Method, device and electronic equipment for predicting a cyber security posture

Abstract

The application discloses a network security situation prediction method and device and electronic equipment. The method is applied to the field of artificial intelligence. The method comprises the following steps: obtaining traffic information and network running information of a target device in operation to obtain target information; and predicting the network security situation of the target information by using a target prediction model to obtain a prediction result corresponding to the target information. The target prediction model is obtained by dimension reduction of data in a preset data set by quantum amplitude coding, and the model is obtained by training a preset classification model by using the dimension-reduced data. By the application, the problem that the speed of the model in predicting the network security situation is slow and the response speed of the model is reduced due to the high dimension of the data in the data set when the model for predicting the network security situation is trained by using the data set in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and electronic device for predicting cybersecurity posture. Background Technology

[0002] With the development of the digital economy, the development, sharing, and interconnection of networks are becoming increasingly sophisticated, leading to an explosive growth in network traffic and a surge in malicious attacks and theft. To prevent economic losses from network attacks, enterprises need to implement security controls such as access control, intrusion detection, and identity verification. Furthermore, their operations and maintenance personnel must be proactive in identifying abnormal events and assessing the overall security posture of the network. The process of assessing network security posture generally includes: acquiring data that impacts network security posture; fusing, mining, and analyzing this data to obtain processed data; and predicting future trends in network security posture based on the processed data.

[0003] Currently, predictive algorithms are generally used to predict cybersecurity posture. However, due to the large amount of data influencing cybersecurity posture, the efficiency of these algorithms in processing the multi-dimensional features of massive amounts of data is significantly low, resulting in a high training time required. To reduce algorithm complexity, existing technologies can process the data influencing cybersecurity posture using methods such as classification, merging, and association analysis to extract relatively important data for training the prediction algorithm. However, these methods lose some information from the data influencing cybersecurity posture, affecting the accuracy of subsequent assessments and predictions of cybersecurity posture. Furthermore, with the increase in data volume and the increased coupling and complexity between data information in the era of big data, traditional data processing techniques are no longer sufficient for the data preparation work in predicting cybersecurity posture.

[0004] There is currently no effective solution to the problem that when training models for predicting cybersecurity posture using datasets in related technologies, the high dimensionality of the data in the datasets leads to slow prediction speeds and reduced model response times. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, and electronic device for predicting cybersecurity situation, in order to solve the problem in related technologies where, when training a model for predicting cybersecurity situation using a dataset, the high dimensionality of the data in the dataset leads to a slow prediction speed and reduces the model's response speed.

[0006] To achieve the above objectives, according to one aspect of this application, a method for predicting network security situation is provided. The method includes: acquiring traffic information and network operation information of a target device during operation to obtain target information; using a target prediction model to predict the network security situation of the target information to obtain a prediction result corresponding to the target information, wherein the target prediction model is a model obtained by reducing the dimensionality of data in a preset dataset through quantum amplitude encoding and training a preset classification model with the dimensionality-reduced data.

[0007] Further, the target prediction model is obtained by the following steps: preprocessing the data in the preset dataset to obtain processed data; using n qubits to perform quantum amplitude encoding on the processed data to obtain the dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; using the dimensionality-reduced data to train the preset classification model to obtain the target prediction model.

[0008] Further, using n qubits to perform quantum amplitude encoding on the processed data to obtain the dimensionality-reduced data includes: encoding the processed data into the amplitude of the n qubits to obtain the target quantum circuit; measuring the target quantum circuit to obtain the measurement results of the n qubits, and determining the dimensionality-reduced data based on the measurement results.

[0009] Furthermore, determining the dimensionality-reduced data based on the measurement results includes: performing multiple measurements on the target quantum circuit to obtain multiple measurement results for the n qubits; and determining the dimensionality-reduced data based on the number of times a first preset character appears in each measurement result.

[0010] Furthermore, before encoding the processed data into the amplitude of the n qubits to obtain the target quantum circuit, the method further includes: determining whether the dimension of the processed data is a preset dimension; if the dimension of the processed data is not the preset dimension, then filling the processed data with a second preset character; if the dimension of the processed data is the preset dimension, then using the n qubits to perform quantum amplitude encoding on the processed data.

[0011] Further, the data in the preset dataset is preprocessed to obtain processed data, including: processing abnormal data in the preset dataset to obtain first data, wherein the abnormal data includes at least the following: empty data and incomplete data; smoothing the discrete data in the first data to obtain second data; and standardizing and normalizing the second data to obtain the processed data.

[0012] Furthermore, before training the preset classification model using the dimensionality-reduced data to obtain the target prediction model, the method further includes: processing the dimensionality-reduced data using a kernel function to obtain a target dataset; and dividing the target dataset according to a preset ratio to obtain a training set and a test set.

