Content type detection method, device, equipment and storage medium

Abstract

The embodiment of the present application discloses a content type detection method, device, electronic device and storage medium, the method includes: inputting each content feature subset in the initial content feature population into the initial detection model respectively, obtaining the prediction results corresponding to each content feature subset, iteratively adjusting the initial content feature population based on the content type prediction results of each content sample and the content type label of each content sample, until the number of iterative adjustments reaches a preset number, stopping the iterative adjustment, selecting a target content feature subset from the feature population when the adjustment stops, and updating the initial detection model using the target content feature subset to obtain a target detection model; based on the target detection model, detecting the content to be detected, and determining the type of the content to be detected. By adopting the above method, the obtained target detection model can be made more accurate, and thus the type of the content to be detected determined when the target detection model is used to detect the content to be detected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a content type detection method, apparatus, device and storage medium. Background Art

[0002] With the widespread use of Internet technology, while it brings convenience to people's lives and work, there are also some security risks. For example, in some business scenarios, users can publish user-created content through social networks, such as UGC (User Generated Content), and some malicious users use these methods to spread malicious content, such as uncivilized information, or information that violates laws and regulations, etc. Some users even transmit risky programs or risky information such as Trojan programs, fraudulent information or Trojan files on the Internet, which has a very bad impact on everyone's life and work, and even causes huge losses to users. Therefore, how to screen and identify these malicious contents becomes very important.

[0003] The traditional way of screening and identifying malicious content on the network is usually based on keyword or logo matching. For example, according to different business scenarios, a table of black words can be maintained, and malicious content can be screened according to the number of times black words appear in the published content. However, for traditional screening methods, as time goes by, more and more keywords need to be maintained manually, and the combination of words becomes more and more complex, making the manual operation and maintenance cost huge. Summary of the invention

[0004] In view of this, the embodiments of the present application propose a content type detection method, apparatus, device and storage medium, which can use the trained target detection model to identify malicious content, thereby effectively alleviating the above-mentioned technical problems.

[0005] In a first aspect, an embodiment of the present application provides a content type detection method, the method comprising: obtaining an initial content feature population, wherein the initial content feature population is established based on target sample features of multiple content samples, the initial content feature population comprises multiple content feature subsets, each content feature subset comprises at least one target sample feature in each of the content samples, each of the content samples respectively has a content type label, and the content samples include malicious content samples; inputting each content feature subset in the initial content feature population into an initial detection model respectively to obtain a content type prediction result of each content sample in the content feature subset; iteratively adjusting the initial content feature population based on the content type prediction result of each of the content samples and the content type label of each of the content samples until the number of iterative adjustments reaches a preset number, stopping the iterative adjustment, selecting a target content feature subset from the feature population when the adjustment stops, and using the target content feature subset to update the initial detection model to obtain a target detection model; detecting the content to be detected based on the target detection model to determine the type of the content to be detected.

[0006] In a second aspect, an embodiment of the present application provides a content type detection device, which includes: a feature population acquisition module, a sample prediction module, a target model acquisition module and a content type determination module. A feature population acquisition module is used to acquire an initial content feature population, wherein the initial content feature population is established based on target sample features of multiple content samples, the initial content feature population includes multiple content feature subsets, each content feature subset includes at least one target sample feature in each of the content samples, each of the content samples has a content type label, and the content samples include malicious content samples; a sample prediction module is used to input each content feature subset in the initial content feature population into an initial detection model to obtain a content type prediction result for each content sample in the content feature subset; a target model acquisition module is used to iteratively adjust the initial content feature population based on the content type prediction result of each of the content samples and the content type label of each of the content samples until the iterative adjustment number reaches a preset number, then stop the iterative adjustment, select a target content feature subset from the feature population when the adjustment stops, and use the target content feature subset to update the initial detection model to obtain a target detection model; a content type determination module is used to detect the content to be detected based on the target detection model to determine the type of the content to be detected.

[0007] In one possible implementation, the target model acquisition module includes: a sample prediction result acquisition submodule, a first merit value determination submodule, and a target content feature subset selection module. The sample prediction result acquisition submodule is used to input each content feature subset in the feature population when the adjustment is stopped into the input to the initial detection model to obtain the prediction results corresponding to each content feature subset, and the prediction results corresponding to each content feature subset include the prediction results of the content samples in each content feature subset; the first merit value determination submodule is used to determine the merit value of each content feature subset according to the prediction results of each content sample in each content feature subset and the content type label of each content sample; the target content feature subset selection module is used to select the target content feature subset based on the merit value of each content feature subset.

[0008] In one possible implementation, the target content feature subset selection module is further configured to select a content feature subset with the largest merit value as the target content feature subset based on the merit values ​​of each of the content feature subsets.

[0009] In one possible implementation, the first merit value determination submodule is also used to calculate the merits of each content feature subset based on the fitness function of the random forest, the prediction results of each content sample in each content feature subset, and the content type label of each content sample, so as to obtain the merit value of each content feature subset.

[0010] In one possible implementation, the target model acquisition module is further used to select candidate content feature subsets based on the prediction results of each content sample in each content feature subset and the content type label of each content sample, and perform feature change processing based on the candidate content feature subsets to obtain a new initial content feature population.

[0011] In one possible implementation, the target model acquisition module further includes: a second merit value determination submodule, a probability determination submodule, and a content feature subset selection submodule. The second merit value determination submodule is used to determine the merit value of each content feature subset according to the prediction results of each content sample in each content feature subset and the content type label of each content sample; the probability determination submodule is used to determine the probability of each content feature subset being selected as a candidate content feature subset according to the merit value of each content feature subset; the content feature subset selection submodule is used to select a first preset number of candidate content feature subsets from each content feature subset according to the probability corresponding to each content feature subset.

[0012] In one possible implementation, the target model acquisition module is further configured to use a genetic algorithm to perform feature change processing on the candidate content feature subset to obtain a new initial content feature population.

[0013] In one possible implementation, the feature population acquisition module includes: a sample acquisition submodule, a feature extraction submodule, and a population establishment submodule. The sample acquisition submodule is used to acquire multiple content samples, each of which has a content type label; the feature extraction submodule is used to extract the target sample features of each of the content samples; and the population establishment submodule is used to establish an initial content feature population based on the target sample features of each of the content samples.

[0014] In one possible implementation mode, the feature extraction module is further used to perform feature extraction on each of the content samples to obtain multiple sample features of each of the content samples; use an information gain algorithm to calculate the information gain value of the sample features of each of the content samples, and determine multiple target sample features of each of the content samples based on the information gain value of the sample features of each of the content samples.

[0015] In one possible implementation, the content type determination module includes a feature extraction submodule and a type prediction submodule. The feature extraction submodule is used to extract target data features from the content to be detected, and the target data features are the same as the target sample features of each content sample in the target content feature subset; the data prediction module is used to input the target data features of the content to be detected into the target detection model for prediction, and obtain the type prediction result of the content to be detected.

[0016] In one possible implementation, the content type detection device further includes: an alarm event generation module. The alarm event generation module is used to obtain multiple data contents having the same transmission path as the content to be detected when the type prediction result of the content to be detected is an abnormal type, and to generate and display an alarm event list when a second preset number of the type prediction results of the multiple data contents are abnormal types, wherein the alarm event list includes the data contents whose type prediction results are abnormal types and the transmission path.

[0017] In one possible implementation, the content type detection device also includes a content sample acquisition module, which is used to receive label information of the content to be detected input by the target user based on the alarm event single, use the content to be detected as a new content sample, and use the label information of the content to be detected as the content type label of the content sample.

[0018] In one possible implementation, the content samples include conversation flow samples, and the conversation flow samples include at least one of conversation flow samples shared by an open source community, conversation flow samples generated by penetration testers in attack drills, and conversation flow samples captured by security personnel in an intranet; the malicious content samples include conversation flow samples generated by a Trojan horse, and the content type label of the conversation flow sample generated by the Trojan horse is a positive sample label; the conversation flow samples also include conversation flow samples generated by a normal application, and the content type label of the conversation flow sample generated by a normal application is a negative sample label.

[0019] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory; one or more programs are stored in the memory and configured to be executed by the processor to implement the above method.

[0020] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored, wherein the above method is executed when the program code is executed by a processor.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device obtains the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above method.

