A method and device for predicting power system network security based on deep learning

Abstract

The present disclosure relates to the fields of network security and artificial intelligence, and specifically to a method and device for predicting network security of an electric power system based on deep learning. When performing pre-debugging, unmarked debugging is first performed independently on a log feature mining operator and a network flow feature mining operator, and then marked debugging is performed on an initial network security detection neural network including an initial log feature mining operator and an initial network flow feature mining operator obtained by the unmarked debugging. Combined with subsequent marked debugging, features based on network security service logs and network flow data can be learned. The network security detection neural network obtained by the pre-debugging can learn information in a pre-debugging learning sample library to a great extent, deeply acquire existing knowledge in the pre-debugging learning samples, and at the same time learn the correlation between different data, thereby helping to increase the detection accuracy of the network.

Description

Technical Field

[0001] This disclosure relates to the fields of cybersecurity and artificial intelligence, and more specifically, to a method and apparatus for predicting cybersecurity in power systems based on deep learning. Background Technology

[0002] With the rapid development of power systems, their information and automation technologies are constantly improving. While bringing convenience to users, the security of power systems is becoming increasingly important. Power system monitoring is used to monitor the production and supply of electricity and is a crucial guarantee for the stable and safe operation of the power system. Power system monitoring utilizes computer technology as a foundation, while also employing communication and data network technologies to protect the security of the power system. The security problems faced by power systems are becoming increasingly serious. If they suffer cybersecurity attacks, it could lead to widespread power problems, seriously threatening national security and residents' lives.

[0003] The purpose of establishing power system monitoring is to prevent malicious acts such as damage, illegal operations, and data theft caused by hackers, viruses, and malicious network attacks. Power system monitoring generally includes three aspects: protection, monitoring, and hardening. These three aspects complement each other, forming a protective network for the power system. Network security situation prediction can play an early warning role within the monitoring system, enabling proactive protection against malicious operations before they occur.

[0004] Currently, power system cybersecurity situation prediction technology is still in its early stages, and there is a lack of early warning capabilities in power system security protection. Cyberattack methods are constantly evolving, with threats such as hackers, viruses, and malware emerging in endless forms. For example, ransomware, data breaches, and phishing attacks pose significant risks to the property and reputation of individuals and organizations. Processing and analyzing cybersecurity service data can aid in security detection. In related technologies, due to the continuously accumulating nature of cybersecurity service data, a front-end network is pre-calibrated. Upon receiving cybersecurity service data, the network is fine-tuned or used directly for cybersecurity identification, thus improving data processing efficiency. This approach still has room for further improvement. Summary of the Invention

[0005] In view of this, the present disclosure provides at least one method and apparatus for predicting power system network security based on deep learning.

[0006] According to one aspect of the embodiments of this disclosure, a deep learning-based power system network security prediction method is provided, comprising:

[0007] Obtain network security service logs and determine the network traffic data corresponding to the network security service logs;

[0008] The network security service log and the network traffic data are input into the pre-debugged target network security detection neural network to obtain the network security detection result output by the target network security detection neural network. The target network security detection neural network is a neural network obtained by performing detailed optimization on the network security detection neural network obtained by pre-debugging.

[0009] The network security detection neural network, during pre-debugging, includes:

[0010] Obtain a pre-debugging learning sample library, wherein each pre-debugging learning sample in the pre-debugging learning sample library includes a network security service log learning sample, and network traffic data learning samples and security detection result sample tags corresponding to the network security service log learning sample;

[0011] Based on the network security service log learning examples included in the pre-debugging learning example library, the log feature mining operator is subjected to multiple generations of unlabeled debugging to obtain the debugged initial log feature mining operator.

[0012] Based on the network traffic data learning examples corresponding to each network security service log learning example in the pre-debugging learning example library, the network traffic feature mining operator is debugged for multiple generations without labels to obtain the debugged initial network traffic feature mining operator.

[0013] Based on the pre-debugging learning sample library, the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator, is subjected to multi-generation labeled debugging to obtain the network security detection neural network obtained from the pre-debugging.

[0014] According to one example of an embodiment of this disclosure, obtaining the pre-debugging learning sample library includes:

[0015] Based on the past network security service data corresponding to each network security service object, a set of past network security service data corresponding to each network security service object is established; wherein, each set of past network security service data includes past network security service logs, past network traffic data corresponding to the past network security service logs, and initial security detection result tags;

[0016] For each network security service object, a target false detection network corresponding to the network security service object is obtained after labeled debugging based on the past network security service data corresponding to the network security service object.

[0017] For each past network security service log, based on each target fake detection network, determine each fake detection result corresponding to the past network security service log, and determine the initial security detection result tag corresponding to the past network security service log and the merged result of each fake detection result as the security detection result sample tag corresponding to the past network security service log;

[0018] Based on the past network security service logs, the security detection result sample tags corresponding to the past network security service logs, and past network traffic data, a pre-debugging learning sample is constructed.

[0019] The pre-debugging learning example library is established based on each pre-debugging learning example.

[0020] According to an example of an embodiment of this disclosure, the step of establishing a set of past network security service data corresponding to each network security service object based on the past network security service data corresponding to each network security service object includes:

[0021] An initial network security service data set is established based on the initial network security service data collected from each network security service object within a preset collection period; each initial network security service data set includes an initial network security service log, as well as the corresponding past network traffic data and initial security detection result markers;

[0022] One initial network security service data point is retrieved sequentially from the initial network security service data set. Redundancy cleansing is performed on the retrieved initial network security service data, and the process stops when no unretrieved initial network security service data point remains in the initial network security service data set. Each redundancy cleansing operation includes:

[0023] Determine the log feature commonality measurement coefficient between the initial network security service log in the retrieved initial network security service data and the initial network security service log in the other initial network security service data in the initial network security service data set;

[0024] Within the initial network security service data set, remove any remaining initial network security service data whose log feature commonality coefficients with the retrieved initial network security service data satisfy the critical commonality coefficient.

[0025] The initial network security service data in the initial network security service dataset after redundancy cleansing is identified as past network security service data.

[0026] Based on the network security service objects corresponding to each past network security service data, a set of past network security service data corresponding to each network security service object is obtained by grouping the past network security service data.

[0027] According to an example of an embodiment of this disclosure, determining the various fake detection results corresponding to the past network security service logs based on various target fake detection networks includes:

[0028] Determine the target network security service object corresponding to the past network security service logs, and determine the target fake detection network corresponding to the target network security service object. Obtain the remaining target fake detection networks corresponding to each of the other network security service objects outside the target network security service object.

[0029] Based on the various other target fake detection networks, the corresponding fake detection results in the past network security service logs are determined respectively.

[0030] According to an example of an embodiment of this disclosure, the fake detection result includes a fake detection tag and a result classification inference value obtained by inferring the fake detection tag; after determining each fake detection result corresponding to the past network security service log, the method further includes:

[0031] Obtain the initial intersection result between the fake detection tags included in each fake detection result and the initial security detection result tags corresponding to the past network security service logs, and determine the result classification inference value corresponding to each detection result classification tag in the initial intersection result;

[0032] Clean out the detection result classification tags in the initial intersection results that satisfy the tag filtering requirements from the initial security detection result tags corresponding to the past network security service logs, and obtain the processed initial security detection result tags;

[0033] For the processed initial security detection result tag, the step is to determine the security detection result sample tag corresponding to the past network security service log by merging the initial security detection result tag corresponding to the past network security service log with each fake detection result.

