Data processing method and system for data center construction

Abstract

The embodiment of the present application provides a data processing method and system for the construction of a data middle station, which improves the processing speed by segmenting the first template network intrusion data sequence and determining the extraction scale based on the scale ratio. By generating a third template network intrusion data sequence and combining it with the second template network intrusion data sequence to generate a sample learning data sequence, the comprehensiveness and accuracy of the model learning are guaranteed. The network intrusion prediction model is model parameter learning using the sample learning data sequence, which can more accurately predict and identify various network intrusion behaviors, thereby enhancing the security protection capabilities of the data middle station service system. By classifying the target network intrusion data and performing security protection enhancement configuration on the data middle station to be constructed based on the classification prediction results, personalized protection for the data middle station to be constructed is achieved, effectively improving the security and stability of the data middle station.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a data processing method and system for building a data center. Background Art

[0002] With the rapid development of information technology, the data center, as an important hub for enterprise data management and services, has become increasingly vulnerable to security issues. Network intrusions pose a serious threat to the security of the data center. Therefore, how to effectively detect and prevent network intrusions has become an urgent problem to be solved.

[0003] In traditional network intrusion detection and defense methods, static rule bases and signature matching technologies are mainly relied on to identify known attack patterns. However, this method is often powerless when facing new and unknown network intrusions. In addition, traditional defense methods are also unable to cope well with complex and changing network environments and attack methods. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a data processing method and system for building a data center.

[0005] According to the first aspect of the present application, a data processing method applied to data middle platform construction is provided, which is applied to a data middle platform service system, and the method includes:

[0006] Acquire a first template network intrusion data sequence and a second template network intrusion data sequence applied to the data middle platform construction, the first template network intrusion data sequence and the second template network intrusion data sequence have different network intrusion categories, and the template configuration scale of the first template network intrusion data sequence is greater than the template configuration scale of the second template network intrusion data sequence;

[0007] Dividing the first template network intrusion data sequence into a plurality of template network intrusion data subsequences, and determining an extraction scale of each of the template network intrusion data subsequences based on a scale ratio of a template configuration scale of the first template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence;

[0008] Extracting data from each of the template network intrusion data subsequences based on the extraction scale to generate a third template network intrusion data sequence, and generating a sample learning data sequence based on the third template network intrusion data sequence and the second template network intrusion data sequence, wherein a scale ratio of a template configuration scale of the third template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence is less than a set ratio;

[0009] Performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning;

[0010] Based on the network intrusion prediction model that has completed model parameter learning, the target network intrusion data is classified to generate a classification prediction result of the target network intrusion data, and based on the classification prediction result of the target network intrusion data, a security protection enhancement configuration is performed on the data middle platform to be constructed, and the classification prediction result represents the network intrusion category of the target network intrusion data.

[0011] In a possible implementation of the first aspect, obtaining a first template network intrusion data sequence and a second template network intrusion data sequence applied to the data middle platform construction includes:

[0012] Acquire a reference intrusion log carrying an attack type label from an initial network intrusion log, wherein the attack type label represents a network intrusion category of the reference intrusion log;

[0013] Encoding the benchmark intrusion log to generate an intrusion path encoding vector of the benchmark intrusion log;

[0014] The first template network intrusion data sequence and the second template network intrusion data sequence are determined based on the intrusion path encoding vector of the benchmark intrusion log.

[0015] In a possible implementation manner of the first aspect, obtaining a reference intrusion log carrying an attack type label from an initial network intrusion log includes:

[0016] Obtaining initial intrusion knowledge points of the benchmark intrusion log;

[0017] Determining intrusion behavior assessment information based on the initial intrusion knowledge points of the benchmark intrusion log;

[0018] Based on the intrusion behavior assessment information and the intrusion feature template, the noise intrusion log is removed from the benchmark intrusion log to generate an updated benchmark intrusion log.