[0022] The embodiments of the present application provide a content type detection method, apparatus, device and storage medium, the method comprising: obtaining an initial content feature population, the initial content feature population being established based on target sample features of multiple content samples, the initial content feature population comprising multiple content feature subsets, each content feature subset comprising at least one target sample feature in each of the content samples, each of the content samples having a content type label, and the content samples comprising malicious content samples; inputting each content feature subset in the initial content feature population into an initial detection model to obtain a content type prediction result of each content sample in the content feature subset; iteratively adjusting the initial content feature population based on the content type prediction results of each of the content samples and the content type label of each of the content samples until the iterative adjustment number reaches a preset number, stopping the iterative adjustment, selecting a target content feature subset from the feature population when the adjustment stops, and updating the initial detection model using the target content feature subset to obtain a target detection model; detecting the content to be detected based on the target detection model to determine the type of the content to be detected. By adopting the above method, it is possible to iteratively adjust the content feature subset in the initial content feature population to obtain a continuously optimized feature population, and select a target content feature subset from the final optimized feature population, so that when the target content feature subset is used for model training, the model training result is more accurate, and then when the target detection model is used to detect the content to be detected, the type of the content to be detected is determined more accurately. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 A schematic diagram of an application scenario of a content type detection method provided in an embodiment of the present application is shown;

[0025] Figure 2 A schematic diagram of a process flow of a content type detection method provided in an embodiment of the present application is shown;

[0026] Figure 3 Shows Figure 2 Schematic diagram of the process of step S110;

[0027] Figure 4 Shows Figure 2 Schematic diagram of the process of step S130;

[0028] Figure 5 Shows Figure 2 Another flow chart of step S130;

[0029] Figure 6 Another schematic diagram of a content type detection method provided by an embodiment of the present application is shown;

[0030] Figure 7 A schematic diagram showing another application scenario of a content type detection method provided in an embodiment of the present application is shown;

[0031] Figure 8 Another schematic diagram of a process of detecting a content type provided in an embodiment of the present application is shown;

[0032] Fig. 9 A flowchart of a content type detection method provided by an embodiment of the present application is shown;

[0033] Fig.10 A system framework diagram of a detection model provided in an embodiment of the present application is shown;

[0034] Fig.11 Another schematic diagram of a process of detecting a content type provided in an embodiment of the present application is shown;

[0035] Fig.12 Another system framework diagram of a detection model provided by an embodiment of the present application is shown;

[0036] Fig.13 A connection block diagram of a content type detection device provided in an embodiment of the present application is shown;

[0037] Fig.14 A structural block diagram of an electronic device for executing the method of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0038] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0039] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0040] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0041] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0042] It should be noted that the “plurality” mentioned in this article refers to two or more.

[0043] To facilitate understanding of this solution, the following briefly introduces several concepts:

[0044] A content feature subset is a set consisting of at least one target feature of multiple content samples. The target feature types of each content sample in the same content feature subset are the same. For example, multiple content samples include sample A, sample B, sample C and sample D, and each sample has four target features a, b, c, d and e respectively. Then the content feature subset may include at least one target feature (at least one of a, b, c, d and e) of each content sample (sample A, sample B, sample C and sample D).

[0045] A feature population refers to a set consisting of multiple content feature subsets, and the content samples of each content feature subset included in each feature population are the same but the feature types of the content samples are different. For example, if a feature population has three content feature subsets, namely, content feature subset 1, content feature subset 2, and content feature subset 3, if content feature subset 1 is composed of target sample features of four content samples (composed of at least one target sample feature of sample A, sample B, sample C, and sample D), then content feature subset 2 and content feature subset 3 are also composed of at least one target sample feature of the four content samples (that is, content feature subset 2 and content feature subset 3 are also composed of at least one target sample feature of sample A, sample B, sample C, and sample D, respectively), and among the target sample features corresponding to different content feature subsets, at least one target sample feature is different.

[0046] In related technologies, machine learning has been gradually applied to the network to identify malicious content in the network, such as for identifying encrypted communication traffic. However, the network communication traffic is huge. Taking TLS network communication traffic as an example, it has been calculated that about 4810 TLS flows are generated per second in a 10Gbps network bandwidth. Even if the false alarm rate of the detection model is very good, such as only 0.1%, the number of false alarms generated is huge, reaching nearly 5 per second, making it difficult for security emergency personnel to operate. Therefore, providing a more accurate detection model is an urgent problem to be solved.

[0047] The inventors have found through research that, at present, the effect of machine learning is largely subject to the quality of the feature set. When the selected features are poor, the number of false alarms will increase, and when the selected features are good, the number of false alarms will decrease.

[0048] Based on this, the present application provides a content type detection method, which obtains an initial content feature population, wherein the initial content feature population is established based on target sample features of multiple content samples, and the initial content feature population includes multiple content feature subsets, each of which includes at least one target sample feature in each content sample, each content sample has a content type label, and the content samples include malicious content samples; each content feature subset in the initial content feature population is input into an initial detection model to obtain a content type prediction result of each content sample in the content feature subset; the initial content feature population is iteratively adjusted based on the content type prediction result of each content sample and the content type label of each content sample until the number of iterative adjustments reaches a preset number, the iterative adjustment is stopped, a target content feature subset is selected from the feature population when the adjustment stops, and the initial detection model is updated using the target content feature subset to obtain a target detection model; and the content to be detected is detected based on the target detection model to determine the type of the content to be detected.

[0049] By adopting the above-mentioned content type detection method, during the iterative training process, the target sample features in the candidate content feature subset are continuously adjusted, so as to select a target content feature subset with more accurate target sample features, thereby making the target detection model obtained using the target content feature subset with more accurate target sample features more accurate, and thereby making the type of the content to be detected determined when using the target detection model to detect the content to be detected more accurate.

[0050] like Figure 1 As shown, a schematic diagram of an application scenario of a content type detection method provided by the present application is shown in FIG. Figure 1 ,This application scenario includes terminals and servers. The terminal can connect to the server through a network, which can be a wide area network or a local area network, or a combination of the two, using a wireless link to achieve data transmission.

[0051] Server 10 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, as well as big data and artificial intelligence platforms.

[0052] The terminal 20 may be a smart phone, a smart TV, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc. The terminal 20 may be provided with a client for displaying the detection results.

[0053] The terminal 20 and the server 10 may be connected directly or indirectly via wired or wireless communication, which is not limited in the present application.

[0054] Among them, the content type detection method provided by the present invention can be applied to terminals or servers, and can also be provided to other customers, such as corporate customers, in the form of cloud services. This application does not make specific restrictions. Among them, when provided to corporate customers as a cloud service, it helps them train the detection model according to different device usage environments.

[0055] As an example, the server 10 is used to deploy a detection model and train the detection model. The trained detection model can also be deployed in a corresponding terminal 20, and the deployed detection model can be used to perform data detection through the terminal 20.

[0056] Among them, the content type detection method provided in the embodiment of the present application is based on artificial intelligence. Artificial Intelligence (AI) is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making.

[0057] Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning. In the embodiments of this application, the main artificial intelligence software technology involved includes machine learning / deep learning and other directions. The solution of this application is mainly to improve the accuracy of the detection model in security detection in a network environment.

[0058] When applying content type detection methods to Figure 1 When the server 10 in the example is used, an initial detection model can be deployed on the server 10. When the server 10 obtains the initial content feature population, each content feature subset in the initial content feature population is input into the initial detection model respectively to obtain the content type prediction result of each content sample in the content feature subset, and the initial content feature population is iteratively adjusted based on the content type prediction result of each content sample and the content type label of each content sample until the number of iterative adjustments reaches a preset number, then the iterative adjustment is stopped, and a target content feature subset is selected from the feature population when the adjustment is stopped, and the initial detection model is updated using the target content feature subset to obtain a target detection model, so that when the content to be detected is subsequently detected, the target data feature of the content to be detected can be extracted, and the target data feature is the same as the target sample feature of each content sample in the target content feature subset, and then the target data feature of the content to be detected is input into the target detection model for prediction, so that the prediction result of the content to be detected can be obtained. After obtaining the above prediction result, the server 10 can send the prediction result of the content to be detected to the terminal 20 so that the user can view the prediction result of the content to be detected through the terminal 20.

[0059] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0060] See also Figure 2 , Figure 2 A content type detection method proposed in an embodiment of the present application is shown, and the method includes:

[0061] Step S110: Acquire an initial content feature population.

[0062] An initial content feature population is established based on target sample features of multiple content samples. The initial content feature population includes multiple content feature subsets, each of which includes at least one target sample feature in each content sample. Each content sample has a content type label, and the content samples include malicious content samples.