[0013] Furthermore, training the preset classification model with the dimensionality-reduced data to obtain the target prediction model includes: training the preset classification model with the training set to obtain a first model; and optimizing the first model with the test set to obtain the target prediction model.

[0014] To achieve the above objectives, according to another aspect of this application, a network security situation prediction device is provided. The device includes: an acquisition unit, configured to acquire traffic information and network operation information of a target device during operation to obtain target information; and a prediction unit, configured to use a target prediction model to predict the network security situation of the target information to obtain a prediction result corresponding to the target information. The target prediction model is a model obtained by reducing the dimensionality of data in a preset dataset using quantum amplitude encoding and training a preset classification model with the reduced dimensionality data.

[0015] Further, the prediction unit includes: a first processing subunit, used to preprocess the data in the preset dataset to obtain processed data; a second processing subunit, used to perform quantum amplitude encoding on the processed data using n qubits to obtain the dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; and a first computation subunit, used to train the preset classification model using the dimensionality-reduced data to obtain the target prediction model.

[0016] Further, the second processing subunit includes: a first processing module, used to encode the processed data into the amplitude of the n qubits to obtain a target quantum circuit; and a calculation module, used to measure the target quantum circuit, obtain the measurement results of the n qubits, and determine the dimensionality-reduced data based on the measurement results.

[0017] Furthermore, the calculation module includes: a calculation submodule, used to perform multiple measurements on the target quantum circuit to obtain multiple measurement results for the n qubits; and a determination submodule, used to determine the dimensionality-reduced data based on the number of times a first preset character appears in each measurement result.

[0018] Furthermore, the second processing subunit further includes: a judgment module, used to determine whether the dimension of the processed data is a preset dimension before encoding the processed data into the amplitude of the n qubits to obtain the target quantum circuit; a second processing module, used to fill the processed data with a second preset character if the dimension of the processed data is not the preset dimension; and a third processing module, used to encode the processed data with quantum amplitude using the n qubits if the dimension of the processed data is the preset dimension.

[0019] Further, the first processing subunit includes: a fourth processing module, used to process abnormal data in the preset dataset to obtain first data, wherein the abnormal data includes at least the following: empty data and incomplete data; a fifth processing module, used to smooth the discrete data in the first data to obtain second data; and a sixth processing module, used to standardize and normalize the second data to obtain the processed data.

[0020] Furthermore, the prediction unit further includes: a third processing subunit, used to process the dimensionality-reduced data using a kernel function to obtain a target dataset before training the preset classification model with the dimensionality-reduced data to obtain the target prediction model; and a partitioning subunit, used to partition the target dataset according to a preset ratio to obtain a training set and a test set.

[0021] Furthermore, the prediction unit includes: a second calculation subunit, used to train the preset classification model using the training set to obtain a first model; and a fourth processing subunit, used to optimize the first model using the test set to obtain the target prediction model.

[0022] To achieve the above objectives, according to one aspect of this application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security posture prediction method described in any of the above claims.

[0023] This application employs the following steps: obtaining traffic and network operation information of the target device during operation to obtain target information; using a target prediction model to predict the network security situation of the target information to obtain the prediction result corresponding to the target information. The target prediction model is obtained by reducing the dimensionality of data in a preset dataset using quantum amplitude encoding, and then training a preset classification model with the dimensionality-reduced data. This solves the problem in related technologies where, when training a model for predicting network security situation using a dataset, the high dimensionality of the data in the dataset leads to slow prediction speed and reduced model response. By using quantum amplitude encoding to reduce the dimensionality of massive amounts of data, the dimensionality of the data used to train the model is reduced, accelerating the model training speed and the prediction speed of the trained model, thereby improving the prediction speed of network security situation and achieving a faster response to network security situations. Attached Figure Description

[0024] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 This is a flowchart of a network security posture prediction method provided in Embodiment 1 of this application;

[0026] Figure 2 This is a schematic diagram of an optional network security posture prediction method provided in Embodiment 1 of this application. Figure 1 ;

[0027] Figure 3 This is a schematic diagram of an optional network security posture prediction method provided in Embodiment 1 of this application. Figure 2 ;

[0028] Figure 4 This is a schematic diagram of a network security situation prediction device according to Embodiment 2 of this application;

[0029] Figure 5 This is a schematic diagram of a network security posture prediction electronic device provided according to Embodiment 5 of this application. Detailed Implementation

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0031] It should be noted that the user information (including but not limited to user device information, user personal information, user network information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, transmitted data, sent data, received data, processed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0032] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] Example 1

[0035] The present invention will now be described in conjunction with preferred implementation steps. Figure 1 This is a flowchart of a network security posture prediction method according to Embodiment 1 of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0036] Step S101: Obtain traffic information and network operation information of the target device during operation to obtain target information.

