A multi-engine intelligent detection method for software access to the network

Abstract

The present application provides a multi-engine software network access intelligent detection method, which relates to the field of data processing technology. The method includes: reading the access detection engine and performing matrix distribution conversion, determining the engine matrix, supervising the training of the intelligent detection module, reading the network access detection task, activating the microprocessor, executing the engine internal competitive allocation and multi-engine parallel joint inspection to determine the network access detection column, and then performing hierarchical weighting processing based on a single feature coefficient to determine the comprehensive network access coefficient, and then performing single coefficient determination and comprehensive coefficient determination, and finally visualizing the network access detection report and synchronously generating the network access permission instruction. Through this application, the problem that the existing technology has low detection efficiency and accuracy due to the single detection engine or the lack of an effective multi-engine integration mechanism, and the missed alarm rate and false alarm rate are high, which further affects the overall effect of network security protection, improves the detection capability of software network access, and ensures the security and stability of the network environment.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a multi-engine software network access intelligent detection method. Background Art

[0002] With the continuous development of network technology, the number of malware and suspicious files is also increasing. These files may use various means to evade traditional static feature library comparison analysis, making detection increasingly difficult. Therefore, a more intelligent and efficient detection method is needed to meet this challenge.

[0003] At present, existing software access detection methods often rely on a single detection engine, or use multiple engines but lack an effective integration mechanism. These methods are powerless in the face of complex and changing network environments and evolving malware. On the one hand, a single engine may not be able to fully cover various threats, resulting in a high false negative rate; on the other hand, the simple stacking of multiple engines without effective coordination and integration may lead to low detection efficiency and even false positives.

[0004] In summary, the existing technology has low detection efficiency and accuracy, high missed detection rate and false alarm rate due to the single detection engine or lack of effective multi-engine integration mechanism, which further affects the overall effect of network security protection. Summary of the invention

[0005] The purpose of this application is to provide a multi-engine intelligent detection method for software access to the network, so as to solve the problems in the prior art such as low detection efficiency and accuracy, high missed alarm rate and false alarm rate due to a single detection engine or lack of an effective multi-engine integration mechanism, which further affects the overall effect of network security protection.

[0006] In view of the above problems, the present application provides a multi-engine software network access intelligent detection method.

[0007] The present application provides a multi-engine software network access intelligent detection method, wherein the method includes: reading access detection engines and performing matrix distribution conversion to determine an engine matrix, wherein the engine type is a matrix row and the engine unique code is a matrix column; combining the engine matrix, supervising the training of an intelligent detection module, wherein the intelligent detection module includes a plurality of parallel microprocessors, and the microprocessors can be integrated, and the microprocessors correspond to the engine types one by one; reading network access detection tasks, combining the intelligent detection module, activating the microprocessors, executing engine intra-competitive allocation and multi-engine parallel joint inspection, and determining a network access detection column, wherein the network access detection task includes at least one item; traversing the network access detection column, performing hierarchical weighting processing based on a single feature coefficient, and determining a comprehensive network access coefficient, wherein the hierarchical weighting includes a primary weighting based on the association of homologous features and a secondary weighting with multi-source features; performing a single coefficient determination and a comprehensive coefficient determination based on the network access detection column and the comprehensive network access coefficient, and generating a network access detection report; performing terminal visualization on the network access detection report, and synchronously generating a network access permission instruction if the network access standard is met.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0009] The engine matrix is ​​determined by reading the access detection engine and performing matrix distribution conversion, wherein the engine type is the matrix row and the engine unique code is the matrix column; in combination with the engine matrix, the intelligent detection module is supervised for training, wherein the intelligent detection module includes a plurality of parallel microprocessors, and the microprocessors can be integrated, and the microprocessors correspond to the engine types one by one; the network access detection task is read, in combination with the intelligent detection module, the microprocessor is activated, the engine intra-competitive allocation and multi-engine parallel joint inspection are executed, and the network access detection single column is determined, wherein the network access detection task includes at least one item; the network access detection single column is traversed, and hierarchical weighting processing based on a single feature coefficient is performed to determine Determine a comprehensive network access coefficient, wherein hierarchical weighting includes a primary weighting based on the association of homologous features and a secondary weighting with multi-source features; based on the network access detection column and the comprehensive network access coefficient, perform single coefficient determination and comprehensive coefficient determination, and generate a network access detection report; perform terminal visualization on the network access detection report, and if the network access standards are met, simultaneously generate a network access permission instruction, which effectively solves the problem of low detection efficiency and accuracy, high missed reporting rate and false alarm rate in the prior art due to a single detection engine or lack of an effective multi-engine integration mechanism, which further affects the overall effect of network security protection, improves the detection capability of software network access, and ensures a secure and stable network environment.

