A method for detecting performance of a cyber attack detection model and a related device

Abstract

The embodiment of the application belongs to the technical field of financial technology, is applied to the field of security access detection, guarantees information security, and relates to a method for detecting the performance of a network attack detection model and related equipment thereof, comprising the following steps: constructing an initial classification decision model based on an XGBoost algorithm; inputting a training sample set into the initial classification decision model based on the XGBoost algorithm, performing model optimization and training by using an improved whale swarm algorithm, and obtaining a trained network attack detection model; testing according to a test sample set and analyzing the detection performance of the improved network attack detection model. The initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized are dynamically updated, the initial classification decision model is sufficiently optimized, a network attack detection model with good performance and high processing efficiency is obtained, and the security of business data, transaction data and payment data is guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial technology, and is applied to the field of secure access detection, guarantees information security, and particularly relates to a method for detecting the performance of a network attack detection model and a related device thereof. BACKGROUND

[0002] With the increasing use of the Internet by people, the number of malicious behaviors and attack behaviors in the network is also increasing. Illegal network intrusion not only causes high economic losses, but also can cause serious impact on the information security of enterprises and individuals. In the early days, people used access control, firewall, traffic control and other means to protect information security. With the diversification of attack means and the change of the current network environment, the implementation effect is not ideal in the complex network environment.

[0003] With the development of artificial intelligence technology, many researchers have applied machine learning technology to intrusion detection, combined machine learning technology with intrusion detection technology, and made deeper progress in intrusion detection research. However, most machine learning parameters currently use grid search method to determine, or directly assign parameters. In network data processing, due to the large difference between various data flows in real network data, most training models have poor generalization ability in processing unbalanced data, and cannot efficiently detect illegal intrusion in complex network environment. Therefore, the existing technology still has the problem of being unable to efficiently detect illegal intrusion in complex network environment when detecting network attacks. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a method for detecting the performance of a network attack detection model and a related device thereof, to solve the problem that the existing technology cannot efficiently detect illegal intrusion in complex network environment when detecting network attacks.

[0005] To solve the above technical problems, the embodiments of the present application provide a method for detecting the performance of a network attack detection model, which adopts the following technical solutions:

[0006] A method for detecting the performance of a network attack detection model, comprising the following steps:

[0007] Obtain batch network access data to be accessed to a target system, and perform data preprocessing on the batch network access data to obtain a data preprocessing result;

[0008] The data preprocessing result is dimensionally reduced by using a PCA analysis method to obtain a dimensionally reduced result, and a target feature is screened according to the dimensionally reduced result, wherein the target feature refers to a target classification type of each network access data, and the target classification type includes a normal access type and an abnormal access type;

[0009] The target feature is taken as a decision target of an XGBoost algorithm to construct an initial classification decision model based on the XGBoost algorithm;

[0010] The batch network access data is divided into a training sample set and a test sample set according to a preset proportion;

[0011] The training sample set is input into the initial classification decision model based on the XGBoost algorithm, and an improved whale swarm algorithm is used for model optimization and training to obtain a trained network attack detection model;

[0012] The test sample set is input into the trained network attack detection model, and normal access type detection data and abnormal access type detection data in the test sample set are output;

[0013] The detection performance of the improved network attack detection model is analyzed according to the normal access type detection data and the abnormal access type detection data in the test sample set and the dimensionally reduced result.

[0014] Further, the step of obtaining batch network access data to be accessed to a target system and performing data preprocessing on the batch network access data to obtain a data preprocessing result specifically includes:

[0015] Batch network access data to be accessed to a target system is obtained through data acquisition or data reception;

[0016] The batch network access data is numerically and normalized according to a preset data statistical index to obtain the data preprocessing result.

[0017] Further, the step of dimensionally reducing the data preprocessing result by using a PCA analysis method to obtain a dimensionally reduced result and screening a target feature according to the dimensionally reduced result specifically includes:

[0018] The data preprocessing result is displayed as an N*M matrix array, wherein N is the number of rows, representing the batch value of the batch network access data, and M is the number of columns, representing the number of index of the preset data statistical index;

[0019] Decenter the N*M matrix array to obtain a new matrix X, where the decentering is implemented by subtracting the mean value of each column from each column value in the N*M matrix array, and the new matrix X is still an N*M matrix array;

[0020] Calculate the covariance matrix C of the new matrix X after decentering, where the covariance matrix C is an M*M matrix array;

[0021] According to the preset data statistical index, perform eigenvalue decomposition on the covariance matrix C to obtain the eigenvalue and eigenvector of the covariance matrix;

[0022] Sort the eigenvectors in descending order from left to right according to the corresponding eigenvalues to obtain a projection matrix of K dimensions, where K dimensions are the target dimensions of the dimension reduction processing;

[0023] According to the target feature, divide and arrange each matrix point in the projection matrix, and according to the division and arrangement result, determine the normal access type and non-normal access type of the network access data in the batch network access data.

[0024] Further, the step of constructing an initial classification decision model based on the XGBoost algorithm with the target feature as the decision target of the XGBoost algorithm, specifically includes:

[0025] The preset data statistical index is a leaf node of the target classification decision tree constructed by the XGBoost algorithm;

[0026] The target feature is a next-level classification node of the root node of the target classification decision tree constructed by the XGBoost algorithm;

[0027] According to the number of leaf nodes of the classification decision tree corresponding to the XGBoost algorithm and the number of next-level classification nodes of the root node, the maximum decision depth of the classification decision tree corresponding to the XGBoost algorithm is calculated;

[0028] Set the hyperparameters of the initial classification decision model based on the XGBoost algorithm, where the hyperparameters include the maximum decision depth, learning rate, minimum partition loss threshold, and model complexity control parameter;

[0029] Obtain a pre-set experience loss function and a target training function;

[0030] configure the preset data statistical indicators, the target features, the maximum decision depth, the learning rate, the minimum partition loss threshold, the model complexity control parameter, the experience loss function and the target training function to the initialized classification decision model based on the XGBoost algorithm, and complete the construction of the initialized classification decision model.

