Methods, apparatuses, devices, media, and program products for defending against cyber attacks

Abstract

The present disclosure provides a method, device, equipment, medium and program product for preventing network attacks, which can be applied to the fields of artificial intelligence and information security technology. The method comprises: identifying a user access request by using a pre-trained user input identification model to obtain an identification result, wherein the identification result comprises that the user access request belongs to one of a safe category, a risk category and an unsafe category, wherein the safety levels of the safe category, the risk category and the unsafe category decrease in turn; when the user access request belongs to the risk category, matching the user access request with a keyword in a vulnerability vocabulary library; if the matching is successful, intercepting the user access request, otherwise, releasing the user access request.

Description

Technical Field

[0001] This disclosure relates to the fields of artificial intelligence and information security technology, and more specifically to a method, apparatus, device, medium, and program product for preventing cyberattacks. Background Technology

[0002] With the rapid development of the internet, people's production and lives have become increasingly digitized and intelligent. Web applications, due to their convenience and openness, have become the mainstream network application, allowing users to better enjoy network services. However, as the complexity of web application functions increases, many problems have gradually emerged, such as SQL injection attacks, cross-site scripting (XSS) attacks, and cross-site request forgery (CSRF) attacks, posing a significant threat to the network security of web applications. Existing technologies utilize training machine learning models to identify legitimate and malicious user access, becoming an effective means of preventing network attacks.

[0003] In the process of realizing this solution concept, the inventors discovered that existing methods for preventing cyberattacks by training machine learning models have the following drawbacks: the recognition effectiveness of machine learning models is affected by the size and richness of the training dataset, inevitably leading to misjudgments, which in turn introduces security risks or causes over-interception. Summary of the Invention

[0004] In view of the above problems, this disclosure provides methods, apparatus, devices, media and program products for preventing network attacks that improve the efficiency and accuracy of preventing network attacks.

[0005] A first aspect of this disclosure provides a method for preventing network attacks. The method includes: acquiring a user access request; identifying the user access request using a pre-trained user input recognition model to obtain an identification result; wherein the identification result includes whether the user access request belongs to one of a secure category, a risk category, and an insecure category; wherein the security level of the secure category, risk category, and insecure category decreases sequentially; and processing the user access request based on the identification result, including: when the user access request belongs to a risk category, matching the user access request with keywords in a vulnerability vocabulary database; if the match is successful, blocking the user access request; otherwise, allowing the user access request.

[0006] According to embodiments of this disclosure, matching the user access request with keywords in the vulnerability vocabulary database includes: segmenting the user access request into words to obtain a set of words to be matched; and matching the words in the set of words to be matched with the keywords in the vulnerability vocabulary database using a string matching algorithm.

[0007] According to embodiments of this disclosure, matching the user access request with keywords in a vulnerability vocabulary includes: segmenting the user access request into words to obtain a set of words to be matched; extracting the vector representation of each word in the set of words to be matched using a word vector model; wherein the word vector model is the model used to extract the vector representation of each keyword in the vulnerability vocabulary, and the vulnerability vocabulary stores the vector representation of each keyword; calculating the similarity between the words in the set of words to be matched and the keywords in the vulnerability vocabulary based on the vector representation of the words; and determining that the match is successful when at least one calculated similarity value is greater than or equal to a preset similarity threshold, otherwise the match is unsuccessful.

[0008] According to embodiments of this disclosure, in the vulnerability vocabulary database, each keyword has a similarity to at least one other keyword that is greater than or equal to a preset similarity threshold.

[0009] According to embodiments of this disclosure, the vulnerability vocabulary is constructed as follows: a vulnerability attack corpus is constructed, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus; the vulnerability attack corpus in the vulnerability attack corpus is segmented into words to obtain a segmentation result set; a word vector model is trained using the segmentation result set; the vector representation of each word in the segmentation result set is extracted using the trained word vector model; the similarity between words in the segmentation result set is calculated based on the vector representation of each word in the segmentation result set; and words with a similarity greater than or equal to the similarity threshold are selected from the segmentation result set as keywords and stored in the vulnerability vocabulary.

[0010] According to an embodiment of this disclosure, the construction of the vulnerability attack corpus further includes: when the user access request belongs to an insecure category, storing the code of the user access request into the vulnerability attack corpus to update the vulnerability attack corpus.

[0011] According to embodiments of this disclosure, the step of performing word segmentation on the vulnerability attack corpus in the vulnerability attack corpus to obtain a word segmentation result set further includes: counting the frequency of occurrence of each word in the word segmentation result set; and filtering out words in the word segmentation result set whose frequency is lower than a preset frequency threshold.

[0012] According to embodiments of this disclosure, the method further includes: obtaining a matching result by matching the user access request with keywords in the vulnerability vocabulary; labeling the user access request with tags corresponding to the matching result to obtain a training sample data; wherein, when the matching result is a successful match, the tag corresponding to the matching result indicates that the user access request belongs to the insecure category; when the matching result is an unsuccessful match, the tag corresponding to the matching result indicates that the user access request belongs to the secure category; expanding the training sample data into updated training data; and using the updated training data to train and update the user input recognition model.