[0010] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented according to the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are specifically cited below. It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easy to understand through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0012] Figure 1 A flowchart of a multi-engine software network access intelligent detection method for this application;

[0013] Figure 2 A flowchart of performing decoupling processing in a multi-engine software network access intelligent detection method of the present application is provided. DETAILED DESCRIPTION

[0014] The present application provides a multi-engine intelligent detection method for software access to the network, which solves the problem that the existing technology has low detection efficiency and accuracy, high missed reporting rate and false alarm rate due to a single detection engine or lack of an effective multi-engine integration mechanism, which further affects the overall effect of network security protection, improves the detection capability of software access to the network, and ensures the security and stability of the network environment.

[0015] Below, the technical solutions in the present application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments of the present application. It should be understood that the present application is not limited to the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. It should also be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, rather than all of them.

[0016] Embodiment 1

[0017] Please refer to the attached Figure 1 The present application provides a multi-engine software network access intelligent detection method, wherein the method specifically includes the following steps:

[0018] S1: Read the access detection engine and perform matrix distribution conversion to determine the engine matrix, where the engine type is the matrix row and the engine unique code is the matrix column.

[0019] Specifically, collect information about all connected detection engines, including engine type, unique code, etc. Make sure each engine has a unique code and create a blank matrix with the number of rows equal to the number of different engine types and the number of columns equal to the total number of connected engines. Traverse the collected engine information and place each engine in the corresponding position of the matrix according to its type and unique code. For example, if there is an engine of type A with a unique code of 001, fill in the relevant information of the engine in the Ath row and the 001th column of the matrix, i.e., version number, function status, etc.

[0020] S2: Combined with the engine matrix, supervise the training of an intelligent detection module, wherein the intelligent detection module includes a plurality of parallel microprocessors, and the microprocessors can be fused, and the microprocessors correspond one to one with the engine types.

[0021] Specifically, the intelligent detection module is composed of multiple parallel microprocessors. Each microprocessor corresponds to an engine type in the engine matrix, and each engine type has a dedicated microprocessor to handle the detection tasks associated with it. According to the number of engine types in the engine matrix, the corresponding number of microprocessors is initialized to ensure that each microprocessor has the ability to process the data of the corresponding engine type. Known software samples, including normal software and malware, are used as training data. The training data is input into the intelligent detection module, and the engine matrix is ​​used to determine the part of the data that each microprocessor should process. Each microprocessor processes its corresponding data and outputs the detection result. The detection result of the microprocessor is compared with the known software label and the error is calculated. Back propagation is performed based on the error to adjust the parameters of the microprocessor to improve the detection accuracy. For tasks that require higher detection accuracy, the fusion function of the microprocessor can be enabled. Multiple microprocessors are merged into a more powerful processing unit through specific algorithms or hardware support. The fused microprocessor can handle more complex detection tasks and improve the accuracy and efficiency of detection.

[0022] S3: Read the network access detection task, activate the microprocessor in combination with the intelligent detection module, execute engine internal competitive allocation and multi-engine parallel joint inspection, determine the network access detection list, and the network access detection task includes at least one item.

[0023] Specifically, the intelligent detection module activates the corresponding microprocessor according to the specific needs of the network access detection task. Each microprocessor is responsible for handling a specific type of detection task to ensure the professionalism and accuracy of the detection. The activated microprocessor will execute a competitive allocation mechanism inside it to determine which detection engine is most suitable for handling the current task. This allocation is based on factors such as the detection engine's capabilities, historical performance, and current load to ensure optimal resource utilization and detection efficiency. Once the responsible detection engine is determined, multiple engines will perform the detection task in parallel. Each engine runs independently, but shares the management and coordination of the intelligent detection module to ensure the consistency and accuracy of the detection. After the multi-engine parallel joint inspection is completed, the intelligent detection module will summarize the detection results of each engine. Through comprehensive analysis and comparison, the final network access detection list is determined, that is, whether the device meets the network access standards.

