Model generation method and data malicious attack behavior detection method and device

Abstract

The application discloses a model generation method and a data malicious attack behavior detection method and device. The model generation method comprises the following steps: constructing a data malicious attack behavior detection model, the data malicious attack behavior detection model comprising a space feature extraction unit for extracting data space features, a time sequence feature extraction unit for extracting data time sequence features and an attack behavior detection unit for detecting attack behaviors, wherein the output result is an output result of the data malicious attack behavior detection model; obtaining a training data set; and training the data malicious attack behavior detection model according to training data feature information in the training data set, a data malicious attack behavior detection result corresponding to the training data feature information, a greedy selection algorithm and a neighborhood search learning algorithm of a reverse learning algorithm, to obtain a trained data malicious attack behavior detection model.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a model generation method and a data malicious attack behavior detection method and device. BACKGROUND

[0002] With the rapid development of network technology, the network scale and network information volume are increasing, which brings great convenience to people's learning, work and life. However, network security risks are gradually exposed. Some people take advantage of the interconnection, openness and diversity of the network to steal data by attacking the network, causing data leakage, and in severe cases, causing the property or commercial secrets of the data holder to be lost.

[0003] Although the network intrusion is detected and identified in the related art, the accuracy of identifying the network intrusion is low, and it is still difficult to effectively improve the security of the data. SUMMARY

[0004] The application embodiment provides a model generation method and a data malicious attack behavior detection method and device, which can effectively improve the accuracy of identifying network intrusion.

[0005] In a first aspect, the application embodiment provides a model generation method, which comprises:

[0006] A data malicious attack behavior detection model is constructed, which comprises a space feature extraction unit for extracting data space features, a time sequence feature extraction unit for extracting data time sequence features, and an attack behavior detection unit for detecting attack behaviors. The attack behavior detection unit is configured to fuse the space features output by the space feature extraction unit and the time sequence features output by the time sequence feature extraction unit to generate fusion features, and to generate an output result according to the fusion features, wherein the output result is the output result of the data malicious attack behavior detection model.

[0007] A training data set is obtained, which comprises training data feature information and data malicious attack behavior detection results corresponding to the training data feature information. The training data feature information comprises connection features, content features and traffic features. The data malicious attack behavior detection results corresponding to the training data feature information comprise no attack or data malicious attack. The data malicious attack is used to represent the existence of data attack behavior or the attack type of data attack behavior.

[0008] The data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection results corresponding to the training data feature information, a greedy selection algorithm and a neighborhood search learning algorithm of a backpropagation algorithm, to obtain a trained data malicious attack behavior detection model.

[0009] In some implementations of the first aspect, the constructing the malicious attack behavior detection model comprises:

[0010] The spatial feature extraction unit comprises a first convolutional layer, a second convolutional layer, a first pooling layer, a third convolutional layer, a fourth convolutional layer, and a second pooling layer connected in sequence.

[0011] The temporal feature extraction unit comprises a data transformation layer and a gated recurrent unit neural network connected in sequence.

[0012] The attack behavior detection unit comprises a feature data fusion layer, an input layer, a hidden layer, and an output layer connected in sequence.

[0013] The feature data fusion layer of the attack behavior detection unit is configured to fuse the spatial features output by the second pooling layer and the temporal features output by the gated recurrent unit neural network to generate fusion features, which are the input of the attack behavior detection unit.

[0014] The output layer of the attack behavior detection unit is configured to output a detection result, which is the data malicious attack behavior detection result of the malicious attack behavior detection model.

[0015] In some implementations of the first aspect, the training data feature information comprises a first input feature of N*N dimensions.

[0016] The training data set is obtained by:

[0017] The initial training data feature information is obtained by:

[0018] The non-numeric data in the training data feature information is converted into numeric data to obtain initial training data feature information after character conversion.

[0019] A feature matrix of M*M dimensions corresponding to the initial training data feature information after character conversion is generated.

[0020] The feature matrix of M*M dimensions is normalized to obtain a normalized feature matrix of M*M dimensions.

[0021] The normalized feature matrix of M*M dimensions is reduced in dimension to obtain a first input feature of N*N dimensions.

[0022] In some implementations of the first aspect, the normalized feature matrix of M*M dimensions is reduced in dimension to obtain a first input feature of N*N dimensions, comprising:

[0023] According to the principal component analysis dimension reduction algorithm, the normalized M*M dimensional feature matrix is processed to obtain a first input feature of N*N dimensions.

[0024] In some implementations of the first aspect, the data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm, to obtain the trained data malicious attack behavior detection model, including:

[0025] The network parameters of the data malicious attack behavior detection model are initialized, wherein the initialized network parameters include a network parameter upper limit and a network parameter lower limit, and between the network parameter upper limit and the network parameter lower limit, a plurality of network parameter individuals are included, and each network parameter individual is used to represent a vector composed of all network parameters of the data malicious attack behavior detection model.

[0026] The initialized data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm, to obtain the trained data malicious attack behavior detection model.

[0027] In some implementations of the first aspect, the data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm, to obtain the trained data malicious attack behavior detection model, including:

[0028] According to the training data set, the fitness value corresponding to each network parameter individual is determined, and the network parameter individual with the maximum fitness value of K% is taken as a search individual and the remaining network parameter individual with the fitness value of 1-K% is taken as a following individual, wherein k% is an initialization search ratio;

[0029] The neighborhood search is performed on each search individual, and the search individual is updated according to the greedy selection algorithm to obtain an updated search individual;

[0030] According to the reverse learning algorithm, the reverse individual corresponding to each updated search individual is determined;

[0031] The updated search individual is replaced by the individual with the maximum fitness value of H% in the reverse individual to determine a first target individual, and the first target individual is taken as a new search individual;

[0032] In the new search individual, a second target individual corresponding to each following individual is determined according to a roulette selection algorithm, and a neighborhood search is performed on the following individual based on the second target individual, to obtain an updated following individual;

[0033] In a case where the number of iterations reaches a preset training number T, or the maximum fitness value in the search individual and the following individual is greater than a set threshold, the training is ended, and the individual with the maximum fitness value is taken as a final network parameter of the data malicious attack behavior detection model, to obtain the trained data malicious attack behavior detection model.

[0034] In some implementable manners of the first aspect, the method further includes:

[0035] In a case where the number of iterations does not reach the preset training number T, and the maximum fitness value in the search individual and the following individual is less than or equal to the set threshold, in the updated search individual and the updated following individual, the network parameter individual with the maximum K% fitness value is taken as the search individual of the current iteration training, and the remaining 1-K% network parameter individuals are taken as the following individuals of the current iteration, and the iteration training is continued;

[0036] Until the number of iterations reaches the preset training number T, or the maximum fitness value in the search individual and the following individual is greater than the set threshold, the training is ended, and the individual with the maximum fitness value is taken as a final network parameter of the data malicious attack behavior detection model, to obtain the trained data malicious attack behavior detection model.