[0063] Among them, the above-mentioned malicious content samples may be information samples containing spam messages, uncivilized information, or information samples that violate laws and regulations, and the corresponding content samples also include normal information samples; the above-mentioned malicious content samples may also carry program samples of Trojan programs, and the corresponding content samples also include program samples of normal programs; the above-mentioned malicious content samples may also be samples carrying fraudulent information, and the corresponding content samples also include information samples of normal information; the above-mentioned malicious content samples may also be conversation flow samples carrying Trojan files, and the corresponding content samples also include conversation flow samples of normal files.

[0064] The target sample feature of the content sample refers to a sample feature selected from multiple sample features obtained by feature extraction of the content sample. There are many ways to extract features from the content sample, for example, some feature extractors can be used for feature extraction, or some feature extraction methods can be used for feature extraction.

[0065] When feature extraction is performed based on a feature extraction method, feature extraction can be performed based on a structural feature method, or based on a principal component analysis method, or based on a genetic algorithm, or based on a gray level co-occurrence matrix method, or using a spatial autocorrelation function, etc., and no specific limitation is made here.

[0066] It should be understood that for different content samples, the feature extraction method adopted may be different. For example, if the content sample is a Trojan communication data stream (a session stream sample marked with a Trojan file identifier), then when extracting features from the content sample, CICFlowMeter (a network traffic generator and analyzer) can be used to perform feature extraction and obtain more than 80 statistical network traffic features, such as duration, number of packets, number of bytes, packet length, etc.

[0067] In one possible implementation, if the content samples include conversation flow samples, the conversation flow samples include at least one of conversation flow samples shared by an open source community, conversation flow samples generated by penetration testers in attack drills, and conversation flow samples captured by security personnel in an intranet; the malicious content samples include conversation flow samples generated by a Trojan horse, and the content type label of the conversation flow sample generated by the Trojan horse is a positive content type label; the conversation flow samples also include conversation flow samples generated by a normal application, and the content type label of the conversation flow sample generated by the normal application is a negative content type label.

[0068] There are many ways to obtain the initial content feature population, for example, it can be: obtaining the initial content feature population pre-stored in the electronic device, the memory associated with the electronic device, or the server associated with the electronic device. It can also be obtaining content samples, extracting features from the content samples to obtain target features of the content samples, and constructing the initial content feature population according to the target features of each content sample to complete the acquisition of the initial content feature population.

[0069] See also Figure 3 In one possible implementation, the above step S110 may include:

[0070] Step S112: Acquire multiple content samples, each of which has a content type label.

[0071] The method of obtaining multiple content samples may be to obtain content samples pre-stored in the electronic device or in a memory associated with the electronic device. When obtaining multiple content samples, multiple content samples may be obtained at a specified time, or multiple content samples may be obtained at intervals of a preset time. The setting may be made according to actual needs, and is not specifically limited here.

[0072] Step S114: extracting target sample features of each content sample.

[0073] For the method of extracting target sample features of each content sample, please refer to the above content.

[0074] Taking into account that there are many types of features extracted from content samples, and in the subsequent processing process, invalid features in the extracted features will affect the subsequent results, in this embodiment, the above step S114 can be specifically: extract features from each content sample to obtain multiple sample features of each content sample, and select target sample features from the multiple sample features of each content sample.

[0075] Among them, the method of selecting the target sample feature from the multiple sample features of each content sample can be: based on the multiple sample features of each content sample, analyze whether each sample feature affects other sample features, or affects the content type label, so as to select the target sample feature according to the analysis results of each sample.

[0076] Exemplarily, an information gain algorithm may be used to select target sample features from sample features of content samples, a chi-square test algorithm may be used to select target sample features from multiple sample features of content samples, or a mutual information feature selection method may be used to select target sample features from multiple sample features of content samples.

[0077] In one possible implementation of the present application, selecting a target sample feature from multiple sample features of each content sample includes: calculating an information gain value of the sample feature of each content sample using an information gain algorithm, and determining multiple target sample features of each content sample based on the information gain value of the sample feature of each content sample.

[0078] Specifically, the information gain algorithm can be expressed as the difference between entropy and feature conditional entropy, as shown in equation (1): IG(X) = H(C) - H(C|X). In equation (1), H(C) represents information entropy, which is essentially a measure of the uncertainty of random variables. In feature selection, it represents the amount of information when the system has feature C, and its definition is shown in equation (2): In equation (2), P(Ci) represents the probability of Ci occurring, and H(C|X) represents conditional entropy, which is a measure of the uncertainty of the random variable c when x takes a certain value. Its definition is shown in equation (3): In equation (3), H(C|X=x) represents the amount of information when X=x. In feature selection, H(C|X) conditional entropy represents the total amount of information remaining in the system after losing the information brought by feature x.

[0079] Exemplarily, when the information gain value of a sample feature calculated using the above three equations is 0 or less than a preset value (the preset value is a value greater than 0), it can be indicated that the sample feature is an invalid feature, and accordingly, the target feature selected from the multiple sample features of each content sample does not include invalid features.

[0080] Step S116: establishing an initial content feature population based on the target sample features of each content sample.

[0081] The initial content feature population may include content feature subsets formed by different combinations of target features, or may only include a specified number of content feature subsets selected from content feature subsets formed by different combinations of target features to form the initial content feature population, thereby completing the establishment of the initial content feature population. Exemplarily, if the target features include feature a, feature b, feature c, and feature d, the initial content feature population includes content feature subsets, and each content feature subset is composed of at least one target feature among the above four features.

[0082] Step S120: inputting each content feature subset in the initial content feature population into the initial detection model to obtain a content type prediction result of each content sample in the content feature subset.

[0083] When each content feature subset in the initial content feature population is input into the initial detection model, since each content feature subset includes at least one target sample feature in each content sample, each obtained content feature subset includes the prediction results of each content sample.

[0084] Exemplarily, if the initial content feature population includes three content feature subsets, namely content feature subset 1, content feature subset 2 and content feature subset 3, if content feature subset 1 is composed of target sample features of four content samples (composed of at least one target sample feature of sample A, sample B, sample C and sample D), and the target features include feature a, feature b, feature c and feature d, wherein content feature subset 1 includes feature a, feature b, feature c and feature d in the above four samples, content feature subset 2 includes feature a, feature b and feature c in the above four samples, and content feature subset 3 includes feature c and feature d in the above four samples, then the sample features of each sample in the above content feature subsets can be respectively input into the initial detection model to obtain the prediction results of each sample included in the content feature subset.

[0085] Step S130: Iteratively adjust the initial content feature population based on the content type prediction results of each content sample and the content type label of each content sample until the iterative adjustment times reach a preset number, then stop the iterative adjustment, select a target content feature subset from the feature population when the adjustment stops, and use the target content feature subset to update the initial detection model to obtain a target detection model.

[0086] Each adjustment is implemented in the following manner: selecting candidate content feature subsets according to the prediction results of each content sample in each content feature subset and the content type label of each content sample, and performing feature change processing based on the candidate content feature subsets to obtain a new initial content feature population.

[0087] Specifically, the method for selecting candidate content feature subsets based on the prediction results of each content sample in each content feature subset and the content type label of each content sample can be: performing loss calculation based on the prediction results of each content sample in each content feature subset and the content type label of each content sample to obtain the loss calculation results of each content feature subset, and selecting candidate content feature subsets based on the loss calculation results of each content feature subset.

[0088] In this way, the content feature subsets whose loss calculation results are less than the preset value can be selected as candidate content feature subsets, and the content feature subsets can be sorted in order from small to large according to the loss results, and the content feature subsets whose loss results are sorted before the set number are selected as candidate content feature subsets. The above-mentioned set number can be 2, 5, 10 or 20, etc., which is not specifically limited here and can be set according to data requirements.

[0089] Another method for selecting candidate content feature subsets based on the prediction results of each content sample in each content feature subset and the content type label of each content sample is: using the fitness function of the random forest to calculate the pros and cons of the content type prediction results of each content sample and the content type label of each content sample, so as to select the candidate content feature subsets based on the pros and cons calculation results.

[0090] See also Figure 4 In this implementation manner, the above-mentioned selection of candidate content feature subsets according to the prediction results of each content sample in each content feature subset and the content type label of each content sample may specifically include the following steps:

[0091] Step S131: determining the merit value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample.

[0092] Specifically, the above step S131 may be to respectively bring the content type label of the predicted content sample of each content sample in each content feature subset into the fitness function of the random forest to calculate the merit value of each content feature subset.