[0024] S4: traverse the network access detection column, perform hierarchical weighting processing based on single feature coefficients, and determine a comprehensive network access coefficient, wherein the hierarchical weighting includes a primary weighting based on the association of homologous features and a secondary weighting based on multi-source features.

[0025] Specifically, iterate through each item in the network access detection column. These items usually represent different detection features and indicators, such as the device's hardware configuration, software version, security settings, etc. For each detection feature, there will be a feature coefficient associated with it, which reflects the importance of the feature in the overall assessment. The hierarchical weighting process is a staged process that includes two main steps, primary weighting and secondary weighting. Primary weighting focuses on factors directly related to a specific feature. For example, if a feature is about device security, other security features associated with it may receive a higher weight in the weighting process. According to a preset rule or algorithm, a relative weight is assigned to these homologous features. This weight reflects the relative importance of these features in the overall security assessment. Secondary weighting considers a wider set of features, including those that may not be directly related but still have an impact on the overall assessment. For example, the performance indicators of a device may not be directly related to the security indicators, but still need to be considered in the comprehensive assessment. All relevant features are considered comprehensively and weighted according to their potential impact on overall performance or security. After the primary and secondary weighting processes, each feature will have an adjusted weight coefficient. These weighted characteristic coefficients are summed up to calculate a comprehensive network access coefficient, which is a comprehensive indicator that reflects the overall performance and security of the device in multiple aspects.

[0026] S5: Based on the network access detection column and the comprehensive network access coefficient, single coefficient determination and comprehensive coefficient determination are performed to generate a network access detection report.

[0027] Specifically, for each feature item in the network access detection column, a judgment is made based on its corresponding feature coefficient. One or more thresholds are set to determine whether each feature item meets the standard. For example, a security threshold can be set for security-related feature items; a performance threshold can be set for performance-related feature items. The actual value of each feature item is compared with the corresponding threshold. If the actual value is higher than or equal to the threshold, the feature item is determined to meet the standard; otherwise, it is determined to be non-compliant. The calculated comprehensive network access coefficient is used for judgment. This coefficient is obtained based on the weighted summary of multiple feature items. A comprehensive judgment threshold is set to determine whether the overall performance of the device meets the standard. The comprehensive network access coefficient is compared with the comprehensive judgment threshold. If the comprehensive network access coefficient is higher than or equal to the threshold, the device is determined to meet the network access standard as a whole; otherwise, it is determined to be non-compliant. A network access detection report is generated based on the results of the single coefficient judgment and the comprehensive coefficient judgment. The report contains the single coefficient judgment results of each feature item, including whether it meets the standard and the comparison between the actual value and the threshold. The report should also contain the results of the comprehensive coefficient judgment, clearly indicating whether the device meets the network access standard.

[0028] S6: Perform terminal visualization on the network access detection report, and if the network access standard is met, synchronously generate a network access permission instruction.

[0029] Specifically, the key data and judgment results in the network access test report are visualized on the terminal in the form of charts, images or animations. Use bar charts to show the judgment results of each feature item, use pie charts to show the distribution of device performance, and use dynamic flowcharts to show the detection process and results. According to the judgment results of the network access test report, if the device meets the network access standards, that is, all key feature items and comprehensive coefficients meet the standards, the generation of the network access permission instruction is automatically triggered. The network access permission instruction is a clear signal that the device has been authorized to access the network. This instruction can be recognized by the network device and perform corresponding operations, such as allowing the device to connect to the network, allocating network resources, etc.

[0030] Furthermore, step S2 of the present application also includes:

[0031] The microprocessor includes an internal competition processing block and a risk detection block, and initially trains the microprocessor structure;

[0032] Based on the microprocessor structure, perform structural replication parallel configuration, retrieve and collect valid training data mapped to each engine type, perform differential training and cross-validation on the microprocessor structure, and establish a mapping between the multiple parallel microprocessors and the engine matrix to obtain the intelligent detection module that meets the convergence conditions;

[0033] Among them, the cross-validation standard is that the corresponding samples are trained until the upper limit of convergence is met, and the verification of random non-corresponding samples meets the lower limit of convergence.

