Attack identification method, device, apparatus and storage medium

Abstract

The application discloses an attack identification method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: collecting to-be-identified data; inputting the to-be-identified data into a pre-constructed attack identification network for identification to obtain an identification result, wherein the attack identification network is constructed by using an attention mechanism and a loss function optimized based on data characteristics, and the application is easy to discover new attacks and unknown attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an attack identification method and device, equipment and a storage medium. BACKGROUND

[0002] With the continuous progress of technology, in order to protect computer systems, networks and data from various malicious attacks, network security technology is also developing, and thus attack identification technology emerges as the times require.

[0003] Attack identification technology helps to discover and respond to potential security threats in a timely manner by monitoring, analyzing and detecting abnormal behavior in real time, thereby improving the overall network security protection capability.

[0004] The prior art usually adopts a rule-based attack identification method to identify attacks, but this attack identification method is difficult to discover new attacks and unknown attacks.

[0005] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0006] The main purpose of the present application is to provide an attack identification method, device, equipment and storage medium, which aims to solve the technical problem that the current rule-based attack identification method is difficult to discover new attacks and unknown attacks.

[0007] To achieve the above purpose, the present application provides an attack identification method, which comprises:

[0008] Collecting to-be-identified data;

[0009] Inputting the to-be-identified data into a pre-constructed attack identification network for identification to obtain an identification result, wherein the attack identification network is constructed by an attention mechanism and a loss function optimized based on data characteristics.

[0010] In an embodiment, the step of collecting to-be-identified data comprises:

[0011] Obtaining essence data based on the to-be-identified data;

[0012] The step of inputting the to-be-identified data into a pre-constructed attack identification network for identification to obtain an identification result comprises:

[0013] Inputting the essence data into the pre-constructed attack identification network for identification to obtain the identification result.

[0014] In an embodiment, the method is applied to an edge computing platform, and the step of obtaining essence data based on the to-be-identified data comprises:

[0015] classifying the to-be-identified data to obtain a plurality of categories of data, the plurality of categories of data comprising at least one of device behavior data, network communication data, access control log data, system log data, physical environment data, application layer data, and device integrity verification data of the edge computing platform;

[0016] generating a corresponding class vector for each of the categories of data;

[0017] calculating a feature essence value based on the class vectors;

[0018] if the feature essence value is higher than a preset essence value threshold, determining the data corresponding to the feature essence value as the essence data.

[0019] In an embodiment, the step of calculating a feature essence value based on the class vectors comprises:

[0020] generating a class vector average value based on the class vectors;

[0021] generating an inter-class scatter matrix, an intra-class scatter matrix, and a class vector redundancy based on the class vector average value;

[0022] calculating a feature value variance based on a preset feature value variance model;

[0023] calculating the feature essence value based on the inter-class scatter matrix, the intra-class scatter matrix, the class vector redundancy, and the feature value variance.

[0024] In an embodiment, the step of inputting the essence data into the pre-constructed attack identification network for identification to obtain the identification result comprises:

[0025] allocating a corresponding weight to the essence data through an attention layer;

[0026] obtaining features in the essence data based on the corresponding weight through a convolution layer;

[0027] performing regularization processing on the features in the essence data through a random inactivation layer to obtain processed features;

[0028] integrating the processed features through a full connection layer to obtain integrated features;

[0029] performing data scale adjustment on the integrated features through a normalization layer to obtain the identification result.

[0030] In an embodiment, the step of obtaining essence data based on the to-be-identified data comprises:

[0031] creating a neural network based on an attention mechanism;

[0032] obtaining a corresponding position importance level and / or a type importance level based on the data of each category;

[0033] optimizing a predefined weighted cross-entropy loss function based on the position importance level and / or the type importance level to obtain an optimized weighted cross-entropy loss function;

[0034] optimizing the neural network based on the optimized weighted cross-entropy loss function to obtain the attack recognition network.

[0035] In an embodiment, the step of optimizing the predefined weighted cross-entropy loss function based on the position importance level and / or the type importance level to obtain an optimized weighted cross-entropy loss function comprises:

[0036] assigning a value to the position importance level, denoted as a position importance value;

[0037] assigning a value to the type importance level, denoted as a type importance value;

[0038] multiplying the position importance value and the type importance value to obtain a final importance value;

[0039] optimizing the predefined weighted cross-entropy loss function based on the final importance value to obtain the optimized weighted cross-entropy loss function.

[0040] In addition, to achieve the above object, the present application further provides an attack recognition device, which comprises:

[0041] a data acquisition module configured to collect to-be-identified data;

[0042] an identification module configured to input the to-be-identified data into a pre-constructed attack recognition network for identification to obtain an identification result, wherein the attack recognition network is constructed by using an attention mechanism and a loss function optimized based on data characteristics.