[0013] According to embodiments of this disclosure, the step of using a user input recognition model to identify the user access request and obtain the identification result includes: obtaining the probability that the user access request is vulnerable to attack as predicted by the user input recognition model; determining that the user access request belongs to a secure category when the probability is less than a first probability threshold; determining that the user access request belongs to an insecure category when the probability is greater than a second probability threshold; wherein the second probability threshold is greater than the first probability threshold; and determining that the user access request belongs to a risk category when the probability is greater than or equal to the first probability threshold and less than or equal to the second probability threshold.

[0014] According to embodiments of this disclosure, processing the user access request based on the identification result further includes: intercepting the user access request when it belongs to an insecure category; and allowing the user access request when it belongs to a secure category.

[0015] According to embodiments of this disclosure, the user input recognition model includes a convolutional module, which includes a first pointwise convolutional module, a depthwise convolutional module, and a second pointwise convolutional module. Data input to the first pointwise convolutional module is processed by the first pointwise convolutional module, then processed by a first activation function, and finally input to the depthwise convolutional module. Data input to the depthwise convolutional module is processed by the depthwise convolutional module, then processed by a second activation function, and finally input to the second pointwise convolutional module.

[0016] A second aspect of this disclosure provides an apparatus for preventing network attacks. The apparatus includes an acquisition module, a user input recognition module, and a processing module. The processing module includes a secondary verification module. The acquisition module acquires user access requests. The user input recognition module includes a pre-trained user input recognition model, used to recognize the user access request using the user input recognition model to obtain a recognition result; wherein the recognition result includes whether the user access request belongs to a secure category, a risk category, or an insecure category; wherein the security level of the secure category, risk category, and insecure category decreases sequentially; and the processing module processes the user access request based on the recognition result; the processing module includes a secondary verification module; wherein the secondary verification module is used to: when the user access request belongs to a risk category, match the user access request with keywords in a vulnerability vocabulary database; if the match is successful, block the user access request; otherwise, allow the user access request.

[0017] According to embodiments of this disclosure, the processing module is further configured to: intercept the user access request when the user access request belongs to an insecure category; and allow the user access request when the user access request belongs to a secure category.

[0018] According to embodiments of this disclosure, the apparatus further includes a vulnerability vocabulary building module. The vulnerability vocabulary building module is used to build a vulnerability vocabulary, specifically including: building a vulnerability attack corpus, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus, the vulnerability attack corpus being at least one of vulnerability attack code, malicious code fragments, HTML tags, or JavaScript tags; performing word segmentation processing on the vulnerability attack corpus in the vulnerability attack corpus to obtain a word segmentation result set; training a word vector model using the word segmentation result set; extracting the vector representation of each word in the word segmentation result set using the trained word vector model; calculating the similarity between words in the word segmentation result set based on the vector representation of each word in the word segmentation result set; and selecting words from the word segmentation result set whose similarity is greater than or equal to the similarity threshold as keywords and storing them in the vulnerability vocabulary.

[0019] According to embodiments of this disclosure, the apparatus further includes a model update module. The model update module is configured to: obtain a matching result obtained by matching the user access request with keywords in the vulnerability vocabulary; label the user access request with a tag corresponding to the matching result to obtain a training sample data; wherein, when the matching result is successful, the tag corresponding to the matching result indicates that the user access request belongs to the insecure category; when the matching result is unsuccessful, the tag corresponding to the matching result indicates that the user access request belongs to the secure category; then expand the training sample data into updated training data; and use the updated training data to train and update the user input recognition model.

[0020] A third aspect of this disclosure provides an electronic device. The electronic device includes one or more processors and a memory. The memory is used to store one or more programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method for preventing network attacks provided in the first aspect above.

[0021] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the steps of the method for preventing network attacks provided in the first aspect.

[0022] A fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method for preventing network attacks provided in the first aspect. Attached Figure Description

[0023] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 The illustration schematically depicts application scenarios of methods, apparatuses, devices, media, and program products for preventing cyberattacks according to embodiments of the present disclosure;

[0025] Figure 2 A flowchart illustrating a method for preventing cyberattacks according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 3 The flowchart illustrating the construction of a vulnerability vocabulary library in a method according to an embodiment of this disclosure is shown in the schematic diagram.

[0027] Figure 4 This illustration schematically shows a flowchart of matching user access requests and a vulnerability vocabulary in a method according to an embodiment of the present disclosure;

[0028] Figure 5 A flowchart illustrating the matching of user access requests and vulnerability vocabularies in a method according to another embodiment of this disclosure is shown schematically.

[0029] Figure 6 This illustration schematically shows a network architecture diagram of a user input recognition model according to an embodiment of the present disclosure;

[0030] Figure 7 Schematic illustration Figure 6 An example of a core module in the user input recognition model shown;

[0031] Figure 8 A flowchart illustrating a method for preventing cyberattacks according to another embodiment of this disclosure is shown schematically.

[0032] Figure 9 A block diagram schematically illustrates an apparatus for preventing cyberattacks according to embodiments of the present disclosure; and

[0033] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a method for preventing cyberattacks according to embodiments of the present disclosure. Detailed Implementation

[0034] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0035] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0036] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0037] In the technical solution of this invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0038] Embodiments of this disclosure provide a method, apparatus, device, medium, and program product for preventing cyberattacks.