[0034] Specifically, the microprocessor includes an internal competition processing block and a risk detection block. These two blocks are responsible for different tasks. The internal competition processing block may focus on handling internal competition or optimizing resource allocation, while the risk detection block focuses on identifying and evaluating potential risks. At the beginning, an initial structure is set for the microprocessor. This structure may be based on theoretical knowledge and historical data. The initial structure is trained using a set of basic data sets to adjust its parameters and configuration. Based on the initially trained microprocessor structure, the structure is replicated, that is, multiple identical microprocessor structure instances are created. These replicated microprocessors will be configured in parallel. For each engine type, valid training data is retrieved and collected. These data should be able to reflect the characteristics and behaviors of the engine type. Data collection includes multiple sources, such as actual network environment, historical data, etc. The replicated microprocessors are discriminated using valid training data mapped to each engine type. Each microprocessor will be optimized for its corresponding engine type. Cross-validation is performed to ensure the stability and generalization ability of the training. The corresponding samples are trained until the convergence upper limit is met, that is, the data of the engine type corresponding to the microprocessor is used for training until the predetermined training effect or performance upper limit is reached. The verification of random non-corresponding samples meets the convergence lower limit, and the data that does not correspond to the current microprocessor engine type is used for verification to ensure that the microprocessor can still maintain a certain performance lower limit when facing data of non-specific engine types. The mapping relationship between multiple parallel microprocessors and engine matrices is established. When the convergence condition is met, that is, the training effect and the verification effect meet the expected standards, the final trained intelligent detection module is obtained.

[0035] Furthermore, the present application also includes:

[0036] If the task concurrency exceeds the limit and the task processing time limit collides, a processor extension instruction is generated;

[0037] Based on the task characteristics, similarity analysis is performed on the pre-check microprocessor, similar processors are determined, and temporary call auxiliary processing is established between the similar processors and the pre-check microprocessor;

[0038] If the similar processor is empty, the processing domain is temporarily redistributed.

[0039] Specifically, when it is detected that the task concurrency exceeds the preset limit and the processing time limits of multiple tasks overlap or conflict, processor extension instructions are generated. These instructions are for increasing processor resources, optimizing task scheduling or performing load balancing. A monitoring mechanism can be set to track the number and processing time limits of concurrent tasks in real time. Once the preset threshold is reached, the generation of extension instructions is triggered. Based on the task characteristics, similarity analysis is performed on the pre-check microprocessor to find other processors that are similar to the current pre-check microprocessor in terms of processing power, resource usage, etc. When necessary, these similar processors can be called to assist in processing tasks, thereby dispersing the load. Similarity analysis can be based on a variety of factors, such as the computing power, memory usage, processing speed, etc. of the processor. By comparing these factors, one or more processors similar to the pre-check microprocessor can be selected. Once similar processors are determined, a temporary calling mechanism is established to allow tasks to be assigned to these similar processors for processing when necessary. This includes the optimization of the task scheduling algorithm to ensure that tasks can be evenly and efficiently assigned to each processor. If no other processor similar to the pre-check microprocessor is found, it is necessary to consider temporarily re-dividing the existing processing domain. The division of processing domains may be based on the priority, urgency or other key performance indicators of the tasks. By reallocating processing resources, high concurrency and time limit conflicts can be better handled.

[0040] Further, if Figure 2 As shown, step S3 of the present application also includes:

[0041] Identify the network access detection task, determine the detection characteristics and configure the pre-check engine type;

[0042] Based on the pre-check engine type, matching of microprocessors is performed, and activation of task microprocessors;

[0043] Based on the pre-check engine type, traverse the engine matrix to conduct internal competition among detection engines of the same type, and determine the pre-check engine, wherein the internal competition rules are switched autonomously based on the task detection requirements;

[0044] Temporary coupling is established between the task microprocessors and the pre-check engines respectively, the network access detection task is executed and the network access detection list is generated, and decoupling processing is performed.

[0045] Specifically, the detection task entering the network is identified, including analyzing the data packets, traffic or requests of the task. After identifying the task, the detection feature set is determined according to the nature of the task, such as the protocol type, data transmission mode, etc. Based on the detection features, a suitable pre-check engine type is configured, which depends on the characteristics and requirements of the task. Once the pre-check engine type is determined, a microprocessor that can support this type of detection is found. According to the requirements of the pre-check engine, the corresponding microprocessor in the processor pool is matched and activated to process the task. In a distributed or multi-processor environment, there are multiple detection engines of the same type. Traverse an engine matrix, which contains all available detection engines of the same type. A specific pre-check engine is selected to process the task through an internal competition mechanism. For example, task adaptability, detection degree, functional bias, etc., autonomous switching is performed. Preferably, internal competition processing can be performed based on multiple rules. After the task microprocessor and pre-check engine are determined, a temporary communication or data exchange channel is established between them, which can be regarded as temporary coupling. Through this coupling, task data can be efficiently transmitted between the microprocessor and the pre-check engine, thereby performing the network access detection task. After the test is completed, a network access test list is generated, which may be a report, log or data record, detailing the results of the test. Finally, the decoupling process is performed, that is, the temporary connection between the microprocessor and the pre-check engine is disconnected.