[0031] Further, before the step of inputting the training sample set into the initialized classification decision model based on the XGBoost algorithm and using the improved whale swarm algorithm to optimize and train the model to obtain the trained network attack detection model, the method further comprises:

[0032] randomly constructing a plurality of classification decision trees with the preset data statistical indicators as leaf nodes and the target features as root nodes and next level nodes;

[0033] obtaining the population number and the maximum iteration number of the improved whale swarm algorithm, wherein the population number of the improved whale swarm algorithm is less than or equal to the number of the plurality of classification decision trees;

[0034] The step of inputting the training sample set into the initialized classification decision model based on the XGBoost algorithm and using the improved whale swarm algorithm to optimize and train the model to obtain the trained network attack detection model specifically comprises:

[0035] Step A, obtaining the hyperparameters of the XGBoost algorithm to be optimized, and setting the value range respectively, wherein the hyperparameters of the XGBoost algorithm to be optimized include the maximum decision depth, the learning rate and the minimum partition loss threshold;

[0036] Step B, initializing the whale swarm optimization algorithm, and setting the population number and the maximum iteration number of the improved whale swarm algorithm as the initial parameters of the whale swarm optimization algorithm;

[0037] Step C, inputting the obtained training sample set into the plurality of classification decision trees for decision training respectively;

[0038] Step D, obtaining the decision training result corresponding to each classification decision tree in the plurality of classification decision trees;

[0039] Step E, according to the number of the decision training result corresponding to each classification decision tree and the number of elements in the training sample set, calculating the decision degree value corresponding to each classification decision tree in the plurality of classification decision trees using the probability value method;

[0040] Step F, screening out all the classification decision trees corresponding to the decision degree value greater than the preset threshold, and calculating the convergence factor according to the preset convergence algorithm;

[0041] Step G: Based on the number of all classification decision trees corresponding to the selected decision degree values ​​being greater than a preset threshold, update the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized.

[0042] Step H: Repeat steps C to G until the preset execution termination condition is met, then stop repeating the execution.

[0043] Step 1: Select the classification decision tree corresponding to the decision degree value that is greater than the preset threshold and the decision degree value is the maximum value from all the execution output results as the optimal selection individual;

[0044] Step J: Select the classification decision tree corresponding to the optimal selected individual, thus obtaining the trained network attack detection model.

[0045] Furthermore, the step of calculating the convergence factor according to the preset convergence algorithm specifically includes:

[0046] According to the preset convergence algorithm: Calculate the convergence factor, where a represents the value of the convergence factor, t represents the current iteration number, and T... max This represents the maximum number of iterations, 1 ≤ t ≤ T. max ,t and T max All are positive integers;

[0047] The step of updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized specifically includes:

[0048] The number of all classification decision trees corresponding to the selected decision degree values ​​being greater than a preset threshold after each iteration is counted and reset as the population size of the improved whale swarm algorithm;

[0049] After each iteration, the maximum number of remaining iterations is reset. The reset maximum number of remaining iterations is 1 less than the maximum number of remaining iterations set in the previous iteration.

[0050] Based on the value ranges corresponding to the maximum decision depth, learning rate, and minimum partitioning loss threshold, the maximum decision depth, learning rate, and minimum partitioning loss threshold are randomly and dynamically adjusted after each iteration.

[0051] The preset execution termination conditions include a remaining maximum number of iterations of 0, and the number of all classification decision trees corresponding to a decision degree value greater than a preset threshold after the current iteration being 0 or 1. The step of stopping repeated execution until the preset execution termination conditions are met specifically includes:

[0052] Determine whether the maximum remaining number of iterations is 0;

[0053] The number of all classification decision trees corresponding to the selected decision degree value being greater than the preset threshold after the current iteration is determined to be 0 or 1;

[0054] If the maximum remaining iteration count is 0, or the number of all classification decision trees corresponding to the selected decision degree value after the current iteration being greater than the preset threshold is 0 or 1, then the preset execution termination condition is met.

[0055] Furthermore, the step of inputting the test sample set into the trained network attack detection model and outputting normal access type detection data and abnormal access type detection data from the test sample set specifically includes:

[0056] The test sample set is obtained and input into the trained network attack detection model;

[0057] Based on the trained network attack detection model, normal access type detection data and abnormal access type detection data are selected from the test sample set;

[0058] The step of analyzing the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results specifically includes:

[0059] Identify normal access type detection data and abnormal access type detection data in the test sample set;

[0060] Based on the dimensionality reduction result, the target features corresponding to the normal access type detection data and abnormal access type detection data in the test sample set during the dimensionality reduction process are obtained.

[0061] The total number of times the target feature matches the normal access type detection data and abnormal access type detection data in the test sample set is counted, and the probability value of outputting as true is calculated based on the total number and the test sample set.

[0062] Determine whether the probability value of the output being true is greater than a preset detection performance threshold;

[0063] If the value is greater than the target value, then the detection performance of the improved network attack detection model meets the standard.

[0064] Otherwise, if the detection performance of the improved network attack detection model is not up to standard, a secondary optimization is performed by re-optimizing the hyperparameters of the XGBoost algorithm and adjusting the initial parameters of the whale swarm optimization algorithm until the detection performance of the improved network attack detection model meets the standard, at which point the secondary optimization stops.