[0039] According to embodiments of this disclosure, user access requests generated based on web user input can first undergo security risk identification using a user input recognition model built on machine learning algorithms. Based on the security level of the user input, it can be categorized into one of three classes: secure, risky, or insecure, with the security level decreasing sequentially from secure to risky to insecure. Then, for user access requests categorized as risky, a pre-built vulnerability vocabulary can be used for keyword matching. Based on the matching results, it can be further determined whether to block or allow the user access request. The vulnerability vocabulary stores keywords from web vulnerability attack corpora. This approach overcomes the problem that single models, when identifying the security of user input, often categorize user access requests in the middle ground between clearly secure and clearly insecure into either a secure or insecure category, leading to security risks or excessive blocking.

[0040] It should be noted that the methods, apparatus, devices, media and program products for preventing network attacks provided in the embodiments of this disclosure can be used in the financial field, or in any field other than the financial field. This disclosure does not limit the application field.

[0041] Figure 1 The illustration schematically depicts application scenarios of methods, apparatuses, devices, media, and program products for preventing cyberattacks according to embodiments of the present disclosure.

[0042] like Figure 1As shown, application scenario 100 according to this embodiment may include at least one terminal device (three are shown in the figure: terminal devices 101, 102, and 103), a network 104, and a server 105. Network 104 serves as a medium for providing a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0043] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0044] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0045] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0046] In some embodiments, the method for preventing network attacks provided in this disclosure can be executed by server 105. For example, when server 105 receives user access requests sent by terminal devices 101, 102, and 103, it can first execute the method for preventing network attacks according to this disclosure, and then only respond normally to user access requests that can be allowed, while not responding to user access requests that need to be blocked, for example, returning access error information to the client. In this way, server 105 is effectively prevented from being attacked by network attacks. Accordingly, the apparatus, device, medium, and program products for preventing network attacks provided in this disclosure can generally be installed in server 105.

[0047] In other embodiments, the method for preventing network attacks provided in this disclosure can be executed by other devices communicating with server 105. For example, when server 105 receives user access requests from terminal devices 101, 102, and 103, it can first send the user access requests to the other devices, which will then execute the method for preventing network attacks provided in this disclosure, determine the user access requests, and provide the server 105 with the processing result of allowing or blocking them. Server 105 only responds normally to user access requests that are allowed by the processing result, and does not respond to user access requests that need to be blocked, for example, it can return access error information to the client. Accordingly, the apparatus, device, medium, and program products for preventing network attacks provided in this disclosure can be installed in other devices communicating with server 105.

[0048] In some embodiments, the method for preventing network attacks provided in this disclosure can also be partially executed by terminal devices 101, 102, and 103, and partially executed by server 105 (or other devices communicating with server 105). For example, user input recognition models can be installed in terminal devices 101, 102, and 103. When terminal devices 101, 102, and 103 receive a user access request generated based on user input, they can first use the user input recognition model to identify the user access request. User access requests identified as secure or insecure can be allowed or blocked. For user access requests identified as having security risks, they can be sent to server 105, where server 105 can call a vulnerability vocabulary database for matching. Accordingly, the apparatus, device, medium, and program products for preventing network attacks provided in this disclosure can be partially disposed in terminal devices 101, 102, and 103, and partially disposed in server 105 (or other devices communicating with server 105).

[0049] Understandable. Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included. Figure 1 The application scenario shown is merely an example and does not constitute a limitation of this disclosure.

[0050] The following will be based on Figure 1 The described scene, through Figures 2-8 The method for preventing cyberattacks according to embodiments of this disclosure will be described in detail.

[0051] Figure 2 A flowchart illustrating a method for preventing cyberattacks according to an embodiment of this disclosure is shown schematically.

[0052] like Figure 2As shown, the method for preventing network attacks in this embodiment may include operations S210 to S220, operations S231, S232, or operations S2331 to S2334.

[0053] In operation S210, the user access request is obtained.

[0054] In operation S220, a pre-trained user input recognition model is used to identify user access requests and obtain recognition results.

[0055] The identification result includes whether the user access request belongs to one of the following categories: secure, risky, or insecure; wherein the security level of the secure, risky, and insecure categories decreases sequentially. The security level can be represented by the probability (or range) of a vulnerability attack on the user access request predicted by the user input identification model, or the probability (or range or level) of the security level.

[0056] Next, based on the identification results, user access requests can be processed according to three branches.

[0057] Specifically, in branch one, operation S231 is executed, and when the identification result indicates that the user access request belongs to the insecure category, the user access request is intercepted.

[0058] In branch two, operation S232 is executed. When the identification result indicates that the user access request belongs to the security category, the user access request is allowed.

[0059] Execute operations S2331 to S2334 in branch three.

[0060] In operation S2331, when the identification result indicates that the user access request belongs to a risk category, the user access request is matched with keywords in the vulnerability vocabulary database. The keywords in the vulnerability vocabulary database are extracted from a large amount of collected vulnerability attack corpus.

[0061] During operation S2332, a match is determined. A successful match is achieved if at least one keyword from the vulnerability vocabulary database is found; otherwise, the match is considered unsuccessful.