[0093] Take the content type label of the content sample as including positive sample label (that is, the content sample is a positive sample) and negative sample label (that is, the content sample is a negative sample). Among them, the content sample with malicious content is a positive sample, and its content type label is a positive sample label; while the content sample without malicious content (a sample with normal content) is a negative sample, and its content type label is a negative sample label. For example, the content type prediction result of any content sample is a normal type or an abnormal type. Then F can be calculated by the random forest classifier. 1-score(Good or Bad Value) is used to evaluate the good or bad of each content feature subset. Specifically, equation (4), equation (5) and equation (6) can be used to jointly calculate the good or bad value of each content feature subset. Equation (4) is: Equation (5) is: Equation (6) is: In the formula, Precision represents the prediction accuracy, N TP Indicates the number of content samples whose type prediction results are abnormal types, N FP Recall represents the recall rate, N FN represents the number of content samples whose type prediction results are normal types and whose content type labels are positive sample labels (that is, content samples whose prediction results are that they do not contain malicious content but actually contain malicious content), F 1-score The larger the value of is, the better the features selected in the corresponding content feature subset are, and the more accurate the prediction results are. 1-score The smaller the value of , the worse the features selected in the identification content feature subset, and the less accurate the prediction results.

[0094] It should be understood that the above definitions of positive samples and negative samples can be defined according to actual needs. For example, if the positive sample is a malicious sample generated by a Trojan program and the negative sample is a benign sample generated by a normal program, then N TP Represents the number of samples that are identified as malicious and are also labeled as malicious, N FP Represents the number of samples identified as malicious but labeled as benign, N FN Represents the number of samples that are identified as benign but labeled as malicious. If the positive sample is fraudulent information from criminals, then the negative sample is normal information, and the corresponding N TP Represents the number of samples that are identified as fraudulent and are also labeled as fraudulent, N FP Represents the number of samples identified as fraudulent samples and labeled as normal samples, N FN Represents the number of samples that are identified as normal samples but labeled as fraudulent samples. If the positive sample is a Trojan software and the negative sample is a normal software, then N TP Represents the number of samples that are identified as Trojan software samples and are also labeled as Trojan software samples, N FP Represents the number of samples identified as Trojan software but labeled as normal software, N FN Represents the number of samples that are identified as normal software samples but are labeled as Trojan software samples.

[0095] Step S132: determining the probability of each content feature subset being selected as a candidate content feature subset according to the quality value of each content feature subset.

[0096] The above step S132 can be: sorting each content feature subset in descending order according to the merits of each content feature subset to obtain the sorting order of each content feature subset, selecting the content feature subsets with the pre-set number of sortings, and setting the selection probability of the selected content feature subsets to 1.

[0097] The above step S132 may also be: after accumulating the merits and demerits of each content feature subset to obtain a merit cumulative value, for each content feature subset, taking the ratio of the merits and demerits of the content feature subset to the merit cumulative value as the probability that the content feature subset is selected as a candidate content feature subset.

[0098] Specifically, in this implementation mode, the probability that the i-th content feature subset in the initial content feature population is selected as the candidate content feature subset is: Among them, F iti is the quality value corresponding to the i-th content feature subset.

[0099] Step S133: selecting a first preset number of candidate content feature subsets from each content feature subset according to the probability corresponding to each content feature subset.

[0100] By adopting the above step S133, the probability of selecting a content feature subset with a higher merit value is higher, that is, the better the feature, the greater the probability of being selected; and the probability of selecting a content feature subset with a lower merit value is lower.

[0101] The above-mentioned first preset number can be 5, 10, 15 or 20, etc., and can be set according to at least one of the types of target sample features and the number of content samples, etc., and is not specifically limited here.

[0102] The method of performing feature change processing based on the candidate content feature subset to obtain a new initial content feature population may be: performing feature change processing on the candidate content feature subset using an ant colony algorithm to obtain a new initial content feature population. It may also be performing feature change processing on the candidate content feature subset using an annealing algorithm to obtain a new initial content feature population; it may also be performing feature change processing on the candidate content feature subset using a genetic algorithm or an evolutionary algorithm to obtain a new initial content feature population.

[0103] In one possible implementation of the present application, performing feature change processing based on the candidate content feature subset to obtain a new initial content feature population includes: performing feature change processing on the candidate content feature subset using a genetic algorithm to obtain a new initial content feature population.

[0104] In this implementation manner, when the genetic algorithm is used to perform feature change processing on the candidate content feature subsets, the candidate content feature subsets may be subjected to change processing in three aspects: selection, crossover, and mutation, to generate a new feature population.

[0105] Among them, selection refers to selecting one or more target features from the multiple target features included in the candidate content feature subset to form a new content feature subset. Crossover refers to crossing the target features included in at least two candidate content feature subsets to obtain a new content feature subset. The essence of crossover is optimization combination, which can jump out of the local optimal limitation and ensure that the population evolves in the direction of the optimal solution. The present application adopts a uniform crossover method to obtain new individuals, that is, a new content feature subset. Mutation refers to changing the target features of one or more content samples in the candidate content feature subset. For example, when a feature of a content sample is represented by 0 / 1 coding, the feature can be changed from the original 0 to 1, or the original 1 can be changed to 0. The essence of mutation is to ensure the diversity of the population, so that the characteristics of the population are not limited to the existing feature types, but explore outward, providing the possibility of finding the global optimal solution.

[0106] By adopting the above method, after constructing a new initial content feature population based on the candidate content feature subset, it is possible to return to steps S120-S130 to iteratively adjust the feature population until the number of iterations reaches a preset number, and then stop iterating.

[0107] The above-mentioned preset number of times may be 50 times, 100 times, 200 times, 500 times or 2000 times, etc., which is not specifically limited here. Exemplarily, in this embodiment, the number of times the initial content feature population is iteratively adjusted may be 2000 times.

[0108] The method of selecting the target content feature subset from the feature population when the adjustment stops can be: input each content feature subset in the feature population when the adjustment stops into the initial detection model respectively, and obtain the prediction results corresponding to each content feature subset, wherein the prediction results corresponding to each content feature subset include the prediction results of the content samples in each content feature subset; select the target content feature subset according to the prediction results corresponding to each content feature subset and the prediction results of each content sample.

[0109] Among them, the method of selecting the target content feature subset based on the prediction results corresponding to each content feature subset and the prediction results of each content sample can be: based on the prediction results of each content sample in each content feature subset and the content type label of each content sample, loss calculation is performed to obtain the loss calculation results of each content feature subset, and the target content feature subset is selected based on the loss calculation results of each content feature subset.

[0110] In this manner, a target content feature subset may be determined from content feature subsets whose loss calculation results are less than a preset value, and a content feature subset with the smallest loss result may be used as the target content feature subset.

[0111] Another method for selecting a target content feature subset based on the prediction results of each content sample in each content feature subset and the content type label of each content sample is: using the fitness function of a random forest to calculate the pros and cons of the content type prediction results of each content sample and the content type label of each content sample, so as to select the target content feature subset based on the pros and cons calculation results.

[0112] See also Figure 5 In this implementation manner, selecting a target content feature subset from the feature population when the adjustment stops may specifically include:

[0113] Step S135: Input each content feature subset in the feature population when the adjustment stops into the initial detection model to obtain the prediction results corresponding to each content feature subset, wherein the prediction results corresponding to each content feature subset include the prediction results of the content samples in each content feature subset.

[0114] Step S136: determining the merit value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample.

[0115] For a detailed description of step S136, please refer to the detailed description of step S131 above.

[0116] In one possible implementation of the present application, the above-mentioned step S136 may specifically be: based on the fitness function of the random forest, the prediction results of each content sample in each content feature subset, and the content type label of each content sample, the quality of each content feature subset is calculated to obtain the quality value of each content feature subset.

[0117] Step S137: selecting a target content feature subset based on the quality values ​​of each content feature subset.

[0118] The above step S137 may be to select the content feature subset with the largest merit value from the merit values ​​of each content feature subset as the target content feature subset. Alternatively, a content feature subset may be randomly selected from the content feature subsets ranked by a previous set value obtained by sorting the merit values ​​of the content feature subsets from large to small as the target content feature subset. The above set value may be 2, 3 or 5, etc., which is not specifically limited here.

[0119] In order to make the selected content feature subset optimal, and thus make the target detection model obtained based on the target content feature subset optimal, in one possible implementation mode of the present application, the above step S137 can specifically be: based on the pros and cons values ​​of each content feature subset, select the content feature subset with the largest pros and cons value as the target content feature subset.