[0043] In addition, to achieve the above object, the present application further provides an attack recognition device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the attack recognition method as described above.

[0044] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, wherein the computer program is executable by a processor to implement the steps of the attack recognition method as described above.

[0045] Further, in order to achieve the above object, the present application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the attack identification method as described above.

[0046] The one or more technical solutions provided by the present application have at least the following technical effects:

[0047] The present application constructs an attack identification network through an attention mechanism, and identifies the to-be-identified data through the attack identification network, wherein the attention mechanism can help the attack identification network focus on the part of the to-be-identified data related to the attack feature, thereby improving the sensitivity to the attack behavior. When the attack identification network encounters a new attack or an unknown attack, the attention mechanism can help the attack identification network automatically adjust the focus, thereby more easily discovering abnormal patterns or features. Furthermore, the present application constructs the attack identification network based on a loss function optimized based on data characteristics, wherein the loss function optimized based on data characteristics can better reflect the characteristics of the data, so that the attack identification network can better capture the abnormal patterns of the to-be-identified data, thereby improving the identification ability of the new attack or the unknown attack. BRIEF DESCRIPTION OF DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows, and obviously, other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0050] Figure 1 The flowchart provided by the attack identification method embodiment one of the present application;

[0051] Figure 2 The flowchart of calculating the feature essence value of the attack identification method of the present application;

[0052] Figure 3 The flowchart of the attack identification method of the present application in the attack identification network for attack identification;

[0053] Figure 4 The module structure diagram of the attack identification device of the present application embodiment;

[0054] Figure 5 The device structure diagram of the hardware running environment involved in the attack identification method in the present application embodiment.

[0055] The objectives, functional features and advantages of the present application will be further explained in conjunction with the embodiments, with reference to the accompanying drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and are not intended to limit the present application.

[0057] In order to better understand the technical solutions of the present application, the following will be described in detail in conjunction with the drawings and specific embodiments.

[0058] The main solution of the embodiments of the present application is: collecting to-be-identified data; inputting the to-be-identified data into a pre-constructed attack identification network for identification to obtain an identification result, wherein the attack identification network is constructed through an attention mechanism and a loss function optimized based on data characteristics.

[0059] In the present embodiment, for the convenience of description, the following will be described taking an attack identification device as the execution subject.

[0060] Since the prior art usually adopts a rule-based attack identification method for attack identification, but such attack identification method is difficult to discover new attacks and unknown attacks.

[0061] The present application provides a solution, which constructs an attack identification network through an attention mechanism, and identifies to-be-identified data through the attack identification network, wherein the attention mechanism can help the attack identification network focus on the part of the to-be-identified data related to attack features, thereby improving the sensitivity to attack behaviors. When the attack identification network encounters new attacks or unknown attacks, the attention mechanism can help the attack identification network automatically adjust the focus, thereby more easily discovering abnormal patterns or features. Moreover, the present application constructs the attack identification network through a loss function optimized based on data characteristics, wherein the loss function optimized based on data characteristics can better reflect the characteristics of the data, so that the attack identification network can better capture the abnormal patterns of the to-be-identified data, thereby improving the identification ability for new attacks or unknown attacks.

[0062] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, an attack identification device, etc. capable of realizing the above functions. The following will take an attack identification device as an example to describe the present embodiment and each of the following embodiments.

[0063] At present, the common technical means for network security identification is:

[0064] Signature-based detection: relies on known signatures of attacks (such as specific code snippets of malware) to identify threats. However, it struggles to identify zero-day attacks (attacks that have not been discovered yet), and attackers can evade detection by modifying the code of the malware.

[0065] Behavioral-based detection: monitors the behavior patterns of systems or networks to identify abnormal behavior that deviates from normal activity. However, it suffers from high false positive rates, and the boundary between normal and malicious behavior can be blurry, while adjusting the detection threshold to reduce false positives can increase the risk of missing real attacks.

[0066] Anomaly detection: uses statistical methods to analyze network traffic and system activity to find patterns that deviate significantly from historical data. However, it requires a large amount of historical data to find patterns, and the patterns may need to be frequently updated as the network environment changes.

[0067] Sandboxing: runs suspicious programs or code in an isolated environment to observe their behavior to determine whether they are malicious. However, some advanced malware can detect whether they are running in a sandbox and change their behavior to avoid detection.

[0068] Honeypot technology: deploys decoy systems that pretend to be real systems to attract attackers to study their strategies and techniques. However, maintaining honeypot systems requires additional resources. In addition, advanced attackers may recognize and avoid honeypots.

[0069] From the above, it can be seen that although there are some network security identification methods in the prior art, there are various problems.