[0062] If a match is found, execute operation S2333 to intercept the user's access request.

[0063] If the match fails, execute operation S2334 to allow the user's access request.

[0064] In one embodiment, the user input recognition model can be a three-classification model, which can classify user access requests into a secure category, a risk category, or an insecure category, wherein the security level of the secure category, risk category, and insecure category decreases in that order.

[0065] In other embodiments, the user input recognition model can also be a binary classification model, for example, dividing user access requests into two categories: secure and those with security risks. In this case, during operation S220, when a user access request is identified as belonging to the category with security risks, the probability of a vulnerability attack predicted by the user input recognition model can be further obtained. Then, requests with a probability greater than a certain threshold (e.g., 90%) are identified as insecure and processed according to branch one above; while other cases are classified into the risk category and processed according to branch three above.

[0066] In another embodiment, operation S220 can directly obtain the probability that the user input recognition model predicts a vulnerability attack in the user access request, and determine which of the three branches to execute based on this probability value. For example, when the predicted probability is less than a first probability threshold, the user access request is determined to belong to the secure category, and is processed according to branch three; when the probability is greater than a second probability threshold, the user access request is determined to belong to the insecure category, and is processed according to branch one; wherein, the second probability threshold is greater than the first probability threshold. Furthermore, when the probability is greater than or equal to the first probability threshold and less than or equal to the second probability threshold, the user access request is determined to belong to the risk category, and is processed according to branch two.

[0067] As can be seen, in this embodiment of the disclosure, for user access requests that fall between clearly secure and clearly insecure as identified by the user input recognition model, a secondary verification is performed using a vulnerability vocabulary database different from machine learning algorithms. This multi-verification judgment using different recognition and verification methods improves the reliability of security risk judgment results, reduces the impact of misjudgment by a single model, and improves the efficiency and accuracy of preventing network attacks.

[0068] According to some embodiments of this disclosure, after operation S2333 or S2334, the user access request can be labeled based on the matching results between the user access request and keywords in the vulnerability vocabulary to generate updated training data for updating the user input recognition model, thus helping the user input recognition model to learn online. Specifically, firstly, the matching results obtained by matching the user access request with keywords in the vulnerability vocabulary are acquired. Then, the user access request is labeled with tags corresponding to the matching results to obtain a training sample data. When the matching result is successful, the tag corresponding to the matching result indicates that the user access request belongs to the insecure category; when the matching result is unsuccessful, the tag corresponding to the matching result indicates that the user access request belongs to the secure category. Next, the training sample data is expanded into the updated training data. Then, when the amount of updated training data accumulates to a certain extent, the updated training data can be used to train and update the user input recognition model, improving the adaptability of the user input recognition model.

[0069] Figure 3 The flowchart illustrating the construction of a vulnerability vocabulary library in a method according to an embodiment of the present disclosure is shown schematically.

[0070] like Figure 3 As shown in the embodiments of this disclosure, the process of constructing a vulnerability vocabulary database may include operations S301 to S306.

[0071] In operation S301, a vulnerability attack corpus is constructed, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus. The vulnerability attack corpus includes, but is not limited to: vulnerability attack code, malicious code snippets, HTML tags, or JavaScript tags.

[0072] In operation S302, the vulnerability attack corpus in the vulnerability attack corpus is segmented into words to obtain a segmentation result set.

[0073] In some embodiments, after segmenting the vulnerability attack corpus in the vulnerability attack corpus, the frequency of each word in the segmentation result set can be counted, and then words with a frequency lower than a preset frequency threshold in the segmentation result set can be filtered out to improve the redundant information in the original vocabulary used to build the vulnerability vocabulary database and reduce noise.

[0074] In operation S303, the Word2Vec word vector model (abbreviated as Word2Vec model) is trained using the word segmentation result set.

[0075] Then, S304 is used to extract the vector representation of each word in the word segmentation result set using the trained Word2Vec model.

[0076] Next, in operation S305, the similarity between words in the segmentation result set is calculated based on the vector representation of each word in the segmentation result set.

[0077] Finally, in operation S306, words with similarity greater than or equal to the similarity threshold are selected from the word segmentation result set as keywords and stored in the vulnerability vocabulary database.

[0078] This example illustrates how to build an XSS vulnerability vocabulary database. The XSS vulnerability vocabulary database can store keywords extracted from common XSS attack code, malicious code snippets, and specific HTML and JavaScript tags.

[0079] Specifically, data collection begins first. In one embodiment, to collect a large-scale XSS attack code corpus, a simulated testing environment for testing and researching cross-site scripting attacks can be created. In this environment, a website can be built, and automated scanning tools can be used to automatically send malicious script code and check for and collect response code that contains vulnerabilities or potential vulnerabilities. Additionally, large-scale XSS attack code collected during system operation through testing or monitoring can also be added to the corpus, thereby constructing an XSS vulnerability attack corpus in operation S301.

[0080] Next, word segmentation processing; word segmentation tools can be used to segment the corpus collected from the above XSS vulnerability attack corpus.