[0034] According to one example of an embodiment of this disclosure, the process of performing first-generation label-free debugging on a log feature mining operator includes:

[0035] A preset number of network security service log learning samples are retrieved from the pre-debugging learning sample library, and a preset number of log data cluster samples with corresponding time order are selected from each retrieved network security service log learning sample according to the log feature mining operator.

[0036] The log feature mining operator constructs an active learning sample tuple based on log data cluster samples corresponding to the same network security service log learning example, and constructs a negative learning sample tuple based on log data cluster samples corresponding to different network security service log learning examples; a learning sample tuple includes two log data cluster samples.

[0037] The log feature mining operator is subjected to multiple generations of label-free iterative debugging based on the active learning example pairs and the passive learning example pairs, and stops when the preset convergence requirements are met.

[0038] According to an example of an embodiment of this disclosure, the step of selecting a preset number of log data cluster samples with corresponding time order from each of the retrieved network security service log learning samples includes:

[0039] For each network security service log learning example retrieved, a target selection time corresponding to the network security service log learning example is set according to the time period corresponding to the network security service log learning example. A preset number of log data cluster examples with corresponding time order are selected from the log data cluster examples corresponding to the target selection time on the network security service log learning example.

[0040] or;

[0041] For each network security service log learning example retrieved, the network security service log learning example is divided into a preset number of log data cluster learning examples according to the time period corresponding to the network security service log learning example. Then, one log data cluster example is randomly selected from each log data cluster learning example to obtain a preset number of log data cluster examples with corresponding time order.

[0042] According to an example of an embodiment of this disclosure, when the network security detection neural network obtained through pre-debugging includes a log feature mining operator obtained through pre-debugging, a network traffic feature mining operator obtained through pre-debugging, and a detection and identification operator obtained through pre-debugging, if the log detection result classification label set during detailed optimization is different from the detection result classification label set in the detection and identification operator obtained through pre-debugging, detailed optimization is performed on the network security detection neural network obtained through pre-debugging to obtain the target network security detection neural network, including:

[0043] Obtain a detailed optimization learning example library, wherein each detailed optimization learning example includes a detailed optimization network security service log learning example, as well as a detailed optimization network traffic data learning example and a detailed optimization security detection result example tag corresponding to the detailed optimization network security service log learning example;

[0044] Based on the classification labels of each log detection result during detailed optimization, the detection result classification labels set in the detection and recognition operator obtained from the pre-debugging are corrected.

[0045] Based on the detailed optimization learning example library, the modified network security detection neural network is subjected to multiple generations of detailed optimization to obtain a detailed-optimized target network security detection neural network.

[0046] According to another aspect of the embodiments of this disclosure, a power system network security prediction device based on deep learning is provided, comprising:

[0047] The data acquisition module is used to acquire network security service logs and determine the network traffic data corresponding to the network security service logs.

[0048] The network call module is used to input the network security service log and the network traffic data into the pre-debugged target network security detection neural network to obtain the network security detection result output by the target network security detection neural network. The target network security detection neural network is a neural network obtained by performing detailed optimization on the network security detection neural network obtained by pre-debugging.

[0049] A network pre-debugging module is used for pre-debugging the network security detection neural network; the pre-debugging of the network security detection neural network includes:

[0050] Obtain a pre-debugging learning sample library, wherein each pre-debugging learning sample in the pre-debugging learning sample library includes a network security service log learning sample, and network traffic data learning samples and security detection result sample tags corresponding to the network security service log learning sample;

[0051] Based on the network security service log learning examples included in the pre-debugging learning example library, the log feature mining operator is subjected to multiple generations of unlabeled debugging to obtain the debugged initial log feature mining operator.

[0052] Based on the network traffic data learning examples corresponding to each network security service log learning example in the pre-debugging learning example library, the network traffic feature mining operator is debugged for multiple generations without labels to obtain the debugged initial network traffic feature mining operator.

[0053] Based on the pre-debugging learning sample library, the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator, is subjected to multi-generation labeled debugging to obtain the network security detection neural network obtained from the pre-debugging.

[0054] According to another aspect of the embodiments of this disclosure, a power system network security prediction system based on deep learning is provided, comprising:

[0055] One or more processors;

[0056] and one or more memories, wherein the memories store computer-readable code that, when run by the one or more processors, causes the one or more processors to perform the methods described above.

[0057] The beneficial effects of this disclosure include at least the following:

[0058] In the embodiments of this disclosure, during pre-debugging, label-free debugging is first performed independently on the log feature mining operator and the network traffic feature mining operator. Then, labeled debugging is performed on the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator obtained from the label-free debugging. The initial label-free debugging allows different modalities of network security service logs and network traffic data to learn and mine corresponding feature information. Combined with subsequent labeled debugging, it can learn features based on network security service logs and network traffic data, achieving the effect of network security detection. The network security detection neural network obtained from the pre-debugging can learn information from the pre-debugging learning example library to a great extent, deeply acquiring existing knowledge from the pre-debugging learning examples, and simultaneously learning the correlation between different data, helping to increase the accuracy of network detection. Furthermore, during network security detection, after acquiring the network security service logs and corresponding network traffic data, a target network security detection neural network, obtained by optimizing the network security detection neural network obtained from the pre-debugging, is used to output the network security detection result based on the network security service logs and network traffic data. Based on this, for the network security detection neural network obtained through phased pre-debugging, by optimizing the network security detection neural network obtained from the effective experience gained during pre-debugging, the target network security detection neural network can effectively increase the speed of security detection, and can be used to predict the network security situation of the power system in the future. Managers can then take corresponding countermeasures based on the network security situation in the future, that is, to take precautions before the attack threat arrives.

[0059] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this disclosure. Attached Figure Description

[0060] The above and other objects, features, and advantages of the present disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the present disclosure and form part of the specification. They are used together with the embodiments of the present disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0061] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this disclosure.

[0062] Figure 2 This is a schematic diagram illustrating the implementation process of a network security detection neural network obtained through pre-debugging in a deep learning-based power system network security prediction method provided in this embodiment of the disclosure.

[0063] Figure 3 This is a schematic diagram of the composition structure of a deep learning-based power system network security prediction device provided in an embodiment of this disclosure.

[0064] Figure 4 This is a schematic diagram of the hardware entity of a computing device provided in an embodiment of this disclosure. Detailed Implementation

[0065] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure. To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure will be further elaborated in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be considered as limitations on this disclosure, and all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure. In the following description, the term "some embodiments" refers to a subset of all possible embodiments; however, it is understood that "some embodiments" can be the same subset or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first / second" are merely used to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this disclosure described herein can be implemented in an order other than that illustrated or described herein.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for descriptive purposes only and is not intended to limit this disclosure.

[0067] Figure 1 A schematic diagram of an application scenario 100 according to an embodiment of this disclosure is shown, schematically illustrating a server 110 and multiple service objects 120. The server 110 can be an independent server for network security detection and classification, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, location services, and big data and artificial intelligence platforms. This disclosure does not impose specific limitations in this regard. Each of the multiple service objects 120 can be a fixed terminal such as a desktop computer, or a smartphone, tablet computer, portable computer, handheld device, personal digital assistant terminal, or any combination thereof. This disclosure does not impose specific limitations in this regard.

[0068] First, the implementation background and solutions of the embodiments of this disclosure will be summarized.

[0069] In existing technologies, to perform security detection on the large volume of real-time network security service logs and achieve system network security monitoring and classification, a pre-debugging network for log security detection is typically used to improve the efficiency of application security classification and detection. Since network security service logs and network traffic data are interdependent, comprehensive analysis helps improve the accuracy of security analysis. Therefore, this log security detection network includes two structures: a network security service log processing structure and a corresponding network traffic data processing structure. However, in existing methods, the pre-debugging network only focuses on the relationship between logs and traffic data, offering limited help in improving the efficiency of detection and classification.