[0070] Therefore, the attack identification method of the present application is proposed, which is to identify attacks through a pre-constructed attack identification network, wherein the attack identification network is constructed through an attention mechanism and a loss function optimized based on data characteristics.

[0071] It should be noted that the attack identification method of the present embodiment is applicable to any Internet technology, and specifically, the attack identification method is described in combination with edge computing.

[0072] Edge computing can transfer data processing and analysis tasks from cloud computing centers to the edges of the network, i.e., close to the data source, which can significantly reduce latency, improve response speed, and reduce the load of the central cloud. In addition, edge computing can also improve the real-time and reliability of data processing, especially in Internet of Things application scenarios that require immediate decision-making, such as Internet of Things payment, autonomous driving, and intelligent manufacturing scenarios.

[0073] With the proliferation of IoT devices, edge computing has become a key technology for processing the large amount of data generated by these devices, and it is crucial to conduct security identification on edge computing. The security challenges faced by edge computing include data privacy leakage, unauthorized data access, device tampering, and network attacks, etc. Since edge devices are usually distributed in a wide geographical location and may lack sufficient security protection measures, they become potential targets for attackers.

[0074] Currently, the commonly used techniques for edge computing security identification include rule-based security threat identification methods, which use predefined rules and patterns to identify attack behaviors. These predefined rules and patterns include specific IP addresses, URLs, etc. The advantage of this method is simple and easy to use, but it is difficult to identify new or unknown attack methods.

[0075] Based on this, the embodiments of the present application provide an attack identification method, referring to Figure 1 , Figure 1 The flowchart provided by the first embodiment of the attack identification method of the present application.

[0076] In this embodiment, the attack identification method includes steps S10 and S70:

[0077] Step S10, collect the data to be identified;

[0078] It should be noted that in the edge computing environment, the data to be identified can be collected from multiple edge devices or nodes (such as sensors, smart devices, servers, etc.).

[0079] Among them, the data to be identified includes all data flowing through and generated in edge computing, including but not limited to the following multi-dimensional data:

[0080] 1. Device behavior data: behavior pattern data of edge devices, such as abnormal CPU usage, sudden increase in memory, etc.

[0081] 2. Network communication data: communication pattern data between edge computing nodes, such as abnormal network traffic or unauthorized data transmission.

[0082] 3. Access control log data: device and service access request data, such as unauthorized access test data.

[0083] 4. System log data: system operation log data, such as abnormal event data.

[0084] 5. Physical environment data: For some edge computing scenarios, such as smart factories, monitor physical environment change data.

[0085] 6. Application layer data: running data of applications running on the edge computing platform, such as running abnormal behavior data.

[0086] 7. Device integrity verification data: by checking the integrity of device firmware and software, identify devices that have been tampered with or infected with malicious software.

[0087] Step S70, input the to-be-identified data into the pre-constructed attack identification network for identification to obtain an identification result, the attack identification network is constructed by attention mechanism and loss function optimized based on data characteristics.

[0088] It should be noted that once the to-be-identified data is collected, it will be input into the pre-constructed attack identification network for processing. Since the edge computing node is close to the data source, this step can be performed on the edge node, thereby reducing the delay and bandwidth consumption of data transmission and improving real-time performance.

[0089] Wherein, before step S70, a neural network based on attention mechanism needs to be created, and a preset loss function is optimized based on the data characteristics of the to-be-identified data, and then the neural network is trained based on the optimized loss function to obtain the attack identification network.

[0090] The embodiment considers that the edge computing field is a highly delay- and resource usage-sensitive field, and the edge computing device is usually limited in resources, so an efficient and accurate security attack identification solution is needed. Therefore, the application constructs an attack identification network through an attention mechanism, and identifies the to-be-identified data through the attack identification network, wherein the attention mechanism can help the attack identification network focus on the part of the to-be-identified data related to the attack feature, thereby improving the sensitivity to attack behavior. When the attack identification network encounters a new attack or unknown attack, the attention mechanism can help the attack identification network automatically adjust the focus, so as to more easily discover abnormal patterns or features. Moreover, the application constructs the attack identification network through a loss function optimized based on data characteristics, wherein the loss function optimized based on data characteristics can better reflect the characteristics of the data, so that the attack identification network can better capture the abnormal patterns of the to-be-identified data, thereby improving the identification ability of new attacks or unknown attacks. Moreover, the present application utilizes the deep learning and attention mechanism which have wide application range and great application potential to improve the ability to identify unknown attack patterns.