[0037] In this first embodiment, in order to predict the network security status of the target device, it is necessary to obtain the traffic information and network operation information of the target device in real time to obtain target information that characterizes the network operation status of the target device.

[0038] Specifically, the target information can include basic TCP connection characteristics, content characteristics, time-based network traffic statistics, and device-based network traffic statistics of the target device's network connection. Basic TCP connection characteristics can include fundamental network connection attributes such as duration, protocol type, and number of bytes transmitted. Content characteristics can include the number of times sensitive system files and directories on the target device were accessed, the number of failed login attempts, the number of file creation operations, and the number of shell commands used. Time-based network traffic statistics provide information related to the current connection over the past two seconds, such as the number of connections with the same device and the number of connections providing the same service. Device-based network traffic statistics can provide statistical information on connections with the same device as the current connection out of 100 connection records, such as the number of connections with the same device, the number of connections with both the same device and the same service, and the percentage of connections with both the same device and the same service.

[0039] Step S102: The network security situation of the target information is predicted by the target prediction model to obtain the prediction result corresponding to the target information. The target prediction model is obtained by reducing the dimensionality of the data in the preset dataset through quantum amplitude encoding and training the preset classification model with the dimensionality-reduced data.

[0040] In this first embodiment, in order to predict the network security status of the target device, it is necessary to reduce the dimensionality of massive data through quantum amplitude encoding, and use the dimensionality-reduced data to train a preset classification model to obtain a target prediction model for predicting the network security status.

[0041] Specifically, network security posture refers to the future security development trends of a network. Network security posture awareness, on the other hand, refers to the acquisition, understanding, and display of security elements that can cause changes in the network security posture in a large-scale network environment, and based on this, predicting the future security development trends of the network. For example... Figure 2As shown, network security situation awareness can be divided into three parts: situation element awareness, situation understanding, and situation prediction. First, situation element awareness refers to collecting and extracting operational data from the current network or system through various means, such as website security logs, vulnerability databases, and malware databases. Second, situation understanding involves extracting data from the data collected in the previous step and performing relevant preprocessing to correlate information related to the network security situation and assign quantitative or qualitative labels, preparing data for the next step of situation prediction. Finally, situation prediction refers to using predictive algorithms (such as Bayesian networks, support vector machines, and deep learning algorithms) to analyze the current and historical network security situation, predicting potential threats to target devices, thereby helping personnel or operating systems achieve proactive defense.

[0042] In summary, the network security situation prediction method provided in Embodiment 1 of this application obtains target information by acquiring traffic and network operation information of the target device during operation; it then uses a target prediction model to predict the network security situation of the target information, obtaining the prediction result corresponding to the target information. The target prediction model is obtained by reducing the dimensionality of data in a preset dataset using quantum amplitude encoding, and training a preset classification model with the dimensionality-reduced data. This solves the problem in related technologies where training models for predicting network security situations using datasets results in slow prediction speeds due to the high dimensionality of the data, thus reducing the model's response speed. By reducing the dimensionality of massive datasets using quantum amplitude encoding, the dimensionality of the data used to train the model is reduced, accelerating model training and prediction speed, thereby improving the prediction speed of the network security situation and achieving a faster response to network security situations.

[0043] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, the above-mentioned target prediction model is obtained by the following steps: preprocessing the data in the preset dataset to obtain processed data; using n qubits to perform quantum amplitude encoding on the processed data to obtain dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; using the dimensionality-reduced data to train the preset classification model to obtain the target prediction model.

[0044] In this first embodiment, in order to speed up the training of the model, the data used to train the model can be preprocessed to obtain processed data. The processed data is then quantum amplitude encoded using n qubits to reduce the dimensionality of the processed data, resulting in dimensionality-reduced data. The dimensionality-reduced data is then used to train a preset classification model to obtain a target prediction model.

[0045] Specifically, the data used to train the model can be data from a pre-set dataset (e.g., the KDD CUP99 dataset), or it can be the historical network operation data of the target device. Quantum amplitude encoding can encode n-dimensional data using only log2(n) qubits to achieve dimensionality reduction. For example, to perform amplitude encoding on a 4-dimensional floating-point data x = (1.0, 0.0, -5.5, -0.0), the data x is first standardized and normalized to obtain... Then use 2 qubits to pair x norm Amplitude encoding is performed to obtain x norm The corresponding quantum amplitude is The preset classification model can be a model or algorithm used for binary classification, such as support vector machine, decision tree algorithm, etc.