[0065] To address the aforementioned technical problems, this application also provides an apparatus for performance testing of a network attack detection model, employing the following technical solution:

[0066] An apparatus for testing the performance of a network attack detection model, comprising:

[0067] The data preprocessing module is used to acquire batch network access data to be accessed by the target system, and to preprocess the batch network access data to obtain data preprocessing results.

[0068] The feature dimensionality reduction and filtering module is used to perform dimensionality reduction processing on the data preprocessing results using PCA analysis to obtain dimensionality reduction results, and to filter target features based on the dimensionality reduction results. The target features refer to the target classification types of each network access data, and the target classification types include: normal access type and abnormal access type.

[0069] An initialization model building module is used to construct an initialization classification decision model based on the XGBoost algorithm, using the target features as the decision target of the XGBoost algorithm.

[0070] The sample set partitioning module is used to divide the batch network access data into a training sample set and a test sample set according to a preset ratio.

[0071] The model training module is used to input the training sample set into the initial classification decision model based on the XGBoost algorithm, and to optimize and train the model using the improved whale swarm algorithm to obtain the trained network attack detection model.

[0072] The model testing module is used to input the test sample set into the trained network attack detection model and output normal access type detection data and abnormal access type detection data from the test sample set.

[0073] The model detection performance analysis module is used to analyze the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results.

[0074] To address the aforementioned technical problems, this application also provides a computer device that employs the following technical solution:

[0075] A computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the method for performance testing of a network attack detection model described above.

[0076] To address the aforementioned technical problems, this application also provides a computer-readable storage medium, employing the technical solution described below:

[0077] A computer-readable storage medium storing computer-readable instructions, which, when executed by a processor, implement the steps of the method for performance testing of a network attack detection model as described above.

[0078] Compared with the prior art, the embodiments of this application have the following main advantages:

[0079] The method for performance testing of a network attack detection model described in this application involves acquiring batch network access data of a target system to be accessed and performing data preprocessing; using PCA analysis to reduce the dimensionality of the preprocessed data and filter out target features; using the target features as the decision target of the XGBoost algorithm to construct an initial classification decision model based on the XGBoost algorithm; inputting the training sample set into the initial classification decision model based on the XGBoost algorithm, and using an improved whale swarm algorithm for model optimization and training to obtain a trained network attack detection model; testing based on the test sample set, and analyzing the detection performance of the improved network attack detection model. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, the initial classification decision model is sufficiently optimized to obtain a network attack detection model with sufficiently good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access. Attached Figure Description

[0080] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0081] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0082] Figure 2A flowchart of an embodiment of a method for performance testing of a network attack detection model according to this application;

[0083] Figure 3 A schematic diagram of the structure of an embodiment of the apparatus for testing the performance of a network attack detection model according to this application;

[0084] Figure 4 A schematic diagram of the structure of an embodiment of the computer device according to this application. Detailed Implementation

[0085] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0086] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0087] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0088] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0089] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0090] Terminal devices 101, 102, and 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc.

[0091] Server 105 can be a server that provides various services, such as a backend server that supports the pages displayed on terminal devices 101, 102, and 103.

[0092] It should be noted that the method for performance testing of network attack detection models provided in this application is generally executed by a server / terminal device, and correspondingly, the device for performance testing of network attack detection models is generally located in the server / terminal device.

[0093] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0094] Continue to refer to Figure 2 The diagram illustrates a flowchart of an embodiment of a method for performance testing of a network attack detection model according to this application. The method for performance testing of a network attack detection model includes the following steps:

[0095] Step 201: Obtain batch network access data to be accessed on the target system, and perform data preprocessing on the batch network access data to obtain data preprocessing results.

[0096] In this embodiment, the steps of acquiring batch network access data to be accessed on the target system and performing data preprocessing on the batch network access data to obtain data preprocessing results specifically include: acquiring batch network access data to be accessed on the target system through data acquisition or data reception; and performing numerical and normalization processing on the batch network access data according to preset data statistical indicators to obtain the data preprocessing results.

[0097] In this embodiment, the normalization process can be implemented using a preset normalization formula, for example: Where x is a numerical result corresponding to a certain target feature statistical indicator in the preset data statistical indicators, x maxx is the maximum value among all numerical results corresponding to the target feature index. min is the minimum value among all numerical results corresponding to the target feature index, and m is the normalized value corresponding to x.

[0098] In this embodiment, the preset data statistics indicators include UV (UniqueVisitor refers to the number of unique visitors within a certain time period), PV (PageView refers to the total number of visits within a certain time period), new visit rate, number of pages visited, dwell time, bounce rate, successful visit records, and failed visit records.

[0099] In this embodiment, the step of numericalizing and normalizing the batch network access data according to preset data statistical indicators can be implemented in one specific way: if the preset data statistical indicators only include numerical data such as UV value, PV value, new visit rate, number of pages visited, dwell time, and bounce rate, the numerical data corresponding to each data statistical indicator is directly obtained, and then the batch network access data is normalized for each data statistical indicator respectively; another specific way is to implement it in another specific way: if the preset data statistical indicators include not only numerical data such as UV value, PV value, new visit rate, number of pages visited, dwell time, and bounce rate, but also non-numerical data, the non-numerical data is first transformed into numerical data, and then normalized in the same way as described above.

[0100] By preprocessing the various statistical indicators, it becomes easier to perform feature analysis on the statistical indicators in the subsequent process.

[0101] Step 202: The data preprocessing results are subjected to dimensionality reduction using PCA analysis to obtain dimensionality reduction results, and target features are selected based on the dimensionality reduction results.

[0102] In this embodiment, the target feature refers to the target classification type of each network access data, wherein the target classification type includes: normal access type and abnormal access type.

