Multi-step attack identification model training method and multi-step attack identification method

Abstract

The application relates to the technical field of information security, and provides a multi-step attack identification model training method and a multi-step attack identification method. The multi-step attack identification model training method comprises the following steps: obtaining a training sample of a self-organizing mapping neural network model; adjusting a connection weight in the self-organizing mapping neural network model based on the training sample; and if it is confirmed that the similarity between the connection weight and the input mode of the training sample reaches a target threshold value, the current self-organizing mapping neural network model is determined as a target multi-step attack identification model.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a training method for a multi-step attack identification model and a multi-step attack identification method. Background Technology

[0002] To effectively ensure the operational stability of wireless sensor networks, an increasing number of technicians are choosing to analyze real-time traffic data generated by wireless sensor networks to determine whether multi-step attack events exist in various links of the wireless sensor network.

[0003] However, the existing technology for identifying multi-step attack events in wireless sensor network data has not solved the problems of dimensionality curse and overfitting that often occur in wireless sensor network data. This directly leads to low identification efficiency and the need to improve the identification accuracy of multi-step attack events in wireless sensor network data based on the existing technology. Summary of the Invention

[0004] Therefore, it is necessary to provide a training method and a multi-step attack identification method for the aforementioned technical problems.

[0005] Firstly, this application provides a method for training a multi-step attack identification model, the method comprising:

[0006] Obtain training samples for the self-organizing map neural network model;

[0007] Based on the training samples, adjust the connection weights in the self-organizing map neural network model;

[0008] If it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches the target threshold, then the current self-organizing map neural network model is determined as the target multi-step attack identification model.

[0009] In one embodiment, the method for obtaining training samples of the self-organizing map neural network model further includes:

[0010] Based on the obtained wireless sensor network data samples, link security historical features and link security evaluation results are obtained; according to the link security historical features and the link security evaluation results, a set of link security level coefficients is obtained; the set of link security level coefficients is processed to obtain the distribution of link security level coefficients corresponding to several links in the wireless sensor network; based on the distribution of each link security level coefficient, the training samples are generated.

[0011] In one embodiment, processing the set of link security level coefficients to obtain the distribution of link security level coefficients for each of several links in the wireless sensor network includes:

[0012] A sliding window mechanism is used to transform the set of link security level coefficients into a first sample data set; the first sample data set is used to train a deep belief network model; based on the pre-trained deep belief network model, the distribution of the link security level coefficients corresponding to each link is obtained.

[0013] In one embodiment, adjusting the connection weights in the self-organizing map neural network model based on the training samples includes:

[0014] Based on the distance between the input pattern and each competing layer neuron in the self-organizing map neural network model, a target neuron is selected; the connection weights between the target neuron and each neuron in its neighborhood are adjusted until the similarity between the connection weights and the input pattern reaches the target threshold.

[0015] Secondly, this application provides a method for identifying multi-step attacks in wireless sensor networks, the method comprising:

[0016] A multi-step attack identification model for a target is obtained; the multi-step attack identification model for a target is trained based on the method described in any one of claims 1 to 4.

[0017] The wireless sensor network data is input into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

[0018] Thirdly, this application also provides a training apparatus for a multi-step attack identification model, the apparatus comprising:

[0019] The model training sample acquisition module is used to acquire training samples for the self-organizing map neural network model.

[0020] The model connection weight adjustment module is used to adjust the connection weights in the self-organizing map neural network model based on the training samples.

[0021] The target recognition model output module is used to determine the current self-organizing map neural network model as a target multi-step attack recognition model if it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches a target threshold.

[0022] Fourthly, this application also provides a multi-step attack identification device for wireless sensor networks, the device comprising:

[0023] A multi-step attack identification model acquisition module is used to acquire a target multi-step attack identification model; the target multi-step attack identification model is trained based on the method of any one of claims 1 to 4.

[0024] The multi-step attack identification result output module is used to input wireless sensor network data into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

[0025] Fifthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the above-described method.

[0026] Sixthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0027] In a seventh aspect, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the above-described method.