[0037] In some implementable manners of the first aspect, the method further includes: in a case where the following individual does not increase in fitness value in L times of training, a new following individual or a mutated individual is randomly generated, and the new following individual or the mutated individual is used to replace the following individual.

[0038] In a first aspect, an embodiment of the present application provides a data malicious attack behavior detection method, which includes:

[0039] Collecting real-time data feature information;

[0040] Preprocessing the real-time data feature information to obtain preprocessed real-time data feature information;

[0041] Identifying the real-time data feature information according to the trained data malicious attack behavior detection model to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is trained according to the generation method of the model in the first aspect or any implementable manner of the first aspect.

[0042] In a third aspect, an embodiment of the present application provides a model generation device, which includes:

[0043] The processing module is configured to construct a data malicious attack behavior detection model, the data malicious attack behavior detection model comprising: a spatial feature extraction unit configured to extract spatial features of data, a time sequence feature extraction unit configured to extract time sequence features of data, and an attack behavior detection unit configured to detect attack behaviors, wherein the attack behavior detection unit is configured to fuse the spatial features output by the spatial feature extraction unit and the time sequence features output by the time sequence feature extraction unit to generate fused features, and to generate an output result according to the fused features, wherein the output result is an output result of the data malicious attack behavior detection model.

[0044] The acquisition module is further configured to acquire a training data set, the training data set comprising training data feature information and a data malicious attack behavior detection result corresponding to the training data feature information, the training data feature information comprising connection features, content features, and traffic features, and the data malicious attack behavior detection result corresponding to the training data feature information comprising no attack or existence of data malicious attack, the existence of data malicious attack being used to represent existence of data attack behavior or an attack type of data attack behavior.

[0045] The processing module is further configured to train the data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, a greedy selection algorithm, and a neighborhood search learning algorithm of a backpropagation algorithm, to obtain a trained data malicious attack behavior detection model.

[0046] In a fourth aspect, an embodiment of the present application provides a data malicious attack behavior detection device, which comprises:

[0047] The acquisition module is configured to collect real-time data feature information.

[0048] The processing module is configured to pre-process the real-time data feature information to obtain pre-processed real-time data feature information.

[0049] The processing module is further configured to identify the real-time data feature information according to the trained data malicious attack behavior detection model to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is obtained according to the generation method of the model in the first aspect or any of the implementation manners of the first aspect.

[0050] In a fifth aspect, the present application provides an electronic device, which comprises a processor and a memory storing computer program instructions; the processor implements the generation method of the model in the first aspect or any of the implementation manners of the first aspect or the data malicious attack behavior detection method of the second aspect when executing the computer program instructions.

[0051] In a sixth aspect, the present application provides a computer readable storage medium, and the computer readable storage medium stores computer program instructions. When the computer program instructions are executed by a processor, the generation method of the model in the first aspect or any possible implementation manner of the first aspect or the detection method of the data malicious attack behavior in the second aspect is implemented.

[0052] In a seventh aspect, the present application provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the generation method of the model in the first aspect or any possible implementation manner of the first aspect or the detection method of the data malicious attack behavior in the second aspect.

[0053] The generation method of the model and the detection method of the data malicious attack behavior provided in the embodiments of the present application. The spatial information and the time sequence information of the data feature information are extracted by the data malicious attack behavior detection model, and the spatial information and the time sequence information are fused and recognized, so that the malicious attack behavior against the data can be accurately detected, and the feature loss can be effectively reduced. In addition, the data malicious attack behavior detection model is trained based on the greedy selection algorithm and the neighborhood search learning algorithm of the backpropagation algorithm, so that better training effect can be achieved, the data malicious attack behavior detection model after training has strong detection capability, and the accuracy of identifying network intrusion can be effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments of the present application will be briefly introduced. Those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0055] Figure 1 is a flowchart of a generation method of a model provided by the embodiments of the present application;

[0056] Figure 2 is a structural diagram of a data malicious attack behavior detection model provided by the embodiments of the present application;

[0057] Figure 3 is a structural diagram of a generation device of a model provided by the embodiments of the present application;

[0058] Figure 4 is a structural diagram of a detection device of a data malicious attack behavior provided by the embodiments of the present application;

[0059] Figure 5 is a structural diagram of an xx device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0060] The features and exemplary embodiments of the various aspects of the present application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are intended to explain the principles of the present application, and are not intended to limit the present application. The present application can be implemented without some of the specific details, which are well known to those skilled in the art. The following description of the embodiments is merely provided to give a better understanding of the present application by showing examples of the present application.

[0061] It should be noted that, in this document, the terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Also, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, method, article or device. Without more limitations, the elements defined by the statement "include" do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0062] With the rapid development of network technology, the network scale and network information are increasing, which brings great convenience to people's learning, work and life. However, network security risks have gradually emerged. Some people take advantage of the interconnection, openness and diversity of the network to attack the network to steal data, causing data leakage, and in severe cases, the property or business secrets of the data holder are lost.

[0063] Although in the related art, detection and identification of network intrusion are implemented, the accuracy of identifying network intrusion is low, and it is still difficult to effectively improve the security of data.

[0064] In order to solve the problems in the prior art, the present application provides a model generation method and a data malicious attack behavior detection method and device. First, the model generation method provided by the present application will be introduced.

[0065] Figure 1 The flowchart of the model generation method provided by an embodiment of the present application is shown. As shown in Figure 1 The method can include the following steps 101 to 103.

[0066] In step 101, a data malicious attack behavior detection model is constructed, and the data malicious attack behavior detection model comprises a space feature extraction unit for extracting space features of data, a time sequence feature extraction unit for extracting time sequence features of data, and an attack behavior detection unit for detecting attack behaviors, wherein the attack behavior detection unit is configured to fuse the space features output by the space feature extraction unit and the time sequence features output by the time sequence feature extraction unit to generate fused features, and generate an output result according to the fused features, wherein the output result is an output result of the data malicious attack behavior detection model.

[0067] In step 102, a training data set is obtained, the training data set comprises training data feature information and a data malicious attack behavior detection result corresponding to the training data feature information, the training data feature information comprises connection features, content features and traffic features, and the data malicious attack behavior detection result corresponding to the training data feature information comprises no attack or data malicious attack, and the data malicious attack is used to represent the existence of data attack behaviors or attack types of data attack behaviors.