[0103] In this embodiment, the distinction between normal and abnormal access types is related to specific network access behavior. For example, if a user can continuously access a page for more than a preset number of seconds, they will not be forcibly kicked out, which is considered a normal access type; otherwise, it is considered an abnormal access type.

[0104] In this embodiment, the step of using PCA (Principal Component Analysis) to perform dimensionality reduction on the data preprocessing results, and then selecting target features based on the dimensionality reduction results, specifically includes: displaying the data preprocessing results as an N×M matrix array, where N is the number of rows, representing the batch value of the batch network access data, and M is the number of columns, representing the number of preset data statistical indicators; decentralizing the N×M matrix array to obtain a new matrix X, wherein the decentralization is specifically implemented by subtracting the mean of the column from each column value in the N×M matrix array, wherein the new matrix X is still... An N×M matrix array is used; the covariance matrix C of the decentralized new matrix X is calculated, where the covariance matrix C is an M×M matrix array; based on the preset data statistical indicators, the covariance matrix C is subjected to eigenvalue decomposition to obtain the eigenvalues ​​and eigenvectors of the covariance matrix; the eigenvectors are sorted in descending order from left to right according to their corresponding eigenvalues ​​to obtain a projection matrix reduced to K dimensions, where K dimensions are the target dimension of the dimensionality reduction process; the matrix points in the projection matrix are divided and organized according to the target features, and based on the division and organization results, the normal access type and the abnormal access type network access data in the batch network access data are determined.

[0105] In this embodiment, the target feature can be some main features already included in the preset data statistics indicators, or it can be a new feature named based on the dimensionality reduction processing results. Taking the preset data statistics indicators as an example, assuming that the preset data statistics indicators only include the UV value, PV value, new visit rate, number of pages visited, dwell time, and bounce rate, if the obtained target feature is dwell time, then the target feature is a feature already included in the data statistics indicators. If the obtained target features are normal access type and attack access type, obviously, the preset data statistics indicators do not directly include these two indicators. Therefore, it is necessary to use a comprehensive analysis method, combining the above-mentioned multi-dimensional features such as UV value, PV value, new visit rate, number of pages visited, dwell time, and bounce rate, to perform dimensionality reduction processing and analysis, and finally obtain new simulated indicators to represent normal access type and attack access type.

[0106] PCA analysis is used to reduce the dimensionality of batch network access data. Dimensionality reduction retains the most important features of high-dimensional data while removing noise and unimportant features, thereby improving data processing speed. By eliminating unimportant features that characterize normal and abnormal access data, only important features are retained to distinguish between normal and abnormal access data in the network access data. This reduces the impact of excessive redundant features and improves data processing speed to some extent.

[0107] Step 203: Using the target features as the decision objective of the XGBoost algorithm, construct an initial classification decision model based on the XGBoost algorithm.

[0108] In this embodiment, the step of constructing an initial classification decision model based on the XGBoost algorithm, using the target feature as the decision target of the XGBoost algorithm, specifically includes: using the preset data statistical indicators as the leaf nodes of the target classification decision tree constructed by the XGBoost algorithm; using the target feature as the next-level classification node of the root node of the target classification decision tree constructed by the XGBoost algorithm; calculating the maximum decision depth of the segmentation tree corresponding to the XGBoost algorithm based on the number of leaf nodes and the number of next-level classification nodes of the root node; setting the hyperparameters of the initial classification decision model based on the XGBoost algorithm, wherein the hyperparameters include the maximum decision depth, learning rate, minimum split loss threshold, and model complexity control parameters; obtaining the preset empirical loss function and target training function; configuring the preset data statistical indicators, the target feature, the maximum decision depth, learning rate, minimum split loss threshold, model complexity control parameters, the empirical loss function, and the target training function to the initial classification decision model based on the XGBoost algorithm, thereby completing the construction of the initial classification decision model.

[0109] In this embodiment, the construction of an initial classification decision model based on the XGBoost algorithm, using the target features as the decision objective, essentially involves using the statistical indicators corresponding to the batch network access data as leaf nodes, performing gradient boosting to construct multiple decision trees with several classification decision levels, and finally selecting the classification decision tree that best suits the classification of normal access type network access data and attack access type network access data in the batch network access data. When constructing the model, the XGBoost algorithm is used to build the initial classification decision model. Therefore, based on the XGBoost algorithm, it is necessary to pre-set hyperparameters such as maximum decision depth, learning rate, minimum split loss threshold, and model complexity control parameters. Since machine learning is used for classification decision, an empirical loss function and a target training function need to be set to ensure the integrity of the constructed initial classification decision model.

[0110] Step 204: Divide the batch network access data into a training sample set and a test sample set according to a preset ratio.

[0111] In this embodiment, the batch network access data is divided into a training sample set and a test sample set according to a preset ratio. Generally, the amount of data in the training sample set is greater than that in the test sample set. The batch network access data can be divided in a 4:1 ratio to obtain the training sample set and the test sample set.

[0112] Step 205: Input the training sample set into the initialization classification decision model based on the XGBoost algorithm, and use the improved whale swarm algorithm to optimize and train the model to obtain the trained network attack detection model.

[0113] In this embodiment, before executing the steps of inputting the training sample set into the initial classification decision model based on the XGBoost algorithm and optimizing and training the model using the improved whale swarm algorithm to obtain the trained network attack detection model, the method further includes: randomly constructing several classification decision trees with the preset data statistical indicators as leaf nodes and the target features as the next-level nodes with the root nodes; obtaining the preset population size and maximum number of iterations of the improved whale swarm algorithm, wherein the population size of the improved whale swarm algorithm is less than or equal to the number of the several classification decision trees.

[0114] By randomly constructing several classification decision trees and setting the population size and maximum number of iterations of the improved whale swarm algorithm, the aim is to ensure sufficient optimization of the initial classification decision model during training. This results in a network attack detection model with sufficiently good performance and high processing efficiency. Furthermore, a better-performing network attack detection model helps the target end avoid insecure intrusions and ensures data access security.