[0028] The training method for the aforementioned multi-step attack identification model first obtains training samples of a self-organizing map neural network model. Then, based on the training samples, the connection weights in the self-organizing map neural network model are adjusted. Finally, if the similarity between the connection weights and the input patterns of the training samples reaches a target threshold, the current self-organizing map neural network model is identified as the target multi-step attack identification model. This application solves the dimensionality curse and overfitting problems frequently encountered in wireless sensor network data by performing unsupervised training on the self-organizing map neural network model based on the link security features of wireless sensor networks. This not only improves the identification efficiency of multi-step attack events in wireless sensor network data but also effectively enhances the identification accuracy. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a training method for a multi-step attack identification model provided in one embodiment;

[0030] Figure 2 This is a schematic diagram of the network structure of a self-organizing map neural network model provided in one embodiment;

[0031] Figure 3 This is a flowchart illustrating a specific method for generating training samples for a self-organizing map neural network model, as provided in one embodiment.

[0032] Figure 4 This is a flowchart illustrating a specific method for obtaining the distribution of link security level coefficients for several links in a wireless sensor network, as provided in one embodiment.

[0033] Figure 5 This is a schematic diagram of the structure of a deep belief network model provided in one embodiment;

[0034] Figure 6 This is a flowchart illustrating a specific method for adjusting connection weights in a self-organizing map neural network model, as provided in one embodiment.

[0035] Figure 7 This is a flowchart illustrating a multi-step attack identification method for a wireless sensor network provided in one embodiment.

[0036] Figure 8 This is a structural block diagram of a training device for a multi-step attack identification model in one embodiment;

[0037] Figure 9 This is a structural block diagram of a multi-step attack identification device for a wireless sensor network in one embodiment;

[0038] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0040] The training method for the multi-step attack identification model and the multi-step attack identification method for wireless sensor networks provided in this application can be applied to server execution. The terminal communicates with the server via a network; the data storage system can store the data that the server needs to process; the data storage system can be integrated on the server, or it can be located on the cloud or other network servers; the terminal can be, but is not limited to, various personal computers and laptops; the server can be implemented using a standalone server or a server cluster composed of multiple servers.

[0041] In one embodiment, such as Figure 1 As shown, a training method for a multi-step attack identification model is provided, including the following steps:

[0042] Step S110: Obtain training samples for the self-organizing map neural network model.

[0043] In this step, the self-organizing map neural network model refers to the self-organizing map neural network model (SOM); the training samples, i.e. the training samples of the self-organizing map neural network model, refer to the data samples used for unsupervised training of the self-organizing map neural network model.

[0044] In practical applications, the specific network structure of a self-organizing map neural network model can be as follows: Figure 2 As shown in the figure.

[0045] Step S120: Adjust the connection weights in the self-organizing map neural network model based on the training samples.

[0046] In this step, the training samples, i.e. the training samples of the self-organizing map neural network model, refer to the data samples used for unsupervised training of the self-organizing map neural network model; the connection weights in the self-organizing map neural network model refer to the weights of the connections between each neuron in the self-organizing map neural network model.

[0047] Specifically, the process of adjusting the connection weights in a self-organizing map neural network model based on training samples can be divided into two stages: the first stage is for coarse learning and coarse adjustment, in which connection weight vectors in different directions are moved toward the input pattern and initial adjustments are made to determine the mapping positions of different input patterns; the second stage is for fine learning and fine adjustment, in which the network's learning is concentrated on adjusting the connection weights within a relatively small range, thus making the adjustment of the connection weights more refined.

[0048] Step S130: If it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches the target threshold, then the current self-organizing map neural network model is determined as the target multi-step attack identification model.

[0049] In this step, connection weights, i.e., connection weights in a self-organizing map neural network model, refer to the weights of the connections between each neuron in the self-organizing map neural network model; training samples, i.e., training samples of the self-organizing map neural network model, refer to the data samples used for unsupervised training of the self-organizing map neural network model; the current self-organizing map neural network model refers to the self-organizing map neural network model obtained when the similarity between the weights of each neuron connection and the input pattern of the training sample reaches a target threshold; the target threshold is used to determine whether the similarity between the connection weights of each neuron in the self-organizing map neural network model and the input pattern of the training sample meets the preset standard target threshold.