[0068] In step 103, the data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, a greedy selection algorithm and a neighborhood search learning algorithm of a reverse learning algorithm, to obtain a trained data malicious attack behavior detection model.

[0069] The above steps will be specifically introduced in combination with specific embodiments.

[0070] Firstly, in step 101, the space features and the time sequence features of the data are extracted at the same time, and the space features output by the space feature extraction unit are fused with the time sequence features output by the time sequence feature extraction unit, so that the features generated by the network behaviors can be better exhibited, the recognition of the data malicious attack behaviors is more accurate, and the security of the data is improved.

[0071] Optionally, in addition to the data malicious attack behavior detection model constructed in the embodiment, other classification neural networks can also be directly used for recognizing the data malicious attack behaviors.

[0072] Next, in step 102, the training data set comprises the training data feature information and the data malicious attack behavior detection result corresponding to the training data feature information.

[0073] The training data feature information and the data malicious attack behavior detection result corresponding to the training data feature information can be data pre-stored in a database, or data input by human-computer interaction.

[0074] When the detection task is relatively simple, the data malicious attack behavior detection result can only be whether there is a data malicious attack behavior. When the detection task is relatively complex, the data malicious attack behavior detection result can be whether there is a data malicious attack behavior and a specific attack type. For example, the data malicious attack behavior detection result can be no attack, class A attack, or class B attack.

[0075] Next, in relation to step 103 described above, during the training process, the main parameter to be trained is the connection weight, and other parameters are set conventionally. The connection weight is trained so that the data malicious attack behavior detection model has the ability to accurately identify attack behaviors.

[0076] Optionally, in addition to the training method provided in the embodiment, other optimization algorithms can also be used to train the data malicious attack behavior detection model. For example, the Adam optimization algorithm is used for training.

[0077] In some embodiments of the present application, Figure 2 is a structural schematic diagram of a data malicious attack behavior detection model provided by an embodiment of the present application, which, in combination with Figure 2 as shown, the data malicious attack behavior detection model is constructed, which can specifically include the following steps: constructing a spatial feature extraction unit, the spatial feature extraction unit including a first convolutional layer, a second convolutional layer, a first pooling layer, a third convolutional layer, a fourth convolutional layer, and a second pooling layer connected in sequence; constructing a time sequence feature extraction unit, the time sequence feature extraction unit including a data transformation layer and a gated recurrent unit neural network connected in sequence; constructing an attack behavior detection unit, the attack behavior detection unit including a feature data fusion layer, an input layer, a hidden layer, and an output layer connected in sequence.

[0078] The feature data fusion layer of the attack behavior detection unit is configured to fuse the spatial features output by the second pooling layer and the time sequence features output by the gated recurrent unit neural network to generate fusion features, which are the input of the attack behavior detection unit. The output layer of the attack behavior detection unit is configured to output a detection result, which is the data malicious attack behavior detection result of the malicious attack behavior detection model.

[0079] For example, the connection features include connection duration, connection protocol, network service type of the destination address, connection error or normal state, data byte number from the source host to the target host, data byte number from the target host to the source host, whether the source or destination is the same port / host, and the number of error fragments.

[0080] Content features include the number of times sensitive files and directories are accessed, the number of failed login attempts, whether the login was successful, the number of times a compromised condition occurred, whether root user privileges were obtained, whether the su root command occurred, the number of accesses by the root user, the number of file creation operations, the number of times a shell prompt occurred, the number of accesses to critical files, and whether the login was on a hot list.

[0081] Traffic features include the number of connections with the same destination host as the current connection, the number of connections with the same service as the current connection, the percentage of connections with the same destination host as the current connection that have a SYN error, the percentage of connections with the same service as the current connection that have a SYN error, the percentage of connections with the same destination host as the current connection that have a REJ error, the percentage of connections with the same service as the current connection that have a REJ error, the percentage of connections with the same destination host as the current connection that have the same service, the percentage of connections with the same destination host as the current connection that have a different service, the percentage of connections with the same service as the current connection that have a different destination host.

[0082] The spatial feature extraction unit outputs spatial features, and the time sequence feature extraction unit outputs time sequence features. The feature data fusion layer fuses the spatial features output by the spatial feature extraction unit and the time sequence features output by the time sequence feature extraction unit to obtain fused features.

[0083] The fused features are input into the attack behavior detection unit, thereby constructing a data malicious attack behavior detection model. The attack behavior detection unit outputs a data malicious attack behavior detection result, and the output of the attack behavior detection unit is taken as the output of the data malicious attack behavior detection model.

[0084] By constructing an N*N-dimensional first input feature, the spatial feature extraction unit is combined with the time sequence features of the data, thereby improving the recognition ability of the model for the data type.

[0085] In this embodiment, the KDDCup99 data set is mainly selected as the training data feature information. The KDDCup99 data set includes four attack types and is a benchmark data set in the intrusion detection field. The data set is obtained by simulating the communication environment of the United States Air Force local area network by the Lincoln Laboratory and collecting traffic data. Because the communication data collected is large, the KDDCup99 data set is used. After processing, 10% of the standard data set is obtained, in which the abnormal state is divided into Dos attack behavior (denial of service attack), Probe attack behavior (port monitoring and detection attack), R2L attack behavior (remote host illegal access), and U2R attack behavior (illegal access of ordinary users to superuser privileges).

[0086] It is worth mentioning that optionally, if it is necessary to identify other types of attack behaviors, training data including other types of attack behaviors can be used.

[0087] In some embodiments, the training data feature information includes a first input feature of N*N dimensions.

[0088] In the collected initial training data feature information, there may be some characters, and the deep learning model cannot directly recognize the characters, so it is necessary to convert the non-numeric data first, and thus the training data feature information is numeric data.

[0089] The training data set can be obtained by the following steps:

[0090] Step 201, obtaining initial training data feature information, the initial training data feature information including non-numeric data;

[0091] Step 202, converting the non-numeric data in the training data feature information into numeric data to obtain the initial training data feature information after character conversion;

[0092] Step 203, generating a M*M dimensional feature matrix corresponding to the initial training data feature information after character conversion;

[0093] Step 204, normalizing the M*M dimensional feature matrix to obtain a normalized M*M dimensional feature matrix;

[0094] Step 205, performing dimension reduction processing on the normalized M*M dimensional feature matrix to obtain a first input feature of N*N dimensions.

[0095] For example, the first convolutional layer and the data conversion layer jointly receive the N*N dimensional first input feature, and the data conversion layer converts the N*N dimensional first input feature into a 1*N2 dimensional second input feature, so that the spatial feature extraction unit extracts the spatial feature in the first input feature and the time sequence feature extraction unit extracts the time sequence feature in the second input feature.

