrypted event is mapped into a Chinese character respectively to obtain encrypted text with Chinese characters.

[0056] In some embodiments, before retraining the pre-trained model, a mapping dictionary of numbers to Chinese characters in the encrypted event needs to be established, and the establishment rule of the mapping dictionary is to randomly find a Chinese character to map to an encrypted number, and then map the encrypted number in the encrypted event to a Chinese character according to the established mapping dictionary to obtain an encrypted text with Chinese characters. The encrypted event refers to the text description of the event being encrypted.

[0057] In S102, the encrypted text with Chinese characters is segmented to obtain a subword sequence.

[0058] In some embodiments, the encrypted text with Chinese characters is segmented by using a CRF algorithm to obtain a subword sequence {piece1, piece2, piece3,..., piece m}, where m is the number of subwords in the subword sequence.

[0059] In S103, the subword sequence and its corresponding mask label are used as a training set to retrain the bert pre-trained model to obtain a retrained bert pre-trained model.

[0060] Preferably, the pre-trained model is a Chinese bert pre-trained model based on roformer. Before retraining the bert pre-trained model, the embedding layer of the bert pre-trained model needs to be initialized by Kaiming random initialization.

[0061] In some embodiments, retraining the bert pre-trained model using the subword sequence and its corresponding mask label as a training set includes: masking the subword sequence to obtain a subword sequence with a mask; and retraining the bert pre-trained model using the subword sequence and its corresponding mask label as a training set.

[0062] In some embodiments, the subword sequence is masked according to the N-Gram masking strategy of candidate tokens, and the masking percentage from a single piece to four consecutive pieces is set to 45%, 35%, 15%, and 5%, where the 4-gram model can be represented as:

[0063]

[0064] In some embodiments, when the subword sequence is masked, first, the cosine similarity is used to calculate the similarity between each subword in the subword sequence and each word in the corpus to obtain a similarity set {p i , where the corpus is a large amount of corpus in the field, specifically a large amount of event description text and / or sentences in the field. Then, the similarity set {p iThe first quartile after ascending sorting is denoted as a threshold M, and the similarity between the subword in the subword sequence and the most similar word in the corpus is denoted as P sim . Then, the similarity P sim between each subword in the subword sequence and the corresponding most similar word in the corpus is compared with the threshold N, when P sim >N, the most similar word is used to mask the corresponding subword, when P sim <=N, the corresponding subword is randomly replaced and masked.

[0065] Specifically, the word vector of each word in the corpus is obtained by using the word2vec algorithm and the negative sampling method. When the cosine similarity is used to calculate the similarity between two words, the cosine value of the included angle between the two word vectors is used to evaluate the similarity between the two words.

[0066] In some embodiments, each subword in the subword sequence has a 15% probability of being masked, wherein 90% of the masked subwords are masked using the most similar word, 5% of the subwords are masked using a random word, and the remaining subwords remain unchanged. In this way, the subword sequence is masked by using the above masking method to obtain a subword sequence with a mask.

[0067] Further, the subword sequence is taken as a sample, and the mask in the subword sequence is taken as a label, that is, the subword sequence and the corresponding mask label are taken as a training set to retrain the bert pre-training model. By retraining the model, the retrained bert pre-training model can predict the masked subwords in the subword sequence.

[0068] According to the embodiments of the present disclosure, the bert pre-training model can sufficiently learn the semantic relationship in the encrypted event, and further, the retrained bert pre-training model can be more suitable for the downstream encrypted event classification task.

[0069] In S104, the encrypted event and the corresponding encrypted event category label are organized in the form of a pre-defined template T = {|P 0:i |, x, |P i+1:m |, y}, wherein |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the i+1th to mth prompt word in the template T, x is the encrypted event, and y is the encrypted event category.

[0070] In some embodiments, prompt learning refers to changing the downstream task to a text generation task by adding "prompt information" to the input without significantly changing the structure and parameters of the pre-trained language model, as shown in Table 1:

[0071] Table 1

[0072]

[0073] In the table, "the subject of the present text is" is used as "prompt information" to classify the text, and the output of the classified text is classified as education or philosophy.

[0074] In some embodiments, the retrained bert pre-training model is denoted as M, and the encrypted event after truncation of the maximum length is denoted as x 1:n = {x0, x1,..., x n}, and x 1:n = {x0, x1,..., x n} is mapped to the embedding representation {e(x0), e(x1),..., e(x n )}, and the mapping method is to map it after the embedding layer of the retrained bert pre-training model, and the embedding layer is denoted as e e M.