[0081] Next, a lexicon is built. Based on the word segmentation results, the frequency of each word can be counted. A dictionary data structure can be used to store the words and their frequency information. A frequency threshold (e.g., 0.8) can be set to filter out low-frequency words.

[0082] Next, we train the Word2Vec model; we use a segmented XSS attack corpus to train the Word2Vec model.

[0083] Next, keyword extraction is performed. Using a trained Word2Vec model, keywords are extracted by calculating the similarity between words (either k-nearest neighbor clustering or similarity threshold comparison can be used to extract keywords, and the extracted keywords are input into the vulnerability vocabulary database).

[0084] Finally, the keywords selected in the above steps are stored in the XSS vulnerability vocabulary database.

[0085] This XSS vulnerability vocabulary can be used in the previous branch three to match potential XSS attack code.

[0086] It is understood that when the method of this embodiment is used to prevent XSS attacks, the user input recognition model is a machine learning model trained using training data of XSS attacks to identify XSS attacks, and the corresponding vulnerability vocabulary can be the aforementioned XSS vulnerability vocabulary. When the method of this embodiment is used to prevent other network attacks, the user input recognition model is a machine learning model trained using training data of other network attacks to identify those other network attacks, and the corresponding vulnerability vocabulary is a vulnerability vocabulary obtained by processing the corpus of other network attacks.

[0087] According to embodiments of this disclosure, after constructing a vulnerability vocabulary database through operations S301-S306, during the process of preventing network attacks, if a user inputs an insecure user access request identified by the recognition model, the code of the insecure user access request identified by the recognition model can be stored in the vulnerability attack corpus to update the vulnerability attack corpus constructed in operation S301. Thus, based on the updates to the vulnerability attack corpus, operations S302-S306 can be executed periodically or triggered by conditions (e.g., when the number of updates in the vulnerability attack corpus reaches a predetermined amount) to update the vulnerability vocabulary database. As the vulnerability vocabulary database continues to improve, the accuracy of identifying potential attack requests using the vulnerability vocabulary database in the above-mentioned branch three will also continuously increase.

[0088] Figure 4 The flowchart illustrating the process of matching user access requests and vulnerability vocabularies in operation S2331 is shown in one embodiment of the present disclosure.

[0089] like Figure 4 As shown, according to this embodiment, the process of matching user access requests and vulnerability vocabulary in operation S2331 may include operations S401 to S402.

[0090] In operation S401, the user access request is segmented to obtain a set of words to be matched.

[0091] Then, in step S402, a string matching algorithm is used to match words in the set of words to be matched against keywords in the vulnerability vocabulary. For example, the Aho-Corasick string matching algorithm is used to match the vulnerability vocabulary. If a keyword in the vulnerability vocabulary is matched, the user's access request is blocked to prevent malicious behavior; if no keyword in the vulnerability vocabulary is matched, the user's access request is marked as risk-free and can be allowed to access the user.

[0092] Figure 5 The flowchart illustrating the process of matching user access requests and vulnerability vocabularies in operation S2331 is shown in another embodiment of the method of this disclosure.

[0093] like Figure 5 As shown, according to this embodiment, when the vulnerability vocabulary database stores the vector representation of each keyword extracted using the Word2Vec model, the process of matching the user access request and the vulnerability vocabulary database in operation S2331 may include operations S501 to S504.

[0094] In operation S501, the user access request is segmented to obtain a set of words to be matched.

[0095] In the S502 operation, the Word2Vec model is used to extract the vector representation of each word in the set of words to be matched. This Word2Vec model is the word vector model used when extracting the vector representation of each keyword in the vulnerability vocabulary.

[0096] In one embodiment, the Word2Vec model used in operation S502 may be the Word2Vec model trained in the aforementioned operation S303.

[0097] In operation S503, based on the vector representation of words, the similarity between words in the set of words to be matched and keywords in the vulnerability vocabulary is calculated.

[0098] In operation S504, if the calculated similarity value is greater than or equal to the preset similarity threshold, the match is determined to be successful; otherwise, the match is unsuccessful.

[0099] According to embodiments of this disclosure, when the vulnerability vocabulary stores vector representations of each keyword, a successful match can be determined based on word similarity according to the word vector representations. In particular, when the Word2Vec model is used in the construction of the vulnerability vocabulary, the rapid extraction of word vector representations using this model greatly facilitates word similarity calculation.

[0100] Furthermore, when the Word2Vec model is trained using word segmentation from a vulnerability attack corpus, it can more effectively combine the environment and context of the vulnerability attack corpus to identify the vector representation of words, thereby further improving the accuracy and reliability of the matching results.

[0101] In one embodiment, the similarity threshold used in operation S504 is the same as the similarity threshold used in operation S306 when selecting keywords from the vulnerability vocabulary. That is, a successful match in operation S504 means that the matched keyword meets the conditions for being stored in the vulnerability vocabulary as a keyword, indicating that the user access request has vulnerability attack characteristics. Correspondingly, if a word that successfully matches the vulnerability vocabulary in operation S504 has not yet appeared in the vulnerability vocabulary, it can be stored as a keyword in the vulnerability vocabulary to update it. Similarly, as the vulnerability vocabulary is continuously improved, the accuracy and efficiency of identifying potential attack requests using the vulnerability vocabulary in the aforementioned branch three will also continuously improve.