[0120] After obtaining the target content feature subset, the target content feature subset is input into the initial detection model to train the initial detection model using the content type label corresponding to each content sample in the target content feature subset and the target sample features included in each content sample until the target detection model is obtained when the model converges, thereby completing the training of the target detection model.

[0121] Step S140: Detect the content to be detected based on the target detection model to determine the type of the content to be detected.

[0122] Specifically, detecting the content to be detected based on the target model may be inputting the content to be detected into the target detection model for detection to determine the type of the content to be detected.

[0123] The present application provides a content type detection method. During the training process, after obtaining the initial content feature population, each content feature subset in the initial content feature population is input into the initial detection model respectively to obtain the prediction results corresponding to each content feature subset, and a candidate content feature subset is selected according to the prediction results of each content sample in each content feature subset and the content type label of each content sample, and feature change processing is performed based on the candidate content feature subset to obtain a new initial content feature population. Then, the method returns to the step of inputting each content feature subset in the initial content feature population into the initial detection model respectively to obtain the prediction results corresponding to each content feature subset, so as to iteratively adjust the initial content feature population until the number of iterations reaches a preset number, then the iteration is stopped, and a target content feature subset is selected from the feature population obtained by the last iterative adjustment, and the initial detection model is trained with the target content feature subset to obtain a target detection model, thereby completing the training of the detection model. By adopting the above-mentioned training method, a continuously optimized feature population can be obtained by continuously iteratively adjusting the content feature subset in the feature population, and a target content feature subset is selected from the continuously optimized feature population, so that when the target content feature subset is used for model training, the model training result is more accurate, that is, when the trained target model is used to detect the content to be detected, it can be accurately detected whether the content to be detected includes malicious content, and then when the target detection model is used to detect the content to be detected, the type of the content to be detected is determined more accurately.

[0124] Furthermore, after selecting the target features using the information gain algorithm, the fitness function of the random forest and the genetic algorithm can be used in the iterative training process to continuously optimize the feature population obtained in the iterative process, thereby making the target content feature subset finally obtained optimal, ensuring that the target detection model obtained by training based on the target content feature subset is more accurate.

[0125] See also Figure 6 Another embodiment of the present application provides a content type detection method, the method comprising:

[0126] Step S210: Acquire an initial content feature population.

[0127] Among them, the initial content feature population is established based on the target sample features of multiple content samples, the initial content feature population includes multiple content feature subsets, each content feature subset includes at least one target sample feature in each content sample, each content sample has a content type label, and the content samples include malicious content samples.

[0128] Step S220: inputting each content feature subset in the initial content feature population into the initial detection model to obtain a prediction result corresponding to each content feature subset.

[0129] The prediction result corresponding to the content feature subset includes the prediction result of each content sample in the content feature subset.

[0130] Step S230: Iteratively adjust the initial content feature population based on the content type prediction results of each content sample and the content type label of each content sample until the number of iterative adjustments reaches a preset number, then stop the iterative adjustment, select a target content feature subset from the feature population when the adjustment stops, and use the target content feature subset to update the initial detection model to obtain a target detection model.

[0131] Each adjustment is implemented in the following ways:

[0132] A candidate content feature subset is selected according to the prediction result of each content sample in each content feature subset and the content type label of each content sample, and feature change processing is performed based on the candidate content feature subset to obtain a new initial content feature population.

[0133] Step S240: Obtain the content to be detected.

[0134] The method of obtaining the content to be detected may be to obtain the content to be detected transmitted in the network, to obtain pre-stored content to be detected, or to obtain the content to be detected generated by a specified device or program, which is not specifically limited here.

[0135] In one possible implementation of the application, the above-mentioned content to be detected is data that matches the type of the content sample. For example, when the content sample is a content sample identified as a Trojan program or a normal program, the content to be detected is the program to be detected; when the content sample is a session flow sample identified with a Trojan file identifier or a normal file identifier, the content to be detected is the session flow data to be detected; when the content sample is an information sample identified with fraudulent information or normal information, the content to be detected is the information to be detected.

[0136] Step S250: extracting target data features from the content to be detected, where the target data features are the same as the target sample features of each content sample in the target content feature subset.

[0137] The method of extracting target features from the content to be detected may be to extract features in the content to be detected using the same feature extraction method as that of the content sample, and select target data features from the features in the content to be detected.

[0138] For a detailed description of extracting target features from the content to be detected, please refer to the detailed description of step S110 in the above embodiment, which will not be described in detail here.

[0139] Step S260: Input the target data features of the content to be detected into the target detection model for prediction, and obtain the type prediction result of the content to be detected.

[0140] By adopting the above steps S210-S260, the detection model is trained, and after the training is completed, the target detection model obtained by the training is used to detect the content to be detected to obtain the type prediction result of the content to be detected, and the type prediction result is used to characterize whether the content to be detected is malicious content, wherein if the content to be detected is malicious content, the type prediction result of the content to be detected is predicted to be an abnormal type. Thus, the accuracy of the type prediction result of the content to be detected is ensured.

[0141] Considering that the content to be detected may be data transmitted in a fragmented manner in the network, in order to avoid such data generating a large number of alarm results when the prediction result is abnormal, which is inconvenient for the user to handle. In the embodiment of the present application, after executing step S260, if the content to be detected is data content transmitted in a fragmented manner in the network, the method further includes:

[0142] Step S270: If the prediction result of the type of the content to be detected is an abnormal type, multiple data contents having the same transmission path as the content to be detected are obtained.

[0143] The above-mentioned having the same transmission path as the content to be detected means having the same source IP, source port, destination IP and destination port as the content to be detected.

[0144] Step S280: If a second preset number of the type prediction results of the plurality of data contents are of abnormal type, an alarm event sheet is generated and displayed, and the alarm event sheet includes the data content and transmission path of which the type prediction results are of abnormal type.

[0145] The type prediction results of the above-mentioned multiple data refer to the type prediction results of each data content obtained after the target detection model performs the same or corresponding steps as the above-mentioned steps S250-S260 on the multiple data contents. The above-mentioned second preset number can be 10, 20, 30 or 100, etc. By displaying the above-mentioned alarm event list, the user can handle the generated alarm event in time.

[0146] In order to achieve continuous iteration and update of the detection model and continuous evolution, and to greatly improve the detection performance of the model, in this embodiment, the method also includes: Step S290: receiving the label information of the content to be detected input by the target user based on the alarm event single, taking the content to be detected as a new content sample, and taking the label information of the content to be detected as the content type label of the content sample.

[0147] In order to make the obtained samples more reliable and to play a role in convergence and optimization of the model when applied in the model training process, the above-mentioned step S290 can be: receiving the label information of the content to be detected input by the target user based on the alarm event single, if the label information is inconsistent with the prediction result, then the content to be detected is used as a new content sample, and the label information of the content to be detected is used as the content type label of the content sample.

[0148] By adopting the above method, in the process of using the target detection model to detect the content to be detected, the samples can be continuously expanded and the target detection model can be continuously updated, thereby greatly improving the detection performance of the model.

[0149] The present application also provides a model training method, which is applied in an intrusion detection system, and the intrusion detection system is used to detect whether there is a session flow generated by the Cobalt Strike Trojan in an office environment. That is, in this embodiment, the content samples used include sample session flows generated by the Cobalt Strike Trojan and sample session flows generated by normal applications, and the trained target detection model is used to identify the session flows generated by the Cobalt Strike Trojan, thereby significantly improving the problem that the existing technology is difficult to detect for such communications.

[0150] There are two ways for the communication behavior of Cobalt Strike Trojan. One is to show the direct communication process between Cobalt Strike Trojan and C&C server without any obfuscation technology. The other is to use domain fronting or cloud function to obfuscate the communication process, showing the communication process between Cobalt Strike Trojan and intermediate public servers (such as CDN). In any communication method, the communication process adopts the session flow method.

[0151] like Figure 7 As shown, it is a typical application scenario of a model training method provided by the present application, which includes multiple office networks and intrusion detection systems, and each office network includes multiple hosts. When each host needs to interact with the server, the interaction is carried out in the form of a session flow through the Internet proxy application and the network. In the specific detection process, the intrusion detection system needs to mirror the network traffic (session flow) in the intranet at the Internet proxy (copy the network traffic of a certain port to another port) and import it into the intrusion detection system; and extract the characteristics of the session flow and send it to the deployed detection model to complete the detection.