[0070] To improve the efficiency of security detection and classification, the method provided in this embodiment includes the following steps for the pre-debugging part: after obtaining the pre-debugging learning sample library, the network traffic feature mining operator is subjected to multiple generations of unlabeled debugging based on the network security service log learning samples in the pre-debugging learning sample library to obtain the debugged initial log feature mining operator; the network traffic feature mining operator is subjected to multiple generations of unlabeled debugging based on the network traffic data learning samples in the pre-debugging learning sample library to obtain the debugged initial network traffic feature mining operator; and the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator, is subjected to multiple generations of labeled debugging based on the pre-debugging learning sample library to obtain the network security detection neural network obtained from the pre-debugging. Based on this, during pre-debugging, the log feature mining operator and network traffic feature mining operator are first independently debugged without labels. Then, the initial network security detection neural network, including the initial log feature mining operator and initial network traffic feature mining operator obtained from the label-free debugging, is debugged with labels. This allows the label-free debugging process in the pre-debugging stage to independently learn feature mining from network security service logs and network traffic data. Combined with subsequent labeled debugging, it can learn the features of network security service logs and network traffic data to achieve the effect of network security detection. The network security detection neural network obtained from the pre-debugging stage can learn information from the pre-debugging learning example library to a great extent, acquiring existing knowledge included in the pre-debugging learning examples, and learning the correlation between different data, helping to increase the accuracy of network detection. Furthermore, during network security detection, after acquiring network security service logs and corresponding network traffic data, the target network security detection neural network, obtained after detailed optimization of the network security detection neural network obtained from the pre-debugging stage, outputs the network security detection results based on the network security service logs and network traffic data. Based on this, for the network security detection neural network obtained through phased pre-debugging, the target network security detection neural network obtained by optimizing the network security detection neural network obtained through pre-debugging based on the effective experience gained during pre-debugging can effectively increase the speed of security detection.

[0071] The following describes the specific implementation process of the network security service data processing method provided in the embodiments of this disclosure. First, the process of obtaining the network security detection neural network through pre-debugging is introduced. This method can be executed by the processor of server 110. Figure 2 This is a schematic diagram illustrating the implementation process of a network security detection neural network obtained through pre-debugging in a deep learning-based power system network security prediction method provided in this disclosure. Figure 2 As shown, the method includes the following steps 110 to 140, including the following during pre-debugging:

[0072] Step S110: Obtain the pre-debugging learning sample library.

[0073] The pre-debugging learning sample library contains multiple pre-debugging learning samples. During the construction process, the pre-debugging learning sample library can be built using two strategies.

[0074] In the first strategy, a pre-debugging learning sample library is established using past cybersecurity service data originating from a single cybersecurity service object (i.e., a network system protected by cybersecurity). This library is built by using past cybersecurity service data from a single cybersecurity service object as pre-debugging learning samples. Each pre-debugging learning sample includes a cybersecurity service log learning sample (i.e., a log sample for learning), a corresponding network traffic data learning sample (i.e., a network traffic data sample for learning), and security detection result sample tags (i.e., the actual security detection results corresponding to the cybersecurity service log, labeled with tags such as malware type, abnormal activity type, data breach vulnerability, etc.). The number of security detection result sample tags can be one or more, and the specific level of granularity can be set according to actual needs. Network security service logs (Log Data) include various log records generated by network devices, servers, applications, etc., such as access logs, security event logs, system logs, etc.; network traffic data can include data traffic information during network transmission, such as source IP address, destination IP address, port number, protocol type, etc. Traffic data can be monitored and analyzed by network traffic analysis tools to help detect potential attack behaviors or abnormal traffic.

[0075] In the second strategy, a pre-debugging and learning sample library is established by using past cybersecurity service data from multiple cybersecurity service objects.

[0076] This disclosure embodiment constructs a pre-debugging and learning sample library using past network security service data from multiple network security service objects, which may specifically include the following steps:

[0077] Step S111: Establish a set of past network security service data corresponding to each network security service object based on the past network security service data corresponding to each network security service object.

[0078] Specifically, past network security service data is obtained from each network security service object, and the past network security service data corresponding to the same network security service object are clustered to construct a past network security service data set; each past network security service data set obtained from each network security service object is obtained, and each past network security service data set includes past network security service logs, past network traffic data and initial security detection result tags corresponding to the past network security service logs.

[0079] In one implementation, to prevent redundant information from being included in the constructed pre-debugging learning sample library, this embodiment establishes an initial network security service data set by obtaining initial network security service data from various network security service objects. Redundancy is then removed from each initial network security service data within the initial network security service data set. Redundancy can be determined by comparing the log feature commonality coefficient (i.e., similarity measurement result, which can be calculated by determining the Euclidean distance of the log feature vectors) between the initial network security service log retrieved from the initial network security service data set and the initial network security service logs in all other initial network security service data within the initial network security service data set, to a preset critical commonality coefficient (the specific value is set according to actual needs).

[0080] During redundancy cleanup within the initial network security service data set, an initial network security service data set is first established using the initial network security service data collected from each network security service object within a preset collection period. Each initial network security service data set includes an initial network security service log, as well as the corresponding past network traffic data and initial security detection result markers. When each network security service object obtains the initial network security service data, a preset collection period for determining the initial network security service data can be set based on the actual situation. Then, the network security service data collected by each network security service object within this collection period is determined as each initial network security service data set. Next, one piece of initial network security service data is retrieved one by one from the initial network security service data set. Redundancy cleaning is performed on the retrieved initial network security service data. The process stops when there is no unretrieved initial network security service data in the initial network security service data set. Each redundancy cleaning operation may include the following steps: determining the log feature commonality measurement coefficient between the initial network security service logs in the retrieved initial network security service data and the initial network security service logs in the other initial network security service data in the initial network security service data set; cleaning out the remaining initial network security service data in the initial network security service data set whose log feature commonality measurement coefficient with the retrieved initial network security service data satisfies the critical commonality measurement coefficient.

[0081] Before determining the log feature commonality metric coefficient, the features of the initial network security service logs are first obtained. For example, based on a preset convolutional neural network, the features of each initial data cluster (such as access data cluster, event data cluster) in each initial network security service data are fused to obtain the embedded features of the initial network security service logs. These embedded features are the features of the network security service logs. When determining the log feature commonality metric coefficients between the features of the network security service logs, common similarity determination methods (such as Euclidean distance, cosine distance, Jaccard distance, etc., as mentioned above) can be used to determine the log feature commonality metric coefficients between the features of the network security service logs. When performing redundancy cleaning based on the currently retrieved initial network security service data, other initial network security service data within the initial network security service data set whose log feature commonality metric coefficients with the retrieved initial network security service data meet the critical commonality metric coefficient are cleaned out. The other initial network security service data within the initial network security service data set whose log feature commonality metric coefficients with the retrieved initial network security service data reach the preset critical commonality metric coefficient are the duplicate data of the initial network security service data.

[0082] Furthermore, the initial cybersecurity service data within the initial cybersecurity service data set after redundancy cleansing is identified as past cybersecurity service data. Based on the cybersecurity service objects corresponding to each past cybersecurity service data, a past cybersecurity service data set corresponding to each cybersecurity service object is obtained by grouping the past cybersecurity service data (e.g., using clustering algorithms). For example, the initial cybersecurity service data after redundancy cleansing within the initial cybersecurity service data set is identified as past cybersecurity service data. Then, based on the cybersecurity service objects corresponding to the initial cybersecurity service data, each past cybersecurity service data is grouped to obtain a past cybersecurity service data set corresponding to each cybersecurity service object. One past cybersecurity service data set corresponds to one cybersecurity service object.