[0091] And, the scheme has a very wide market application prospect in the network security identification field, and provides a very effective solution for the problems to be solved in the industry. The scheme can improve the security of the edge computing system, reduce the risk of data leakage or system attack, thereby increasing the trust of customers for enterprise products; can identify and respond to security threats in a timely manner, maintain the stable operation of the system, enhance the market competitiveness of the enterprise, improve customer satisfaction and loyalty, and also open up new market opportunities and income sources, such as providing security services.

[0092] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as the above-mentioned first embodiment can be referred to the above introduction, and the subsequent will not be described in detail. On this basis, step S10, after collecting the to-be-identified data, the attack identification method further includes step S20:

[0093] Step S20, obtaining essence data based on the to-be-identified data;

[0094] It should be noted that there may be redundant data in the to-be-identified data, and the to-be-identified data needs to be processed to obtain the essence data.

[0095] Among them, as an implementation manner, the processing of the to-be-identified data can include but is not limited to data filtering, feature extraction and data reduction.

[0096] Further, in the edge computing environment, data can be processed and filtered in the edge device or node to reduce bandwidth usage and improve processing efficiency.

[0097] The step S70 inputs the to-be-identified data into the pre-constructed attack identification network for identification to obtain an identification result, which includes:

[0098] Step S71, inputting the essence data into the pre-constructed attack identification network for identification to obtain the identification result.

[0099] Among them, the essence data obtained after data processing is identified to obtain an identification result.

[0100] This embodiment quickly locks the essence data from the collected to-be-identified data, removes redundant data, and thus can quickly identify new or unknown edge computing security attacks on the basis of ensuring accuracy.

[0101] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as the above-mentioned second embodiment can be referred to the above introduction, and the subsequent will not be described in detail. On this basis, the present embodiment is applied to the edge computing platform, and step S20, obtaining essence data based on the to-be-identified data includes steps S21-S24:

[0102] Step S21, classify the to-be-identified data to obtain several categories of data, including at least one of device behavior data, network communication data, access control log data, system log data, physical environment data, application layer data, and device integrity verification data.

[0103] Among them, the to-be-identified data needs to be classified based on the data types in the edge computing platform.

[0104] Among them, by classifying the to-be-identified data, it is helpful to conduct special analysis and processing for different types of data, thereby improving the efficiency and accuracy of attack identification.

[0105] Step S22, generate a corresponding class vector for each of the categories of data.

[0106] Among them, the class vector is a numerical vector representing the characteristics or summary of the category data.

[0107] For example, for network communication data, the class vector may contain statistical information such as the number of data packets, the average data packet size, common IP addresses and ports within a certain time period.

[0108] For system log data, the class vector may contain the number of log entries, the frequency of different types of events, etc.

[0109] Step S23, calculate the feature essence value based on the class vector.

[0110] It should be noted that the feature essence value is a comprehensive index for measuring important feature information contained in the class vector. The method for calculating the feature essence value may include but is not limited to the following:

[0111] Weighted sum: add each feature value in the class vector according to a certain weight.

[0112] Principal component analysis (PCA): extract the principal components in the class vector that best explain the data variation.

[0113] Attention mechanism: use the attention mechanism in neural networks to highlight important features.

[0114] Step S24, if the feature essence value is higher than the preset essence value threshold, the data corresponding to the feature essence value is determined as the essence data.

[0115] Among them, the calculated feature essence value is compared with the preset threshold. If the feature essence value is higher than the threshold, it means that the data contains important feature information, which is determined as the essence data.

[0116] The embodiment collects multi-dimensional data, and performs essence extraction processing on the data to quickly lock effective data, obtain essence data, and greatly improve the use efficiency and quality of the collected data. Moreover, the embodiment performs essence extraction processing on the collected to-be-identified data to effectively reduce the complexity of the data while retaining the most critical information for attack identification. This efficient data processing method can significantly reduce the computational resource demand and time of the subsequent processing stage, enabling the device to respond to new attacks more quickly.

[0117] Based on Embodiment Three of the present application, in Embodiment Four of the present application, the same or similar content as Embodiment Three can be referred to the foregoing description, and will not be described in detail hereinafter. On this basis, step S23 includes steps S231-S234 for calculating the feature essence value based on the class vector:

[0118] Step S231 generates a class vector average value based on the class vector.

[0119] For details, refer to Figure 2 , Figure 2 FIG. 1 is a schematic diagram of the module structure of an attack identification device according to an embodiment of the present application.

[0120] It should be noted that after the to-be-identified data is collected, the to-be-identified data is classified, and a corresponding class vector is generated for each class. The class vector calculation formula is as follows:

[0121]

[0122] wherein, L ic represents the class vector corresponding to each class; s represents the dimension of the class corresponding to the class vector; c is the class index; and d represents the number of samples in each class.

[0123] The class vector average value is:

[0124]

[0125] wherein, u cj represents the cth class vector average value; d is the number of samples in each class; and L ic represents the class vector corresponding to each class.