[0115] In this embodiment, the step of inputting the training sample set into the initial classification decision model based on the XGBoost algorithm, and using the improved whale swarm algorithm for model optimization and training to obtain the trained network attack detection model specifically includes:

[0116] Step A: Obtain the hyperparameters of the XGBoost algorithm to be optimized and set their value ranges respectively. The hyperparameters of the XGBoost algorithm to be optimized include the maximum decision depth, learning rate, and minimum split loss threshold.

[0117] Step B: Initialize the whale swarm optimization algorithm by setting the population size and maximum number of iterations of the improved whale swarm optimization algorithm as its initial parameters.

[0118] Step C: Input the obtained training sample set into the several classification decision trees respectively for decision training;

[0119] Step D: Obtain the decision training results corresponding to each of the plurality of classification decision trees;

[0120] Step E: Based on the number of decision training results corresponding to each classification decision tree and the number of elements in the training sample set, calculate the decision degree value corresponding to each of the several classification decision trees using the probability value method.

[0121] Step F: Select all classification decision trees whose decision degree value is greater than the preset threshold, and calculate the convergence factor according to the preset convergence algorithm;

[0122] In this embodiment, the step of calculating the convergence factor according to a preset convergence algorithm specifically includes: according to the preset convergence algorithm: Calculate the convergence factor, where a represents the value of the convergence factor, t represents the current iteration number, and T... max This represents the maximum number of iterations, 1 ≤ t ≤ T. max ,t and T max All are positive integers.

[0123] Previous improvements to the whale swarm algorithm, which calculated the convergence factor using a linear adjustment strategy, for example: In this embodiment of the application, a nonlinear adjustment strategy is adopted without changing the trend of the convergence factor a: This ensures both the algorithm's global and local search capabilities and accelerates its convergence speed.

[0124] Step G: Based on the number of all classification decision trees corresponding to the selected decision degree values ​​being greater than a preset threshold, update the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized.

[0125] In this embodiment, the step of updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized specifically includes: counting the number of all classification decision trees corresponding to the selected decision degree values ​​being greater than a preset threshold after each iteration, and resetting them as the population size of the improved whale swarm algorithm; after each iteration, resetting the maximum remaining iteration count, wherein the reset maximum remaining iteration count is cumulatively reduced by 1 based on the maximum remaining iteration count set in the previous iteration; and randomly and dynamically adjusting the maximum decision depth, learning rate, and minimum split loss threshold after each iteration according to the value ranges corresponding to the maximum decision depth, learning rate, and minimum split loss threshold, respectively.

[0126] By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, the initial classification decision model is sufficiently optimized during training to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0127] Step H: Repeat steps C to G until the preset execution termination condition is met, then stop repeating the execution.

[0128] In this embodiment, the preset execution termination conditions include the remaining maximum number of iterations being 0, and the number of all classification decision trees corresponding to the decision degree value selected after the current iteration being greater than a preset threshold being 0 or 1.

[0129] In this embodiment, the step of stopping repeated execution until a preset execution termination condition is met specifically includes: determining whether the maximum remaining iteration count is 0; determining whether the number of all classification decision trees corresponding to the selected decision degree value being greater than a preset threshold after the current iteration is 0 or 1; if the maximum remaining iteration count is 0 or the number of all classification decision trees corresponding to the selected decision degree value being greater than the preset threshold after the current iteration is 0 or 1, then the preset execution termination condition is met.

[0130] By determining whether the termination condition is met, training of the initial classification decision model is stopped. From all classification decision models obtained through continuous dynamic optimization, the optimal classification decision model and its corresponding XGBoost algorithm hyperparameters are selected. This ensures that the initial classification decision model is sufficiently optimized to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the attacked end avoid insecure intrusions and ensures the security of data access.

[0131] Step 1: Select the classification decision tree corresponding to the decision degree value that is greater than the preset threshold and the decision degree value is the maximum value from all the execution output results as the optimal selection individual;

[0132] Step J: Select the classification decision tree corresponding to the optimal selected individual, thus obtaining the trained network attack detection model.

[0133] In this embodiment, an improved whale swarm algorithm is used to optimize the XGBoost algorithm. Essentially, all the corresponding classification decision trees in the XGBoost algorithm are treated as individual entities in the whale swarm algorithm. By analyzing the classification ability of each individual, the optimal classification decision tree is obtained iteratively. Simultaneously, during the iteration process, the relevant hyperparameters in the XGBoost algorithm are continuously adjusted, ensuring that the classification results of the same decision tree differ across iterations. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, the initial classification decision model is sufficiently optimized during training to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0134] Step 206: Input the test sample set into the trained network attack detection model, and output the normal access type detection data and abnormal access type detection data in the test sample set.

[0135] In this embodiment, the step of inputting the test sample set into the trained network attack detection model and outputting normal access type detection data and abnormal access type detection data from the test sample set specifically includes: obtaining the test sample set and inputting it into the trained network attack detection model; and filtering out normal access type detection data and abnormal access type detection data from the test sample set according to the trained network attack detection model.

[0136] Step 207: Analyze the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results.

[0137] In this embodiment, the step of analyzing the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing result specifically includes: identifying the normal access type detection data and abnormal access type detection data in the test sample set; obtaining the target features corresponding to the normal access type detection data and abnormal access type detection data in the test sample set during the dimensionality reduction processing based on the dimensionality reduction processing result; counting the total number of target features that are consistent with the normal access type detection data and abnormal access type detection data in the test sample set, and calculating the probability value of outputting true based on the total number and the test sample set; determining whether the probability value of outputting true is greater than a preset detection performance threshold; if it is greater, the detection performance of the improved network attack detection model meets the standard; otherwise, the detection performance of the improved network attack detection model does not meet the standard, and secondary optimization is performed by re-optimizing the hyperparameters of the XGBoost algorithm and adjusting the initial parameters of the whale swarm optimization algorithm until the detection performance of the improved network attack detection model meets the standard, and then the secondary optimization is stopped.