[0083] For example, suppose there are 10 initial network security service logs A~10. If the critical commonality measurement coefficient for log feature is set to 0.88, and the initial network security service logs corresponding to each initial network security service data in the currently constructed initial network security service dataset are: initial network security service log A, initial network security service log B, initial network security service log C, ..., initial network security service log J. If initial network security service log A is retrieved, the log feature commonality measurement coefficients for initial network security service log A and initial network security service logs B~J are determined respectively to obtain the commonality measurement coefficients for each log feature. For example, it is determined that the log feature commonality measurement coefficients between initial network security service logs D, H, and I and initial network security service log A reach the critical coefficient of 0.88. In other words, initial network security service logs D, H, and I are redundant logs of initial network security service log A. The initial network security service data corresponding to initial network security service logs D, H, and I are then cleaned out from the initial network security service dataset. Then, retrieve (e.g., randomly) one of the remaining unretrieved initial network security service logs, and repeat the above process until there are no unretrieved initial network security service logs in the redundancy-cleaned initial network security service data set.

[0084] Of course, when retrieving initial network security service logs to determine the log feature commonality measurement coefficients, it is not necessary to repeatedly determine the log feature commonality measurement coefficients between two identical initial network security service logs. When determining the log feature commonality measurement coefficients between initial network security service logs, the log feature commonality measurement coefficients between the currently retrieved initial network security service log and the remaining unretrieved initial network security service logs can be obtained, which improves efficiency and reduces computational overhead.

[0085] Step S112: For each network security service object, based on the past network security service data corresponding to the network security service object, perform labeled debugging to obtain the target fake detection network corresponding to the network security service object.

[0086] In this embodiment, after obtaining a set of past network security service data for each network security service object, a corresponding target fake detection network is obtained by performing labeled iterative debugging (i.e., supervised training) on ​​each set of past network security service data. Each set of past network security service data includes a past network security service log, past network traffic data corresponding to the log, and an initial security detection result label. One network security service object corresponds to one target fake detection network. Specifically, for each network security service object, the past network security service data within the set of past network security service data corresponding to the network security service object is obtained, and the initial fake detection network is subjected to labeled debugging based on the obtained past network security service data to obtain the debugged target fake detection network. One target fake detection network is obtained by debugging the past network security service data set of one network security service object.

[0087] In this embodiment, when configuring an initial fake detection network for a set of past network security service data, the initial security detection result tags corresponding to each past network security service log within the set are first analyzed. The number of detection result classification tags corresponding to each past network security service log is determined. The determined number of detection result classification tags and each detection result classification tag are then set into a detection and identification operator of the initial fake detection network to obtain the configured initial fake detection network. Then, based on the set of past network security service data configured for the initial fake detection network, the corresponding initial fake detection network is debugged. Upon network convergence, the debugged target fake detection network is obtained.

[0088] Based on this, by debugging the corresponding target fake detection network for each set of past network security service data, the debugged target fake detection network can classify network security service logs according to the classification method in the corresponding network security service object, that is, it learns to classify according to the classification label of the detection results of different network security service objects.

[0089] Step S113: For each past network security service log, determine each fake detection result corresponding to the past network security service log based on each target fake detection network, and determine the initial security detection result mark corresponding to the past network security service log and the merged result of each fake detection result as the security detection result sample mark corresponding to the past network security service log.

[0090] The following example illustrates how to construct fake detection results for a given past network security service log, without distinguishing between past network security service data sets corresponding to those logs. Specifically, this can include:

[0091] Step S1131: Determine the target network security service object corresponding to the past network security service logs, determine the target fake detection network corresponding to the target network security service object, and obtain the remaining target fake detection networks corresponding to each of the other network security service objects outside the target network security service object.

[0092] After identifying the target network security service object corresponding to the past network security service logs, the target fake detection network corresponding to the target network security service object is identified. Then, among the target fake detection networks corresponding to each network security service object, each fake detection network other than the target fake detection network corresponding to the target network security service object is identified.

[0093] Step S1132: Based on each of the remaining target fake detection networks, determine the corresponding fake detection results in the past network security service logs.

[0094] After determining the fake detection networks for each remaining target, based on the determined fake detection networks for each remaining target, the fake detection results corresponding to the past network security service logs are determined respectively. Then, the fake detection results determined according to the past network security service logs are determined as the fake detection results corresponding to the past network security service logs. Among them, a fake detection result includes a fake detection label and a result classification inference value obtained by inferring the fake detection label.

[0095] It should be noted that when determining the fake detection tags corresponding to past network security service logs based on other target fake detection networks, the input can be determined based on the architecture of the target fake detection network. For example, if the classification of the target fake detection network depends on the simultaneously input network security service logs and network traffic data, then network traffic data is obtained based on past network security service logs to determine the network traffic data corresponding to the past network security service logs. Then, the determined network traffic data and the past network security service logs are input together into the target fake detection network to obtain the corresponding fake detection results. Based on this, when classifying the security detection of past network security service logs corresponding to a network security service object using the target fake detection networks corresponding to other network security service objects, a comprehensive classification of the past network security service logs can be performed based on the classification methods corresponding to other network security service objects. This results in a more refined classification of the past network security service logs and obtains more tags representing the content within the past network security service logs. Furthermore, the combined result (i.e., the union) of the fake detection results corresponding to a current past network security service log and the initial security detection result tags is determined as the security detection result sample tag corresponding to the past network security service log.

[0096] Because noise may be generated during data processing, in order to avoid incorrect initial security detection result markings in past network security service logs, after determining each false detection result corresponding to the past network security service logs, the initial security detection result markings corresponding to the past network security service logs are selected based on each false detection result corresponding to the past network security service logs.

[0097] Specifically, the process involves obtaining the initial intersection result (i.e., the intersection) between the fake detection tags included in each fake detection result and the initial security detection result tags corresponding to the past network security service logs, determining the result classification inference value corresponding to each detection result classification tag in the initial intersection result, cleaning out the detection result classification tags in the initial intersection result tags whose result classification inference values ​​meet the tag filtering requirements from the initial security detection result tags corresponding to the past network security service logs, obtaining the processed initial security detection result tags, and then performing the step of merging the initial security detection result tags corresponding to the past network security service logs and each fake detection result to determine the security detection result sample tag corresponding to the past network security service logs. When processing the initial security detection result tags corresponding to past network security service logs, the false detection results are used as a reference. After determining the initial intersection results between each false detection tag and the initial tag corresponding to the past network security service logs, the result classification inference value corresponding to each detection result classification tag in the initial intersection results is determined. By determining the matching result between the result classification inference value and the tag filtering requirement, the detection result classification tags whose corresponding result classification inference values ​​meet the tag filtering requirements are cleaned from the initial security detection result tags corresponding to the past network security service logs, and the processed initial security detection result tags are obtained. The tag filtering requirement can be that the result classification inference value is less than the filtering threshold.

[0098] Based on this, considering that the accuracy of the classification tags for detection results corresponding to past network security service logs can significantly impact the subsequent debugging of network security service datasets, thus affecting the network's security detection classification results, this disclosure filters out detection result classification tags in the initial security detection result tags whose corresponding result classification inference values ​​are less than the filtering threshold; and deletes detection result classification tags in the initial security detection result tags that are identified as having low probability by the target fake detection network, making the remaining initial security detection result tags more accurate.

[0099] In addition, the combined result of each fake detection result and the processed initial security detection result label corresponding to the past network security service log is determined as the security detection result sample label corresponding to the past network security service log.