[0102] Figure 6The diagram illustrates the network architecture of a user input recognition model according to an embodiment of this disclosure. In this embodiment, the user input model performs security identification of user access requests, which can be achieved by using deep learning and Natural Language Processing (NLP) techniques to initially identify whether there are security risks in the user access requests.

[0103] like Figure 6 As shown, in one embodiment, the user input recognition model can be a binary classification model improved based on the BERT model. The main workflow of the user input model is as follows: the user access request x is serialized into serialized data E through a BERT layer, then learned by a multi-layer Transformer-S encoder to obtain the text feature representation T. The feature representation T is then learned through a two-layer gated recurrent network and subjected to two fully connected layers. Finally, the output of the fully connected layers is softmax normalized to obtain a probability distribution matrix indicating whether the user access request is risky or not. The index of the maximum value can be taken to obtain the probability of whether the user input is risky. Then, according to the embodiments of this disclosure, this probability can be used to determine which of the three branches described above should be processed next.

[0104] The core module, the Transformer-S encoder, incorporates convolutional concepts, enabling more accurate learning of local information on long sequences. Furthermore, a two-layer gated recurrent network (GRU) is added after the BERT model to address long-term dependency issues and gradient problems during backpropagation.

[0105] In one embodiment, the core module, the Transformer-S encoder, includes a convolutional module (e.g., ConvNlpBlock). This convolutional module comprises a first pointwise convolutional module, a depthwise convolutional module, and a second pointwise convolutional module. The data processing procedure of the convolutional modules is as follows: data input to the first pointwise convolutional module is processed by the first pointwise convolutional module, then processed by a first activation function, and input to the depthwise convolutional module. Then, data input to the depthwise convolutional module is processed by the depthwise convolutional module, then processed by a second activation function, and input to the second pointwise convolutional module. This combination of pointwise, depthwise, and pointwise convolution allows for scanning via row and column computation, avoiding full scanning during convolution and reducing the computational load. The structure and processing flow of the core module in one embodiment are as follows: Figure 7 As shown.

[0106] Figure 7 Schematic illustration Figure 6 An example of a core module in the user input recognition model shown.

[0107] like Figure 7 As shown, the core module, the Transformer-S encoder, can include a ConvNlp Block, which is connected after LayerNormalization. After receiving learning from the multi-head self-attention module, and quickly converging the results through residual connections and LayerNormalization, this module first uses pointwise convolution to strengthen the contextual relationships between channels, then uses the Glu activation function to better capture long-term dependencies in the projected sequence data, followed by a depthwise convolution module to fully fuse local information. Subsequently, it continuously uses the ReLU activation function, normalization, and pointwise convolution to adjust the number of channels and deepen the learning depth. Finally, dropout reduces the probability of overfitting, and residual connections are made with the initial data to obtain the final text feature representation for downstream processing. The learning depth N of the convolution module can be adjusted based on specific experimental results.

[0108] In other embodiments, when the user input recognition model is a binary classification model, when applying the method of this disclosure, user access requests identified by the user input recognition model as having security risks (including user access requests in branches one and three described above) can all be processed according to branch three described above. For example, in binary classification, the threshold for the probability of having security risks can be set relatively low. User access requests with a probability lower than this threshold are explicitly identified as safe and processed according to branch two. For user access requests classified as having security risks, secondary verification can be performed uniformly through the vulnerability vocabulary database in branch three. Figure 8 An example is provided.

[0109] Figure 8 A flowchart illustrating a method for preventing cyberattacks according to another embodiment of this disclosure is shown schematically.

[0110] like Figure 8 As shown, firstly, a training dataset for training a user input recognition model is constructed by collecting, statistically analyzing, and labeling a large amount of normal user input and malicious input data. Then, this training dataset is used to train the user input recognition model. Next, a large amount of malicious input corpus data is collected to construct a vulnerability vocabulary database.

[0111] Next, each user input is processed by a user input recognition model, which uses binary classification to determine if the input poses a potential attack risk. If the input is deemed risk-free, it is allowed to proceed; otherwise, a secondary verification is performed. In this secondary verification, the user input is matched against keywords in a vulnerability vocabulary database. If at least one keyword is matched, the input is considered risky. If no keyword is matched, the input is deemed risk-free and allowed to proceed.

[0112] The user input recognition model can be as follows: Figure 6 and Figure 7 This model is an improvement on the BERT model. This allows the user input recognition model library to extract deep semantic features from the natural language in user input, better distinguishing between normal and malicious input, and reducing the false positive rate.

[0113] Meanwhile, as the vulnerability vocabulary database continues to improve, the accuracy and efficiency of secondary verification will also continue to increase. For potential attacks initially identified, the vulnerability vocabulary database will be used for secondary verification to reduce the impact of misjudgment by a single model and improve the efficiency and accuracy of preventing network attacks.

[0114] Based on the methods for preventing network attacks described in the above embodiments, this disclosure also provides an apparatus for preventing network attacks. The following will be combined with... Figure 9 The device is described in detail.

[0115] Figure 9 A block diagram of an apparatus 900 for preventing cyberattacks according to an embodiment of the present disclosure is shown schematically.