[0096] The training data feature information after character conversion is composed into a M*M dimensional feature matrix;

[0097] Optionally, the missing part of the M*M dimensional feature matrix is processed by zero filling.

[0098] In order to standardize the data, the longest training data feature information can be collected to construct a M*M dimensional feature matrix, and then reduced to a first input feature of N*N dimensions, so as to ensure the detection accuracy of the data malicious attack behavior.

[0099] The M*M dimensional feature matrix is normalized to obtain a normalized M*M dimensional feature matrix. By normalizing the feature matrix, the data volume can be effectively reduced, and the data recognition speed can be accelerated.

[0100] The normalized M*M dimensional feature matrix is dimensionally reduced to obtain an N*N dimensional first input feature, that is, preprocessed training data feature information.

[0101] In some embodiments, the normalized M*M dimensional feature matrix is dimensionally reduced to obtain an N*N dimensional first input feature, including: dimensionally reducing the normalized M*M dimensional feature matrix according to a principal component analysis (PCA) dimension reduction algorithm to obtain an N*N dimensional first input feature.

[0102] Optionally, in addition to the principal component analysis (PCA) dimension reduction method provided in the embodiment, other dimension reduction methods can also be used for dimension reduction processing.

[0103] In some embodiments, the data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the backpropagation algorithm, to obtain the trained data malicious attack behavior detection model, including:

[0104] Step 301, initializing the network parameters of the data malicious attack behavior detection model, wherein the initialized network parameters include a network parameter upper limit and a network parameter lower limit, and between the network parameter upper limit and the network parameter lower limit, a plurality of network parameter individuals are included, each network parameter individual is used to represent a vector composed of all network parameters of the data malicious attack behavior detection model.

[0105] Step 302, training the initialized data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the backpropagation algorithm, to obtain the trained data malicious attack behavior detection model.

[0106] Specifically, the network parameter upper limit and the network parameter lower limit of the data malicious attack behavior detection model are set, and the network parameters of the data malicious attack behavior detection model are generated between the network parameter upper limit and the network parameter lower limit to obtain network parameter individuals, and a plurality of network parameter individuals are obtained, each network parameter individual is used to represent a vector composed of all network parameters of the data malicious attack behavior detection model.

[0107] Optionally, in addition to generating the network parameters of the data malicious attack behavior detection model between the upper limit of the network parameters and the lower limit of the network parameters, a chaotic sequence can be used for initialization of the network parameter individuals, so that the initial population is more uniformly distributed in the solution space, and the training effect can be effectively improved.

[0108] In some embodiments, the initialized data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm, to obtain a trained data malicious attack behavior detection model, including:

[0109] Step 401, according to the training data set, determining the fitness value corresponding to each network parameter individual, and taking the network parameter individual with the maximum fitness value as the search individual and taking the remaining 1-K% network parameter individual as the following individual, wherein k% is the initialization search ratio;

[0110] Step 402, performing neighborhood search on each search individual, and updating the search individual according to the greedy selection algorithm to obtain an updated search individual;

[0111] Step 403, determining the reverse individual corresponding to each updated search individual according to the reverse learning algorithm;

[0112] Step 404, taking out the individual with the maximum fitness value from the updated search individual and the reverse individual, and determining the individual as the first target individual, and taking the first target individual as the new search individual;

[0113] Step 405, in the new search individual, determining the second target individual corresponding to each following individual according to the roulette selection algorithm, and performing neighborhood search on the following individual based on the second target individual to obtain an updated following individual;

[0114] Step 406, in the case where the number of iterations reaches the preset training number T, or the maximum fitness value in the search individual and the following individual is greater than the set threshold, the training is ended, and the individual with the maximum fitness value is taken as the final network parameter of the data malicious attack behavior detection model, to obtain the trained data malicious attack behavior detection model.

[0115] In addition, in some embodiments of the present application, the method further comprises:

[0116] Step 407, in the case that the iteration number does not reach the preset training number T, and the maximum fitness value in the search individual and the following individual is less than or equal to the set threshold, in the updated search individual and the updated following individual, the network parameter individual with the maximum K % of the fitness value is taken as the search individual of the current iteration training, and the remaining 1-K % of the network parameter individual is taken as the following individual of the current iteration, and the iteration training is continued.

[0117] Step 408, until the iteration number reaches the preset training number T, or the maximum fitness value in the search individual and the following individual is greater than the set threshold, the training is ended, and the individual with the maximum fitness value is taken as the final network parameter of the data malicious attack behavior detection model, and the trained data malicious attack behavior detection model is obtained.

[0118] In the training process, the method further comprises: in the case that whether the following individual is not increased in L times of training, a new following individual or a variation individual is randomly generated, and the new following individual or the variation individual is used to replace the following individual.

[0119] As a specific example, before training, the following settings can be made: the initial search ratio is K %, the maximum local optimum limit number L, the maximum training number T, and the training counter t = 1.

[0120] According to the preprocessed training data feature information and the data malicious attack behavior detection result corresponding to the training data feature information, the fitness value corresponding to all network parameter individuals is determined.

[0121] The fitness value is a common technical means in deep learning, and the embodiment does not involve any improvement, which is not described here. For example, the negative value of the root mean square error or the negative value of the cross entropy loss function can be used as the fitness value.

[0122] The network parameter individual with the maximum K % of the fitness value is taken as the search individual, and the remaining 1-K % of the network parameter individual is taken as the following individual.

[0123] Optionally, in addition to using the set ratio to divide the search individual and the following individual, the number of search individuals in each training process can be specified, and the remaining individuals are taken as the following individual.

[0124] The neighborhood search is performed on each search individual, and the greedy selection algorithm is used to update the search individual, and the updated search individual is obtained.

[0125] The reverse learning algorithm is used to determine the reverse individual corresponding to each updated search individual, and H% of the individuals with the maximum fitness value are taken from all the updated search individuals and the reverse individuals to obtain first target individuals. The first target individuals are used as new search individuals. Optionally, H can be 50.

[0126] The reverse learning algorithm is integrated into the search algorithm, which can effectively improve the convergence rate and avoid falling into a local optimal solution to some extent.

[0127] According to the new search individual, the roulette selection algorithm is used to determine the second target individual corresponding to each following individual, and the following individual is searched based on the second target individual to obtain an updated following individual.

[0128] It is judged whether the fitness value of the following individual does not increase in L times of training. If yes, a new individual or a mutated individual is randomly generated, and the new individual or the mutated individual is used to replace the following individual. Otherwise, the termination condition judgment process is performed.

[0129] When an individual serves as a following individual in L times of training and the fitness value does not increase, it can be proved that the individual belongs to a poor solution and has no updating value. In order to speed up the training data, the individual is re-generated for training.