[0019] In a possible implementation manner of the first aspect, encoding the benchmark intrusion log to generate an intrusion path encoding vector of the benchmark intrusion log includes:

[0020] According to the prior attack behavior record of the benchmark intrusion log, construct an initial intrusion knowledge vector of the benchmark intrusion log, wherein the initial intrusion knowledge vector at least includes an attack type, an attack source, and an attack target;

[0021] Constructing the attack strategy penetration feature of the benchmark intrusion log according to the attack mode of the benchmark intrusion log;

[0022] Based on a set time window, the initial intrusion knowledge vector and the attack strategy penetration feature of the benchmark intrusion log are serialized to fuse the fused initial intrusion knowledge vector and the fused attack strategy penetration feature of different time windows;

[0023] Encoding at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion with the attack strategy penetration feature to obtain a first encoding vector of the benchmark intrusion log;

[0024] Processing the classification vector in the first encoding vector of the benchmark intrusion log to generate a second encoding vector of the benchmark intrusion log;

[0025] The first coding vector and the second coding vector of the benchmark intrusion log are concatenated to generate an intrusion path coding vector of the benchmark intrusion log, where the intrusion path coding vector of the benchmark intrusion log is a numerical intrusion path coding vector.

[0026] In a possible implementation manner of the first aspect, encoding at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion with the attack strategy penetration feature to obtain a first encoding vector of the benchmark intrusion log includes:

[0027] Performing regularization conversion on a structured vector in at least one attack strategy penetration feature in the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion; and

[0028] Discretization conversion is performed on at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion and the unstructured vector in the attack strategy penetration feature.

[0029] In a possible implementation manner of the first aspect, dividing the first template network intrusion data sequence into a plurality of template network intrusion data subsequences, and determining an extraction scale of each of the template network intrusion data subsequences based on a scale ratio of a template configuration scale of the first template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence, includes:

[0030] When the scale ratio of the first template network intrusion data sequence and the second template network intrusion data sequence is greater than the set ratio, the extraction scale is determined based on the set ratio, the template configuration scale of the template network intrusion data subsequence and the template configuration scale of the second template network intrusion data sequence.

[0031] In a possible implementation manner of the first aspect, the performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning includes:

[0032] arbitrarily extracting multiple features of each sample learning data in the sample learning data sequence, and inputting them into an initial learning algorithm to generate a risk-weighted prediction tree;

[0033] Iteratively executing the step of arbitrarily extracting multiple features of each sample learning data in the sample learning data sequence and inputting an initial learning algorithm to generate a risk-weighted prediction tree until X risk-weighted prediction trees are generated, where X is a positive integer greater than 1; and

[0034] Performing integrated learning on the X risk-weighted prediction trees to generate the network intrusion prediction model.

[0035] In a possible implementation manner of the first aspect, the performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning includes:

[0036] Dividing the sample learning data sequence into a first subsequence and a second subsequence;

[0037] Performing model parameter learning on the network intrusion prediction model according to the initialization weight information and the first subsequence, the initialization weight information including the scale of the template network intrusion data subsequence, the X and the scale of the feature of each sample learning data arbitrarily extracted from the sample learning data sequence;

[0038] Performing network intrusion prediction behavior learning on the network intrusion prediction model;

[0039] According to the model parameter information after learning the network intrusion prediction behavior, continue to learn the model parameters of the network intrusion prediction model to generate the network intrusion prediction model that has completed the model parameter learning, and test the network intrusion prediction model that has completed the model parameter learning according to the second subsequence;

[0040] In a possible implementation of the first aspect, classifying target network intrusion data based on the network intrusion prediction model that has completed model parameter learning to generate a classification prediction result of the target network intrusion data includes:

[0041] Encoding the acquired target network intrusion data set to generate an intrusion path encoding vector of the target network intrusion data;

[0042] Inputting the intrusion path encoding vector of the target network intrusion data into each of the risk weighted prediction trees in the network intrusion prediction model that has completed model parameter learning, so that each of the risk weighted prediction trees outputs network intrusion classification data;

[0043] The classification prediction result is generated based on the network intrusion classification data output by each of the risk-weighted prediction trees.

[0044] In a possible implementation of the first aspect, the network intrusion classification data includes a confidence that the target network intrusion data belongs to different network intrusion categories, and the generating the classification prediction result based on the network intrusion classification data output by each risk weighted prediction tree includes:

[0045] Calculating the scale of the network intrusion classification data whose confidence level of each network intrusion category is greater than a preset confidence level;

[0046] The network intrusion category whose scale is greater than half of X is determined as the classification prediction result.