[0100] Based on this, the security detection result sample tags constructed from past network security service logs are combined with different detection result classification tags corresponding to each network security service object. This allows the detection result classification tags corresponding to past network security service logs to be associated, alleviating the deficiency of insufficient tag comprehensiveness for a single network security service object.

[0101] Step S114: Based on each past network security service log, the security detection result sample tags corresponding to the past network security service log, and past network traffic data, construct a pre-debugging learning sample, and establish a pre-debugging learning sample library based on each pre-debugging learning sample.

[0102] Without considering the network security service logs corresponding to past network security service logs, a corresponding pre-debugging learning example is established for each past network security service log, along with the security detection result example tags and past network traffic data. Furthermore, a pre-debugging learning example library is built using these constructed pre-debugging learning examples.

[0103] Based on this, when multiple network security service objects obtain past network security service data, the corresponding target fake detection network is debugged and constructed using the past network security service data from each network security service object. This allows the network security detection network to learn the ability to classify network security vulnerabilities according to the classification methods of each network security service object. When constructing fake detection results for each past network security service log based on each target fake detection network, different network security detection classification methods are integrated. Pre-debugging and learning examples can avoid classification errors in network security service data obtained from different network security service objects, completing multi-dimensional classification of network security service logs and facilitating accurate supervision during pre-debugging.

[0104] Step S120: Based on the network security service log learning examples included in each learning example in the pre-debugging learning example library, perform multi-generation unlabeled debugging of the log feature mining operator to obtain the debugged initial log feature mining operator.

[0105] After obtaining the pre-debugging learning sample library, based on the network security service log learning samples in the pre-debugging learning samples, the log feature mining operator is subjected to multiple generations of unlabeled debugging (i.e. unsupervised training) to obtain the debugged initial log feature mining operator. The first generation of unlabeled debugging of the log feature mining operator is to input a batch of network security service log learning samples into the log feature mining operator for debugging.

[0106] The process of performing first-generation label-free debugging of log feature mining operators in this embodiment of the disclosure may specifically include:

[0107] Step S121: Retrieve a preset number of network security service log learning samples from the pre-debugging learning sample library, and select a preset number of log data cluster samples with corresponding time order from each of the retrieved network security service log learning samples according to the log feature mining operator.

[0108] The system retrieves a predetermined number of network security service log learning examples from the pre-debugging learning example library based on the number of network security service log learning examples in a batch of data, and determines the time period corresponding to each network security service log learning example. The time period is the start and end time of the network security service log coverage. Based on the initial log feature mining operator, data clusters are acquired for each network security service log learning example in the current batch input. From the retrieved network security service log learning examples, a predetermined number of log data cluster examples with corresponding time order are selected. The data cluster acquisition process can start from the target selection time and select a predetermined number of log data cluster examples consecutively. For example, for each retrieved network security service log learning example, based on the time period corresponding to the network security service log learning example, a target selection time corresponding to the network security service log learning example is set, and a predetermined number of log data cluster examples with corresponding time order are selected from the log data cluster examples corresponding to the target selection time on the network security service log learning example. Based on this, by first arbitrarily selecting a moment in the network security service log learning sample, and then successively acquiring log data cluster samples, each of the obtained log data cluster samples can represent local data in the network security service log learning sample, thus constructing a diverse set of unlabeled debugging samples. In other embodiments, the data cluster acquisition process can also involve dividing the network security service log learning sample into a preset number of log data cluster learning samples, and then arbitrarily selecting one log data cluster sample from each of these learning samples. For example, for each retrieved network security service log learning sample, based on the time period corresponding to the network security service log learning sample, the network security service log learning sample is divided into a preset number of log data cluster learning samples, and then arbitrarily selecting one log data cluster sample from each of these learning samples, resulting in a preset number of log data cluster samples with a corresponding time order.

[0109] Step S122: Using log feature mining operators, construct active learning sample tuples based on log data cluster samples corresponding to the same network security service log learning example, and construct negative learning sample tuples based on log data cluster samples corresponding to different network security service log learning examples.

[0110] When performing label-free debugging on the log feature mining operator, the pre-debugging task revolves around clustering the data clusters of each network security service log learning example in a batch using the log feature mining operator. Then, based on two log data clusters corresponding to the same network security service log learning example, an active learning example pair is constructed. Similarly, a passive learning example pair is constructed using two log data clusters corresponding to different network security service log learning examples. Each learning example pair includes two log data clusters. An active learning example pair is a positive sample pair (containing the target of interest), while a passive learning example pair is a negative sample pair (not containing the target of interest).

[0111] Step S123: Perform multi-generation unlabeled iterative debugging of the log feature mining operator based on the active learning example pairs and the passive learning example pairs, and stop when the preset convergence requirements are met.

[0112] Specifically, after obtaining the active learning sample pairs and passive learning sample pairs established by the log feature mining operator, the established log feature mining operator is iterated and debugged for multiple generations based on the active learning sample pairs and passive learning sample pairs, and stops when it meets the preset convergence requirements.

[0113] It is understood that in this disclosure, the preset convergence requirements are not limited, such as the number of iterations reaching a preset number or the operator loss reaching a minimum.

[0114] Log feature mining operators can be any feasible deep learning network, such as convolutional neural networks, recurrent neural networks, etc.

[0115] During unlabeled debugging, after establishing active and passive learning sample pairs using log data cluster samples through the log feature mining operator, and then performing unlabeled debugging based on the log features output from two log data cluster samples in a learning sample pair, the similarity loss between the features of the two network security service logs is obtained.

[0116] Step S130: Based on the network traffic data learning examples corresponding to each network security service log learning example in the pre-debugging learning example library, perform multi-generation unlabeled debugging of the network traffic feature mining operator to obtain the debugged initial network traffic feature mining operator.

[0117] In this embodiment, BERT can be used to construct network traffic feature mining operators. The label-free debugging process of the network traffic feature mining operators is existing technology and will not be elaborated upon here. Based on network traffic data learning examples within the pre-debugging network traffic dataset, when performing multi-generation label-free debugging on the network traffic feature mining operators, the pre-debugging task revolves around combining network traffic data learning examples corresponding to the same network security service log learning example to construct an active learning example tuple, and combining network traffic data learning examples corresponding to different network security service log learning examples to construct a passive learning example tuple.

[0118] Step S140: Based on the pre-debugging learning sample library, perform multi-generation labeled debugging on the initial network security detection neural network, which includes the initial log feature mining operator and the initial network traffic feature mining operator, to obtain the network security detection neural network obtained from the pre-debugging.

[0119] After obtaining the initial log feature mining operator and the initial network traffic feature mining operator, the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator, is further subjected to multi-generation labeled debugging based on the pre-debugging learning sample library to obtain the network security detection neural network obtained from the pre-debugging.

[0120] In the specific debugging process, the established log feature mining operator is first iterated and unlabeled multiple times based on network security service log learning examples to obtain the initial log feature mining operator after unlabeled debugging. In addition, the established network traffic feature mining operator is iterated and unlabeled multiple times based on network traffic data learning examples to obtain the initial network traffic feature mining operator after unlabeled debugging. Then, the initial network security detection neural network, which includes the initial network traffic feature mining operator and the initial log feature mining operator, is iterated and unlabeled multiple times based on the pre-debugging learning examples, including network security service log learning examples, network traffic data learning examples, and security detection result example labels, to obtain the network security detection neural network obtained from the pre-debugging. In this embodiment of the disclosure, since the initial network security detection neural network is established to achieve network security detection classification, the established initial network security detection neural network includes an initial log feature mining operator, an initial network traffic feature mining operator, a feature aggregation operator for fusing features of network traffic data and features of network security service logs (e.g., a structure that implements feature vector addition and concatenation, such as concat, cross attention structure), and a detection and recognition operator for performing security detection classification (which can be any feasible classifier, such as softmax, SVM, fully connected unit).