[0046] By using n qubits to encode the processed data with quantum amplitude, high-dimensional data can be converted into low-dimensional data. The reduced-dimensional data can then be used to train a pre-defined classification model, which significantly reduces the complexity of data computation during model training, lowers the training time, and improves the prediction speed of the trained model.

[0047] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, using n qubits to encode the processed data into quantum amplitude to obtain the dimensionality-reduced data includes: encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit; measuring the target quantum circuit to obtain the measurement results of n qubits, and determining the dimensionality-reduced data based on the measurement results.

[0048] Specifically, quantum amplitude encoding refers to encoding n-dimensional data into the amplitude of a quantum state, which can compress normalized and standardized n-dimensional data (i.e., the processed data) to a dimension of log2(n). The normalized and standardized n-dimensional data x can be represented by the quantum state amplitude |ψ| of one log2(n) qubits. x >Indicates:

[0049]

[0050] Among them, X iLet |i> be the i-th element of x, and |i> be the i-th computational ground state. After determining the quantum state amplitude corresponding to the n-dimensional data, the target quantum circuit corresponding to the n qubits can be determined based on the quantum state amplitude. After obtaining the target quantum circuit, the target quantum circuit can be measured to obtain the measurement results of the n qubits, and the dimensionality-reduced data corresponding to the n-dimensional data can be determined based on the measurement results.

[0051] By using n qubits to encode the processed data with quantum amplitude, the data can be transformed into a full vector space based on quantum states. This fully utilizes the characteristics of the original data and mines the potential correlations between data, thereby enabling the trained model to better predict and assess the cybersecurity situation and improving the prediction accuracy of the trained prediction model.

[0052] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, determining the dimensionality-reduced data based on the measurement results includes: performing multiple measurements on the target quantum circuit to obtain multiple measurement results for n qubits; and determining the dimensionality-reduced data based on the number of times the first preset character appears in each measurement result.

[0053] In this first embodiment, in order to reduce the dimensionality of the processed data using n qubits, the processed data can be encoded into the amplitude of n qubits to obtain the target quantum circuit. Then, the target quantum circuit is measured multiple times to obtain the probability of the measurement results of the n qubits (i.e., the probability that each qubit is 1 or 0), and the dimensionality-reduced data is obtained based on the probability of the measurement results.

[0054] Specifically, after encoding n-dimensional data into the target quantum circuit, the target quantum circuit now has a total of log(2n) qubits. Since qubits possess principles such as superposition and entanglement, multiple measurements of a qubit will yield 0 or 1 with different probabilities. Therefore, a preset number of measurements (e.g., 100, 1000, etc.) can be performed on the log(2n) qubits to calculate the probability of each qubit yielding a result of 1, and this probability can be used as the dimensionality-reduced data corresponding to the n-dimensional data.

[0055] By performing multiple measurements on the target quantum circuit, the measurement results of the qubits can be transformed from discrete data (i.e., 0 or 1 states) into continuous data (i.e., probabilities). This is beneficial for training a pre-defined classification model based on continuous data, reducing the complexity of n-dimensional data and improving the training efficiency of the prediction model.

[0056] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, before encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit, the method further includes: determining whether the dimension of the processed data is a preset dimension; if the dimension of the processed data is not a preset dimension, then filling the processed data with a second preset character; if the dimension of the processed data is a preset dimension, then using n qubits to perform quantum amplitude encoding on the processed data.

[0057] In this first embodiment, to encode the processed data into the amplitude of n qubits, before quantum amplitude encoding, it can be checked whether the processed data meets the encoding requirements, i.e., whether the dimension of the processed data is a preset dimension. The preset dimension refers to the dimension of a power of 2, such as 2, 4, 8, 16, etc. If the dimension of the processed data is not the preset dimension, a second preset character (e.g., 0) can be used to fill the processed data until the dimension of the processed data equals the preset dimension; if the dimension of the processed data meets the preset dimension, quantum amplitude encoding can continue.

[0058] By filling in data whose dimensions are not the preset dimensions in the processed data, it is ensured that the processed data can be successfully encoded using quantum amplitude, which is beneficial for dimensionality reduction of the processed data and improves the computational efficiency of the data.

[0059] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, the data in the preset dataset is preprocessed to obtain the processed data, including: processing the abnormal data in the preset dataset to obtain the first data, wherein the abnormal data includes at least the following data: empty data and incomplete data; smoothing the discrete data in the first data to obtain the second data; and standardizing and normalizing the second data to obtain the processed data.