[0050] Specifically, the way to determine the current self-organizing map neural network model as the target multi-step attack identification model is to determine the obtained self-organizing map neural network model as the target multi-step attack identification model when the similarity between the weights of each neuron connection and the input pattern of the training sample reaches the target threshold.

[0051] The training method for the aforementioned multi-step attack identification model first obtains training samples of a self-organizing map neural network model. Then, based on the training samples, the connection weights in the self-organizing map neural network model are adjusted. Finally, if the similarity between the connection weights and the input patterns of the training samples reaches a target threshold, the current self-organizing map neural network model is identified as the target multi-step attack identification model. This application solves the dimensionality curse and overfitting problems frequently encountered in wireless sensor network data by performing unsupervised training on the self-organizing map neural network model based on the link security features of wireless sensor networks. This not only improves the identification efficiency of multi-step attack events in wireless sensor network data but also effectively enhances the identification accuracy.

[0052] Regarding the specific method for generating training samples for a self-organizing map neural network model, in one embodiment, such as... Figure 3 As shown, before step S110 above, the method further includes:

[0053] Step S310: Based on the obtained wireless sensor network data samples, obtain the historical characteristics of link security and the link security evaluation results.

[0054] In this step, the obtained wireless sensor network data sample refers to the wireless sensor network data sample collected within a preset time period; the link security historical characteristics refer to the link security historical characteristics of the wireless sensor network obtained based on the obtained wireless sensor network data sample; and the link security evaluation result refers to the link security evaluation result of the wireless sensor network obtained based on the obtained wireless sensor network data sample.

[0055] Specifically, the data samples of a wireless sensor network can be represented as traffic data collected within a preset time period; the method for obtaining historical link security features can be based on a pre-trained deep belief network model to extract historical link security features from the obtained wireless sensor network data samples; the link security evaluation results can be represented as link security evaluation results of the wireless sensor network over a future period; and the method for obtaining link security evaluation results can be by using a softmax regressor to predict and analyze the link security evaluation results of the wireless sensor network over a future period based on the obtained wireless sensor network data samples.

[0056] In practical applications, the specific methods for obtaining wireless sensor network data samples can include the following steps:

[0057] First, obtain the initial sample set S. The specific form of the initial sample set S can be represented by the following formula:

[0058]

[0059] Then, using a vector classifier, the optimal linear hyperplane that meets the preset conditions is found, thus transforming the problem into an optimization problem. After completing the transformation, a linear model needs to be established, and the found optimal linear hyperplane must also satisfy the constraints in the following formula:

[0060] x i (ωz i +y)≥1-ψ i

[0061] Where, x i Represents the output sample; ω represents the normal vector; z i Indicates the input sample; y represents the total number of samples; ψ i This represents the distance from the sample point to the classification boundary.

[0062] Next, a penalty term is added to the minimization objective to obtain the optimal hyperplane decision function N(x). The specific form of the aforementioned optimal hyperplane decision function N(x) can be expressed as shown in the following formula:

[0063]

[0064] Where n and m represent constants; (a,b) represents the Lagrange multiplier; sgn represents the step function; and c represents the bias term.

[0065] Subsequently, based on nonlinear transformation, a vector classifier is used to transform all inseparable samples into separable problems within a high-dimensional feature space through mapping. The improved optimal hyperplane decision function can be specifically represented by the following formula:

[0066]

[0067] Where L(a,b) represents the kernel function.

[0068] Next, to satisfy the requirement of arbitrary distribution, RBF is used as the kernel function. The specific form of the aforementioned kernel function RBF can be expressed as shown in the following formula:

[0069]

[0070] Where β represents the kernel function width; s represents the subsample; s i This represents the i-th subsample within the sample set.