[0126] Step S232 generates an inter-class scatter matrix, an intra-class scatter matrix, and a class vector redundancy based on the class vector average value.

[0127] It should be noted that the inter-class scatter matrix can measure the difference between the feature vectors of different classes; the intra-class scatter matrix can measure the difference between the feature vectors within the same class; and the class vector redundancy can measure the degree of redundancy of the information in the class vector, which is usually expressed through the correlation between the features.

[0128] wherein, the inter-class scatter matrix between each class vector is formed, and the calculation process is as follows:

[0129]

[0130] wherein, s m represents the generated inter-class scatter matrix; d is the number of samples in each class; u c represents the average value of the cth class vector; and α is the simple average value of u c ; s is the number of classes; T represents the transpose operation, and T+1 represents adding a unit matrix after matrix transposition to adjust the transposed result and improve the stability of the transposed result within a certain numerical range.

[0131] And the scatter matrix in each class vector is calculated according to the following model:

[0132]

[0133] wherein, D m represents the generated intra-class scatter matrix; s represents the number of classes; and d is the number of samples in each class; u c represents the average value of the cth class vector; L ic represents the class vector corresponding to each class; T represents the transpose operation, and T+1 represents adding a unit matrix after matrix transposition to adjust the transposed result and improve the stability of the transposed result within a certain numerical range.

[0134] In addition, the calculation process of the redundancy between the values of each class vector is as follows:

[0135]

[0136] wherein, G cj represents the redundancy corresponding to the jth data in the cth class vector; L cj represents the redundancy of the jth data in the cth class vector; d is the number of samples in each class; u c represents the average value of the cth class vector; X represents the total number of data points, i.e., the total number of all data in all class vectors; T represents the transpose operation, and T+1 represents adding a unit matrix after matrix transposition to adjust the transposed result and improve the stability of the transposed result within a certain numerical range.

[0137] Step S233, calculating the eigenvalue variance based on a preset eigenvalue variance model;

[0138] The probability of the initial condition and the variance of the characteristic data ρ are estimated based on the following eigenvalue variance model:

[0139] ρ d = β × ρd-1 + γ x p d-2 d >= 2

[0140]

[0141] wherein β and γ are random coefficients between 0 and 1.

[0142] It can be seen that the probability of the initial condition is as follows: when d = 0, the probability is 1; when d = 1, the probability distribution depends on the distribution of β and γ.

[0143] The variance of the characteristic data p can be estimated by the recursive relationship and the variance of p d = 1. d .

[0144] Step S234, the characteristic essence value is calculated based on the between-class scatter matrix, the within-class scatter matrix, the class vector redundancy and the eigenvalue variance.

[0145] wherein the calculation process is as follows:

[0146]

[0147] wherein Q ci is the characteristic essence value; s m represents the generated between-class scatter matrix; D m represents the generated within-class scatter matrix; G cj represents the redundancy corresponding to the jth data in the cth class vector.

[0148] And after obtaining the characteristic essence value, it is judged whether it is essence data according to the pre-set essence value threshold, and the characteristic essence value higher than the essence value threshold is determined as the essence data.

[0149] The embodiment collects multi-dimensional data, and performs essence extraction processing on the data, quickly locks effective data, obtains essence data, and greatly improves the use efficiency and quality of the collected data.

[0150] Based on the second embodiment of the present application, in the fifth embodiment of the present application, the same or similar contents as the above-mentioned second embodiment can be referred to the above introduction, and will not be described in detail. On this basis, step S71, inputting the essence data into the pre-constructed attack recognition network for recognition to obtain the recognition result including steps S711-S715:

[0151] Step S711, assigning corresponding weights to the essence data through the attention layer;

[0152] Reference can be made to Figure 3 , Figure 3A flowchart of a process of attack identification by the attack identification network according to the attack identification method.

[0153] As shown in Figure 3 The attack identification network includes, but is not limited to, an input layer, an attention layer, a convolution layer, a random inactivation layer, a fully connected layer, a normalization layer, and an output layer.

[0154] After the essence data is input into the neural network, the attention layer assigns corresponding weights to the essence data, so that the convolution layer obtains features in the essence data with emphasis based on the weights determined by the attention layer.

[0155] Step S712, obtaining features in the essence data based on the corresponding weights through the convolution layer;

[0156] The convolution layer inputs the obtained features into the random inactivation layer to regularize the features through the random inactivation layer, thereby reducing the probability of overfitting.

[0157] Step S713, regularizing the features in the essence data through the random inactivation layer to obtain processed features;

[0158] Step S714, integrating the processed features through the fully connected layer to obtain integrated features;

[0159] Step S715, adjusting the data scale of the integrated features through the normalization layer to obtain the identification result.