[0060] Specifically, when processing abnormal data in the preset dataset, empty data and data with many missing values ​​(e.g., data where 4 dimensions of a 5-dimensional dataset are empty) can be deleted. For data with fewer missing values ​​(e.g., data where 1 dimension of a 5-dimensional dataset is empty), a third preset character (e.g., 0, 1, etc.) can be used to fill the missing data to obtain the first data. When smoothing the discrete data in the first data, the discrete data can be transformed into continuous data (i.e., the second data) based on the probability of each label of the variable. For example, for data X representing the protocol type, if the protocol type of data X is category 1 (i.e., discrete data) and the probability of X being category 1 is 0.5, then 0.5 (i.e., continuous data) can be used to replace category 1 to obtain new data. When standardizing and normalizing the second data, Min-Max normalization can be used to scale the range of values ​​of the second data to the interval [0, 1], and then z-score standardization can be used to convert the mean of the second data to 0 and the variance of the second data to 1.

[0061] By preprocessing the data in the preset dataset, we obtain processed data, which is beneficial for quantum amplitude encoding. This reduces the dimensionality of the data in the preset dataset, thereby reducing the complexity of the data and improving the training speed of the model.

[0062] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, before training the preset classification model with the dimensionality-reduced data to obtain the target prediction model, the above method further includes: processing the dimensionality-reduced data with a kernel function to obtain the target dataset; and dividing the target dataset according to a preset ratio to obtain the training set and the test set.

[0063] In this first embodiment, if the support vector machine is used as the preset classification model and trained, in order to solve the nonlinear problem in the training process of the support vector machine (i.e., the relationship between the data and the predicted values ​​of the data is not linear, but rather a curve or parabola, which leads to inaccurate prediction results of the model) and to facilitate calculation, a kernel function can be used to process the dimensionality-reduced data to obtain the target dataset. The target dataset is then divided into a training set and a test set to train and optimize the support vector machine. Specifically, the kernel function can be a Gaussian kernel function, as shown in formula (1):

[0064]

[0065] Where, x i Let x represent the i-th data. jLet represent the j-th data point, and σ be a preset parameter in the Gaussian kernel function. When dividing the training and test sets, the dimensionality-reduced data can be partitioned according to a preset ratio (e.g., 8:2). Processing the dimensionality-reduced data using a kernel function addresses the nonlinearity issues in the support vector machine training process to some extent, improving the accuracy of the trained model.

[0066] It's important to note that if other classification models are used as the default, the dimensionality-reduced data can be adjusted accordingly to obtain the target dataset. This target dataset can then be divided into training and testing sets according to a predefined ratio. Specifically, adjusting the dimensions of the dimensionality-reduced data yields the target dataset, which can then be used to train other classification models.

[0067] Optionally, in the network security situation prediction method provided in Embodiment 1 of this application, training a preset classification model with dimensionality-reduced data to obtain a target prediction model includes: training the preset classification model with a training set to obtain a first model; and optimizing the first model with a test set to obtain a target prediction model.

[0068] In this first embodiment, if the support vector machine is used as the preset classification model, the support vector machine can be trained using a training set to obtain the first model. Alternatively, the support vector machine with Lagrange multipliers can be trained using a training set to obtain the first model. The support vector machine with Lagrange multipliers is shown in formula (2).

[0069]

[0070] Among them, a i ≥0 and μ i ≥0 is a Lagrange multiplier; ξ i ≥0 represents slack variables; C>0 represents preset parameters; w and b are parameters representing the hyperplane; x represents the data after dimensionality reduction, and y represents the data label.

[0071] Specifically, the support vector machine can be trained using data from the training set, and the optimal σ value (i.e., the σ value in formula (1) above) and C value (i.e., the C value in formula (2) above) can be determined using grid search in the training set. The model corresponding to the optimal C value and the optimal σ value is taken as the first model. After obtaining the first model, the first model can be optimized using data from the test set, with the F1 value of the first model on the test set as the target. The C value and σ value corresponding to the maximum F1 value are obtained, and the model corresponding to the maximum F1 value is determined as the target prediction model. Then, the target prediction model can be used to predict and discriminate the newly generated network operation data of the target device, and predict network security risks for relevant personnel. In addition, the network operation data of the target device can be collected periodically and added to the training set of the target prediction model to iteratively optimize the target prediction model.

[0072] Furthermore, if other classification models are used as the preset classification models, the training set is used to train the other classification models to obtain the first model, and then the test set is used to optimize the first model to obtain the target prediction model.

[0073] By training and optimizing a pre-defined classification model using training and testing sets, a target prediction model for predicting the cybersecurity posture of a target device can be obtained, improving both the prediction speed and accuracy of the prediction.