[0152] Please combine Figure 8 , Fig. 9 as well as Fig.10 As shown, specifically, the embodiment of the present application can automatically iterate and train the model in an iterative process based on the pre-captured CobaltStrike Trojan traffic samples, so as to effectively screen out malicious network communications, promptly identify the hosts in the intranet infiltrated by the Cobalt Strike Trojan, and after the iterative training of the model, execute the detection process to detect the current session flow sample. Specifically, since the Cobalt Strike Trojan usually uses technologies such as domain pre-positioning and cloud functions to confuse its C&C (command and control) communication, its TLS key exchange process is consistent with some normal applications, making the TLS handshake feature invalid. Therefore, the method of extracting features from the session flow samples adopted by the present application is to use CICFlowMeter (network traffic generator and analyzer) for feature extraction, and obtain more than 80 statistical network traffic features. It should be understood that before performing the detection, model training is required, and the specific model training process is as follows:

[0153] Step S301: Acquire multiple conversation flow samples, and use CICFlowMeter to perform feature extraction to obtain multiple sample features of each conversation flow sample.

[0154] Among them, the session flow samples include at least one of the session flow samples shared by the open source community, the session flow samples generated by penetration testers in attack drills, and the session flow samples captured by security personnel in the intranet; if there is a session flow sample generated by a Trojan horse, the content type label of the session flow sample is an abnormal type label (the abnormal type label is 1); if there is a session flow sample generated by a normal application, the content type label of the session flow sample is a normal type label (the normal type label is 0).

[0155] Step S302: Calculate the information gain value of the sample feature of each conversation flow sample using an information gain algorithm, and determine multiple target sample features of each conversation flow sample according to the information gain value of the sample feature of each conversation flow sample.

[0156] Step S303: establishing an initial traffic feature population based on the target sample features of each session flow sample.

[0157] Step S304: inputting each flow feature subset in the initial flow feature population into the initial detection model to obtain the prediction result corresponding to each flow feature subset;

[0158] The prediction result corresponding to the traffic feature subset includes the prediction result of each session flow sample in the traffic feature subset.

[0159] Step S305: Based on the fitness function of the random forest, the prediction results of each conversation flow sample in each traffic feature subset, and the traffic type label of each conversation flow sample, each traffic feature subset is evaluated to obtain a quality value of each traffic feature subset.

[0160] Step S306: Select candidate flow feature subsets based on the merits of each flow feature subset, and use a genetic algorithm to perform feature change processing on the candidate flow feature subsets to obtain a new initial flow feature population.

[0161] Specifically, the probability of each traffic feature subset being selected as a candidate traffic feature subset can be determined according to the proficiency of each traffic feature subset; and a first preset number of candidate traffic feature subsets can be selected from each traffic feature subset according to the probability corresponding to each traffic feature subset.

[0162] If the number of times the feature change processing is performed is less than the preset number (the number of iterative adjustments is less than the preset number), return to execute step S304; if the number of times the feature change processing is performed reaches the preset number (the number of iterative adjustments reaches the preset number), execute step S307: input each traffic feature subset in the feature population when the iteration stops into the initial detection model respectively, and obtain the prediction results corresponding to each traffic feature subset, and the prediction results corresponding to each traffic feature subset include the prediction results of the conversation flow samples in each traffic feature subset.

[0163] Step S308: Based on the fitness function of the random forest, the prediction results of each conversation flow sample in each traffic feature subset in the feature population when the iteration stops, and the traffic type label of each conversation flow sample, the quality of each traffic feature subset is calculated to obtain the quality value of each traffic feature subset when the iteration stops.

[0164] Step S309: based on the merits of each traffic feature subset when the iteration stops, select the traffic feature subset with the largest merit value as the target traffic feature subset.

[0165] Step S310: Update the initial detection model using the target traffic feature subset to obtain a target detection model.

[0166] By adopting the above steps S301-S310, the training of the target detection model for identifying the session flow generated by the Cobalt Strike Trojan is completed.

[0167] Please refer to Fig.11 and Fig.12 When using the target detection model to detect the session flow to be detected, three steps are required: model deployment, alarm merging, and manual verification to determine whether the alarm output by the machine learning model requires emergency response processing. The specific detection process is as follows:

[0168] Deploy the iteratively trained model and feature set to the detection environment. The model deployment flow chart is as follows: Fig.12 As shown in the figure, its input is the network conversation flow. When a conversation flow to be detected is obtained, the complete feature set (original feature set) is first extracted, with a total of more than 80 features. Then, the corresponding features of the conversation flow to be detected are selected according to the target features of the training samples included in the target traffic feature subset (the features included in the target traffic feature subset output in the iterative process) to obtain the selected feature set. The corresponding features of the conversation flow to be detected (the selected feature set) are imported into the target detection model for prediction to obtain the detection result of the conversation flow to be detected. The specific process is as follows:

[0169] Step S311: Acquire the session flow to be detected.

[0170] Step S312: extracting target data features from the conversation flow to be detected, where the target data features are the same as target sample features of each conversation flow sample in the target traffic feature subset.

[0171] Step S313: inputting the target data features of the conversation flow to be detected into the target detection model for prediction, and obtaining the prediction result of the conversation flow to be detected.

[0172] After obtaining the prediction results of the conversation flow, it can be determined whether the alarm output by the target detection model requires an emergency response. In addition, in order to achieve the iteration process, for the manually confirmed false alarms and the missed alarm events, their samples are labeled, and incremental learning is performed, and a more effective feature set is reselected using a genetic algorithm to iterate the target detection model. Once the target detection model is obtained, the more effective feature set and target detection model obtained above are updated to the model deployment of the detection process, so as to realize the continuous update and iteration of the detection model.

[0173] When testing the communication of the Cobalt Strike Trojan, it was found that when it transmits files, it adopts a fragmented transmission strategy, which will generate a large number of session flows at the same time, and the model will generate a large number of alarms. In this embodiment, after obtaining the prediction result, if the acquired session flow to be detected is data transmitted in the network in a fragmented transmission manner, the method also includes:

[0174] Step S314: if the prediction result of the to-be-detected session flow is abnormal, multiple session flows having the same transmission path as the to-be-detected session flow are obtained.

[0175] Step S315: if a second preset number of the predicted results of the plurality of conversation flows are abnormal, an alarm event sheet is generated and displayed, and the alarm event sheet includes the conversation flows and transmission paths whose predicted results are abnormal.

[0176] When a second preset number of session flows are included in multiple session flows with the same transmission path as abnormal, an alarm event sheet is generated, thereby reducing the event sheets generated by false alarms to achieve alarm merging. The same transmission path refers to the source IP, source port, destination IP, and destination port. Therefore, the present invention is set to generate an event sheet when the second preset number is 100; and alarms that do not meet the conditions are not processed. Finally, the input of the alarm merging step is the prediction result of the previous step (the prediction result of the session flow), and the output is the event sheet obtained based on the input prediction result.

[0177] After the alarm event sheet is output, it can be displayed to the target user for manual verification. Among them, the manual verification mainly completes two parts of work. The first part is to verify whether the event sheet passed in the previous step is generated by the Cobalt Strike Trojan; if so, it will be handed over to the next step for emergency response processing. If not, the false positive session flow to be detected will be used as a new session flow sample and labeled with 0 (indicating that the session flow sample is a negative sample, generated by a normal application), and passed to the iterative process (to use multiple session flow samples including the session flow sample for training again). The second part is that the target user can also obtain the Cobalt Strike Trojan communication session flow from other channels, and the Cobalt Strike Trojan session flow that this target detection model fails to detect is used as a session flow sample, then the session flow sample is labeled with 1 (indicating that the session flow sample is a positive sample, generated by the Cobalt Strike Trojan), and the labeled samples are incrementally stored in the sample database to execute the next round of model training and iterative process. Among them, in order to ensure that the model training process will not affect user use, in this example, the model update can be performed once every preset time interval (such as 1 day, one week or one month, etc.), that is, the detection model is iteratively updated using the updated sample database, thereby realizing continuous iterative updating of the model and continuously evolving the model, which can greatly improve the detection performance of the model.

[0178] As shown in the following table, it is an alarm event list composed of multiple alarm event sheets generated by detecting the session flow using the target detection model deployed in this application, wherein the multiple alarm event sheets include alarm event sheets generated by using the Cobalt Strike Trojan to implement encrypted reverse connection, encrypted reverse connection after injection into a normal process, domain pre-position, and cloud function attack techniques. The alarm event list includes the attack technique of the Cobalt Strike Trojan, the attack time, the amount of traffic generated, the attack details, and whether an alarm is generated:

[0179]

[0180] From the above table, we can see that after using the target detection model to learn the characteristics of Cobalt Strike traffic communication, no matter whether the attacker changes the communication domain name or the Trojan fingerprint, the target detection model can identify the Cobalt Strike Trojan communication behavior, that is, identify the Cobalt Strike session flow.