[0160] The input features are integrated through the fully connected layer and input into the normalization layer for data scale adjustment, thereby obtaining good training effect.

[0161] The neural network structure is adopted in this embodiment to improve the accuracy of feature extraction through network layers such as the attention layer and the fully connected layer. Moreover, the scheme can quickly lock effective data from the collected multi-dimensional data and input the effective data into the convolution network with high identification accuracy for attack identification, thereby quickly and accurately identifying new or unknown edge computing security attacks. Moreover, the convolution network combined with the attention mechanism can better focus on important parts of the data.

[0162] Based on the third embodiment of the present application, in the sixth embodiment of the present application, the same or similar contents as the above-mentioned third embodiment can be referred to the above introduction, and will not be repeated hereinafter. On this basis, step S20, after obtaining the essence data based on the to-be-identified data, includes steps S30-S60:

[0163] Step S30, creating a neural network based on an attention mechanism;

[0164] The structure of the neural network has been introduced in Embodiment Five.

[0165] Then, training data, i.e. multi-dimensional data, is obtained, and whether the training data is an edge computing security attack is determined to classify it as a training positive sample or a training negative sample.

[0166] Then, the neural network based on the attention mechanism is trained based on the training data.

[0167] Step S40, the corresponding position importance level and / or type importance level are obtained based on the data of each category;

[0168] It should be noted that in the edge computing environment, different edge nodes in different positions may have different importance. For example, some nodes are located at key network entrances or sensitive areas, and the data of these positions is crucial to the overall security of the system. Therefore, it is necessary to define a position importance level for data in different positions.

[0169] In addition, it should be noted that the importance of data types in edge computing is also different. For example, real-time video streams may be more critical than environmental temperature data. Similarly, it is necessary to define a type importance level for each data type.

[0170] The importance of the data corresponding to each category is determined by the node position and node type of the Internet of Things where the category data is located.

[0171] Step S50, the pre-defined weighted cross-entropy loss function is optimized based on the position importance level and / or the type importance level, to obtain an optimized weighted cross-entropy loss function;

[0172] Step S60, the neural network is optimized based on the optimized weighted cross-entropy loss function, to obtain the attack identification network.

[0173] In this scheme, in order to avoid the influence of data class imbalance problem on prediction accuracy, the weighted cross-entropy of the neural network needs to be optimized, and the weighted cross-entropy loss function in the neural network is:

[0174]

[0175] Where L represents the loss function; represents the weight value; u i represents the edge computing security attack identification comprehensive value corresponding to the u-th category data; τ i represents the importance of the data corresponding to the i-th category; Y iYi represents the total amount of edge computing security attacks corresponding to the i-th category that are successfully identified; Y0 represents the total amount of edge computing security attacks corresponding to all categories that are successfully identified; σ i φ represents the true category; φ i φ represents the predicted category.

[0176] In determining the importance of the node position and the importance of the node type, the corresponding category of the data can be determined. Specifically, the following examples of edge computing related data are used to illustrate how to determine the importance of the node position and the node type through the corresponding category of the data:

[0177] Device behavior data: Because abnormal device behavior can directly affect the overall security of the edge network, the position importance level and the type importance level of the device behavior data are both high.

[0178] Network communication data: Since edge computing emphasizes instant communication between nodes, the position importance level of network communication data is high; network communication is a common field of attack and defense, so the type importance level is medium.

[0179] Access control log data: Access control log data is usually located in the front position of edge nodes, so the position importance level is high; unauthorized access is a common attack method, so the type importance level is medium.

[0180] System log data: System logs are distributed in various nodes, so the position importance level is medium; but logs provide important information before and after an attack, so the type importance level is medium.

[0181] Physical environment data: In specific application scenarios, such as Internet of Things payment, environmental abnormalities may directly indicate security incidents, so in some specific application scenarios, the position importance level of physical environment data is high, and the type importance level is high; in non-specific application scenarios, there are multiple possibilities when the physical environment data is abnormal, and it cannot directly indicate that the network security is abnormal, so the corresponding position importance level is medium, and the type importance level is medium.

[0182] Application layer data: Since application layer data can be distributed in different levels of edge computing, the position importance level of application layer data is medium; and the application layer is the main place for attackers to exploit vulnerabilities and successfully attack, so the type importance level is high.

[0183] Device integrity verification: Device integrity is directly related to the security of the entire edge computing system, so the position importance and the type importance level are both high.

[0184] In summary, the present solution mainly includes two parts: 1. obtaining essential data from the collected multi-dimensional data; and 2. constructing a convolutional network based on attention and optimizing the loss function of the convolutional network.