[0047] According to the second aspect of the present application, a data middle platform service system is provided, which includes a processor and a readable storage medium, and the readable storage medium stores a program, which, when executed by the processor, implements the aforementioned data processing method applied to the construction of the data middle platform.

[0048] According to the third aspect of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When it is monitored that the computer-executable instructions are executed, the aforementioned data processing method applied to the construction of the data middle platform is implemented.

[0049] According to any of the above aspects, the embodiment of the present application obtains template network intrusion data sequences of two different network intrusion categories, and performs intelligent processing based on their template configuration scale, so that the method can respond to various network intrusion situations more comprehensively and accurately, and improve the security protection capability of the data middle station service system. By segmenting the first template network intrusion data sequence and determining the extraction scale based on the scale ratio, efficient use of data is achieved, the data processing process is optimized, and the calculation complexity is reduced and the processing speed is improved. By generating a third template network intrusion data sequence and combining it with the second template network intrusion data sequence to generate a sample learning data sequence, the comprehensiveness and accuracy of model learning are guaranteed, and a high-quality data foundation is provided for subsequent model parameter learning. The network intrusion prediction model is modeled using the sample learning data sequence, so that the model can more accurately predict and identify various network intrusion behaviors, thereby enhancing the security protection capability of the data middle station service system. By classifying the target network intrusion data and performing security protection enhancement configuration on the data middle station to be constructed based on the classification prediction results, personalized protection of the data middle station to be constructed is achieved, and the security and stability of the data middle station are effectively improved. As a result, the security protection capabilities of the data middle-office service system can be significantly improved, the data processing process can be optimized, the processing speed can be increased, and a guarantee for the safe and stable operation of the data middle-office can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A schematic diagram of a data processing method for data center construction provided in an embodiment of the present application is shown;

[0052] Figure 2 A schematic diagram of the component structure of a data middle platform service system provided in an embodiment of the present application for implementing the above-mentioned data processing method applied to data middle platform construction is shown. DETAILED DESCRIPTION

[0053] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application.

[0054] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0055] Figure 1 The flowchart of the data processing method applied to the construction of the data middle platform provided by the embodiment of the present application is shown. It should be understood that in other embodiments, the order of some steps of the data processing method applied to the construction of the data middle platform can be interchanged according to actual needs, or some steps can be omitted or deleted. The detailed steps of the data processing method applied to the construction of the data middle platform are described as follows.

[0056] Step S110, obtaining a first template network intrusion data sequence and a second template network intrusion data sequence applied to the data middle platform construction, the first template network intrusion data sequence and the second template network intrusion data sequence have different network intrusion categories, and the template configuration scale of the first template network intrusion data sequence is larger than the template configuration scale of the second template network intrusion data sequence.

[0057] In actual scenarios, the construction of the data center requires a large amount of network intrusion data to train and optimize the model. The server can obtain this data from multiple sources, such as the enterprise's internal security monitoring system, security agencies on the Internet, historical data warehouses, etc.

[0058] Assume that the server obtains the following two network intrusion data sequences from the enterprise's internal security monitoring system:

[0059] The first template network intrusion data sequence: contains a series of complex network attack behaviors, such as advanced persistent threat (APT) attacks, cross-site scripting attacks (XSS), etc. These attack behaviors usually have high technical content and harmfulness.

[0060] The second template network intrusion data sequence: contains some common network intrusion behaviors, such as port scanning, malware infection, etc. These attack behaviors are relatively simple, but they also need to be discovered and prevented in a timely manner.

[0061] The server stores the two data sequences in a database for use in subsequent steps.

[0062] Step S120: divide the first template network intrusion data sequence into a plurality of template network intrusion data subsequences, and determine the extraction scale of each of the template network intrusion data subsequences based on the scale ratio of the template configuration scale of the first template network intrusion data sequence to the template configuration scale of the second template network intrusion data sequence.

[0063] In this step, the server needs to divide the first template network intrusion data sequence into multiple subsequences and determine the extraction scale of each subsequence. The extraction scale is determined based on the scale ratio of the first template network intrusion data sequence to the second template network intrusion data sequence.

