A method, device and medium for processing alarm information based on ensemble learning

Abstract

The present application discloses an alarm information processing method, device and medium based on ensemble learning, the method comprising: obtaining the contribution corresponding to the standardized features, screening out the standardized features with high contribution; fusing the standardized features based on the weights assigned to the standardized features; training the neural network model based on the training set to obtain the first ensemble learning branch; constructing a cascaded deep network, and training the different levels of networks based on the preprocessed image features to obtain the second ensemble learning branch; selecting the output based on the asymmetric voter to obtain the final prediction result. The multimodal features of the alarm information are fused through feature fusion, so that the model can describe the features of the alarm information more comprehensively and accurately. Through the ensemble learning method, not only the error rate of the prediction results is reduced and the accuracy of the alarm information processing method is improved, but also the prediction results of multiple models can be combined to better generalize unknown data.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to an alarm information processing method, device and medium based on ensemble learning. Background Art

[0002] With the rapid development of today's society and the popularization and application of information technology, various security risks and network threats in systems and networks have also emerged. Various security threats such as network attacks, data leaks, malware, phishing, etc. continue to emerge. Faced with more and more security risks, it is necessary to use security risk warning methods to promptly discover and deal with potential security issues.

[0003] Alarm information is a means of early warning of security risks. Traditional alarm information processing methods mainly train models based on single features or indicators. This method makes it difficult to fully consider the interrelationships and impacts of various features in the system or network. When faced with a large amount of information with unidentified sources, it is easy for the model to process the alarm information inaccurately and unreliably. Summary of the Invention

[0004] To solve the above problems, the present application proposes an alarm information processing method based on ensemble learning, comprising: extracting multimodal features of the alarm information, normalizing the multimodal features to obtain standardized features, obtaining contributions corresponding to the standardized features, and screening out the standardized features whose contributions are higher than a preset range;

[0005] By using a feature transformation method, the dimensions of the standardized features are changed, from the original space to the space of the required dimensions, and feature weighting is performed based on the weights assigned to the standardized features to fuse the standardized features;

[0006] Determining a neural network architecture, constructing a neural network model, randomly dividing the fused standardized features into a training set, a validation set, and a test set, and training the neural network model based on the training set to obtain a first ensemble learning branch based on the neural network model;

[0007] Preprocessing the image features in the multimodal features to construct a cascaded deep network, and training different layers of the cascaded deep network using different network models based on the preprocessed image features to obtain a second ensemble learning branch based on the cascaded deep network;

[0008] The first ensemble learning branch and the second ensemble learning branch are used as parallel network branches, and the outputs of the first ensemble learning branch and the second ensemble learning branch are selected based on an asymmetric voter to obtain a final prediction result.

[0009] On the other hand, the present application also proposes an alarm information processing device based on ensemble learning, including:

[0010] at least one processor; and,

[0011] a memory communicatively connected to the at least one processor; wherein,

[0012] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm information processing method based on integrated learning as described in the above example.

[0013] On the other hand, the present application also proposes a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured as: the alarm information processing method based on ensemble learning described in the above example.

[0014] This application proposes an alarm information processing method based on ensemble learning, which can bring the following benefits:

[0015] Beneficial effects:

[0016] By fusing the multimodal features of the alarm information through feature fusion, we can capture the features of different aspects of the alarm information and the correlation between the features, improve the performance of the model, and enable the model to describe the features of the alarm information more comprehensively and accurately.

[0017] Through the ensemble learning method, the features of the alarm information are extracted based on multimodality and single modality respectively, and the models are trained respectively to obtain the first ensemble learning branch and the second ensemble learning branch. The output results obtained by the two branches are voted based on the voting machine, and the optimal result is comprehensively selected as the alarm information prediction result. This not only reduces the error rate of the prediction results, improves the accuracy of the alarm information processing method, and reduces false alarms and missed alarms, but also can combine the prediction results of multiple models to better generalize unknown data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 Schematic diagram of a flow chart of an alarm information processing method based on ensemble learning in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of an integrated learning method in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of image feature extraction in an embodiment of the present application;

[0022] Figure 4 Schematic diagram of cascade network training at different layers of a cascaded deep network in an embodiment of the present application;

[0023] Figure 5 This is a schematic diagram of the second-layer cascade network training of the cascaded deep network in an embodiment of the present application;

[0024] Figure 6 This is a schematic diagram of an alarm information processing device based on ensemble learning in an embodiment of the present application. DETAILED DESCRIPTION

[0025] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0027] like Figure 1 As shown, the embodiment of the present application provides an alarm information processing method based on ensemble learning, including:

[0028] S101: extracting multimodal features of alarm information, normalizing the multimodal features to obtain normalized features, obtaining contributions corresponding to the normalized features, and screening out normalized features whose contributions are higher than a preset range.