[0130] It is judged whether the current iteration number t is greater than the maximum training number T or the maximum fitness value in the search individual and the following individual is greater than a set threshold. If yes, the training is ended, the individual with the maximum fitness value is used as the final network parameter of the data malicious attack behavior detection model, and the trained data malicious attack behavior detection model is obtained. Otherwise, the count value of the current iteration number t is increased by one, the search individual and the following individual are re-divided, and the next training is performed.

[0131] In a possible implementation, the neighborhood search is performed on each search individual, and the search individual is updated by using the greedy selection algorithm to obtain an updated search individual, including:

[0132] The neighborhood search is performed on each search individual, and the first update value corresponding to the search individual is determined as:

[0133]

[0134] wherein, represents the jth network parameter in the ith search individual in the tth training, j = 1, 2, …, D, D represents the total dimension of the network parameter, and rand represents a random number between (-1, 1), represents the jth network parameter in a random individual other than the ith search individual in the tth training, R ijdenotes the jth element in the random number vector R generated by the ith search individual, R ij is uniformly distributed, and R ij ∈(0, 1), γ denotes a control parameter, and γ max denotes the final value of the control parameter γ, γ min denotes the initial value of the control parameter γ, e denotes a natural constant, and b denotes a constant factor.

[0135] The greedy selection algorithm is used to search for an optimal value between the search individual and the first updated value, and an updated search individual is obtained.

[0136] When the fitness value of the search individual is greater than the fitness value of the corresponding first updated value, the optimal value is the search individual itself. When the fitness value of the search individual is less than the fitness value of the corresponding first updated value, the optimal value is the first updated value, and the first updated value is taken as the updated search individual.

[0137] By simultaneously searching for the network parameters of each dimension in the search individual, the convergence speed can be effectively accelerated, and the greedy selection algorithm is used for updating, which can avoid moving to a poor solution during updating. The control parameter of the embodiment is dynamically adjusted, so that the algorithm has strong search ability in the early stage and better development ability in the later stage.

[0138] In a possible implementation, the reverse individual corresponding to each updated search individual is determined by using a backpropagation algorithm, including:

[0139] The first reverse value is determined as:

[0140]

[0141] wherein, denotes the jth network parameter in the lth updated search individual in the tth training process, denotes the corresponding first reverse value, min j denotes the lower limit of the jth network parameter, and max j denotes the upper limit of the jth network parameter.

[0142] It is determined whether the first reverse value is located between [min j , max j ]. If yes, the reverse individual corresponding to the updated search individual is determined according to the first reverse value , otherwise, a second reverse value is obtained as a random value between [min j , max j ], and the reverse individual corresponding to the updated search individual is determined according to the second reverse value determine a reverse individual corresponding to the updated search individual.

[0143] In a possible implementation, according to the new search individual, a roulette algorithm is used to determine a second target individual corresponding to each following individual, and based on the second target individual, a neighborhood search is performed on the following individual to obtain an updated following individual, including:

[0144] According to the new search individual, a probability of each new search individual being a second target individual is determined as follows:

[0145]

[0146] wherein p i represents the probability of each new search individual being a second target individual, f i represents an adaptive value corresponding to the i th new search individual, and I represents a total number of search individuals.

[0147] Based on the probability of each new search individual being a second target individual, a roulette algorithm is used to determine a second target individual corresponding to the k th following individual

[0148] According to the second target individual perform a neighborhood search on the following individual, and determine a second updated value of the following individual as follows:

[0149]

[0150] wherein, represents a j th network parameter in the k th following individual represents the updated x bestj represents an individual with the largest adaptive value in the updated search individual, represents a j th network parameter in the second target individual

[0151] A greedy selection algorithm is used to select a better value between the following individual and the second updated value, to obtain an updated following individual.

[0152] wherein when the adaptive value of the following individual is greater than the adaptive value of the second updated value, the better value is the following individual itself; and when the adaptive value of the following individual is less than the adaptive value of the second updated value, the better value is the second updated value, and the second updated value is taken as the updated following individual.

[0153] By performing a neighborhood search on the following individual through the search individual and the global optimal value, the algorithm can avoid prematureness under the premise of maintaining population diversity, thereby improving the training effect.​​​

[0154] In a possible implementation, the new individual or the mutated individual is randomly generated, and the new individual or the mutated individual is used to replace the following individual, including:

[0155] The network parameter of the data malicious attack behavior detection model is generated between the upper limit of the network parameter and the lower limit of the network parameter, to obtain a new individual corresponding to the following individual whose fitness value is not increased in L times of training.

[0156] The mutated individual corresponding to the following individual whose fitness value is not increased in L times of training is generated as follows:

[0157] v wj = x wj + λ (x bestj - x wj ) + λ (x r1j - x r2j )

[0158] Wherein, x wj represents the jth network parameter in the following individual whose fitness value is not increased in L times of training, λ represents a scaling factor, x bestj represents the jth network parameter in the individual with the maximum current fitness value, v wj represents the jth network parameter in the mutated individual, x r1j represents the jth network parameter in the first random individual, and x r2j represents the jth network parameter in the second random individual, and the first random individual, the second random individual, and the following individual whose fitness value is not increased in L times of training are all different.

[0159] By generating the new individual and the mutated individual, the convergence effect of the algorithm can be improved on the premise of increasing the population diversity.

[0160] The individual with the maximum fitness value in the mutated individual and the new individual is used to replace the following individual.

[0161] Optionally, since the neighborhood search learning algorithm used in this embodiment may cause the out-of-bound behavior of the network parameter in the search process, the network parameter needs to be processed for out-of-bound after each update of the parameter. For example, the update value is first determined, then the out-of-bound processing is performed, and finally the greedy algorithm is selected.

[0162] According to the model generation method provided in the embodiments of the present application, the embodiments of the present application further provide a data malicious attack behavior detection method, which specifically can include steps 501 to 503.

[0163] Step 501, collecting real-time data feature information;

[0164] At step 502, the real-time data feature information is preprocessed to obtain preprocessed real-time data feature information.

[0165] At step 503, the real-time data feature information is identified according to the trained data malicious attack behavior detection model to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is obtained according to the model generation method provided in the embodiments of the present application.

[0166] In the embodiments of the present application, the data malicious attack behavior detection model can extract spatial information and time sequence information of data feature information, and fuse and identify the spatial information and time sequence information, so as to accurately detect malicious attack behaviors against data. Meanwhile, the data malicious attack behavior detection model is trained based on the neighborhood search learning algorithm of the greedy selection algorithm and the backpropagation algorithm, which can achieve better training effect and make the trained data malicious attack behavior detection model have strong detection capability, thereby solving the low detection rate problem in the prior art.