[0071] Step S320: Based on the historical characteristics of link security and the results of link security evaluation, obtain a set of link security level coefficients.

[0072] In this step, the link security historical characteristics refer to the link security historical characteristics of the wireless sensor network obtained based on the acquired wireless sensor network data samples; the link security evaluation results refer to the link security evaluation results of the wireless sensor network obtained based on the acquired wireless sensor network data samples; and the link security level coefficient set refers to the set of link security level coefficients obtained based on the link security historical characteristics and the link security evaluation results.

[0073] Specifically, the specific way to obtain the set of link security level coefficients based on the historical characteristics of link security and the results of link security evaluation is to use a Support Vector Classification (SVM) to evaluate the historical link security level coefficients of the wireless sensor network based on the historical characteristics of link security and the results of link security evaluation, and obtain the set of link security level coefficients based on the results of the aforementioned evaluation.

[0074] In practical applications, the characteristics of each link in a wireless sensor network differ. Links can be classified according to their location within a given area. For example, links in a secure zone can be defined as Level 1 (highest level, highest security), links in a transition zone as Level 2 (medium level), and links in a blank zone as Level 3 (low level). This transforms the link security assessment problem of a wireless sensor network into a link security level classification problem, enabling the assessment of the link security level of a wireless sensor network.

[0075] Step S330: Process the set of link security level coefficients to obtain the distribution of link security level coefficients for each of the links in the wireless sensor network.

[0076] In this step, the link security level coefficient set refers to the set of link security level coefficients obtained based on the historical characteristics of link security and the results of link security evaluation; the link security level coefficient distribution, that is, the distribution of link security level coefficients corresponding to several links in the wireless sensor network, refers to the distribution of link security level coefficients corresponding to several links in the wireless sensor network obtained by processing the link security level coefficient set.

[0077] Step S340: Generate training samples based on the distribution of security level coefficients for each link.

[0078] In this step, the distribution of security level coefficients for each link, i.e., the distribution of security level coefficients for each link in the wireless sensor network, refers to the distribution of security level coefficients for each link in the wireless sensor network obtained by processing the set of security level coefficients; the training samples, i.e., the training samples of the self-organizing map neural network model, refer to the training samples of the self-organizing map neural network model generated based on the distribution of security level coefficients for each link.

[0079] This application embodiment solves the dimensionality curse and overfitting problems that often occur in wireless sensor network data by obtaining historical link security features and link security evaluation results based on the acquired wireless sensor network data samples, obtaining a set of link security level coefficients based on the historical link security features and link security evaluation results, and obtaining the distribution of link security level coefficients of several links in the wireless sensor network used to generate training samples by processing the set of link security level coefficients. This effectively improves the identification accuracy of multi-step attack events in wireless sensor network data.

[0080] In one embodiment, the specific method for obtaining the distribution of link security level coefficients for several links in a wireless sensor network is as follows: Figure 4 As shown, step S330 specifically includes:

[0081] Step S410: Using a sliding window mechanism, the set of link security level coefficients is transformed into a first sample data set; the aforementioned first sample data set is used to train the deep belief network model.

[0082] In this step, the link security level coefficient set refers to the set of link security level coefficients obtained based on the historical characteristics of link security and the results of link security evaluation; the first sample data set refers to the first sample data set obtained by transforming the link security level coefficient set using a sliding window mechanism to train the deep belief network model; the deep belief network model refers to the deep belief network (DBN) model.

[0083] In practical applications, the specific network structure of a deep belief network model can be as follows: Figure 5 The specific representation of the first sample data set can be expressed as shown in the following formula:

[0084]

[0085] Step S420: Based on the pre-trained deep belief network model, obtain the distribution of link security level coefficients for each link.

[0086] In this step, the pre-trained deep belief network model refers to the deep belief network model trained based on the first sample data set; the first sample data set refers to the first sample data set obtained by transforming the link security level coefficient set using a sliding window mechanism to train the deep belief network model; the distribution of link security level coefficients corresponding to each link, that is, the distribution of link security level coefficients corresponding to each link in the wireless sensor network, refers to the distribution of link security level coefficients corresponding to each link in the wireless sensor network obtained based on the pre-trained deep belief network model.