[0046] Furthermore, the present application also includes:

[0047] Based on the temporary coupling configuration, perform multi-engine parallel joint inspection to determine multiple output columns;

[0048] Traversing the plurality of output columns, performing homologous correlation detection identification based on the temporary coupling relationship and the correlation of the detection features, and determining identification information;

[0049] The plurality of output lists and the identification information are integrated to determine the network access detection list.

[0050] Specifically, by using the established temporary coupling configuration, the detection task can be distributed to multiple detection engines at the same time. These detection engines work in parallel, and each engine detects the task independently, and then generates its own output list, that is, the detection result. Multiple output lists refer to multiple detection results generated by different detection engines. By traversing the output list generated by each detection engine, by analyzing the detection features in these output lists and the correlation between them, it is possible to identify which detection results are generated for the same task or the same data source. For these homologous detection results, the identification is performed, and this identification includes task ID, timestamp, data source identification, etc. After completing the traversal and identification of all output lists, the information is integrated. By matching and combining the detection results in multiple output lists with the corresponding identification information, a comprehensive and detailed network access detection list can be generated. This network access detection list not only contains the detection results of each detection engine, but also shows the correlation and consistency between these results through identification information, thereby helping users to understand the network access situation more comprehensively.

[0051] Furthermore, the present application also includes:

[0052] Identify the identification information, and perform weighting based on the detection importance and influence to determine a layer of distribution weights, wherein the layer of distribution weights includes the subordinate feature distribution weights of each non-related feature source;

[0053] Based on the task relevance, the non-relevant feature sources are weighted twice to determine the second-level distribution weights;

[0054] The first-layer distribution weight and the second-layer distribution weight are combined to perform a hierarchical weighting calculation based on the single feature coefficient to obtain the comprehensive network access coefficient.

[0055] Specifically, key identification information is identified and extracted from network traffic, system logs, data packets, etc. This identification information includes specific data patterns, abnormal behavior signs, signs of sensitive data leakage, etc. For each identification information, its importance and impact on the network or system are determined through threat intelligence analysis or statistical analysis based on historical data. The importance can reflect the criticality of the identification information in the detection process, while the impact can reflect the potential harm to the system if the identification information is maliciously used. According to the assessed importance and impact, a preliminary weight is assigned to each identification information, which constitutes a layer of distribution weights. These weights are determined using quantitative methods such as scoring systems or qualitative assessments. For features that are not directly related to each other, non-related feature sources, their subordinate feature distribution weights need to be considered separately. These subordinate features may be finer-grained features that constitute the upper-level identification information, and each subordinate feature is also assigned a layer of distribution weights according to its importance and impact. According to the current security detection task, such as intrusion detection, data leakage detection, etc., the relevance of each non-related feature source to the task is evaluated. Task relevance can be predicted by analyzing historical cases or machine learning algorithms. Based on the task relevance, the first-layer distribution weights are adjusted to reflect the actual importance of each feature in the current task. This is achieved by multiplying by a coefficient related to the task relevance to obtain the second-layer distribution weights. Combine the first-layer distribution weights with the second-layer distribution weights by multiplying the two layers of weights or combining them in other ways. The single feature coefficient refers to the relative importance of each feature in the hierarchical weighting calculation. Through normalization, ensure that the sum of the weights of all features is 1, so that each feature will have a single feature coefficient. The comprehensive network access coefficient is a comprehensive indicator that takes into account feature importance, influence and task relevance. The comprehensive network access coefficient is obtained by combining the single feature coefficients through weighted averaging or other comprehensive calculation methods.

[0056] Furthermore, the present application also includes: determining a network access detection ecosystem, which is timely updateable and scalable, and based on quantitative evaluation, performs engine optimization and elimination and updates and optimizations of detection mechanisms.