[0029] It should be noted that if Figure 2 As shown, this is a schematic diagram of the centralized learning method. In the embodiment of the present application, the output results obtained based on multimodal feature training and unimodal feature training are selected through an asymmetric voter, and the output result with the highest similarity to the true result is selected as the final prediction result, thereby improving the accuracy of the alarm information prediction.

[0030] Specifically, different deep neural network models are used to extract the multimodal features of the warning information. For example, the residual neural network model is used to extract image features, and the deep neural network is used to extract semantic features. Then, the feature data of different modalities are normalized to obtain standardized features to eliminate the dimensional differences between the multimodal features, so as to integrate and compare them. Scale the eigenvalues ​​of the multimodal features to a preset range, where x refers to the original eigenvalue of the feature and x max is the characteristic maximum value, x min is the minimum characteristic value, x norm is the normalized eigenvalue, and the preset range is (0, 1).

[0031] It should be noted that feature extraction converts raw alarm information into more discriminative and interpretable feature vectors, providing a foundation for subsequent analysis and processing. By extracting features from alarm information, operations such as classification, clustering, association, and analysis can be performed. Residual neural networks address the problem of vanishing or exploding gradients in deep networks by introducing residual connections, thereby achieving better model performance and better capturing subtle changes in input features. By replacing a single large convolution kernel with multiple small convolution kernels, deep neural networks enhance the network's nonlinear expression capabilities and provide the model with improved feature extraction capabilities.

[0032] Furthermore, the standardized features are classified according to the modality and divided into different feature groups. The mean square error within the group and the mean square error between the groups of each feature are calculated. Determine the contribution of each feature to model training and select standardized features whose contribution is higher than the preset range. b is the mean square error between groups, MS w It is the mean square error within the group. The larger the F value, the greater the contribution, which means the greater the impact of the standardized feature on the target variable. The preset range can be set to the top 25% of the contribution.

[0033] S102: By using a feature transformation method, the dimension of the standardized features is changed, and the space is converted from the original space to the space of the required dimension. Based on the weights assigned to the standardized features, feature weighting is performed to fuse the standardized features.

[0034] Specifically, after the standardized features are screened, the filtered features are transformed by the formula Y=XW to change the dimension of the standardized features and convert the features from the original space to the required space, where X represents the original feature matrix, W represents the projection feature matrix, and Y represents the transformed feature matrix. The original feature matrix X is linearly transformed by the projection matrix W. Through the feature transformation, the original high-dimensional features are mapped to a lower-dimensional feature space, thereby reducing the dimension of the features and retaining the important information in the original features. This can play a role in removing redundant features in the subsequent model training process.

[0035] Furthermore, according to the weights assigned to the standardized features, the formula The features of different modes are weighted and the features are fused to comprehensively utilize the information of each feature. fused is the fused feature, F i is the eigenvector of the i-th mode, W i is the weight corresponding to the i-th feature. By adjusting the weights reasonably, we can highlight the important features in the standardized features and suppress the unimportant features, thereby improving the overall feature expression ability.

[0036] S103: Determine a neural network architecture, construct a neural network model, randomly divide the fused standardized features into a training set, a validation set, and a test set, train the neural network model based on the training set, and obtain a first integrated learning branch based on the neural network model.

[0037] Specifically, based on a two-layer neural network, a neural network model is constructed, and the network parameters are initialized. The loss function is defined to measure the degree of difference between the predicted results of the neural network model and the true value. The fused standardized features are randomly divided into training set, validation set and test set. The neural network model is trained with the training set, the neural network model parameters are adjusted with the validation set, and the performance of the neural network model after training is evaluated with the test set.

[0038] More specifically, the feature data in the training set is randomly sampled and divided into multiple subsets. A neural network model is trained based on each subset to obtain multiple neural network sub-models. The first prediction results of each sub-model are obtained, and the first prediction results are integrated to obtain a second prediction result as the final prediction result of the neural network model. The loss function between the final prediction result and the actual result is calculated, and the parameters of the neural network model are updated based on the loss function. The model is trained until the loss function converges.

[0039] It should be noted that a two-layer neural network consists of two neural layers: one layer extracts time series features, while the other performs classification and outputs the features. The feature sequence is input into the first neural layer to obtain the time series features and their corresponding hidden states. The time series features are then passed to the second neural layer to obtain the neural network output.