[0075] Define the template T = {|P 0:i |, x, |P i+1:m |, y}, where |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the i+1th to mth prompt word in the template T, x is the encrypted event, and y is the encrypted event category. Specifically, the template design does not use a manual template, but designs the prompt words in the template as [unused*] in the bert word table, and sets each prompt word in the template to be optimized, so that the model learns the most suitable template, such as |P 0:i | and |P i+1:m | are designed in the form of {|unused0|, |unused1|, |MASK|, |unused2|} and {|unused3|, |unused4|, |unused5|} respectively.

[0076] Further, the encrypted event is taken as a sample, and the encrypted event category is taken as a label, and the encrypted event and the corresponding encrypted event category label are organized in the form of template T = {|P 0:i |, x, |P i+1:m |, y} and input into the retrained bert pre-training model, and the retrained bert pre-training model is further trained to obtain an encrypted event classification model.

[0077] In some embodiments, further training the retrained BERT pre-trained model includes: mapping the encrypted events organized in the form of templates and their corresponding encrypted event category labels through the embedding layer of the retrained BERT pre-trained model to obtain vectors {e(|P 0:i |), e(x), e(|P i+1:m |), e(y)}; regarding each prompt word in the template as a pseudo-character, and mapping the vectors {e(|P 0:i |), e(x), e(|P i+1:m |), e(y)} to obtain vectors {h0,..., h i , e(x), h i+1 ,..., h m , e(y)}, where h i (0 ≤ i < m) is a prompt vector; optimizing the representation of the prompt vector h i (0 ≤ i < m) through the Bi-LSTM and loss function of the retrained BERT pre-trained model.

[0078] Specifically, by defining a loss function L, referring to the cross-entropy loss function L = -[ylogy′ + (1 - y)log(1 - y′)], where y represents the encrypted event category and y′ represents the encrypted event category predicted by the model, gradually optimizing the continuous prompt vectors h i (0 ≤ i < m), the optimized prompt vectors h i (0 ≤ i < m) are represented as h 0:m = arg h minl(M(x, y)).

[0079] Because h i (0 ≤ i < m) is a continuous representation, it is also possible to further optimize h i (0 ≤ i < m) to improve its representation ability. Preferably, an LSTM (bidirectional long-short-term memory network) can be used to solve the correlation problem, and a two-layer multi-layer perceptron (MLP) activated by ReLU can be used to handle the discreteness problem. The formula is as follows:

[0080]

[0081] , and through the above method, a better continuous representation of h i (0 ≤ i < m) can be obtained.

[0082] According to the embodiment of the present disclosure, the encryption event and the encryption event category are organized in the form of a template, input into the retrained bert pre-training model, and the model is further trained, so that the model can learn better continuity representation beyond the manual template, thereby further improving the classification ability of the model.

[0083] In some embodiments, the re-pretrained bert pre-training model is further trained for feature representation by contrastive learning.

[0084] Preferably, the re-pretrained bert pre-training model is further trained for feature representation by the training method of SimCSE.

[0085] In contrastive learning, positive samples are generated by Dropout, and negative samples are other samples in the same batch. Specifically, (encryption event category, encryption event category / encryption event category semantically similar category) is taken as a positive sample, and (encryption event category, encryption event category semantically dissimilar category) is taken as a negative sample. In addition, in order to expand the negative samples, the momentum encoder plus queue method proposed by moco is used to store the sample feature representation generated by each batch.

[0086] According to the embodiment of the present disclosure, by contrastive learning, the prediction result of the model is infinitely close to the positive sample and far away from the negative sample, thereby improving the feature representation ability of the model.

[0087] Figure 2 A flowchart of an encryption event classification method according to an embodiment of the present disclosure is shown, as shown in Figure 2 The encryption event classification method 200 includes:

[0088] S201: Organize the encryption event in the form of a pre-defined template T = {|P 0:i |, x, |P i+1:m |}; wherein |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the i+1th to mth prompt word in the template T, and x is the encryption event.

[0089] S202: Input the encryption event organized in the form of the template into the encryption event classification model obtained according to the method 100, and output the corresponding encryption event category.

[0090] In S201, the encryption event is organized in the form of a pre-defined template T = {|P 0:i |, x, |P i+1:m |}.

[0091] In some implementations, the encrypted events input by the user are processed according to the template T = {|P} 0:i |,x,|P i+1:m Organized in the form of |}.