[0087] In practical applications, the training process of a deep belief network model can be divided into two parts: pre-training and fine-tuning. The specific method for obtaining the distribution of link security level coefficients for each link based on the pre-trained deep belief network model can include the following steps:

[0088] First, using a pre-trained deep belief network model, the probability distribution H of different network nodes is calculated. ij The probability distribution H of the aforementioned different network nodes ijIt can be obtained using the following formula:

[0089]

[0090] Where f(x) represents a variable; τ represents the connection weight between two random nodes; i Indicates a visible unit.

[0091] Then, the features of each link are extracted, and the distribution of each link within the wireless sensor network is obtained. Distribution of the aforementioned links within the wireless sensor network It can be obtained using the following formula:

[0092]

[0093] Where ε represents the normalization factor.

[0094] This application embodiment uses a sliding window mechanism to transform the set of link security level coefficients into a first sample data set for training a deep belief network. Based on the pre-trained deep belief network model, it obtains the distribution of link security level coefficients for each link. This effectively solves the dimensionality curse and overfitting problems that often occur in wireless sensor network data, thereby improving the identification efficiency for multi-step attack events in wireless sensor network data.

[0095] Regarding the specific method of adjusting the connection weights in a self-organizing map neural network model, in one embodiment, such as Figure 6 As shown, step S120 specifically includes:

[0096] Step S610: Select the target neuron based on the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model.

[0097] In this step, the input pattern refers to the input pattern of the training samples; the training samples refer to the data samples used for unsupervised training of the self-organizing map neural network model; and the target neuron refers to the target neuron selected based on the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model.

[0098] Specifically, the method for selecting the target neuron based on the distance between the input pattern and each competing layer neuron in the self-organizing map neural network model can be to select the target neuron with the shortest distance to the input pattern.

[0099] Step S620: Adjust the connection weights between the target neuron and each neuron in the neighborhood of the target neuron until the similarity between the connection weights and the input pattern reaches the target threshold.

[0100] In this step, the target neuron refers to the target neuron selected based on the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model; the connection weight refers to the weight of the connection between each neuron in the self-organizing map neural network model; the input pattern refers to the input pattern of the training sample; the training sample refers to the data sample used for unsupervised training of the self-organizing map neural network model; and the target threshold refers to the threshold used to determine whether the similarity between the connection weights of each neuron in the self-organizing map neural network model and the input pattern of the training sample meets the preset standard.

[0101] In practical applications, the specific execution steps for adjusting the connection weights in the self-organizing map neural network model are explained in general, based on steps S610 to S620 above:

[0102] First, set the network input mode to B. k The neuron vector of the competitive layer is B. j Choose the connection weight between two random nodes in the interval [0,1]. The initial learning rate of the network can then be determined using the following formula (after which, the initial values ​​of related parameters such as the neighborhood function also need to be determined):

[0103]

[0104] Where t represents the sampling time.

[0105] Then, using the following formula, the range transform of all input patterns is performed to obtain the normalized result. Among them, the aforementioned normalization process The calculation can be performed using the following formula:

[0106]

[0107] Where β0 represents the link distribution vector.

[0108] Next, the network input pattern (i.e., all training samples are sorted by number and input into the network sequentially according to the sorting result) is given and transmitted into the network. At the same time, the distance D between the connection weight vector and the input pattern is calculated. ij(That is, the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model). Wherein, the distance D between the aforementioned connection weight vector and the input pattern is... ij The following formula can be used for calculation:

[0109]

[0110] in, This represents the connection weight vector.

[0111] Then, based on the distance between the network connection weight vector and the input vector (i.e., the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model), the target neuron G with the shortest distance is selected. best The aforementioned target neuron G with the shortest distance. best The value can be obtained using the following formula:

[0112] G best =min(D ij )

[0113] Next, the connection weights between the input neuron and all competing layer neurons within the neighborhood of the activated neuron are adjusted. The aforementioned connection rights The adjustment can be made using the following formula:

[0114]

[0115] Where ψ(t) represents the learning rate at time t.