[0116] like Figure 9 As shown, according to this embodiment, the device 900 may include an acquisition module 910, a user input recognition module 920, and a processing module 930. The processing module 930 includes a secondary verification module 931.

[0117] The acquisition module 910 is used to acquire user access requests. In one embodiment, the acquisition module 910 can perform the operation S210 described above.

[0118] The user input recognition module 920 includes a user input recognition model, used to identify user access requests and obtain recognition results; wherein the user input recognition model is a trained machine learning model. The recognition results indicate whether the user access request belongs to one of three categories: secure, risky, or insecure; wherein the security level of the secure, risky, and insecure categories decreases sequentially. In one embodiment, the user input recognition module 920 can perform the operation S220 described above.

[0119] The processing module 930 is used to process user access requests based on the recognition results.

[0120] Specifically, the processing module 930 can be used to intercept a user access request when the user access request belongs to an insecure category. In one embodiment, the processing module 930 can perform the operation S231 described above.

[0121] The processing module 930 can also be used to allow user access requests when the user access request belongs to a security category. In one embodiment, the processing module 930 can perform the operation S232 described above.

[0122] The processing module 930 can also be used to call the secondary verification module 921 when the user access request belongs to a risk category.

[0123] The secondary verification module 921 is used to: match the user access request with keywords in the vulnerability vocabulary when the user access request belongs to a risk category; if the match is successful, the user access request is blocked; otherwise, the user access request is allowed. In one embodiment, the secondary verification module 921 can perform operations S2331 to S2334 described above.

[0124] Furthermore, according to another embodiment of this disclosure, the device 900 may also include a vulnerability vocabulary database construction module.

[0125] The vulnerability vocabulary building module is used to construct a vulnerability vocabulary library, specifically including: constructing a vulnerability attack corpus, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus, which is at least one of vulnerability attack code, malicious code fragments, HTML tags, or JavaScript tags; performing word segmentation on the vulnerability attack corpus in the vulnerability attack corpus to obtain a word segmentation result set; training a Word2Vec model using the word segmentation result set; extracting the vector representation of each word in the word segmentation result set using the trained Word2Vec model; calculating the similarity between words in the word segmentation result set based on the vector representation of each word in the word segmentation result set; and selecting words with a similarity greater than or equal to a similarity threshold from the word segmentation result set as keywords and storing them in the vulnerability vocabulary library. In one embodiment, the vulnerability vocabulary building module can perform operations S301 to S306.

[0126] Furthermore, according to another embodiment of this disclosure, the device 900 may also include a model update module.

[0127] The model update module is used to: obtain matching results by matching user access requests with keywords in the vulnerability vocabulary; label user access requests with tags corresponding to the matching results to obtain a training sample data; wherein, when the matching result is successful, the tag corresponding to the matching result indicates that the user access request is insecure; when the matching result is unsuccessful, the tag corresponding to the matching result indicates that the user access request is secure; expand the training sample data into the updated training data; and use the updated training data to train and update the user input recognition model.

[0128] The device 900 can perform the aforementioned... Figures 2-8 The methods for preventing cyberattacks introduced above can be found in the previous text and will not be repeated here.

[0129] According to embodiments of this disclosure, any multiple modules among the acquisition module 910, user input recognition module 920, processing module 930, vulnerability vocabulary database construction module, and model update module can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 910, user input recognition module 920, processing module 930, vulnerability vocabulary database construction module, and model update module can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), programmable logic array (PLA), system-on-a-chip, system-on-a-substrate, system-on-package, application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 910, user input recognition module 920, processing module 930, vulnerability vocabulary database construction module, and model update module can be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0130] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a method for preventing cyberattacks according to embodiments of the present disclosure.

[0131] like Figure 10As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0132] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0133] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0134] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0135] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0136] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the methods for preventing cyberattacks provided in embodiments of this disclosure.

[0137] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0138] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0139] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0142] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0143] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for preventing network attacks, wherein, The method includes: Obtain user access requests; The user access request is identified using a pre-trained user input recognition model to obtain a recognition result. The recognition result indicates that the user access request belongs to one of three categories: secure, risky, or insecure. The security level of the secure, risky, and insecure categories decreases sequentially. The user input recognition model includes a convolutional module, which comprises a first pointwise convolutional module, a depthwise convolutional module, and a second pointwise convolutional module. Data input to the first pointwise convolutional module is processed by the first pointwise convolutional module, then processed by a first activation function, and finally input to the depthwise convolutional module. Data input to the depthwise convolutional module is processed by the depthwise convolutional module, then processed by a second activation function, and finally input to the second pointwise convolutional module. Based on the identification results, the user access request is processed, including: when the user access request belongs to a risk category, matching the user access request with keywords in the vulnerability vocabulary database; if the match is successful, the user access request is blocked; otherwise, the user access request is allowed. Obtain the matching results obtained by matching the user access request with the keywords in the vulnerability vocabulary; The user access request is labeled with a tag corresponding to the matching result to obtain a training sample data; wherein, when the matching result is a successful match, the tag corresponding to the matching result indicates that the user access request belongs to the insecure category; when the matching result is an unsuccessful match, the tag corresponding to the matching result indicates that the user access request belongs to the secure category; The training sample data is then added to the updated training data; and The user input recognition model is trained and updated using the updated training data; The vulnerability vocabulary database is constructed in the following manner: Construct a vulnerability attack corpus, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus; The vulnerability attack corpus in the vulnerability attack corpus is segmented into words to obtain a segmentation result set. Train a word vector model using the word segmentation result set; The vector representation of each word in the word segmentation result set is extracted using the trained word vector model; Based on the vector representation of each word in the word segmentation result set, the similarity between words in the word segmentation result set is calculated; and Words with a similarity greater than or equal to a preset similarity threshold are selected from the word segmentation result set as keywords and stored in the vulnerability vocabulary database.