[0167] Based on the same inventive concept, the present application also provides a model generation device corresponding to the above-mentioned model generation method. The model generation device will be described in detail in combination with Figure 3 the above-mentioned model generation method.

[0168] Figure 3 is a structural schematic diagram of a model generation device provided in the embodiments of the present application, as Figure 3 shown, the model generation device can include a processing module 310 and an acquisition module 320.

[0169] The processing module 310 is configured to construct a data malicious attack behavior detection model, the data malicious attack behavior detection model including a spatial feature extraction unit for extracting data spatial features, a time sequence feature extraction unit for extracting data time sequence features, and an attack behavior detection unit for detecting attack behaviors, wherein the attack behavior detection unit is configured to fuse the spatial features output by the spatial feature extraction unit and the time sequence features output by the time sequence feature extraction unit to generate fused features, and generate an output result according to the fused features, wherein the output result is an output result of the data malicious attack behavior detection model.

[0170] The acquisition module 320 is further configured to acquire a training data set, the training data set including training data feature information and a data malicious attack behavior detection result corresponding to the training data feature information, the training data feature information including connection features, content features, and traffic features, and the data malicious attack behavior detection result corresponding to the training data feature information including no attack or data malicious attack, and the data malicious attack being used to represent the existence of data attack behaviors or attack types of data attack behaviors.

[0171] The processing module 310 is further configured to train the data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighbor search learning algorithm of the reverse learning algorithm, to obtain the trained data malicious attack behavior detection model.

[0172] In some embodiments, the processing module 310 is further configured to construct a spatial feature extraction unit, the spatial feature extraction unit comprising a first convolutional layer, a second convolutional layer, a first pooling layer, a third convolutional layer, a fourth convolutional layer, and a second pooling layer connected in sequence.

[0173] The processing module 310 is further configured to construct a time sequence feature extraction unit, the time sequence feature extraction unit comprising a data transformation layer and a gated recurrent unit neural network connected in sequence.

[0174] The processing module 310 is further configured to construct an attack behavior detection unit, the attack behavior detection unit comprising a feature data fusion layer, an input layer, a hidden layer, and an output layer connected in sequence.

[0175] The feature data fusion layer of the attack behavior detection unit is configured to fuse the spatial feature output by the second pooling layer and the time sequence feature output by the gated recurrent unit neural network to generate a fusion feature, the fusion feature being an input of the attack behavior detection unit.

[0176] The output layer of the attack behavior detection unit is configured to output a detection result, the detection result being a data malicious attack behavior detection result of the malicious attack behavior detection model.

[0177] In some embodiments, the training data feature information comprises a first input feature of N*N dimensions.

[0178] The acquisition module 320 is further configured to acquire initial training data feature information, the initial training data feature information comprising non-numeric data.

[0179] The processing module 310 is further configured to convert the non-numeric data in the training data feature information into numeric data to obtain initial training data feature information after character conversion.

[0180] The processing module 310 is further configured to generate a feature matrix of M*M dimensions corresponding to the initial training data feature information after character conversion.

[0181] The processing module 310 is further configured to perform normalization processing on the feature matrix of M*M dimensions to obtain a normalized feature matrix of M*M dimensions.

[0182] The processing module 310 is further configured to perform dimension reduction processing on the normalized M*M dimensional feature matrix to obtain N*N dimensional first input features.

[0183] In some embodiments, the processing module 310 is further configured to perform dimension reduction processing on the normalized M*M dimensional feature matrix according to a principal component analysis dimension reduction algorithm to obtain N*N dimensional first input features.

[0184] In some embodiments, the processing module 310 is further configured to initialize network parameters of the data malicious attack behavior detection model, wherein the initialized network parameters include an upper limit of network parameters and a lower limit of network parameters, and between the upper limit of network parameters and the lower limit of network parameters, a plurality of network parameter individuals are included, and each network parameter individual is used to represent a vector composed of all network parameters of the data malicious attack behavior detection model.

[0185] The processing module 310 is further configured to train the initialized data malicious attack behavior detection model according to training data feature information in the training data set, data malicious attack behavior detection results corresponding to the training data feature information, a greedy selection algorithm, and a neighborhood search learning algorithm of a backpropagation algorithm.

[0186] In some embodiments, the processing module 310 is further configured to determine the fitness value corresponding to each network parameter individual according to the training data set, and take the network parameter individual with the maximum fitness value as a search individual and take the remaining 1-K% network parameter individuals as following individuals, wherein k% is an initialization search ratio.

[0187] The processing module 310 is further configured to perform neighborhood search on each search individual and update the search individual according to a greedy selection algorithm to obtain an updated search individual.

[0188] The processing module 310 is further configured to determine a reverse individual corresponding to each updated search individual according to a backpropagation algorithm.

[0189] The processing module 310 is further configured to take out the individual with the maximum fitness value from the updated search individual and the reverse individual to determine a first target individual, and take the first target individual as a new search individual.

[0190] The processing module 310 is further configured to determine a second target individual corresponding to each following individual in the new search individual according to a roulette selection algorithm, and perform neighborhood search on the following individual based on the second target individual to obtain an updated following individual.

[0191] The processing module 310 is further configured to end the training and take the individual with the maximum fitness value as the final network parameter of the data malicious attack behavior detection model, and obtain the trained data malicious attack behavior detection model, when the number of iterations reaches the preset training number T or the maximum fitness value in the search individual and the following individual is greater than the set threshold.

[0192] In some embodiments, the processing module 310 is further configured to, when the number of iterations does not reach the preset training number T and the maximum fitness value in the search individual and the following individual is less than or equal to the set threshold, take the network parameter individual with the maximum K% fitness value in the updated search individual and the updated following individual as the search individual of the current iteration training and the network parameter individual with the remaining 1-K% fitness value as the following individual of the current iteration, and continue the iteration training.

[0193] The processing module 310 is further configured to end the training and take the individual with the maximum fitness value as the final network parameter of the data malicious attack behavior detection model, and obtain the trained data malicious attack behavior detection model, when the number of iterations reaches the preset training number T or the maximum fitness value in the search individual and the following individual is greater than the set threshold.

[0194] In some embodiments, the processing module 310 is further configured to, when the following individual does not increase in fitness value in L times of training, randomly generate a new following individual or a mutated individual, and replace the following individual with the new following individual or the mutated individual.

[0195] It can be understood that the model generation apparatus of the embodiments of the present application can correspond to the execution subject of the model generation method provided by the embodiments of the present application, and the specific details of the operations and / or functions of each module / unit of the model generation apparatus can be referred to the description of the corresponding part in the model generation method provided by the embodiments of the present application. For the sake of brevity, it will not be repeated here.