[0138] This application acquires batch network access data of a target system to be accessed and performs data preprocessing; it uses PCA analysis to reduce the dimensionality of the preprocessed data and filter out target features; using the target features as the decision target of the XGBoost algorithm, it constructs an initial classification decision model based on the XGBoost algorithm; it inputs the training sample set into the initial classification decision model based on the XGBoost algorithm, and uses an improved whale swarm algorithm for model optimization and training to obtain a trained network attack detection model; it tests the model based on the test sample set and analyzes the detection performance of the improved network attack detection model. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, it ensures that the initial classification decision model is sufficiently optimized to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0139] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0140] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0141] In this embodiment, by dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, the initial classification decision model is sufficiently optimized to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0142] Further reference Figure 3 As a response to the above Figure 2 The implementation of the method shown in this application provides an embodiment of a device for performance testing of a network attack detection model. This device embodiment is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0143] like Figure 3 As shown, the device 300 for performance testing of a network attack detection model described in this embodiment includes: a data preprocessing module 301, a feature dimensionality reduction and screening module 302, an initialization model construction module 303, a sample set partitioning module 304, a model training module 305, a model testing module 306, and a model detection performance analysis module 307. Wherein:

[0144] The data preprocessing module 301 is used to acquire batch network access data to be accessed by the target system, and to perform data preprocessing on the batch network access data to obtain data preprocessing results.

[0145] The feature dimensionality reduction and screening module 302 is used to perform dimensionality reduction processing on the data preprocessing results using PCA analysis to obtain dimensionality reduction processing results, and to screen target features based on the dimensionality reduction processing results. The target features refer to the target classification types of each network access data, and the target classification types include: normal access type and abnormal access type.

[0146] The initialization model building module 303 is used to build an initialization classification decision model based on the XGBoost algorithm, with the target features as the decision target of the XGBoost algorithm.

[0147] The sample set partitioning module 304 is used to partition the batch network access data into a training sample set and a test sample set according to a preset ratio.

[0148] The model training module 305 is used to input the training sample set into the initial classification decision model based on the XGBoost algorithm, and to use the improved whale swarm algorithm to optimize and train the model to obtain the trained network attack detection model.

[0149] The model testing module 306 is used to input the test sample set into the trained network attack detection model and output normal access type detection data and abnormal access type detection data in the test sample set.

[0150] The model detection performance analysis module 307 is used to analyze the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results.

[0151] This application acquires batch network access data of a target system to be accessed and performs data preprocessing; it uses PCA analysis to reduce the dimensionality of the preprocessed data and filter out target features; using the target features as the decision target of the XGBoost algorithm, it constructs an initial classification decision model based on the XGBoost algorithm; it inputs the training sample set into the initial classification decision model based on the XGBoost algorithm, and uses an improved whale swarm algorithm for model optimization and training to obtain a trained network attack detection model; it tests the model based on the test sample set and analyzes the detection performance of the improved network attack detection model. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, it ensures that the initial classification decision model is sufficiently optimized to obtain a network attack detection model with good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0152] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0153] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0154] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0155] The computer device 4 includes a memory 4a, a processor 4b, and a network interface 4c that are interconnected via a system bus. It should be noted that only the computer device 4 with components 4a-4c is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0156] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0157] The memory 4a includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 4a may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 4a may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 4a may include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 4a is typically used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions for methods of detecting the performance of network attack detection models. In addition, the memory 4a can also be used to temporarily store various types of data that have been output or will be output.

[0158] In some embodiments, the processor 4b may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 4b is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 4b is used to execute computer-readable instructions stored in the memory 4a or to process data, for example, to execute computer-readable instructions for the method of performance testing of the network attack detection model.

[0159] The network interface 4c may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0160] The computer device proposed in this embodiment belongs to the field of financial technology and is applied in the field of secure access detection to ensure information security. This application acquires batch network access data of a target system to be accessed and performs data preprocessing; it uses PCA analysis to reduce the dimensionality of the preprocessed data and filter out target features; using the target features as the decision target of the XGBoost algorithm, it constructs an initial classification decision model based on the XGBoost algorithm; it inputs the training sample set into the initial classification decision model based on the XGBoost algorithm, and uses an improved whale swarm algorithm for model optimization and training to obtain a trained network attack detection model; it tests the model based on the test sample set and analyzes the detection performance of the improved network attack detection model. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, it ensures that the initial classification decision model is sufficiently optimized to obtain a network attack detection model with sufficiently good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0161] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by a processor to cause the processor to perform the steps of the method for detecting the performance of a network attack detection model as described above.

[0162] The computer-readable storage medium proposed in this embodiment belongs to the field of financial technology and is applied in the field of secure access detection to ensure information security. This application acquires batch network access data of a target system to be accessed and performs data preprocessing; it uses PCA analysis to reduce the dimensionality of the preprocessed data and filter out target features; using the target features as the decision target of the XGBoost algorithm, it constructs an initial classification decision model based on the XGBoost algorithm; it inputs the training sample set into the initial classification decision model based on the XGBoost algorithm, and uses an improved whale swarm algorithm for model optimization and training to obtain a trained network attack detection model; it tests the model based on the test sample set and analyzes the detection performance of the improved network attack detection model. By dynamically updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized, it ensures that the initial classification decision model is sufficiently optimized to obtain a network attack detection model with sufficiently good performance and high processing efficiency. Furthermore, the better the performance of the network attack detection model, the better it helps the accessed end avoid insecure intrusions and ensures the security of data access.