[0121] For example, when performing labeled debugging on the initial network security detection neural network, if a batch has four pre-debugging learning samples as input, then four network security service log learning samples and four network traffic data learning samples are retrieved from the pre-debugging sample set and determined as the inputs to the initial network security detection neural network. For example, four network security service log learning examples are input into the initial log feature mining operator; four network traffic data learning examples are input into the initial network traffic feature mining operator; the concatenated results of the features of each network security service log output by the initial log feature mining operator, and the features of the network traffic data output by the initial network traffic feature mining operator are input into the feature aggregation operator to obtain the aggregated features of the network security service logs and the network traffic data; the feature aggregation results output by the feature aggregation operator are then input into the detection and recognition operator to obtain the inference security detection classification results output for each network security service data; the loss between the inference security detection classification results and the corresponding security detection result example labels is obtained, the loss is determined based on a preset loss function (such as cross-entropy), and the network variables (bias, weights, learning rate, etc.) of the initial network security detection neural network are adjusted based on the loss correction (such as gradient descent algorithm), and the correction is stopped when the network converges.

[0122] Based on this, in the pre-debugging process, the log feature mining operator and the network traffic feature mining operator are first independently debugged without labels. Then, the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator obtained from the unlabeled debugging, is debugged with labels. The initial unlabeled debugging allows different modalities of network security service logs and network traffic data to learn and mine corresponding feature information. Combined with subsequent labeled debugging, it can learn features based on network security service logs and network traffic data, achieving the effect of network security detection. The network security detection neural network obtained from the pre-debugging can learn the information in the pre-debugging learning example library to a great extent, deeply acquire the existing knowledge in the pre-debugging learning examples, and learn the correlation between different data, helping to increase the accuracy of network detection.

[0123] After pre-testing, the following describes how to perform network security detection and classification based on the obtained pre-tested network security detection neural network, which may include the following steps:

[0124] Step 210: Obtain network security service logs and determine the network traffic data corresponding to the network security service logs.

[0125] Step 220: Input the network security service logs and network traffic data into the pre-tuned target network security detection neural network to obtain the network security detection results output by the target network security detection neural network.

[0126] It is understandable that before applying the network security detection neural network, the network security detection neural network obtained through pre-debugging is optimized in detail according to actual needs to obtain the target network security detection neural network after detailed optimization. The feature mining operators obtained through pre-debugging include log feature mining operators, network traffic feature mining operators, and detection and recognition operators. Among them, the log feature mining operators obtained through pre-debugging are obtained through the initial log feature mining operators during the labeled debugging process of pre-debugging; the network traffic feature mining operators obtained through pre-debugging are obtained through the initial network traffic feature mining operators during the labeled debugging process of pre-debugging; and the detection and recognition operators obtained through pre-debugging are obtained based on the initial detection and recognition operators in the initial network security detection neural network during the labeled debugging process of pre-debugging.

[0127] The process of detailed optimization may specifically include:

[0128] First, perform detailed optimizations without altering the network security detection neural network structure obtained from the initial debugging.

[0129] If, compared to the classification labels set during the pre-debugging process, the number and content of each classification label remain unchanged during application—in other words, the classification labels for log detection results during detailed optimization are the same as those in the detection and recognition operators obtained during pre-debugging—detailed optimization is performed without altering the structure of the network security detection neural network obtained during pre-debugging. This is achieved by acquiring a detailed optimization learning example library, where each detailed optimization learning example includes a detailed optimization network security service log learning example, a corresponding detailed optimization network traffic data learning example, and detailed optimization security detection result example labels. Then, based on the detailed optimization learning example library, multiple generations of detailed optimization are performed on the network security detection neural network obtained during pre-debugging to obtain the optimized target network security detection neural network. The detailed optimization learning examples in the detailed optimization learning example library can be obtained from the pre-debugging learning example library or adaptively reconstructed, for example, referring to the learning example construction method in step 120. Based on this, when the number and content of the detection result classification labels in the application are the same as those established during pre-debugging, detailed optimizations can be performed based on the actual situation to obtain the target network security detection neural network for network security detection classification. At this point, based on the network security detection neural network obtained during pre-debugging, only a few iterations are needed to obtain the desired target network security detection neural network.

[0130] Second, after adaptive correction of the target detection and recognition operator in the network security detection neural network obtained from the pre-debugging, detailed optimization is performed.

[0131] If the number and content of the detection result classification labels change during application compared to the classification labels set in the pre-debugging process, in other words, the log detection result classification labels during detailed optimization are different from the detection result classification labels in the detection and recognition operators obtained in the pre-debugging process, then the structure of the network security detection neural network obtained in the pre-debugging process needs to be changed, and detailed optimization should be performed to obtain the target network security detection neural network.

[0132] Specifically, a detailed optimization learning example library is obtained, wherein each detailed optimization learning example includes a detailed optimization network security service log learning example, a detailed optimization network traffic data learning example and a detailed optimization security detection result example label corresponding to the detailed optimization network security service log learning example; then, based on the classification labels of each log detection result during detailed optimization, the detection and recognition operators in the network security detection neural network obtained from the pre-debugging are corrected, and the corrected network security detection neural network is subjected to multiple generations of detailed optimization based on the detailed optimization learning example library to obtain the detailed optimized target network security detection neural network.

[0133] When the number and content of the classification labels of the detection results change during application, detailed optimization learning examples are established based on the actual number and content of the classification labels of the detection results. The detection and recognition operators in the network security detection neural network obtained by pre-debugging are specifically modified according to the actual number and content of the classification labels of the detection results. Then, based on the detailed optimization learning examples, the modified network security detection neural network obtained by pre-debugging is subjected to multiple generations of detailed optimization to obtain the detailed optimized target network security detection neural network.

[0134] Based on this, the network security detection neural network obtained through pre-debugging can be modified to meet actual needs. Furthermore, since the backbone network for network security detection classification obtained during pre-debugging—that is, the operators for feature mining of network security service logs and network traffic data—has already been pre-debugged, detailed optimization only requires adjusting the mapping capability for the new detection result classification labels. This results in a network security detection neural network with strong generalization ability and simplifies the detailed optimization process. In addition, after obtaining the target network security detection neural network for network security detection classification, network security service logs and network traffic data are loaded into the target network security detection neural network to obtain the network security detection results output by the target network security detection neural network.

[0135] Based on this, the network security detection results are determined by using a target network security security detection neural network, based on network security service logs and network traffic data.

[0136] The following reference Figure 3 A network security service data processing apparatus according to embodiments of the present disclosure is described. Figure 3 A schematic diagram of the structure of a network security service data processing apparatus 300 according to an embodiment of the present disclosure is shown. Figure 3 As shown, the network security service data processing device 300 may include:

[0137] Data acquisition module 310 is used to acquire network security service logs and determine the network traffic data corresponding to the network security service logs;

[0138] The network call module 320 is used to input the network security service log and the network traffic data into the pre-debugged target network security detection neural network to obtain the network security detection result output by the target network security detection neural network. The target network security detection neural network is a neural network obtained by performing detailed optimization on the network security detection neural network obtained by pre-debugging.