[0074] Optionally, in this first embodiment, the process of dimensionality reduction of the data in the preset dataset can be as follows: Figure 3 As shown, firstly, the data in the preset dataset is preprocessed to obtain the processed data, and it is determined whether the dimension of the processed data is the preset dimension. If the dimension of the processed data is not the preset dimension, it is padded with the character "0". Then, the processed data is encoded into n qubits to obtain the target quantum circuit. Secondly, the quantum states of the n qubits in the target quantum circuit are measured multiple times. Finally, the probabilities of the measurement results of the n qubits are used as the dimensionality-reduced data.

[0075] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0076] Example 2

[0077] Embodiment 2 of this application also provides a network security situation prediction device. It should be noted that the network security situation prediction device of Embodiment 2 of this application can be used to execute the network security situation prediction method provided in Embodiment 1 of this application. The network security situation prediction device provided in Embodiment 2 of this application will be described below.

[0078] Figure 4 This is a schematic diagram of a network security posture prediction device according to Embodiment 2 of this application. Figure 4 As shown, the device includes an acquisition unit 401 and a prediction unit 402.

[0079] Specifically, the acquisition unit 401 is used to acquire traffic information and network operation information of the target device during operation, and obtain target information.

[0080] The prediction unit 402 is used to predict the network security situation of the target information using the target prediction model and obtain the prediction result corresponding to the target information. The target prediction model is a model obtained by reducing the dimensionality of the data in the preset dataset through quantum amplitude encoding and training the preset classification model with the dimensionality-reduced data.

[0081] The network security situation prediction device provided in Embodiment 2 of this application obtains target information by acquiring traffic information and network operation information of the target device during operation through the acquisition unit 401; the prediction unit 402 uses a target prediction model to predict the network security situation of the target information and obtains the prediction result corresponding to the target information. The target prediction model is obtained by reducing the dimensionality of data in a preset dataset using quantum amplitude encoding, and then training a preset classification model with the dimensionality-reduced data. This solves the problem in related technologies where, when training a model for predicting network security situation using a dataset, the high dimensionality of the data in the dataset leads to a slow prediction speed and reduced model response speed. By reducing the dimensionality of massive data through quantum amplitude encoding, the dimensionality of the data information used to train the model is reduced, accelerating the model training speed and the prediction speed of the trained model, thereby improving the prediction speed of network security situation and achieving a faster response to network security situations.

[0082] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the prediction unit 402 includes: a first processing subunit, used to preprocess the data in the preset dataset to obtain processed data; a second processing subunit, used to use n qubits to perform quantum amplitude encoding on the processed data to obtain dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; and a first calculation subunit, used to train a preset classification model using the dimensionality-reduced data to obtain a target prediction model.

[0083] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the second processing subunit includes: a first processing module, used to encode the processed data into the amplitude of n qubits to obtain the target quantum circuit; and a calculation module, used to measure the target quantum circuit, obtain the measurement results of n qubits, and determine the dimensionality-reduced data based on the measurement results.

[0084] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the above-mentioned calculation module includes: a calculation submodule, used to perform multiple measurements on the target quantum circuit to obtain multiple measurement results of n qubits; and a determination submodule, used to determine the dimensionality-reduced data based on the number of times a first preset character appears in each measurement result.

[0085] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the second processing subunit further includes: a judgment module, used to determine whether the dimension of the processed data is a preset dimension before encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit; a second processing module, used to fill the processed data with a second preset character if the dimension of the processed data is not a preset dimension; and a third processing module, used to encode the processed data with quantum amplitude using n qubits if the dimension of the processed data is a preset dimension.

[0086] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the first processing subunit includes: a fourth processing module, used to process abnormal data in a preset dataset to obtain first data, wherein the abnormal data includes at least the following data: empty data and incomplete data; a fifth processing module, used to smooth the discrete data in the first data to obtain second data; and a sixth processing module, used to standardize and normalize the second data to obtain processed data.

[0087] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the prediction unit 402 further includes: a third processing subunit, used to process the dimensionality-reduced data using a kernel function to obtain a target dataset before training a preset classification model with the dimensionality-reduced data to obtain a target prediction model; and a partitioning subunit, used to partition the target dataset according to a preset ratio to obtain a training set and a test set.

[0088] Optionally, in the network security situation prediction device provided in Embodiment 2 of this application, the prediction unit 402 includes: a second calculation subunit, used to train a preset classification model using a training set to obtain a first model; and a fourth processing subunit, used to optimize the first model using a test set to obtain a target prediction model.

[0089] The network security situation prediction device includes a processor and a memory. The acquisition unit 401 and prediction unit 402 mentioned above are stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0090] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can improve the accuracy of network security posture predictions.