[0196] Based on the same inventive concept, the present application also provides a data malicious attack behavior detection apparatus corresponding to the above-mentioned data malicious attack behavior detection method. The data malicious attack behavior detection apparatus will be described in detail in combination with Figure 4 the above.

[0197] Figure 4 is a structural schematic diagram of a data malicious attack behavior detection apparatus provided by the embodiments of the present application, as Figure 4 shown, the data malicious attack behavior detection apparatus comprises an acquisition module 410 and a processing module 420.

[0198] The acquisition module 410 is configured to collect real-time data feature information.

[0199] The processing module 420 is configured to pre-process the real-time data feature information to obtain pre-processed real-time data feature information.

[0200] The processing module 420 is further configured to identify the real-time data feature information according to the trained data malicious attack behavior detection model to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is obtained according to the method for generating a model provided in the embodiments of the present application.

[0201] It can be understood that the data malicious attack behavior detection apparatus in the embodiments of the present application can correspond to an execution subject of the data malicious attack behavior detection method provided in the embodiments of the present application, and the specific details of the operations and / or functions of each module / unit of the data malicious attack behavior detection apparatus can be referred to the description of the corresponding part in the data malicious attack behavior detection method provided in the embodiments of the present application. For brevity, the details are not described herein again.

[0202] Figure 5 A structural schematic diagram of an electronic device provided in an embodiment of the present application is shown. As shown in the figure, the device can include a processor 501 and a memory 502 storing computer program instructions. Figure 5

[0203] Specifically, the processor 501 described above can include a central processing unit (CPU), or a specific integrated circuit (ASIC), or can be configured to implement one or more integrated circuits of the embodiments of the present application.

[0204] The memory 502 can include a mass storage for information or instructions. By way of example and not limitation, the memory 502 can include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. In one example, the memory 502 can include a removable or non-removable (or fixed) medium, or the memory 502 is a non-volatile solid-state memory. The memory 502 can be internal or external to the electronic device.

[0205] ​The memory can include read-only memory (ROM), random-access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Accordingly, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software that, when executed (by one or more processors), is operable to perform operations described with reference to the methods according to an aspect of the present disclosure.

[0206] The processor 501 implements the methods described in the embodiments of the present application by reading and executing computer program instructions stored in the memory 502, and achieves the corresponding technical effects of the embodiments of the present application in executing the methods thereof. For brevity, this will not be described again.

[0207] In one example, the electronic device can further include a communication interface 503 and a bus 504. As shown, the processor 501, the memory 502, and the communication interface 503 are connected through the bus 504 and complete communication therebetween. Figure 5

[0208] The communication interface 503 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiments of the present application.

[0209] The bus 504 includes hardware, software or both to couple components of the online information flow charging device to each other. By way of example, and without limitation, the bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or combination of two or more of these. Where appropriate, the bus 504 can include one or more buses. Although the present embodiments describe and show a particular bus, the present application contemplates any suitable bus or interconnect.

[0210] ​The electronic device can execute the model generation method or the data malicious attack behavior detection method in the embodiments of the present application, thereby achieving the corresponding technical effects of the model generation method or the data malicious attack behavior detection method described in the embodiments of the present application.

[0211] In addition, in combination with the model generation method or the data malicious attack behavior detection method in the above embodiments, the embodiments of the present application can provide a readable storage medium for implementation. The readable storage medium has computer program instructions stored thereon; the computer program instructions are executed by a processor to implement any one of the model generation methods or the data malicious attack behavior detection methods in the above embodiments. Examples of the readable storage medium can be non-transitory machine-readable media, such as electronic circuits, semiconductor memory devices, read-only memories (ROMs), floppy disks, compact discs (CD-ROMs), optical discs, hard disks, and the like.

[0212] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0213] The functional blocks shown in the structural block diagrams described above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, functional cards, and the like. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. The "machine-readable medium" can include any medium capable of storing or transmitting information. Examples of the machine-readable medium include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact discs (CD-ROM), optical disks, hard disks, optical fiber media, radio frequency (RF) links, and the like. The code segments can be downloaded via a computer network such as the Internet, an intranet, or the like.

[0214] It should also be noted that the exemplary embodiments mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in an order different from that in the embodiments, or several steps can be performed simultaneously.

[0215] The embodiments of the present application also provide a computer readable storage medium, which stores computer program instructions; the computer program instructions are executed by a processor to implement the model generation method or the data malicious attack behavior detection method provided by the embodiments of the present application.

[0216] In addition, in combination with the model generation method or the data malicious attack behavior detection method, the device, and the readable storage medium described above, the embodiments of the present application can provide a computer program product to implement. The instructions in the computer program product are executed by the processor of an electronic device, so that the electronic device executes any one of the model generation method or the data malicious attack behavior detection method in the above embodiments.

[0217] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0218] The above solely describes specific implementations of the present application. For the purpose of description and brevity, the specific working process of the system, module and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described herein. It should be understood that the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements shall be included in the protection scope of the present application.

Claims

1. A method of model generation, characterized by, The method comprises the following steps: constructing a data malicious attack behavior detection model, the data malicious attack behavior detection model comprising a spatial feature extraction unit for extracting spatial features, a time sequence feature extraction unit for extracting time sequence features, and an attack behavior detection unit for detecting attack behaviors, wherein the attack behavior detection unit is configured to fuse the spatial features output by the spatial feature extraction unit with the time sequence features output by the time sequence feature extraction unit to generate fused features, and to generate an output result based on the fused features, wherein the output result is an output result of the data malicious attack behavior detection model; obtaining a training data set, the training data set comprising training data feature information and a data malicious attack behavior detection result corresponding to the training data feature information, the training data feature information comprising connection features, content features, and traffic features, and the data malicious attack behavior detection result comprising no attack or data malicious attack, wherein the data malicious attack is used to represent an attack behavior or an attack type of the data attack behavior; training the data malicious attack behavior detection model based on the training data feature information, the data malicious attack behavior detection result corresponding to the training data feature information, a greedy selection algorithm, and a neighborhood search learning algorithm of a backpropagation algorithm, to obtain a trained data malicious attack behavior detection model.