[0040] Furthermore, the training results of the neural network model are verified using the validation set. The validation set is then input into the trained neural network model to obtain a third prediction result of the neural network model. The loss function between the third prediction result and the true result is calculated, thereby adjusting the parameters of the neural network model. The precision and recall of the model are then obtained using the test set to evaluate the performance of the neural network model, thereby obtaining a higher-performance neural network model. Based on the neural network model, a first ensemble learning branch is then derived.

[0041] S104: Preprocess the image features in the multimodal features to construct a cascaded deep network. Based on the preprocessed image features, different layers of the cascaded deep network are trained using different network models to obtain a second integrated learning branch based on the cascaded deep network.

[0042] Specifically, based on multimodal features, image features are obtained and preprocessed, and the original RGB color image is converted into a grayscale image to convert the image into the correct color space to reduce the time cost of image calculation and processing. The image is then cropped, scaled, and rotated to extract useful feature information, and the image features are standardized to ensure the stability of the subsequent model training process.

[0043] Furthermore, a cascaded deep network is constructed based on multiple neural networks to obtain a second ensemble learning branch based on the cascaded deep network, and a corresponding network model is created based on the cascaded deep network. The multiple neural networks include a convolutional neural network, a recurrent neural network, and a convolutional neural network VGG model. After the network model is constructed, the modules of the network model are set to lightweight modules, and the number of convolution channels of the network model is reduced to reduce the depth and width of the network model to optimize the model.

[0044] For example, the number of channels in the current convolutional layer can be halved compared to the previous convolutional layer to reduce the width of the network model; the number of nodes in the current fully connected layer can be halved compared to the previous fully connected layer to reduce the depth and width of the network model. The network model uses the depthwise separable convolution module, a lightweight module that splits the standard convolution into depthwise convolution and pointwise convolution. Depthwise convolution only considers the correlation between channels, while pointwise convolution only considers the correlation within channels. This significantly reduces the number of parameters and computation, reducing the storage space and computational cost of the network model.

[0045] Furthermore, if Figure 3 As shown, the corresponding network models are used to train different layers of the cascaded deep network. For the first layer of the cascaded network, a deep residual network model is used for training. The deep residual network model contains several convolutional layers, such as 50 convolutional layers, which contain several residual blocks and global average pooling layers. The preprocessed image features are input into the deep residual network model, and extracted by several convolutional layers to extract more streamlined first feature information. The first feature information is converted into a first feature vector through a fully connected layer. Figure 4 As shown in the figure, the 224x224x3 image is extracted through several convolutional layers and finally output as a 1x1x4096 feature.

[0046] For the second-layer cascade network, such as Figure 5 As shown, a recursive neural network is used to process sequence data through cyclic connections for training, the first eigenvector is input into the recursive neural network model, the hidden state corresponding to the first eigenvector is calculated to capture the context information of the first eigenvector, and recursion is performed to finally obtain the second eigenvector of the recursive neural network model.

[0047] For the third-layer cascade network, the second feature information of the second feature vector is extracted through the convolution layer of the convolutional neural network model, and the second feature information is normalized. The third feature vector is obtained through the fully connected layer to represent the high-level feature information of the preprocessed image features.

[0048] S105: Use the first ensemble learning branch and the second ensemble learning branch as parallel network branches, and select the outputs of the first ensemble learning branch and the second ensemble learning branch based on an asymmetric voter to obtain a final prediction result.

[0049] Specifically, an asymmetric voter is introduced to obtain the final alarm information prediction result through voting integration. The output results of the first ensemble learning branch and the second ensemble learning branch are voted and selected. The category with the most votes is selected as the final prediction result, where [h i (x) is the output result of the i-th branch, and C represents all possible categories.

[0050] By fusing the multimodal features of the alarm information through feature fusion, we can capture the features of different aspects of the alarm information and the correlation between the features, improve the performance of the model, and enable the model to describe the features of the alarm information more comprehensively and accurately.

[0051] Through the ensemble learning method, the features of the alarm information are extracted based on multimodality and single modality respectively, and the models are trained respectively to obtain the first ensemble learning branch and the second ensemble learning branch. The output results obtained by the two branches are voted based on the voting device, and the optimal result is comprehensively selected as the alarm information prediction result. This not only reduces the error rate of the prediction results, improves the accuracy of the alarm information processing method, and reduces false alarms and missed alarms, but also can combine the prediction results of multiple models to better generalize unknown data.

[0052] like Figure 6 As shown, the embodiment of the present application also proposes an alarm information processing device based on ensemble learning, including:

[0053] at least one processor; and,

[0054] a memory communicatively connected to the at least one processor; wherein,

[0055] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute an alarm information processing method based on ensemble learning as described in any of the above embodiments.

[0056] An embodiment of the present application further provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to be: the alarm information processing method based on ensemble learning described in any of the above embodiments.