[0057] Specifically, the detection engine is designed as a pluggable module, and a distributed system architecture is adopted to process large-scale network traffic and data. According to the changes in network traffic and detection requirements, detection resources are adjusted dynamically to ensure efficient operation. The detection engine should be able to obtain the latest threat intelligence, vulnerability information and security policies in real time to ensure the accuracy of detection. Allow administrators to dynamically adjust detection rules and configurations according to actual needs to adapt to the ever-changing network environment. Regularly evaluate and review the detection ecosystem to promptly discover and solve potential problems. Set clear performance indicators, such as detection accuracy, false alarm rate, and missed alarm rate, to quantitatively evaluate the effectiveness of the detection engine. Use standardized test data sets to perform performance tests on the detection engine to ensure that it meets the preset performance indicators. Based on the quantitative evaluation results, optimize and improve the detection engine to improve its detection performance and accuracy. Monitor the performance and status of the detection engine in real time to ensure that it is in the best working state. Keep up with the latest network security technologies and algorithms in a timely manner, and upgrade and update the detection engine. For detection engines with lagging performance and unable to meet current security needs, an elimination mechanism should be established to gradually replace them with more advanced and efficient detection engines.

[0058] Furthermore, the present application also includes:

[0059] Based on the network access permission instruction, perform software network access processing;

[0060] Interactive network operation records to mine network risk factors;

[0061] Based on the network risk factor, update learning of the risk detection block is performed.

[0062] Specifically, after receiving the network access permission instruction, the software network access processing is carried out. First, the validity of the network access permission instruction is verified to confirm the identity and permissions of the software or device. Then, the necessary network parameters such as IP address, port number, etc. are configured. Finally, the connectivity of the software or device is tested to ensure that it can access network resources normally. The activities of the software or device in the network are continuously monitored and recorded. These records include information such as connection time, disconnection time, data transmission volume, accessed network resources, etc. By analyzing the interactive network operation records, potential network risk factors can be mined. For example, abnormal data transmission volume, frequent disconnection and reconnection, access to sensitive resources, etc. may all be signs of network risks. Advanced algorithms and technologies are used to conduct in-depth analysis of this data to accurately identify risk factors. Once the network risk factors are identified, it will feed this information back to the risk detection block. The risk detection block is a key component responsible for monitoring and identifying network risks. In order to improve the accuracy and efficiency of risk detection, the risk detection block will continuously update and learn. It will use the latest network risk information and data to train and optimize its detection model. In this way, when new network threats emerge, the risk detection block can identify and respond more quickly.

[0063] In summary, the multi-engine software network access intelligent detection method provided by this application has the following technical effects:

[0064] The engine matrix is ​​determined by reading the access detection engine and performing matrix distribution conversion, wherein the engine type is the matrix row and the engine unique code is the matrix column; in combination with the engine matrix, the intelligent detection module is supervised for training, wherein the intelligent detection module includes a plurality of parallel microprocessors, and the microprocessors can be integrated, and the microprocessors correspond to the engine types one by one; the network access detection task is read, in combination with the intelligent detection module, the microprocessor is activated, the engine intra-competitive allocation and multi-engine parallel joint inspection are executed, and the network access detection single column is determined, wherein the network access detection task includes at least one item; the network access detection single column is traversed, and hierarchical weighting processing based on a single feature coefficient is performed to determine Determine a comprehensive network access coefficient, wherein hierarchical weighting includes a primary weighting based on the association of homologous features and a secondary weighting with multi-source features; based on the network access detection column and the comprehensive network access coefficient, perform single coefficient determination and comprehensive coefficient determination, and generate a network access detection report; perform terminal visualization on the network access detection report, and if the network access standards are met, simultaneously generate a network access permission instruction, which effectively solves the problem of low detection efficiency and accuracy, high missed reporting rate and false alarm rate in the prior art due to a single detection engine or lack of an effective multi-engine integration mechanism, which further affects the overall effect of network security protection, improves the detection capability of software network access, and ensures a secure and stable network environment.

[0065] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0066] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalent technology, the present application is also intended to include these modifications and variations.