[0092] In S202, the encrypted events organized according to the template are input into the encrypted event classification model obtained according to method 100, and the corresponding encrypted event category is output.

[0093] In some implementations, encrypted events organized in template form are input into an encrypted event classification model, and then mapped through an embedding layer in the model to obtain the vector {e(|P 0:i |),e(x),e(|P i+1:m |),e(y)}, then, for the vector {e(|P 0:i |),e(x),e(|P i+1:m Mapping |),e(y)} to obtain the vector {h0,...,h i ,e(x),h i+1 ,...,h m Then, the corresponding encrypted event category is obtained through the output layer of the encrypted event classification model.

[0094] According to embodiments of this disclosure, by organizing user-input encrypted events in the form of templates, the encrypted event classification model can more accurately output the encrypted event category when predicting the encrypted event category based on the user input and the prompt words in the template.

[0095] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this disclosure is not limited to the described order of actions, because according to this disclosure, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this disclosure.

[0096] The above is an introduction to the method embodiments. The following describes the solution described in this disclosure further through device embodiments.

[0097] Figure 3 A block diagram of a training system for an encrypted event classification model according to an embodiment of the present disclosure is shown, such as... Figure 3 As shown, the training system 300 for the encrypted event classification model includes:

[0098] The initial module 301 is configured to map each of the encrypted events to a Chinese character according to a preset encrypted event mapping dictionary, to obtain an encrypted text with Chinese characters.

[0099] The word segmentation module 302 is configured to perform word segmentation on the encrypted text with Chinese characters, to obtain a subword sequence.

[0100] The pre-training module 303 is configured to retrain a BERT pre-training model by taking the subword sequence and the corresponding mask label as a training set, to obtain a retrained BERT pre-training model.

[0101] The prompt module 304 is configured to organize the encrypted events and the corresponding encrypted event category labels in a form of a preset template T = {|P 0:i |, x, |P i+1:m |, y}, where |P 0:i | is the 0th to ith prompt word in the template T, |P i+1:m | is the (i+1)th to mth prompt word in the template T, x is the encrypted event, and y is the encrypted event category.

[0102] The training module 305 is configured to further train the retrained BERT pre-training model by taking the encrypted events and the corresponding encrypted event category labels organized in the form of the template as a training set, to obtain an encrypted event classification model.

[0103] Figure 4 A block diagram of an encrypted event classification system according to an embodiment of the present disclosure is shown, as shown in FIG. 4, the encrypted event classification system 400 includes: Figure 4

[0104] The input module 401 is configured to organize the encrypted events in a form of a preset template T = {|P 0:i |, x, |P i+1:m |}, where |P 0:i | is the first i prompt words in the template T, |P i+1:m | is the (i+1)th to mth prompt word in the template T, and x is the encrypted event.

[0105] The output module 402 is configured to input the encrypted events organized in the form of the template into the encrypted event classification model obtained according to the method 100, and output the corresponding encrypted event category.

[0106] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described modules can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0107] ​According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0108] Figure 5 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present disclosure described and / or claimed in this document.

[0109] The electronic device 500 includes a computing unit 501 that can perform various appropriate actions and processes in accordance with a computer program stored in a ROM 502 or a computer program loaded from the storage unit 508 into a RAM 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An I / O interface 505 is also connected to the bus 504.

[0110] Various components in the electronic device 500 are connected to the I / O interface 505, including an input unit 506, such as a keyboard, a mouse, and the like; an output unit 507, such as various types of displays, speakers, and the like; a storage unit 508, such as a magnetic disk, an optical disk, and the like; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0111] The computing unit 501 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 501 performs various methods and processes described above, such as the method 100 and the method 200. For example, in some embodiments, the method 100 and the method 200 can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded onto the RAM 503 and executed by the computing unit 501, one or more steps of the method 100 and the method 200 described above can be performed. Alternatively, in other embodiments, the computing unit 501 can be configured to perform the method 100 and the method 200 by any other appropriate means, such as by means of firmware.

[0112] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0113] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / acts specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0114] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0116] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0117] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0118] It should be understood that the various forms of flow shown above can be used to reorder, add, or delete steps. For example, the steps described in the present disclosure can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions of the present disclosure can be achieved, which are not limited herein.