[0091] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0092] Embodiment 3 of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements a method for predicting network security posture.

[0093] Embodiment 4 of the present invention provides a processor for running a program, wherein the program executes a method for predicting network security situation during runtime.

[0094] like Figure 5 As shown, Embodiment 5 of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: acquiring traffic information and network operation information of the target device during operation to obtain target information; using a target prediction model to predict the network security status of the target information to obtain the prediction result corresponding to the target information. The target prediction model is a model obtained by reducing the dimensionality of data in a preset dataset through quantum amplitude encoding and training a preset classification model with the dimensionality-reduced data.

[0095] When the processor executes the program, it also performs the following steps: The target prediction model mentioned above is obtained by the following steps: preprocessing the data in the preset dataset to obtain processed data; using n qubits to perform quantum amplitude encoding on the processed data to obtain dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; using the dimensionality-reduced data to train the preset classification model to obtain the target prediction model.

[0096] When the processor executes the program, it also performs the following steps: using n qubits to encode the processed data into quantum amplitude to obtain the dimensionality-reduced data, including: encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit; measuring the target quantum circuit to obtain the measurement results of n qubits, and determining the dimensionality-reduced data based on the measurement results.

[0097] When the processor executes the program, it also performs the following steps: determining the dimension-reduced data based on the measurement results includes: performing multiple measurements on the target quantum circuit to obtain multiple measurement results for n qubits; and determining the dimension-reduced data based on the number of times the first preset character appears in each measurement result.

[0098] When the processor executes the program, it also performs the following steps: Before encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit, the above method further includes: determining whether the dimension of the processed data is a preset dimension; if the dimension of the processed data is not a preset dimension, then filling the processed data with a second preset character; if the dimension of the processed data is a preset dimension, then using n qubits to perform quantum amplitude encoding on the processed data.

[0099] When the processor executes the program, it also performs the following steps: preprocessing the data in the preset dataset to obtain processed data, including: processing the abnormal data in the preset dataset to obtain first data, wherein the abnormal data includes at least the following: empty data and incomplete data; smoothing the discrete data in the first data to obtain second data; and standardizing and normalizing the second data to obtain processed data.

[0100] When the processor executes the program, it also performs the following steps: Before training the preset classification model with the dimensionality-reduced data to obtain the target prediction model, the above method also includes: using a kernel function to process the dimensionality-reduced data to obtain the target dataset; dividing the target dataset according to a preset ratio to obtain the training set and the test set.

[0101] When the processor executes the program, it also performs the following steps: training a preset classification model with the dimensionality-reduced data to obtain a target prediction model, including: training the preset classification model with the training set to obtain a first model; and optimizing the first model with the test set to obtain a target prediction model.

[0102] The devices mentioned in this article can be servers, PCs, tablets, mobile phones, etc.

[0103] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: obtaining traffic information and network operation information of the target device during operation to obtain target information; using a target prediction model to predict the network security status of the target information to obtain the prediction result corresponding to the target information, wherein the target prediction model is a model obtained by reducing the dimensionality of data in a preset dataset through quantum amplitude encoding and using the dimensionality-reduced data to train a preset classification model.

[0104] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: the above target prediction model is obtained by the following steps: preprocessing the data in the preset dataset to obtain processed data; using n qubits to perform quantum amplitude encoding on the processed data to obtain dimensionality-reduced data, wherein the dimension of the dimensionality-reduced data is lower than the dimension of the processed data, and n is a positive integer; using the dimensionality-reduced data to train the preset classification model to obtain the target prediction model.

[0105] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: using n qubits to encode the processed data into quantum amplitude to obtain the dimensionality-reduced data, including: encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit; measuring the target quantum circuit to obtain the measurement results of n qubits, and determining the dimensionality-reduced data based on the measurement results.

[0106] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: determining the dimension-reduced data based on measurement results, including: performing multiple measurements on the target quantum circuit to obtain multiple measurement results for n qubits; and determining the dimension-reduced data based on the number of times the first preset character appears in each measurement result.

[0107] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: before encoding the processed data into the amplitude of n qubits to obtain the target quantum circuit, the above method further includes: determining whether the dimension of the processed data is a preset dimension; if the dimension of the processed data is not a preset dimension, then filling the processed data with a second preset character; if the dimension of the processed data is a preset dimension, then using n qubits to encode the processed data using quantum amplitude.

[0108] When executed on a data processing device, it is also suitable to execute an initialization program with the following method steps: preprocessing the data in a preset dataset to obtain processed data, including: processing abnormal data in the preset dataset to obtain first data, wherein the abnormal data includes at least the following: empty data and incomplete data; smoothing the discrete data in the first data to obtain second data; and standardizing and normalizing the second data to obtain processed data.