[0139] The network pre-debugging module 330 is used for pre-debugging the network security detection neural network; the pre-debugging of the network security detection neural network includes:

[0140] Obtain a pre-debugging learning sample library, wherein each pre-debugging learning sample in the pre-debugging learning sample library includes a network security service log learning sample, and network traffic data learning samples and security detection result sample tags corresponding to the network security service log learning sample;

[0141] Based on the network security service log learning examples included in the pre-debugging learning example library, the log feature mining operator is subjected to multiple generations of unlabeled debugging to obtain the debugged initial log feature mining operator.

[0142] Based on the network traffic data learning examples corresponding to each network security service log learning example in the pre-debugging learning example library, the network traffic feature mining operator is debugged for multiple generations without labels to obtain the debugged initial network traffic feature mining operator.

[0143] Based on the pre-debugging learning sample library, the initial network security detection neural network, including the initial log feature mining operator and the initial network traffic feature mining operator, is subjected to multi-generation labeled debugging to obtain the network security detection neural network obtained from the pre-debugging.

[0144] Since the functions of the network security service data processing device 300 are similar in detail to the relevant steps of the network security service data processing method described above, for the sake of simplicity, some repeated descriptions of the content are omitted here.

[0145] Furthermore, the device according to embodiments of this disclosure (e.g., a network security service data processing system) can also be used by means of Figure 4 The architecture of the exemplary computing device shown is used to implement this. Figure 4 A schematic diagram of the architecture of an exemplary computing device according to an embodiment of the present disclosure is shown. Figure 4As shown, computing device 400 may include a bus 410, one or more CPUs 420, read-only memory (ROM) 430, random access memory (RAM) 440, a communication port 450 connected to a network, input / output components 460, a hard disk 470, etc. The storage devices in computing device 400, such as ROM 430 or hard disk 470, can store various data or files used for computer processing and / or communication, as well as program instructions executed by the CPU. Of course, Figure 4 The architecture shown is merely exemplary and can be omitted as needed when implementing different devices. Figure 4 One or more components in the computing device shown. The device according to embodiments of this disclosure can be configured to perform a network security service data processing method according to the various embodiments of this disclosure above, or to implement a network security service data processing apparatus according to the various embodiments of this disclosure above.

[0146] The embodiments of this disclosure can also be implemented as a computer-readable storage medium. A computer-readable storage medium according to embodiments of this disclosure stores computer-readable instructions. When the computer-readable instructions are executed by a processor, a network security service data processing method according to embodiments of this disclosure, as described with reference to the above figures, can be performed. The computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0147] According to embodiments of this disclosure, a computer program product or computer program is also provided, which includes computer-readable instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer-readable instructions from the computer-readable storage medium and execute the computer-readable instructions, causing the computer device to perform the network security service data processing method described in the various embodiments above.

[0148] Those skilled in the art will understand that the contents disclosed herein can be varied and modified in many ways. For example, the various devices or components described above can be implemented in hardware, or in software, firmware, or a combination of some or all of the three.

[0149] Furthermore, as this disclosure indicates, unless the context clearly indicates otherwise, words such as "a," "an," "a kind," and / or "the" are not specifically singular and may also include plural. The terms "first," "second," and similar terms used in this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, words such as "including" or "comprising" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Words such as "connected" or "linked" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect.

[0150] Furthermore, flowcharts are used in this disclosure to illustrate the operations performed by the system according to embodiments of this disclosure. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously. Additionally, other operations can be superimposed on these processes, or one or more steps can be removed from these processes.

[0151] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It should also be understood that terms such as those defined in a common dictionary shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or highly formalized meaning, unless expressly defined herein.

[0152] The present disclosure has been described in detail above; however, it will be apparent to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered ways without departing from the spirit and scope defined herein. Therefore, the description in this specification is for illustrative purposes only and is not intended to be restrictive in any way.

Claims

1. A power system network security prediction method based on deep learning, characterized in that: include: Obtaining a network security service log, and determining network traffic data corresponding to the network security service log; Inputting the network security service log and the network traffic data into a pre-debugging target network security detection neural network to obtain a network security detection result output by the target network security detection neural network, wherein the target network security detection neural network is a neural network obtained by optimizing the details of the network security detection neural network obtained by pre-debugging; Wherein, the network security detection neural network includes: Obtain a pre-debugging learning sample library, wherein each pre-debugging learning sample in the pre-debugging learning sample library includes a network security service log learning sample, and a network traffic data learning sample and a security detection result sample tag corresponding to the network security service log learning sample; Based on the network security service log learning samples included in each learning sample in the pre-debugging learning sample library, multiple generations of unlabeled debugging are performed on the log feature mining operator to obtain an initial log feature mining operator after debugging; Based on the network traffic data learning samples corresponding to each network security service log learning sample in the pre-debugging learning sample library, the network traffic feature mining operator is debugged for multiple generations without tags to obtain an initial network traffic feature mining operator after debugging; Based on the pre-debugging learning sample library, the initial network security detection neural network including the initial log feature mining operator and the initial network traffic feature mining operator is subjected to multiple generations of labeled debugging to obtain a network security detection neural network obtained by pre-debugging; The obtaining of the pre-debugging learning sample library includes: Based on the past network security service data corresponding to each network security service object, a set of past network security service data corresponding to each network security service object is established; wherein each past network security service data includes a past network security service log, and past network traffic data corresponding to the past network security service log and an initial security detection result mark; For each network security service object, based on past network security service data corresponding to the network security service object, a target false detection network corresponding to the network security service object is obtained after marked debugging; For each past network security service log, based on each target false detection network, determine each false detection result corresponding to the past network security service log, and determine the combined result of the initial security detection result mark corresponding to the past network security service log and each false detection result as the security detection result sample mark corresponding to the past network security service log; Based on the past network security service log, the security detection result sample mark corresponding to the past network security service log, and the past network traffic data, a pre-debugging learning sample is constructed; Establishing the pre-debugging learning sample library based on each pre-debugging learning sample; The establishing of a set of past network security service data corresponding to each network security service object based on the past network security service data corresponding to each network security service object includes: Establishing an initial network security service data set based on each initial network security service data collected at a preset collection period in each network security service object; each initial network security service data includes an initial network security service log, and past network traffic data and an initial security detection result mark corresponding to the initial network security service log; Retrieving one initial network security service data piece by piece from the initial network security service data set, performing a redundant cleaning operation according to the retrieved initial network security service data, and stopping when there is no unretrieved initial network security service data in the initial network security service data set, wherein each redundant cleaning operation includes: Respectively determining log feature commonality measurement coefficients between the initial network security service logs in the retrieved initial network security service data and the initial network security service logs in the remaining initial network security service data in the initial network security service data set; Cleaning out the remaining initial network security service data whose log feature commonality measurement coefficients with the retrieved initial network security service data satisfy the critical commonality measurement coefficient in the initial network security service data set; Determine the initial network security service data in the initial network security service data set after redundancy cleaning as the past network security service data; According to the network security service objects corresponding to each piece of past network security service data, obtaining a set of past network security service data corresponding to each network security service object based on each of the past network security service data groups; The determining, based on each target false detection network, each false detection result corresponding to the past network security service log includes: Determine the target network security service object corresponding to the past network security service log, and determine the target false detection network corresponding to the target network security service object, and obtain the remaining target false detection networks corresponding to each remaining network security service object other than the target network security service object; Based on each of the remaining target false detection networks, respectively determine each corresponding false detection result in the past network security service log; The false detection result includes a false detection mark and a result classification inference value obtained by reasoning the false detection mark; after determining each false detection result corresponding to the past network security service log, the method further includes: Obtaining an initial intersection result between the false detection mark included in each false detection result and the initial security detection result mark corresponding to the past network security service log, and determining a result classification inference value corresponding to each detection result classification mark in the initial intersection result; Cleaning the detection result classification marks whose result classification inference values ​​in the initial intersection results meet the mark filtering requirements from the initial security detection result marks corresponding to the past network security service logs, to obtain the processed initial security detection result marks; For the processed initial security detection result mark, a step is performed to determine the combined result of the initial security detection result mark corresponding to the past network security service log and each false detection result as the security detection result sample mark corresponding to the past network security service log.