[0185] By proposing and constructing a convolutional neural network based on an attention mechanism, the present embodiment can improve the active recognition ability of new unknown attack methods through learning and training using essential data. Moreover, the present embodiment optimizes the loss function in combination with the characteristics of multi-dimensional data, so that the trained neural network can more accurately and effectively recognize edge computing security attacks.

[0186] Based on Embodiment Six, in Embodiment Seven, the same or similar contents as Embodiment Six can be referred to the foregoing description, and will not be repeated hereinafter. On this basis, in step S50, the pre-defined weighted cross-entropy loss function is optimized based on the position importance level and / or the type importance level to obtain an optimized weighted cross-entropy loss function, including steps S51-S54.

[0187] In step S51, the position importance level is assigned a value, denoted as a position importance value.

[0188] In step S52, the type importance level is assigned a value, denoted as a type importance value.

[0189] After determining the position importance level and the type importance level corresponding to each category of data, a corresponding value is set for each importance level. It should be noted that the higher the importance level, the higher the corresponding value.

[0190] In step S53, the product of the position importance value and the type importance value is taken as a final importance value.

[0191] The calculation process of the final importance value is as follows:

[0192] τ i =v i ×w i

[0193] wherein v i represents the position importance level; and w i represents the type importance level. In the present solution, the value range of the position importance level and the type importance level is [0, 1].

[0194] In step S54, the pre-defined weighted cross-entropy loss function is optimized based on the final importance value to obtain the optimized weighted cross-entropy loss function.

[0195] Wherein, after the final importance value is calculated, the weighted cross-entropy loss function can be optimized based on the final importance value to obtain an optimized weighted cross-entropy loss function.

[0196] The embodiment can improve the attack recognition accuracy by optimizing the weighted cross-entropy loss function in the neural network in combination with the position importance and type importance level corresponding to the to-be-recognized data. Moreover, after the weighted cross-entropy loss function is optimized in combination with the position importance and type importance, the attack recognition network can effectively improve the recognition accuracy of attack behaviors. By assigning different importance to data of different types and positions, high adaptability and flexibility can be shown, different network environments and attack modes can be coped with, and it is ensured that the scheme can be applicable to future network security requirements.

[0197] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the attack recognition method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0198] The present application also provides an attack recognition device, please refer to Figure 4 , the attack recognition device comprises:

[0199] The data acquisition module 10 is configured to collect to-be-recognized data.

[0200] The recognition module 20 is configured to input the to-be-recognized data into a pre-constructed attack recognition network for recognition to obtain a recognition result, wherein the attack recognition network is constructed by using an attention mechanism and a loss function optimized based on data characteristics.

[0201] The attack recognition device provided by the present application adopts the attack recognition method in the above embodiment, and can solve the technical problem of difficulty in discovering new attacks and unknown attacks. Compared with the prior art, the attack recognition device provided by the present application has the same beneficial effects as the attack recognition method provided by the above embodiment, and other technical features in the attack recognition device are the same as the features disclosed in the above embodiment, which will not be repeated here.

[0202] The present application provides an attack recognition device, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the attack recognition method in the above embodiment one.

[0203] The following refers to Figure 5The diagram illustrates a structural schematic suitable for implementing the attack identification device in the embodiments of this application. The attack identification device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The attack identification device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0204] like Figure 5 As shown, the attack detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the attack detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the attack identification device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show attack identification devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0205] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0206] The attack identification device provided by the present application adopts the attack identification method in the above-mentioned embodiments, and can solve the technical problem of difficulty in discovering new attacks and unknown attacks. Compared with the prior art, the attack identification device provided by the present application has the same beneficial effects as the attack identification method provided by the above-mentioned embodiments, and other technical features in the attack identification device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0207] It should be understood that various parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0208] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0209] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the attack identification method in the above-mentioned embodiments.

[0210] The computer readable storage medium provided in the application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination of the above.

[0211] The above computer readable storage medium may be contained in the attack identification device, or may exist separately without being assembled into the attack identification device.

[0212] The above computer readable storage medium carries one or more programs, when the one or more programs are executed by the attack identification device, the attack identification device is caused to: collect to-be-identified data; input the to-be-identified data into a pre-constructed attack identification network for identification to obtain an identification result, the attack identification network is constructed by using an attention mechanism and an optimized loss function based on data characteristics.

[0213] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0214] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0215] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. Among them, the name of the module does not constitute a limitation to the unit itself in some cases.

[0216] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer program) for executing the attack identification method described above, and can solve the technical problem that it is difficult to find new attacks and unknown attacks. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the attack identification method provided by the above-mentioned embodiments, and will not be described here.

[0217] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the attack identification method as described above.