[0116] Finally, the next learning pattern is passed to the network's input layer until the network has learned all learning patterns. The learning rate and neighborhood function of the network can be updated using the following formulas:

[0117]

[0118] in, Δp represents the updated learning rate; Δp represents the updated neighborhood function.

[0119] This application embodiment selects a target neuron based on the distance between the input pattern and each competing layer neuron in the self-organizing map neural network model, and adjusts the connection weights between the target neuron and each neuron in the neighborhood of the target neuron until the similarity between the connection weights and the input pattern reaches a target threshold. This effectively improves the identification efficiency for multi-step attack events in wireless sensor network data.

[0120] In one embodiment, such as Figure 7As shown, a multi-step attack identification method for wireless sensor networks is provided, including the following steps:

[0121] Step S710: Obtain the target multi-step attack identification model; the aforementioned target multi-step attack identification model is trained using the training method based on the above multi-step attack identification model.

[0122] In this step, the target multi-step attack identification model refers to the target multi-step attack identification model obtained by training a self-organizing map neural network model based on the training method of the above-mentioned multi-step attack identification model.

[0123] Step S720: Input the wireless sensor network data into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

[0124] In this step, wireless sensor network data refers to wireless sensor network data acquired in real time; the target multi-step attack identification model refers to the target multi-step attack identification model obtained by training a self-organizing map neural network model based on the training method of the aforementioned multi-step attack identification model; the multi-step attack identification result corresponding to the wireless sensor network data refers to the multi-step attack identification result obtained by inputting the wireless sensor network data into the target multi-step attack identification model. This multi-step attack identification result can be used to characterize whether multi-step attack events exist in the wireless sensor network data.

[0125] In practical applications, the specific method for inputting wireless sensor network data into a target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data can be as follows: the target multi-step attack identification model is trained based on the distribution of link security level coefficients of several links in the wireless sensor network. The model distinguishes between data representing multi-step attacks and normal behavior in the wireless sensor network data, thereby obtaining the multi-step attack identification result used to characterize whether a multi-step attack event exists in the wireless sensor network data.

[0126] This application embodiment improves the identification efficiency and accuracy of multi-step attack events in wireless sensor network data by inputting wireless sensor network data into a target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

[0127] In one embodiment, to verify the effectiveness of the training method of the multi-step attack identification model and the multi-step attack identification method of wireless sensor networks provided in this application, it can be compared with the experimental data generated by existing technology 1 (which uses a combination of static and dynamic attack methods to launch attacks on different types of networks, and uses the maximum connected subgraph ratio and network efficiency as the identification criteria for judging whether a node is an attack node, thereby realizing multi-step attack identification) and existing technology 2 (which prioritizes adding TCP layer option fields to characterize traffic, and finally realizes multi-step identification through machine learning algorithms), and the identification rate, false alarm rate and identification time are used as the evaluation indicators of this comparative experiment.

[0128] Specifically, the recognition rate D (r) This refers to the ratio between correctly identified multi-step attacks on wireless sensor network data and all multi-step attacks in the sample; this identification rate D (r) The following formula can be used to obtain it:

[0129]

[0130] Among them, tp (x,y) fn represents the true rate; (x,y) This indicates the false negative rate.

[0131] In addition, the false alarm rate F (ar) The false alarm rate (F) refers to the ratio between normal data identified as being targeted by a multi-step attack on wireless sensor network data and all normal data in the test set. A lower false alarm rate indicates a higher accuracy rate. (ar) The following formula can be used to obtain it:

[0132]

[0133] Among them, fp (x,y) Indicates the true negative rate; tn (x,y) This indicates the false positive rate.