[0163] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0164] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A method for performance testing of a network attack detection model, characterized in that, Includes the following steps: Acquire batch network access data to be accessed to the target system, and perform data preprocessing on the batch network access data to obtain data preprocessing results; The data preprocessing results are subjected to dimensionality reduction using PCA analysis to obtain dimensionality reduction results. Target features are then selected based on the dimensionality reduction results. The target features refer to the target classification types of each network access data, including normal access types and abnormal access types. Using the target features as the decision objective of the XGBoost algorithm, an initial classification decision model based on the XGBoost algorithm is constructed. The batch network access data is divided into a training sample set and a test sample set according to a preset ratio; The training sample set is input into the initial classification decision model based on the XGBoost algorithm, and the improved whale swarm algorithm is used for model optimization and training to obtain a trained network attack detection model. The process of optimizing and training the model using the improved whale swarm algorithm includes: dynamically updating the initial parameters of the improved whale swarm algorithm and the hyperparameters of the XGBoost algorithm to be optimized. The initial parameters include the population size and maximum remaining iterations of the improved whale swarm algorithm. Specifically, the number of all classification decision trees whose decision degree values ​​are greater than a preset threshold after each iteration is counted and reset to the population size of the improved whale swarm algorithm. After each iteration, the maximum remaining iterations are reset, wherein the reset maximum remaining iterations are cumulatively reduced by 1 from the maximum remaining iterations set in the previous iteration. The test sample set is input into the trained network attack detection model, and the normal access type detection data and abnormal access type detection data in the test sample set are output. Based on the normal access type detection data and abnormal access type detection data in the test sample set, as well as the dimensionality reduction processing results, the detection performance of the improved network attack detection model is analyzed.

2. The method for performance testing of a network attack detection model according to claim 1, characterized in that, The steps of acquiring batch network access data to be accessed on the target system, and preprocessing the batch network access data to obtain data preprocessing results specifically include: By acquiring or receiving data, batch network access data for the target system to be accessed is obtained. Based on preset data statistical indicators, the batch network access data is numericalized and normalized to obtain the data preprocessing results.

3. The method for performance testing of a network attack detection model according to claim 2, characterized in that, The step of using PCA analysis to reduce the dimensionality of the preprocessed data, obtaining the dimensionality reduction result, and then selecting target features based on the dimensionality reduction result specifically includes: The data preprocessing results are displayed as an N×M matrix array, where N is the number of rows, representing the batch value of the batch network access data, and M is the number of columns, representing the number of preset data statistical indicators. The N×M matrix array is decentered to obtain a new matrix X. The decentering is specifically implemented by subtracting the mean of the column in each column of the N×M matrix array from the column value. The new matrix X is still an N×M matrix array. Calculate the covariance matrix C of the new matrix X after decentralization, where the covariance matrix C is an M×M matrix array; Based on the preset data statistical indicators, the covariance matrix C is decomposed into eigenvalues ​​and eigenvectors of the covariance matrix. The feature vectors are sorted in descending order from left to right according to their corresponding feature values ​​to obtain the projection matrix reduced to K dimensions, where K is the target dimension of the dimensionality reduction process. Based on the target features, the matrix points in the projection matrix are divided and organized. Based on the division and organization results, the network access data of normal access type and abnormal access type in the batch network access data are determined.

4. The method for performance testing of a network attack detection model according to claim 2 or 3, characterized in that, The step of constructing an initial classification decision model based on the XGBoost algorithm, using the target feature as the decision objective of the XGBoost algorithm, specifically includes: The preset data statistical indicators are used as the leaf nodes of the target classification decision tree constructed using the XGBoost algorithm; The target feature is used as the next level classification node of the target classification decision tree constructed using the XGBoost algorithm; The maximum decision depth of the segmentation tree corresponding to the XGBoost algorithm is calculated based on the number of leaf nodes in the classification decision tree corresponding to the XGBoost algorithm and the number of next-level classification nodes of the root node. Set the hyperparameters of the initial classification decision model based on the XGBoost algorithm, wherein the hyperparameters include the maximum decision depth, learning rate, minimum splitting loss threshold, and model complexity control parameters; Obtain the pre-set empirical loss function and target training function; The preset data statistics indicators, target features, maximum decision depth, learning rate, minimum splitting loss threshold, model complexity control parameters, empirical loss function, and target training function are configured to the initial classification decision model based on the XGBoost algorithm, thereby completing the construction of the initial classification decision model.

5. The method for performance testing of a network attack detection model according to claim 4, characterized in that, Before performing the steps of inputting the training sample set into the initialization classification decision model based on the XGBoost algorithm, and using the improved whale swarm algorithm for model optimization and training to obtain the trained network attack detection model, the method further includes: Using the preset data statistical indicators as leaf nodes and the target features as the root nodes of the next level nodes, several classification decision trees are randomly constructed. Obtain the population size and maximum number of iterations of the improved whale swarm algorithm as preset, wherein the population size of the improved whale swarm algorithm is less than or equal to the number of the plurality of classification decision trees; The steps of inputting the training sample set into the initial classification decision model based on the XGBoost algorithm, and using the improved whale swarm algorithm for model optimization and training to obtain the trained network attack detection model specifically include: Step A: Obtain the hyperparameters of the XGBoost algorithm to be optimized and set their value ranges respectively. The hyperparameters of the XGBoost algorithm to be optimized include the maximum decision depth, learning rate, and minimum split loss threshold. Step B: Initialize the whale swarm optimization algorithm by setting the population size and maximum number of iterations of the improved whale swarm optimization algorithm as its initial parameters. Step C: Input the obtained training sample set into the several classification decision trees respectively for decision training; Step D: Obtain the decision training results corresponding to each of the plurality of classification decision trees; Step E: Based on the number of decision training results corresponding to each classification decision tree and the number of elements in the training sample set, calculate the decision degree value corresponding to each of the several classification decision trees using the probability value method. Step F: Select all classification decision trees whose decision degree value is greater than the preset threshold, and calculate the convergence factor according to the preset convergence algorithm; Step G: Based on the number of all classification decision trees corresponding to the selected decision degree values ​​being greater than a preset threshold, update the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized. Step H: Repeat steps C to G until the preset execution termination condition is met, then stop repeating the execution. Step 1: Select the classification decision tree corresponding to the decision degree value that is greater than the preset threshold and the decision degree value is the maximum value from all the execution output results as the optimal selection individual; Step J: Select the classification decision tree corresponding to the optimal selected individual, thus obtaining the trained network attack detection model.