[0218] The computer program product provided by the application can solve the technical problem of difficulty in discovering new attacks and unknown attacks. Compared with the prior art, the computer program product provided by the application has the same beneficial effects as the attack identification method provided by the above-mentioned embodiments, and will not be described here.

[0219] The above only describes some embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation, direct / indirect application in other related technical fields, or direct / indirect application in other related technical fields based on the technical concept of the application and the content of the specification and drawings are included in the patent protection scope of the application.

Claims

1. An attack identification method, characterized in that, The method includes: Collect data to be identified; The data to be identified is input into a pre-constructed attack identification network for identification, and the identification result is obtained. The attack identification network is constructed using an attention mechanism and a loss function optimized based on data characteristics. The loss function is obtained by optimizing a predefined weighted cross-entropy loss function based on position importance level and type importance level. Optimizing the predefined weighted cross-entropy loss function based on the position importance level and the type importance level includes: Assign a value to the position importance level, and record it as the position importance value; Assign a value to the type importance level, denoted as the type importance value; The product of the location importance value and the type importance value is used as the final importance value; The predefined weighted cross-entropy loss function is optimized based on the final importance value to obtain the loss function.

2. The method as described in claim 1, characterized in that, Following the step of collecting the data to be identified, the following is included: Extract essential data based on the data to be identified; The step of inputting the data to be identified into a pre-constructed attack identification network for identification and obtaining the identification result includes: The key data is input into the pre-built attack identification network for identification, and the identification result is obtained; The method is applied to an edge computing platform, and the step of obtaining essential data based on the data to be identified includes: The data to be identified is classified to obtain several categories of data, including at least one of the following: device behavior data, network communication data, access control log data, system log data, physical environment data, application layer data, and device integrity verification data of the edge computing platform. Generate corresponding class vectors for each of the aforementioned categories of data; The feature essence value is calculated based on the class vector; If the feature value is higher than the preset value threshold, then the data corresponding to the feature value is determined as the essence data; The step of calculating the feature essence value based on the class vector includes: Generate the average value of the class vectors based on the class vectors; Based on the average value of the class vectors, generate the inter-class scatter matrix, the intra-class scatter matrix, and the class vector redundancy; The eigenvalue variance is calculated based on a pre-defined eigenvalue variance model. The essential feature value is calculated based on the inter-class scatter matrix, the intra-class scatter matrix, the class vector redundancy, and the eigenvalue variance. The calculation process is as follows: Among them, the For the characteristic essence value, the The generated inter-class scatter matrix is ​​represented by the following. The generated intra-class scatter matrix is ​​represented by the following. The redundancy represents the value corresponding to the j-th data in the c-th class vector. Let ρ be the variance of the feature data; After obtaining the feature essence value, it is determined whether the feature essence value is the essence data according to the preset essence value threshold. If the feature essence value is higher than the essence value threshold, the feature essence value is determined as the essence data.

3. The method as described in claim 2, characterized in that, The step of inputting the essential data into the pre-built attack identification network for identification and obtaining the identification result includes: The attention layer assigns corresponding weights to the essential data. Features in the essential data are obtained through convolutional layers based on the corresponding weights; The features in the essential data are regularized by using a random deactivation layer to obtain the processed features; The processed features are integrated through a fully connected layer to obtain integrated features; The recognition result is obtained by adjusting the data scale of the integrated features through a normalization layer.

4. The method as described in claim 2, characterized in that, The step of obtaining essential data based on the data to be identified includes: Create a neural network based on the attention mechanism; Based on the data for each category, the corresponding location importance level and type importance level are obtained; The predefined weighted cross-entropy loss function is optimized based on the position importance level and the type importance level to obtain the optimized weighted cross-entropy loss function. The attack detection network is obtained by optimizing the neural network based on the optimized weighted cross-entropy loss function.

5. An attack detection device, characterized in that, The device includes: The data acquisition module is used to collect the data to be identified. An identification module is used to input the data to be identified into a pre-constructed attack identification network for identification, and obtain an identification result. The attack identification network is constructed using an attention mechanism and a loss function optimized based on data characteristics. The loss function is obtained by optimizing a predefined weighted cross-entropy loss function based on position importance level and type importance level. The optimization of the predefined weighted cross-entropy loss function based on the position importance level and the type importance level includes: assigning a value to the position importance level, denoted as the position importance value; assigning a value to the type importance level, denoted as the type importance value; multiplying the position importance value and the type importance value as the final importance value; and optimizing the predefined weighted cross-entropy loss function based on the final importance value to obtain the loss function.

6. An attack detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the attack identification method as described in any one of claims 1 to 4.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the attack identification method as described in any one of claims 1 to 4.

8. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the attack identification method as described in any one of claims 1 to 4.

Images