[0181] See also Fig.13 The embodiment of the present application also provides a content type detection device 400, which includes: a feature population acquisition module 410, a sample prediction module 420, a target model acquisition module 430 and a content type determination module 440.

[0182] The feature population acquisition module 410 is used to acquire an initial content feature population. The initial content feature population is established based on target sample features of multiple content samples. The initial content feature population includes multiple content feature subsets. Each content feature subset includes at least one target sample feature in each content sample. Each content sample has a content type label, and the content samples include malicious content samples. The sample prediction module 420 is used to input each content feature subset in the initial content feature population into the initial detection model to obtain a content type prediction result for each content sample in the content feature subset. The target model acquisition module 430 is used to iteratively adjust the initial content feature population based on the content type prediction result of each content sample and the content type label of each content sample until the number of iterative adjustments reaches a preset number, then stop the iterative adjustment, select a target content feature subset from the feature population when the adjustment stops, and use the target content feature subset to update the initial detection model to obtain a target detection model. The content type determination module 440 is used to detect the content to be detected based on the target detection model and determine the type of the content to be detected.

[0183] In one possible implementation, the feature population acquisition module 410 includes: a sample acquisition submodule, a feature extraction submodule, and a population establishment submodule.

[0184] The sample acquisition submodule is used to acquire multiple content samples, each of which has a content type label; the feature extraction submodule is used to extract the target sample features of each content sample; the population establishment submodule is used to establish an initial content feature population based on the target sample features of each content sample.

[0185] In this implementation manner, the feature extraction submodule is also used to extract features from each content sample to obtain multiple sample features of each content sample; the information gain value of the sample feature of each content sample is calculated using an information gain algorithm, and multiple target sample features of each content sample are determined based on the information gain value of the sample feature of each content sample.

[0186] In one possible implementation, the target model acquisition module 430 includes: a sample prediction result acquisition submodule, a first quality value determination submodule, and a target content feature subset selection module.

[0187] A sample prediction result acquisition submodule is used to input each content feature subset in the feature population when the adjustment stops into the initial detection model to obtain the prediction result corresponding to each content feature subset, and the prediction result corresponding to each content feature subset includes the prediction result of the content sample in each content feature subset; a first quality value determination submodule is used to determine the quality value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample; a target content feature subset selection module is used to select a target content feature subset based on the quality value of each content feature subset.

[0188] In this implementation manner, the first merit value determination submodule is also used to calculate the merits of each content feature subset based on the fitness function of the random forest, the prediction results of each content sample in each content feature subset, and the content type label of each content sample, so as to obtain the merit value of each content feature subset.

[0189] In this implementation manner, the target content feature subset selection module is further configured to select a content feature subset with the largest merit value as the target content feature subset based on the merit values ​​of each content feature subset.

[0190] In one possible implementation, each adjustment is implemented in the following manner: selecting a candidate content feature subset based on the prediction results of each content sample in each content feature subset and the content type label of each content sample, and performing feature change processing based on the candidate content feature subset to obtain a new initial content feature population. That is, the target model acquisition module is also used to select a candidate content feature subset based on the prediction results of each content sample in each content feature subset and the content type label of each content sample, and perform feature change processing based on the candidate content feature subset to obtain a new initial content feature population.

[0191] In this implementation, the target model acquisition module 430 further includes: a second merit value determination submodule, a probability determination submodule, and a content feature subset selection submodule.

[0192] The second merit value determination submodule is used to determine the merit value of each content feature subset based on the prediction results of each content sample in each content feature subset and the content type label of each content sample; the probability determination submodule is used to determine the probability of each content feature subset being selected as a candidate content feature subset based on the merit value of each content feature subset; the content feature subset selection submodule is used to select a first preset number of candidate content feature subsets from each content feature subset based on the probability corresponding to each content feature subset.

[0193] In one possible implementation, the target model acquisition module is further used to perform feature change processing on the candidate content feature subset using a genetic algorithm to obtain a new initial content feature population.

[0194] In one possible implementation, the content type determination module 440 includes a feature extraction submodule and a type prediction submodule. The feature extraction submodule is used to extract target data features from the content to be detected, and the target data features are the same as the target sample features of each content sample in the target content feature subset; the data prediction module is used to input the target data features of the content to be detected into the target detection model for prediction, and obtain the type prediction result of the content to be detected.

[0195] In this implementation, the content type detection device 400 further includes: an alarm event generation module. The alarm event generation module is used to obtain multiple data contents having the same transmission path as the content to be detected when the type prediction result of the content to be detected is an abnormal type, and when a second preset number of the type prediction results of the multiple data contents are abnormal types, generate and display an alarm event list, and the alarm event list includes the data content and the transmission path of the abnormal type prediction result.

[0196] The content type detection device 400 also includes a content sample acquisition module, which is used to receive the label information of the content to be detected input by the target user based on the alarm event list, use the content to be detected as a new content sample, and use the label information of the content to be detected as the content type label of the content sample.

[0197] In one possible implementation, the content samples include conversation flow samples, and the conversation flow samples include at least one of conversation flow samples shared by an open source community, conversation flow samples generated by penetration testers in attack drills, and conversation flow samples captured by security personnel in an intranet; the malicious content samples include conversation flow samples generated by a Trojan horse, and the content type label of the conversation flow sample generated by the Trojan horse is a positive sample label; the conversation flow samples also include conversation flow samples generated by a normal application, and the content type label of the conversation flow sample generated by the normal application is a negative sample label.

[0198] It should be noted that the device embodiment in the present application corresponds to the aforementioned method embodiment. The specific principles in the device embodiment can be found in the contents of the aforementioned method embodiment and will not be repeated here.

[0199] The following will be combined Fig.14 An electronic device 100 provided in the present application is described.

[0200] See also Fig.14Based on the data transfer method provided in the above embodiment, the embodiment of the present application also provides another electronic device 100 including a processor 102 that can execute the above method. The electronic device 100 can be a server 10 or a terminal device. The terminal device can be a smart phone, a tablet computer, a computer or a portable computer, etc., which can install the first client and / or the second client.

[0201] The electronic device 100 further includes a memory 104 . The memory 104 stores a program that can execute the contents of the aforementioned embodiments, and the processor 102 can execute the program stored in the memory 104 .

[0202] Among them, the processor 102 may include one or more cores for processing data and a message matrix unit. The processor 102 uses various interfaces and lines to connect various parts of the entire electronic device 100, and executes various functions and processes data of the electronic device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 104, and calling data stored in the memory 104. Optionally, the processor 102 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 102 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 102, but may be implemented separately through a communication chip.

[0203] The memory 104 may include a random access memory (RAM) or a read-only memory (ROM). The memory 104 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 104 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the following various method embodiments, etc. The data storage area may also store data obtained by the electronic device 100 during use, etc.

[0204] The electronic device 100 may also include a network module and a screen. The network module is used to receive and send electromagnetic waves, realize the mutual conversion between electromagnetic waves and electrical signals, and thus communicate with a communication network or other devices, such as communicating with an audio playback device. The network module may include various existing circuit components for performing these functions, such as antennas, radio frequency transceivers, digital signal processors, encryption / decryption chips, user identity modules (SIM) cards, memories, etc. The network module may communicate with various networks such as the Internet, corporate intranets, wireless networks, or communicate with other devices via wireless networks. The above-mentioned wireless networks may include cellular telephone networks, wireless local area networks, or metropolitan area networks. The screen may display interface content and perform data interaction.

[0205] In some embodiments, the electronic device 100 may further include: a peripheral interface 106 and at least one peripheral device. The processor 102, the memory 104 and the peripheral interface 106 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral interface via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency component 108, a positioning component 112, a camera 114, an audio component 116, a display screen 118 and a power supply 122.

[0206] The peripheral interface 106 may be used to connect at least one peripheral device related to I / O (Input / Output) to the processor 102 and the memory 104. In some embodiments, the processor 102, the memory 104, and the peripheral interface 106 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 102, the memory 104, and the peripheral interface 106 may be implemented on a separate chip or circuit board, which is not limited in the embodiments of the present application.