[0057] The various embodiments in this application are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device and medium embodiments are generally similar to the method embodiments, so their descriptions are relatively simple. For relevant portions, refer to the descriptions of the method embodiments.

[0058] The devices and media provided in the embodiments of the present application correspond one-to-one to the methods. Therefore, the devices and media also have similar beneficial technical effects to their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0059] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0060] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0061] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0062] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0063] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0064] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0065] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0066] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0067] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A warning information processing method based on ensemble learning, characterized in that: include: Extracting multimodal features of the alarm information, normalizing the multimodal features to obtain standardized features, obtaining contributions corresponding to the standardized features, and screening out the standardized features whose contributions are higher than a preset range; By using a feature transformation method, the dimensions of the standardized features are changed, from the original space to the space of the required dimensions, and feature weighting is performed based on the weights assigned to the standardized features to fuse the standardized features; Determining a neural network architecture, constructing a neural network model, randomly dividing the fused standardized features into a training set, a validation set, and a test set, and training the neural network model based on the training set to obtain a first ensemble learning branch based on the neural network model; Preprocessing the image features in the multimodal features to construct a cascaded deep network, and training different layers of the cascaded deep network using different network models based on the preprocessed image features to obtain a second ensemble learning branch based on the cascaded deep network; The first ensemble learning branch and the second ensemble learning branch are used as parallel network branches, and the outputs of the first ensemble learning branch and the second ensemble learning branch are selected based on an asymmetric voter to obtain a final prediction result.

2. The method according to claim 1, characterized in that The training of different layers of the cascaded deep network using different network models based on the pre-processed image features specifically includes: For the first layer of the cascade network, extract first feature information of the preprocessed image features through several convolutional layers of the deep residual network model, simplify the first feature information, and convert the first feature information into a first feature vector through a fully connected layer; For the second-layer cascade network, input the first feature vector into a recursive neural network model, calculate the hidden state corresponding to the first feature vector to capture context information of the first feature vector, and obtain a second feature vector of the recursive neural network model; For the third-layer cascade network, the second feature information of the second feature vector is extracted through the convolution layer of the convolutional neural network model, and the second feature information is normalized, and the third feature vector is obtained through the fully connected layer to represent the high-level feature information of the preprocessed image features.

3. The method according to claim 1, characterized in that Before respectively training different layers of the cascaded deep network using different network models, the method further includes: The network model's modules are set as lightweight modules and the number of convolution channels of the network model is reduced to reduce the depth and width of the network model to optimize the model.

4. The method according to claim 1, wherein The step of extracting multimodal features of the warning information and standardizing the multimodal features specifically includes: Different deep neural network models are used to extract the multimodal features of warning information; A normalization method is used to scale the feature values ​​of the multimodal features to within a preset range, and the extracted multimodal features are normalized based on the preset range.

5. The method according to claim 1, characterized in that The obtaining of the contribution corresponding to the standardized features and screening out the standardized features whose contribution is higher than a preset range specifically includes: Classifying the standardized features according to the modality into different feature groups, and obtaining the within-group mean square error and the between-group mean square error of each standardized feature; According to the within-group mean square error and the between-group mean square error, the contribution corresponding to the standardized feature is determined, and the standardized feature whose contribution is higher than a preset range is screened out.

6. The method according to claim 1, characterized in that Determining the neural network architecture and building the neural network model specifically include: Based on the two-layer neural network, build a neural network model and initialize the network parameters; A loss function is defined to measure the degree of difference between the prediction results of the neural network model and the true value.

7. The method according to claim 1, characterized in that The training of the neural network model based on the training set specifically includes: Randomly dividing the feature data in the training set into a plurality of subsets, and inputting the subsets into a plurality of neural network models for training, respectively, to obtain first prediction results of the plurality of neural network models; The first prediction results are integrated to obtain a second prediction result of the neural network model, a loss function between the second prediction result and the true result is calculated, the parameters of the neural network model are updated based on the loss function, and training is continued until the loss function converges.

8. The method according to claim 7, characterized in that After updating the parameters of the neural network model based on the loss function and continuing training until the loss function converges, the method further includes: Using the validation set to validate the training of the neural network model, inputting the validation set as an input sequence into the neural network model to obtain a third prediction result of the neural network model; Adjusting the parameters of the neural network model according to the third prediction result; The accuracy and recall of the neural network model are obtained through the test set, and the neural network model is evaluated.

9. An alarm information processing device based on ensemble learning, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm information processing method based on ensemble learning as described in any one of claims 1 to 8.

10. A non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured as: the alarm information processing method based on ensemble learning as described in any one of claims 1 to 8.

Images