[0119] The above detailed description does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for training a cryptographic event classification model based on prompt learning, characterized in that, The method comprises: According to the preset encryption event mapping dictionary, each encrypted number in the encryption event is respectively mapped to a Chinese character to obtain an encrypted text with Chinese characters; Tokenizing the encrypted text with Chinese characters to obtain a subword sequence; The subword sequence and its corresponding mask label are used as a training set to retrain a bert pre-training model to obtain a retrained bert pre-training model; organize the encryption event and its corresponding encryption event category label in a form of a pre-defined template; wherein, are the 0th to ith cue words in the template T, are the i+1th to mth cue words in the template T, x is an encryption event, and y is an encryption event category. The encryption event organized in the form of the template and its corresponding encryption event category label are used as a training set to further train the retrained bert pre-training model to obtain an encryption event classification model; The mask label is obtained by masking the subword sequence; The masking of the subword sequence comprises: respectively, and the obtained each similarity is collected to obtain a similarity set ; The set of similarities is sorted in ascending order The first quartile of the sorted set is denoted as threshold N, and the similarity of the sub-word in the sub-word sequence to the most similar word in the corpus is denoted as ; comparing each of the subword sequences to a similarity of a corresponding most similar word in a corpus to a threshold N; When the most similar word is used to mask the corresponding subword; When a random replacement mask is applied to the corresponding subword.

2. The method of claim 1, wherein, The method further comprises: The retrained bert pre-training model is further trained for feature representation through contrastive learning.

3. The method of claim 1, wherein, The retrained bert pre-training model is further trained using the encryption event organized in the form of the template and its corresponding encryption event category label as a training set. The encrypted events organized in the form of templates and the corresponding encrypted event category labels are mapped through the embedding layer of the retrained bert pre-training model to obtain vectors ; each prompt word in the template is treated as a dummy character, and the vector is mapped to obtain a vector wherein , is a prompt vector; The prompt vector is optimized by Bi-LSTM of the retrained BERT pre-training model and a loss function. , ​ 4. A method for classifying encrypted events based on prompt learning, characterized by, The method comprises: Encrypt events according to a predefined template Organized in the form of; among which, For the 0th to ith prompt words in template T, Let x be the (i+1)th to the mth prompt in template T, and x be the encryption event; The encryption event organized in the form of the template is input into the encryption event classification model obtained by the method according to any one of claims 1-3, and the corresponding encryption event category is output. 5.A training system of an encryption event classification model based on prompt learning, characterized in that, The system comprises: An initial module configured to map each encrypted number in an encryption event to a Chinese character according to a preset encryption event mapping dictionary to obtain an encrypted text with Chinese characters; A tokenizing module configured to tokenize the encrypted text with Chinese characters to obtain a subword sequence; A pre-training module configured to use the subword sequence and its corresponding mask label as a training set to retrain a bert pre-training model to obtain a retrained bert pre-training model; A prompt module is configured to organize the encryption event and its corresponding encryption event category label in a form of a pre-defined template; wherein, is the 0th to ith prompt word in the template T, is the i+1th to mth prompt word in the template T, x is the encryption event, and y is the encryption event category.​ A training module configured to use the encryption event organized in the form of the template and its corresponding encryption event category label as a training set to further train the retrained bert pre-training model to obtain an encryption event classification model; The mask label is obtained by masking the subword sequence; The masking of the subword sequence comprises: respectively, and the obtained each similarity is collected to obtain a similarity set ; The set of similarities is sorted in ascending order The first quartile of the sorted set is denoted as threshold N, and the similarity of the sub-word in the sub-word sequence to the most similar word in the corpus is denoted as ; comparing each of the subword sequences to a similarity of a corresponding most similar word in a corpus to a threshold N; When the most similar word is used to mask the corresponding subword; When a random replacement mask is applied to the corresponding subword.

6. A prompt-based learning based encrypted event classification system, characterized in that, The system comprises: An input module is configured to organize the encrypted events in a predefined template T, wherein, T = {T0, Ti, Ti+1,..., Tm}, x is an encrypted event, T0 = {T0, Ti, Ti+1,..., Tm}, x is an encrypted event, Ti = {Ti, Ti+1,..., Tm}, x is an encrypted event. An output module configured to input the encryption event organized in the form of the template into the encryption event classification model obtained by the method according to any one of claims 1-3, and output the corresponding encryption event category.

7. An electronic device, comprising: Comprise: At least one processor; And a memory connected in communication with the at least one processor; Characterized in that the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-4. 8.A non-transitory computer readable storage medium storing computer instructions, characterized in that, The computer instructions are used to make the computer execute the method according to any one of claims 1-4.

Images