[0207] The radio frequency component 108 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency component 108 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency component 108 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. Optionally, the radio frequency component 108 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, and the like. The radio frequency component 108 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency component 108 may also include circuits related to NFC (Near Field Communication), which is not limited in this application.

[0208] The positioning component 112 is used to locate the current geographic location of the electronic device 100 to implement navigation or LBS (Location Based Service). The positioning component 112 can be a positioning component based on the US GPS (Global Positioning System), China's Beidou system or Russia's Galileo system.

[0209] The camera 114 is used to capture images or videos. Optionally, the camera 114 includes a front camera and a rear camera. Usually, the front camera is arranged on the front panel of the electronic device 100, and the rear camera is arranged on the back of the electronic device 100. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize the panoramic shooting and VR (Virtual Reality) shooting function or other fusion shooting functions. In some embodiments, the camera 114 may also include a flash. The flash can be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0210] The audio component 116 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 102 for processing, or input them into the RF component 108 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there can be multiple microphones, which are respectively arranged at different parts of the electronic device 100. The microphone can also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 102 or the RF component 108 into sound waves. The speaker can be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio component 114 may also include a headphone jack.

[0211] The display screen 118 is used to display the UI (User Interface). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 118 is a touch display screen, the display screen 118 also has the ability to collect touch signals on the surface or above the surface of the display screen 118. The touch signal can be input to the processor 102 as a control signal for processing. At this time, the display screen 118 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 118 can be one, and the front panel of the electronic device 100 is set; in other embodiments, the display screen 118 can be at least two, which are respectively set on different surfaces of the electronic device 100 or are folded; in some other embodiments, the display screen 118 can be a flexible display screen, which is set on the curved surface or folded surface of the electronic device 100. Even, the display screen 118 can also be set as a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 118 can be made of materials such as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode, machine light-emitting diode).

[0212] The power supply 122 is used to power various components in the electronic device 100. The power supply 122 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 122 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged through a wired line, and a wireless rechargeable battery is a battery that is charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0213] The embodiment of the present application also provides a computer-readable storage medium, in which program codes are stored, and the program codes can be called by a processor to execute the method described in the above method embodiment.

[0214] The computer-readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium includes a non-transitory computer-readable storage medium. The computer-readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code can be compressed, for example, in an appropriate form.

[0215] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the method described in the above various optional implementations.

[0216] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A content type detection method, characterized in that: The method comprises: Acquire an initial content feature population, wherein the initial content feature population is established based on target sample features of a plurality of content samples, the initial content feature population includes a plurality of content feature subsets, each content feature subset includes at least one target sample feature in each of the content samples, each of the content samples has a content type label, the content samples include session flow samples, and the content samples include malicious content samples; Inputting each content feature subset in the initial content feature population into an initial detection model to obtain a content type prediction result for each content sample in the content feature subset; Iteratively adjusting the initial content feature population based on the content type prediction results of each of the content samples and the content type labels of each of the content samples until the iterative adjustment times reach a preset number, stopping the iterative adjustment, selecting a target content feature subset from the feature population when the adjustment stops, and updating the initial detection model using the target content feature subset to obtain a target detection model; The content to be detected is detected based on the target detection model to determine the type of the content to be detected.

2. The method according to claim 1, characterized in that A target content feature subset is selected from the feature population when the adjustment stops, including: Inputting each content feature subset in the feature population when the adjustment is stopped into the input to the initial detection model, respectively, to obtain prediction results corresponding to each content feature subset, wherein the prediction results corresponding to each content feature subset include prediction results of content samples in each content feature subset; Determining the merit value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample; A target content feature subset is selected based on the quality values ​​of each of the content feature subsets.

3. The method according to claim 2, characterized in that Selecting a target content feature subset based on the merits of each of the content feature subsets includes: Based on the merits and demerits of the content feature subsets, a content feature subset with the largest merit and demerit value is selected as a target content feature subset.

4. The method according to claim 2, characterized in that: Determining the merit value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample includes: Based on the fitness function of the random forest, the prediction results of each content sample in each content feature subset and the content type label of each content sample, the quality of each content feature subset is calculated to obtain the quality value of each content feature subset.

5. The method according to claim 1, characterized in that When the initial content feature population is iteratively adjusted based on the content type prediction results of each of the content samples and the content type labels of each of the content samples, each iterative adjustment is implemented in the following manner: A candidate content feature subset is selected according to the prediction result of each content sample in each content feature subset and the content type label of each content sample, and feature change processing is performed based on the candidate content feature subset to obtain a new initial content feature population.

6. The method according to claim 5, characterized in that Selecting a candidate content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample includes: Determining the merit value of each content feature subset according to the prediction result of each content sample in each content feature subset and the content type label of each content sample; Determining the probability of each of the content feature subsets being selected as a candidate content feature subset according to the quality value of each of the content feature subsets; A first preset number of candidate content feature subsets are selected from each of the content feature subsets according to the probabilities corresponding to each of the content feature subsets.

7. The method according to claim 5, characterized in that Performing feature change processing based on the candidate content feature subset to obtain a new initial content feature population includes: A genetic algorithm is used to perform feature change processing on the candidate content feature subset to obtain a new initial content feature population.

8. The method according to claim 1, characterized in that Get the initial content feature population, including: Acquire multiple content samples, each of which has a content type label; Extracting target sample features of each of the content samples; An initial content feature population is established based on the target sample features of each of the content samples.

9. The method according to claim 8, characterized in that Extracting target sample features of each of the content samples includes: Extracting features from each of the content samples to obtain multiple sample features of each of the content samples; An information gain algorithm is used to calculate the information gain value of the sample feature of each content sample, and a plurality of target sample features of each content sample are determined according to the information gain value of the sample feature of each content sample.

10. The method according to claim 1, characterized in that Detecting the content to be detected based on the target detection model and determining the type of the content to be detected includes: Extracting target data features from the content to be detected, wherein the target data features are the same as target sample features of each content sample in the target content feature subset; The target data features of the content to be detected are input into the target detection model for prediction to obtain a prediction result of the type of the content to be detected.

11. The method according to claim 9, characterized in that If the acquired content to be detected is data content transmitted in a fragmented manner in the network, the method further includes: If the prediction result of the type of the content to be detected is an abnormal type, obtaining multiple pieces of data content having the same transmission path as the content to be detected; If a second preset number of the type prediction results of the multiple data contents are abnormal types, an alarm event sheet is generated and displayed, and the alarm event sheet includes the data content whose type prediction results are abnormal types and the transmission path.

12. The method according to claim 11, characterized in that If a preset number of the type prediction results of the plurality of data contents are abnormal types, after generating and displaying an alarm event sheet, the method further includes: The label information of the content to be detected input by the target user based on the alarm event list is received, the content to be detected is used as a new content sample, and the label information of the content to be detected is used as a content type label of the content sample.

13. The method according to claim 1, characterized in that The conversation flow samples include at least one of conversation flow samples shared by an open source community, conversation flow samples generated by penetration testers in attack drills, and conversation flow samples captured by security personnel in an intranet; the malicious content samples include conversation flow samples generated by a Trojan horse, and the content type label of the conversation flow sample generated by the Trojan horse is a positive content type label; the conversation flow samples also include conversation flow samples generated by a normal application, and the content type label of the conversation flow sample generated by a normal application is a negative content type label.

14. A content type detection device, characterized in that: The device comprises: A feature population acquisition module, used to acquire an initial content feature population, wherein the initial content feature population is established based on target sample features of a plurality of content samples, the initial content feature population includes a plurality of content feature subsets, each content feature subset includes at least one target sample feature in each of the content samples, each of the content samples has a content type label, the content samples include session flow samples, and the content samples include malicious content samples; A sample prediction module, used to input each content feature subset in the initial content feature population into an initial detection model to obtain a content type prediction result of each content sample in the content feature subset; a target model acquisition module, configured to iteratively adjust the initial content feature population based on the content type prediction results of each of the content samples and the content type labels of each of the content samples, until the iterative adjustment times reach a preset times, stop the iterative adjustment, select a target content feature subset from the feature population when the adjustment stops, and use the target content feature subset to update the initial detection model to obtain a target detection model; The content type determination module is used to detect the content to be detected based on the target detection model and determine the type of the content to be detected.

15. An electronic device, characterized in that: The method comprises a processor and a memory; one or more programs are stored in the memory and configured to be executed by the processor to implement the method according to any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, wherein when the program code is executed by a processor, the method according to any one of claims 1 to 13 is executed.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method described in any one of claims 1 to 13 are implemented.

Images