[0134] First, the experimental equipment configuration shown in Table 1 can be used in this comparative experiment:

[0135] Table 1

[0136]

[0137] Then, regarding the recognition rate, the recognition rates of the method provided in this application compared with those of prior art 1 and prior art 2 are shown in Table 2 below:

[0138] Table 2

[0139]

[0140] As can be seen from the experimental data in Table 2, the method provided in this application achieves a significantly higher recognition rate than the corresponding recognition rates of prior art 1 and prior art 2 in terms of identifying multi-step attack events in wireless sensor network data. Therefore, the method provided in this application has a higher recognition accuracy and better recognition performance compared to prior art 1 and prior art 2.

[0141] Next, regarding the false alarm rate, the false alarm rates of the method provided in this application compared with those of prior art 1 and prior art 2 are shown in Table 3 below:

[0142] Table 3

[0143]

[0144] As can be seen from the experimental data in Table 3, the method provided in this application has a significantly lower false alarm rate than that of prior art 1 and prior art 2 in the process of identifying multi-step attack events in wireless sensor network data. Therefore, the method provided in this application has a lower false alarm rate and better identification capability compared to prior art 1 and prior art 2.

[0145] Finally, regarding the identification time, the identification time of the method provided in this application compared with that of prior art 1 and prior art 2 is shown in Table 4 below:

[0146] Table 4

[0147]

[0148] As can be seen from the experimental data in Table 4, the method provided in this application requires significantly less identification time than the prior art 1 and prior art 2 in terms of identification time for multi-step attack events in wireless sensor network data. Therefore, the method provided in this application is faster and more efficient than prior art 1 and prior art 2.

[0149] This application embodiment directly compares the experimental data of the method provided in this application with those of the prior art in terms of recognition rate, false alarm rate, and recognition time, thereby intuitively verifying the effectiveness of the method provided in this application. The experimental data shows that the method provided in this application can not only effectively improve the recognition accuracy of multi-step attack events in sensitive data of wireless sensor networks and effectively reduce the false alarm rate in the recognition process of multi-step attack events in sensitive data of wireless sensor networks, but also effectively reduce the recognition time required for the recognition process of multi-step attack events in sensitive data of wireless sensor networks, thereby improving the efficiency of recognizing multi-step attack events in sensitive data of wireless sensor networks.

[0150] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0151] Based on the same inventive concept, this application also provides a training apparatus for a multi-step attack identification model to implement the training method for the multi-step attack identification model described above. The solution provided by this apparatus is similar to the implementation described in the above method. Therefore, the specific limitations of the one or more training apparatus embodiments for multi-step attack identification models provided below can be found in the limitations of the training method for multi-step attack identification models described above, and will not be repeated here.

[0152] In one embodiment, such as Figure 8 As shown, a training device for a multi-step attack identification model is provided, the device comprising:

[0153] The model training sample acquisition module 810 is used to acquire training samples for the self-organizing map neural network model.

[0154] The model connection weight adjustment module 820 is used to adjust the connection weights in the self-organizing map neural network model based on the training samples.

[0155] The target recognition model output module 830 is used to determine the current self-organizing map neural network model as a target multi-step attack recognition model if it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches a target threshold.

[0156] In one embodiment, the above apparatus further includes: a training sample generation module, configured to acquire link security historical features and link security evaluation results based on the acquired wireless sensor network data samples; obtain a set of link security level coefficients according to the link security historical features and the link security evaluation results; process the set of link security level coefficients to obtain the distribution of link security level coefficients corresponding to several links in the wireless sensor network; and generate the training samples based on the distribution of each link security level coefficient.

[0157] In one embodiment, the training sample generation module is specifically used to transform the set of link security level coefficients into a first sample data set using a sliding window mechanism; the first sample data set is used to train a deep belief network model; and based on the pre-trained deep belief network model, the distribution of the link security level coefficients corresponding to each link is obtained.

[0158] In one embodiment, the model connection weight adjustment module 820 is specifically used to select a target neuron based on the distance between the input pattern and each competing layer neuron in the self-organizing map neural network model; and adjust the connection weights between the target neuron and each neuron in the neighborhood of the target neuron until the similarity between the connection weights and the input pattern reaches the target threshold.