2. The method according to claim 1, characterized in that When performing the first generation of tagless debugging on the log feature mining operator, it includes: Retrieving a preset number of network security service log learning samples from the pre-debugging learning sample library, and selecting a preset number of log data cluster samples corresponding to a time sequence from each of the retrieved network security service log learning samples according to the log feature mining operator; By using the log feature mining operator, constructing a positive learning sample binary based on each log data cluster sample corresponding to the same network security service log learning sample, and constructing a negative learning sample binary based on each log data cluster sample corresponding to different network security service log learning samples; a learning sample binary includes two log data cluster samples; Based on the positive learning sample binary group and the negative learning sample binary group, the log feature mining operator is debugged through multiple generations of unlabeled iterations, and the debugging is stopped when a preset convergence requirement is met.

3. The method according to claim 2, characterized in that The selecting of a preset number of log data cluster samples corresponding to a time sequence from each retrieved network security service log learning sample comprises: For each retrieved network security service log learning sample, according to the time period corresponding to the network security service log learning sample, set the target selection time corresponding to the network security service log learning sample, and start selecting a preset number of log data cluster samples corresponding to the target selection time on the network security service log learning sample in a time sequence; or; For each network security service log learning sample retrieved, divide the network security service log learning sample into a preset number of log data cluster learning samples according to the time period corresponding to the network security service log learning sample, and arbitrarily select one log data cluster sample from each log data cluster learning sample to obtain a preset number of log data cluster samples with corresponding time sequence.

4. The method according to claim 1, characterized in that When the network security detection neural network obtained by the pre-debugging includes the log feature mining operator obtained by the pre-debugging, the network traffic feature mining operator obtained by the pre-debugging, and the detection recognition operator obtained by the pre-debugging, if it is judged that the log detection result classification mark set during the detail optimization is different from the detection result classification mark set in the detection recognition operator obtained by the pre-debugging, the network security detection neural network obtained by the pre-debugging is optimized in detail to obtain the target network security detection neural network, including: Obtain a detail optimization learning sample library, wherein each detail optimization learning sample includes a detail optimization network security service log learning sample, and a detail optimization network traffic data learning sample and a detail optimization security detection result sample tag corresponding to the detail optimization network security service log learning sample; According to the classification marks of the detection results of each log during the detail optimization, the detection result classification marks set in the detection recognition operator obtained by the pre-debugging are corrected; Based on the detail optimization learning sample library, multiple generations of detail optimization are performed on the modified network security detection neural network to obtain a target network security detection neural network after detail optimization.

5. A power system network security prediction device based on deep learning, characterized in that: Includes: A data acquisition module, used to acquire a network security service log and determine network traffic data corresponding to the network security service log; A network calling module is used to input the network security service log and the network traffic data into a target network security detection neural network that has been debugged in advance, and obtain a network security detection result output by the target network security detection neural network, wherein the target network security detection neural network is a neural network obtained by optimizing the details of the network security detection neural network obtained by pre-debugging; The network pre-debugging module is used for pre-debugging of the network security detection neural network; when pre-debugging of the network security detection neural network is performed, it includes: Obtain a pre-debugging learning sample library, wherein each pre-debugging learning sample in the pre-debugging learning sample library includes a network security service log learning sample, and a network traffic data learning sample and a security detection result sample tag corresponding to the network security service log learning sample; Based on the network security service log learning samples included in each learning sample in the pre-debugging learning sample library, multiple generations of unlabeled debugging are performed on the log feature mining operator to obtain an initial log feature mining operator after debugging; Based on the network traffic data learning samples corresponding to each network security service log learning sample in the pre-debugging learning sample library, the network traffic feature mining operator is debugged for multiple generations without tags to obtain an initial network traffic feature mining operator after debugging; Based on the pre-debugging learning sample library, the initial network security detection neural network including the initial log feature mining operator and the initial network traffic feature mining operator is subjected to multiple generations of labeled debugging to obtain a network security detection neural network obtained by pre-debugging; The obtaining of the pre-debugging learning sample library includes: Based on the past network security service data corresponding to each network security service object, a set of past network security service data corresponding to each network security service object is established; wherein each past network security service data includes a past network security service log, and past network traffic data corresponding to the past network security service log and an initial security detection result mark; For each network security service object, based on past network security service data corresponding to the network security service object, a target false detection network corresponding to the network security service object is obtained after marked debugging; For each past network security service log, based on each target false detection network, determine each false detection result corresponding to the past network security service log, and determine the combined result of the initial security detection result mark corresponding to the past network security service log and each false detection result as the security detection result sample mark corresponding to the past network security service log; Based on the past network security service log, the security detection result sample mark corresponding to the past network security service log, and the past network traffic data, a pre-debugging learning sample is constructed; Establishing the pre-debugging learning sample library based on each pre-debugging learning sample; The establishing of a set of past network security service data corresponding to each network security service object based on the past network security service data corresponding to each network security service object includes: Establishing an initial network security service data set based on each initial network security service data collected at a preset collection period in each network security service object; each initial network security service data includes an initial network security service log, and past network traffic data and an initial security detection result mark corresponding to the initial network security service log; Retrieving one initial network security service data piece by piece from the initial network security service data set, performing a redundant cleaning operation according to the retrieved initial network security service data, and stopping when there is no unretrieved initial network security service data in the initial network security service data set, wherein each redundant cleaning operation includes: Respectively determining log feature commonality measurement coefficients between the initial network security service logs in the retrieved initial network security service data and the initial network security service logs in the remaining initial network security service data in the initial network security service data set; Cleaning out the remaining initial network security service data whose log feature commonality measurement coefficients with the retrieved initial network security service data satisfy the critical commonality measurement coefficient in the initial network security service data set; Determine the initial network security service data in the initial network security service data set after redundancy cleaning as the past network security service data; According to the network security service objects corresponding to each piece of past network security service data, obtaining a set of past network security service data corresponding to each network security service object based on each of the past network security service data groups; The determining, based on each target false detection network, each false detection result corresponding to the past network security service log includes: Determine the target network security service object corresponding to the past network security service log, and determine the target false detection network corresponding to the target network security service object, and obtain the remaining target false detection networks corresponding to each remaining network security service object other than the target network security service object; Based on each of the remaining target false detection networks, respectively determine each corresponding false detection result in the past network security service log; The false detection result includes a false detection mark and a result classification inference value obtained by reasoning the false detection mark; after determining each false detection result corresponding to the past network security service log, the method further includes: Obtaining an initial intersection result between the false detection mark included in each false detection result and the initial security detection result mark corresponding to the past network security service log, and determining a result classification inference value corresponding to each detection result classification mark in the initial intersection result; Cleaning the detection result classification marks whose result classification inference values ​​in the initial intersection results meet the mark filtering requirements from the initial security detection result marks corresponding to the past network security service logs, to obtain the processed initial security detection result marks; For the processed initial security detection result mark, a step is performed to determine the combined result of the initial security detection result mark corresponding to the past network security service log and each false detection result as the security detection result sample mark corresponding to the past network security service log.

6. A power system network security prediction system based on deep learning, characterized in that: include: one or more processors; and one or more memories, wherein the memories store computer-readable codes, which, when executed by the one or more processors, enable the one or more processors to execute the method as claimed in any one of claims 1 to 4.

Images