2. The method of claim 1, wherein, The method of constructing a data malicious attack behavior detection model comprises: constructing a spatial feature extraction unit, the spatial feature extraction unit comprising a first convolutional layer, a second convolutional layer, a first pooling layer, a third convolutional layer, a fourth convolutional layer, and a second pooling layer connected in sequence; constructing a time sequence feature extraction unit, the time sequence feature extraction unit comprising a data transformation layer and a gated recurrent unit neural network connected in sequence; constructing an attack behavior detection unit, the attack behavior detection unit comprising a feature data fusion layer, an input layer, a hidden layer, and an output layer connected in sequence; wherein the feature data fusion layer of the attack behavior detection unit is configured to fuse the spatial features output by the second pooling layer with the time sequence features output by the gated recurrent unit neural network to generate fused features, and the fused features are input to the attack behavior detection unit; the output layer of the attack behavior detection unit is configured to output the detection result, and the detection result is a data malicious attack behavior detection result of the malicious attack behavior detection model.

3. The method of claim 1, wherein, The training data feature information comprises a first input feature of N*N dimensions. The method of obtaining a training data set comprises: obtaining initial training data feature information, the initial training data feature information comprising non-numeric data; converting the non-numeric data in the training data feature information into numeric data to obtain initial training data feature information after character conversion; generating a feature matrix of M*M dimensions corresponding to the initial training data feature information after character conversion; performing normalization processing on the feature matrix of M*M dimensions to obtain a normalized feature matrix of M*M dimensions; The normalized M*M dimensional feature matrix is dimensionally reduced to obtain the N*N dimensional first input feature.

4. The method of claim 3, wherein, The dimensionally reducing the normalized M*M dimensional feature matrix to obtain the N*N dimensional first input feature comprises: The normalized M*M dimensional feature matrix is dimensionally reduced according to a principal component analysis dimension reduction algorithm to obtain the N*N dimensional first input feature.

5. The method of claim 1, wherein, The training of the data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm comprises: The network parameters of the data malicious attack behavior detection model are initialized, wherein the initialized network parameters include a network parameter upper limit and a network parameter lower limit, and between the network parameter upper limit and the network parameter lower limit, a plurality of network parameter individuals are included, and each network parameter individual is used to represent a vector composed of all network parameters of the data malicious attack behavior detection model; The initialized data malicious attack behavior detection model is trained according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm, to obtain the trained data malicious attack behavior detection model.

6. The method of claim 5, wherein, The training of the initialized data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, the greedy selection algorithm, and the neighborhood search learning algorithm of the reverse learning algorithm comprises: According to the training data set, the fitness value corresponding to each network parameter individual is determined, and the network parameter individual with the maximum fitness value of K% is taken as the search individual and the remaining network parameter individual with the fitness value of 1-K% is taken as the following individual, wherein k% is the initialization search ratio; The neighborhood search is performed on each search individual, and the search individual is updated according to the greedy selection algorithm to obtain an updated search individual; The reverse individual corresponding to each updated search individual is determined according to the reverse learning algorithm. The updated search individual is replaced by the individual with the maximum fitness value of H% in the reverse individual to determine the first target individual, and the first target individual is taken as a new search individual; In the new search individual, the second target individual corresponding to each following individual is determined according to the roulette selection algorithm, and the following individual is neighborhood searched based on the second target individual to obtain an updated following individual; The neighborhood search is performed on each search individual, and the search individual is updated according to the greedy selection algorithm to obtain an updated search individual; In a case that the iteration number reaches a preset training number T or the maximum fitness value in the searching individual and the following individual is greater than a set threshold, the training is ended, and the individual with the maximum fitness value is taken as the final network parameter of the data malicious attack behavior detection model, and a trained data malicious attack behavior detection model is obtained.

7. The method of claim 6, wherein, The method further comprises: In a case that the iteration number does not reach the preset training number T and the maximum fitness value in the searching individual and the following individual is less than or equal to the set threshold, in the updated searching individual and the updated following individual, the network parameter individual with the maximum K% fitness value is taken as the searching individual of the current iteration training, and the remaining 1-K% network parameter individual is taken as the following individual of the current iteration, and the iteration training is continued; In a case that the iteration number reaches a preset training number T or the maximum fitness value in the searching individual and the following individual is greater than a set threshold, the training is ended, and the individual with the maximum fitness value is taken as the final network parameter of the data malicious attack behavior detection model, and a trained data malicious attack behavior detection model is obtained.

8. The method of claim 7, wherein, The method further comprises: in a case that the following individual does not increase in fitness value in L times of training, a new following individual or a mutated individual is randomly generated, and the new following individual or the mutated individual is used to replace the following individual.

9. A method of detecting a data malicious attack behavior, characterized by, Comprise: Collecting real-time data feature information; Pretreating the real-time data feature information to obtain pretreated real-time data feature information; According to the trained data malicious attack behavior detection model, the real-time data feature information is identified to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is trained according to the generation method of the model in any one of claims 1 to 8.

10. A model generation apparatus characterized by comprising: The device comprises: A processing module configured to construct a data malicious attack behavior detection model, the data malicious attack behavior detection model comprising: a spatial feature extraction unit configured to extract spatial features of data, a time sequence feature extraction unit configured to extract time sequence features of data, and an attack behavior detection unit configured to detect attack behaviors, wherein the attack behavior detection unit is configured to fuse the spatial features output by the spatial feature extraction unit and the time sequence features output by the time sequence feature extraction unit to generate fused features, and to generate an output result according to the fused features, wherein the output result is an output result of the data malicious attack behavior detection model; An acquisition module configured to acquire a training data set, the training data set comprising training data feature information and a data malicious attack behavior detection result corresponding to the training data feature information, the training data feature information comprising connection features, content features, and traffic features, and the data malicious attack behavior detection result comprising no attack or data malicious attack, wherein the data malicious attack is used to represent an attack behavior or an attack type of a data attack behavior; The processing module is further configured to train the data malicious attack behavior detection model according to the training data feature information in the training data set, the data malicious attack behavior detection result corresponding to the training data feature information, a greedy selection algorithm, and a neighborhood search learning algorithm of a reverse learning algorithm, to obtain a trained data malicious attack behavior detection model.

11. A data malicious attack behavior detection apparatus characterized by comprising: Comprise: An acquisition module configured to collect real-time data feature information; A processing module configured to pre-process the real-time data feature information to obtain pre-processed real-time data feature information; The processing module is further configured to identify the real-time data feature information according to the trained data malicious attack behavior detection model to obtain a data malicious attack behavior detection result corresponding to the real-time data feature information, wherein the trained data malicious attack behavior detection model is obtained by training according to the model generation method of any one of claims 1 to 8.

12. An electronic device, comprising: The device comprises a processor and a memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the model generation method of any one of claims 1 to 8 and the data malicious attack behavior detection method of claim 9.

13. A readable storage medium, characterized by, The readable storage medium stores computer program instructions, and the computer program instructions are executed by the processor to implement the model generation method of any one of claims 1 to 8 and the data malicious attack behavior detection method of claim 9.

Images