[0159] Based on the same inventive concept, this application also provides a multi-step attack identification device for wireless sensor networks to implement the multi-step attack identification method for wireless sensor networks described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the multi-step attack identification device for wireless sensor networks provided below can be found in the limitations of the multi-step attack identification method for wireless sensor networks described above, and will not be repeated here.

[0160] In one embodiment, such as Figure 9 As shown, a multi-step attack identification device for wireless sensor networks is provided, the device comprising:

[0161] The multi-step attack identification model acquisition module 910 is used to acquire the target multi-step attack identification model; the target multi-step attack identification model is trained based on the training method of the above-mentioned multi-step attack identification model.

[0162] The multi-step attack identification result output module 920 is used to input wireless sensor network data into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

[0163] The training device for the aforementioned multi-step attack identification model and the various modules in the aforementioned multi-step attack identification device for wireless sensor networks can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0164] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to multi-step attack identification in wireless sensor networks. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a training method for a multi-step attack identification model or a multi-step attack identification method for wireless sensor networks.

[0165] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0166] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0167] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0168] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0169] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0171] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0172] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A training method for a multi-step attack detection model, characterized in that, The method includes: Obtain training samples for the self-organizing map neural network model; Based on the training samples, adjust the connection weights in the self-organizing map neural network model; If it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches the target threshold, then the current self-organizing map neural network model is determined as the target multi-step attack identification model. The process of obtaining training samples for the self-organizing map neural network model includes: Based on the obtained wireless sensor network data samples, historical characteristics of link security and link security evaluation results are obtained. Based on the link security historical characteristics and the link security evaluation results, a set of link security level coefficients is obtained; Process the set of link security level coefficients to obtain the distribution of link security level coefficients for each link in the wireless sensor network. The training samples are generated based on the distribution of the security level coefficients of each link.

2. The method according to claim 1, characterized in that, The process of processing the set of link security level coefficients yields the distribution of link security level coefficients for each of several links in the wireless sensor network, including: A sliding window mechanism is used to transform the set of link security level coefficients into a first sample data set; the first sample data set is used to train the deep belief network model. Based on the pre-trained deep belief network model, the distribution of the link security level coefficients corresponding to each link is obtained.

3. The method according to claim 1, characterized in that, The step of adjusting the connection weights in the self-organizing map neural network model based on the training samples includes: The target neuron is selected based on the distance between the input pattern and the neurons in each competing layer of the self-organizing map neural network model; The connection weights between the target neuron and each neuron in its neighborhood are adjusted until the similarity between the connection weights and the input pattern reaches the target threshold.

4. A method for identifying multi-step attacks in wireless sensor networks, characterized in that, The method includes: A multi-step attack identification model for a target is obtained; the multi-step attack identification model for a target is trained based on the method described in any one of claims 1 to 3. The wireless sensor network data is input into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

5. A training device for a multi-step attack identification model, characterized in that, The device includes: The model training sample acquisition module is used to acquire training samples for the self-organizing map neural network model. The model connection weight adjustment module is used to adjust the connection weights in the self-organizing map neural network model based on the training samples. The target recognition model output module is used to determine the current self-organizing map neural network model as a target multi-step attack recognition model if it is confirmed that the similarity between the connection weight and the input pattern of the training sample reaches a target threshold. The model training sample acquisition module is further configured to acquire link security historical features and link security evaluation results based on the acquired wireless sensor network data samples; obtain a set of link security level coefficients based on the link security historical features and the link security evaluation results; process the set of link security level coefficients to obtain the distribution of link security level coefficients corresponding to several links in the wireless sensor network; and generate the training samples based on the distribution of each link security level coefficient.

6. A multi-step attack identification device for wireless sensor networks, characterized in that, The device includes: A multi-step attack identification model acquisition module is used to acquire a target multi-step attack identification model; the target multi-step attack identification model is trained based on the method of any one of claims 1 to 3. The multi-step attack identification result output module is used to input wireless sensor network data into the target multi-step attack identification model to obtain the multi-step attack identification result corresponding to the wireless sensor network data.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images