6. The method for performance testing of a network attack detection model according to claim 5, characterized in that, The step of calculating the convergence factor according to the preset convergence algorithm specifically includes: According to the preset convergence algorithm: Calculate the convergence factor, where a represents the value of the convergence factor, t represents the current iteration number, and T... max This represents the maximum number of iterations, 1 ≤ t ≤ T. max ,t and T max All are positive integers; The step of updating the initial parameters of the whale swarm optimization algorithm and the hyperparameters of the XGBoost algorithm to be optimized further includes: Based on the value ranges corresponding to the maximum decision depth, learning rate, and minimum partitioning loss threshold, the maximum decision depth, learning rate, and minimum partitioning loss threshold are randomly and dynamically adjusted after each iteration. The preset execution termination conditions include a remaining maximum number of iterations of 0, and the number of all classification decision trees corresponding to a decision degree value greater than a preset threshold after the current iteration being 0 or 1. The step of stopping repeated execution until the preset execution termination conditions are met specifically includes: Determine whether the maximum remaining number of iterations is 0; The number of all classification decision trees corresponding to the selected decision degree value being greater than the preset threshold after the current iteration is determined to be 0 or 1; If the maximum remaining iteration count is 0, or the number of all classification decision trees corresponding to the selected decision degree value after the current iteration being greater than the preset threshold is 0 or 1, then the preset execution termination condition is met.

7. The method for performance testing of a network attack detection model according to claim 5 or 6, characterized in that, The step of inputting the test sample set into the trained network attack detection model and outputting normal access type detection data and abnormal access type detection data from the test sample set specifically includes: The test sample set is obtained and input into the trained network attack detection model; Based on the trained network attack detection model, normal access type detection data and abnormal access type detection data are selected from the test sample set; The step of analyzing the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results specifically includes: Identify normal access type detection data and abnormal access type detection data in the test sample set; Based on the dimensionality reduction result, the target features corresponding to the normal access type detection data and abnormal access type detection data in the test sample set during the dimensionality reduction process are obtained. The total number of times the target feature matches the normal access type detection data and abnormal access type detection data in the test sample set is counted, and the probability value of outputting as true is calculated based on the total number and the test sample set. Determine whether the probability value of the output being true is greater than a preset detection performance threshold; If the value is greater than the target value, then the detection performance of the improved network attack detection model meets the standard. Otherwise, if the detection performance of the improved network attack detection model is not up to standard, a secondary optimization is performed by re-optimizing the hyperparameters of the XGBoost algorithm and adjusting the initial parameters of the whale swarm optimization algorithm until the detection performance of the improved network attack detection model meets the standard, at which point the secondary optimization stops.

8. A device for performance testing of a network attack detection model, characterized in that, include: The data preprocessing module is used to acquire batch network access data to be accessed by the target system, and to preprocess the batch network access data to obtain data preprocessing results. The feature dimensionality reduction and filtering module is used to perform dimensionality reduction processing on the data preprocessing results using PCA analysis to obtain dimensionality reduction results, and to filter target features based on the dimensionality reduction results. The target features refer to the target classification types of each network access data, and the target classification types include: normal access type and abnormal access type. An initialization model building module is used to construct an initialization classification decision model based on the XGBoost algorithm, using the target features as the decision target of the XGBoost algorithm. The sample set partitioning module is used to divide the batch network access data into a training sample set and a test sample set according to a preset ratio. The model training module is used to input the training sample set into the initial classification decision model based on the XGBoost algorithm, and to optimize and train the model using the improved whale swarm algorithm to obtain a trained network attack detection model. The optimization and training process using the improved whale swarm algorithm includes: dynamically updating the initial parameters of the improved whale swarm algorithm and the hyperparameters of the XGBoost algorithm to be optimized. The initial parameters include the population size and maximum remaining iterations of the improved whale swarm algorithm. Specifically, the number of all classification decision trees whose decision degree values ​​are greater than a preset threshold after each iteration is counted and reset to the population size of the improved whale swarm algorithm. After each iteration, the maximum remaining iterations are reset, wherein the reset maximum remaining iterations are cumulatively reduced by 1 from the maximum remaining iterations set in the previous iteration. The model testing module is used to input the test sample set into the trained network attack detection model and output normal access type detection data and abnormal access type detection data from the test sample set. The model detection performance analysis module is used to analyze the detection performance of the improved network attack detection model based on the normal access type detection data and abnormal access type detection data in the test sample set and the dimensionality reduction processing results.

9. A computer device comprising a memory and a processor, the memory storing computer-readable instructions, wherein the processor, when executing the computer-readable instructions, implements the steps of the method for performance testing of a network attack detection model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for performance testing of a network attack detection model as described in any one of claims 1 to 7.

Images