[0109] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: before training a preset classification model with the dimensionality-reduced data to obtain the target prediction model, the above method further includes: processing the dimensionality-reduced data with a kernel function to obtain the target dataset; dividing the target dataset according to a preset ratio to obtain a training set and a test set.

[0110] When executed on a data processing device, it is also suitable to execute an initialization program with the following steps: training a preset classification model with dimensionality-reduced data to obtain a target prediction model, including: training the preset classification model with a training set to obtain a first model; and optimizing the first model with a test set to obtain a target prediction model.

[0111] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0116] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0117] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0118] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0119] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0120] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method of predicting a cyber security posture, the method comprising: The method comprises: obtaining traffic information and network running information of a target device at runtime to obtain target information; predicting a network security posture of the target information by using a target prediction model to obtain a prediction result corresponding to the target information, wherein the target prediction model is obtained by dimension reduction of data in a preset data set by quantum amplitude encoding, and the preset classification model is trained by using the dimension-reduced data to obtain the model; the target prediction model is obtained by the following steps: preprocessing data in the preset data set to obtain processed data; using n qubits to perform quantum amplitude encoding on the processed data to obtain the dimension-reduced data, wherein the dimension of the dimension-reduced data is lower than that of the processed data, and n is a positive integer; training the preset classification model by using the dimension-reduced data to obtain the target prediction model; using n qubits to perform quantum amplitude encoding on the processed data to obtain the dimension-reduced data comprises: encoding the processed data into the amplitudes of the n qubits to obtain a target quantum circuit; performing multiple measurements on the target quantum circuit to obtain multiple measurement results of the n qubits; based on the number of times of the multiple measurement results of the n qubits being a preset character, obtaining the probability of the measurement result of the n qubits; obtaining the dimension-reduced data according to the probability of the measurement result; wherein the method further comprises processing the dimension-reduced data by a kernel function.

2. The method of claim 1, wherein, Before the processed data is encoded into the amplitudes of the n qubits to obtain the target quantum circuit, the method further comprises: determining whether the dimension of the processed data is a preset dimension; if the dimension of the processed data is not the preset dimension, filling the processed data with a second preset character; if the dimension of the processed data is the preset dimension, using the n qubits to perform quantum amplitude encoding on the processed data.

3. The method of claim 1, wherein, The preprocessing of the data in the preset data set to obtain the processed data comprises: processing abnormal data in the preset data set to obtain first data, wherein the abnormal data at least includes the following data: empty data, incomplete data; performing smoothing processing on discrete data in the first data to obtain second data; performing standardization and normalization processing on the second data to obtain the processed data.

4. The method of claim 1, wherein, Before the dimension-reduced data is used to train the preset classification model to obtain the target prediction model, the method further comprises: processing the dimension-reduced data by a kernel function to obtain a target data set; dividing the target data set according to a preset proportion to obtain a training set and a test set.

5. The method of claim 4, wherein, Training the preset classification model by using the dimension-reduced data to obtain the target prediction model comprises: training the preset classification model by using the training set to obtain a first model; optimizing the first model by using the test set to obtain the target prediction model.

6. A network security posture prediction apparatus characterized by comprising: The method comprises: An acquisition unit is configured to acquire traffic information and network running information of a target device to obtain target information. A prediction unit is configured to predict a network security posture of the target information by using a target prediction model to obtain a prediction result corresponding to the target information, wherein the target prediction model is obtained by dimension reduction of data in a preset data set by quantum amplitude encoding and training of a preset classification model by using the dimension-reduced data. The prediction unit includes a first processing subunit configured to preprocess data in the preset data set to obtain processed data, a second processing subunit configured to perform quantum amplitude encoding on the processed data by using n qubits to obtain dimension-reduced data, wherein the dimension of the dimension-reduced data is lower than that of the processed data, and n is a positive integer, and a first calculation subunit configured to train the preset classification model by using the dimension-reduced data to obtain the target prediction model. The second processing subunit is further configured to encode the processed data into amplitudes of the n qubits to obtain a target quantum circuit, and to perform multiple measurements on the target quantum circuit to obtain multiple measurement results of the n qubits. A probability of the measurement result of the n qubits is obtained based on the number of times of a preset character in the multiple measurement results of the n qubits. The dimension-reduced data is obtained according to the probability of the measurement result. The device includes processing of the dimension-reduced data by a kernel function.

7. An electronic device, comprising: The device includes one or more processors and a memory configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network security posture prediction method in any one of claims 1 to 5.

Images