2. The method according to claim 1, wherein, The matching of the user access request with keywords in the vulnerability vocabulary database includes: The user access request is segmented into words to obtain a set of words to be matched; The string matching algorithm is used to match words in the set of words to be matched with keywords in the vulnerability vocabulary database.

3. The method according to claim 1, wherein, The matching of the user access request with keywords in the vulnerability vocabulary database includes: The user access request is segmented into words to obtain a set of words to be matched; The word vector model is used to extract the vector representation of each word in the set of words to be matched; wherein the word vector model is the model used to extract the vector representation of each keyword in the vulnerability vocabulary, wherein the vulnerability vocabulary stores the vector representation of each keyword; Based on the vector representation of words, the similarity between words in the set of words to be matched and keywords in the vulnerability vocabulary is calculated; and A match is considered successful when at least one calculated similarity value is greater than or equal to a preset similarity threshold; otherwise, the match is considered unsuccessful.

4. The method according to claim 1, wherein, The construction of the vulnerability attack corpus also includes: When the identification result indicates that the user access request belongs to the insecure category, the code of the user access request is stored in the vulnerability attack corpus to update the vulnerability attack corpus.

5. The method according to claim 1, wherein, The step of performing word segmentation on the vulnerability attack corpus in the vulnerability attack corpus to obtain the word segmentation result set also includes: Calculate the frequency of occurrence of each word in the segmentation result set; and Filter out words whose frequency in the segmentation results is lower than a preset frequency threshold.

6. The method according to claim 1, wherein, The process of using a pre-trained user input recognition model to identify the user access request and obtaining the recognition result includes: The user input recognition model is used to predict the probability that the user access request is vulnerable to attack. When the probability is less than the first probability threshold, the user access request is determined to belong to the security category; When the probability is greater than the second probability threshold, the user access request is determined to belong to the insecure category; wherein the second probability threshold is greater than the first probability threshold; and When the probability is greater than or equal to the first probability threshold and less than or equal to the second probability threshold, the user access request is determined to belong to a risk category.

7. The method according to claim 1, wherein, The step of processing the user access request based on the identification result further includes: When the user access request belongs to an insecure category, the user access request is intercepted; and If the user access request falls under the security category, the user access request is allowed.

8. A device for preventing network attacks, wherein, The device includes: The acquisition module is used to acquire user access requests; The user input recognition module includes a pre-trained user input recognition model, used to recognize the user access request using the user input recognition model to obtain a recognition result; wherein the recognition result includes whether the user access request belongs to one of the following categories: secure, risky, and insecure; wherein the security level of the secure, risky, and insecure categories decreases sequentially; wherein the user input recognition model includes a convolutional module, the convolutional module including a first pointwise convolutional module, a depthwise convolutional module, and a second pointwise convolutional module; wherein data input to the first pointwise convolutional module is processed by the first pointwise convolutional module, then processed by a first activation function, and then input to the depthwise convolutional module; and data input to the depthwise convolutional module is processed by the depthwise convolutional module, then processed by a second activation function, and then input to the second pointwise convolutional module; The processing module is used to process the user access request based on the identification result; the processing module includes a secondary verification module; wherein, the secondary verification module is used to: when the user access request belongs to a risk category, match the user access request with keywords in the vulnerability vocabulary library; if the match is successful, block the user access request; otherwise, allow the user access request. The model update module is used for: obtaining a matching result by matching the user access request with keywords in the vulnerability vocabulary; labeling the user access request with a tag corresponding to the matching result to obtain a training sample data; expanding the training sample data into the updated training data; and using the updated training data to train and update the user input recognition model; wherein, when the matching result is a successful match, the tag corresponding to the matching result indicates that the user access request belongs to the insecure category; when the matching result is an unsuccessful match, the tag corresponding to the matching result indicates that the user access request belongs to the secure category; The vulnerability vocabulary building module is used to construct a vulnerability vocabulary library, specifically for: constructing a vulnerability attack corpus, wherein the vulnerability attack corpus stores at least one vulnerability attack corpus; performing word segmentation processing on the vulnerability attack corpus in the vulnerability attack corpus to obtain a word segmentation result set; training a word vector model using the word segmentation result set; extracting the vector representation of each word in the word segmentation result set using the trained word vector model; calculating the similarity between words in the word segmentation result set based on the vector representation of each word in the word segmentation result set; and selecting words from the word segmentation result set whose similarity is greater than or equal to a preset similarity threshold as keywords and storing them in the vulnerability vocabulary library.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images