Claims

1. A multi-engine software network access intelligent detection method, characterized in that: The method comprises: Read the access detection engine and perform matrix distribution conversion to determine the engine matrix, where the engine type is the matrix row and the engine unique code is the matrix column; Combined with the engine matrix, supervise the training of an intelligent detection module, wherein the intelligent detection module includes a plurality of parallel microprocessors, and the microprocessors can be fused, and the microprocessors correspond to the engine types one by one; Read the network access detection task, combine with the intelligent detection module, activate the microprocessor, execute engine internal competitive allocation and multi-engine parallel joint inspection, and determine the network access detection single column; Traversing the network access detection single column, performing hierarchical weighting processing based on single feature coefficients, and determining a comprehensive network access coefficient, wherein the hierarchical weighting includes a primary weighting based on the association of homologous features and a secondary weighting based on multi-source features; Based on the network access detection single column and the comprehensive network access coefficient, single coefficient determination and comprehensive coefficient determination are performed to generate a network access detection report, wherein the single coefficient determination refers to comparing the characteristic coefficient of each feature of the network access detection single column with the safety threshold of the corresponding feature to determine whether the single coefficient meets the standard; the comprehensive coefficient determination refers to comparing the comprehensive network access coefficient with the comprehensive determination threshold to determine whether the comprehensive coefficient meets the standard; Perform terminal visualization on the network access detection report, and if the network access standard is met, synchronously generate a network access permission instruction; The microprocessor may incorporate: If the task concurrency exceeds the limit and the task processing time limit collides, a processor extension instruction is generated; Based on the task characteristics, similarity analysis is performed on the pre-check microprocessor, similar processors are determined, and temporary call auxiliary processing is established between the similar processors and the pre-check microprocessor; If the similar processor is empty, the processing domain is temporarily redistributed.

2. The method according to claim 1, characterized in that Combined with the engine matrix, supervised training of intelligent detection module includes: The microprocessor includes an internal competition processing block and a risk detection block, and initially trains the microprocessor structure; Based on the microprocessor structure, perform structural replication parallel configuration, retrieve and collect valid training data mapped to each engine type, perform differential training and cross-validation on the microprocessor structure, and establish a mapping between the multiple parallel microprocessors and the engine matrix to obtain the intelligent detection module that meets the convergence conditions; Among them, the cross-validation standard is that the corresponding samples are trained until the upper limit of convergence is met, and the verification of random non-corresponding samples meets the lower limit of convergence.

3. The method according to claim 1, characterized in that The microprocessor activation, execution of engine internal competitive allocation and multi-engine parallel joint inspection, and determination of network access inspection list include: Identify the network access detection task, determine the detection characteristics and configure the pre-check engine type; Based on the pre-check engine type, matching of microprocessors is performed, and activation of task microprocessors; Based on the pre-check engine type, traverse the engine matrix to conduct internal competition among detection engines of the same type, and determine the pre-check engine, wherein the internal competition rules are switched autonomously based on the task detection requirements; Temporary coupling is established between the task microprocessors and the pre-check engines respectively, the network access detection task is executed and the network access detection list is generated, and decoupling processing is performed.

4. The method according to claim 3, characterized in that The executing the network access detection task and generating the network access detection list includes: Based on the temporary coupling configuration, perform multi-engine parallel joint inspection to determine multiple output columns; Traversing the plurality of output columns, performing homologous correlation detection identification based on the temporary coupling relationship and the correlation of the detection features, and determining identification information; The plurality of output lists and the identification information are integrated to determine the network access detection list.

5. The method according to claim 4, characterized in that The step of performing hierarchical weighting processing based on a single characteristic coefficient to determine a comprehensive network access coefficient includes: Identify the identification information, and perform weighting based on the detection importance and influence to determine a layer of distribution weights, wherein the layer of distribution weights includes the subordinate feature distribution weights of each non-related feature source; Based on the task relevance, the non-relevant feature sources are weighted twice to determine the second-level distribution weights; The first-layer distribution weight and the second-layer distribution weight are combined to perform a hierarchical weighting calculation based on the single feature coefficient to obtain the comprehensive network access coefficient.

6. The method according to claim 1, characterized in that Determine a network access detection ecosystem that is up-to-date and scalable, and use quantitative evaluation as a benchmark to optimize the engine and update and optimize the detection mechanism.

7. The method according to claim 2, characterized in that After generating the network access permission instruction, including: Based on the network access permission instruction, perform software network access processing; Interactive network operation records to mine network risk factors; Based on the network risk factor, update learning of the risk detection block is performed.

Images