[0064] Assume that the total size of the first template network intrusion data sequence is 10,000 data points, and the size of the second template network intrusion data sequence is 2,000 data points. Then, the size ratio is 5.

[0065] The server can convert the ratio 5 into the extraction scale of each template network intrusion data subsequence according to the set rules. For example, the server can set the extraction scale of each subsequence to 2000 data points.

[0066] The specific conversion rules can be adjusted according to the actual situation, for example, they can be determined according to factors such as the distribution of data and the training requirements of the model.

[0067] Step S130, extracting data from each of the template network intrusion data subsequences based on the extraction scale to generate a third template network intrusion data sequence, and generating a sample learning data sequence based on the third template network intrusion data sequence and the second template network intrusion data sequence, wherein the scale ratio of the template configuration scale of the third template network intrusion data sequence to the template configuration scale of the second template network intrusion data sequence is less than a set ratio.

[0068] In this step, the server extracts data from each template network intrusion data subsequence according to the determined extraction scale. For example, the server randomly extracts 2000 data points from each subsequence to generate a third template network intrusion data sequence.

[0069] Then, the server combines the third template network intrusion data sequence and the second template network intrusion data sequence into a sample learning data sequence. The sample learning data sequence will be used for subsequent model training.

[0070] When generating a sample learning data sequence, the server needs to ensure that the ratio of the template configuration scale of the third template network intrusion data sequence to the template configuration scale of the second template network intrusion data sequence is less than a set ratio. This set ratio can be adjusted according to actual conditions, for example, it can be set to 1.

[0071] By controlling the scale ratio, the server can ensure that the sample learning data sequence contains enough different types of network intrusion data to improve the generalization ability and accuracy of the model.

[0072] Step S140, performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence, and generating the network intrusion prediction model after completing the model parameter learning.

[0073] In this step, the server uses the sample learning data sequence to train the network intrusion prediction model. The network intrusion prediction model can be a model based on a machine learning algorithm, such as a decision tree, a neural network, etc.

[0074] The server inputs the sample learning data sequence into the model and uses the appropriate training algorithm to train the model. During the training process, the model learns the characteristics and patterns of different network intrusion behaviors, thereby improving the prediction ability of network intrusion.

[0075] The specific training process can include the following steps:

[0076] 1. Data preprocessing: Preprocess the sample learning data sequence, such as data cleaning and feature engineering, to improve the quality and usability of the data.

[0077] 2. Model selection: Select a model suitable for network intrusion prediction, such as decision tree, neural network, etc.

[0078] 3. Train the model: Use the preprocessed data to train the model and adjust the model parameters to improve the performance of the model.

[0079] 4. Model evaluation: Use the validation set or test set to evaluate the trained model, such as calculating indicators such as accuracy and recall to evaluate the performance of the model.

[0080] 5. Model adjustment: According to the results of model evaluation, adjust and optimize the model, such as adjusting model parameters, adding training data, etc.

[0081] 6. Repeat training: Repeat the above steps until the performance of the model meets the expected requirements.

[0082] Through continuous training and adjustment, the server can generate a network intrusion prediction model that completes model parameter learning.

[0083] Step S150, classify the target network intrusion data based on the network intrusion prediction model that has completed model parameter learning, generate a classification prediction result of the target network intrusion data, and perform security protection enhancement configuration on the data center to be constructed based on the classification prediction result of the target network intrusion data, wherein the classification prediction result represents the network intrusion category of the target network intrusion data.

[0084] In actual applications, the server can monitor network traffic in real time and input the monitored target network intrusion data into the trained network intrusion prediction model. The model classifies the target network intrusion data and generates classification prediction results.

[0085] For example, the model predicts that the target network intrusion data belongs to the APT attack category. Based on the classification prediction results, the server performs security protection enhancement configuration on the data center to be built. For example, the server can add firewall rules to restrict access to specific ports; strengthen the monitoring of the intrusion detection system to promptly detect and prevent APT attacks; encrypt the data to protect the security of the data, etc.

[0086] Through the above steps, the server can use the first template network intrusion data sequence and the second template network intrusion data sequence to generate a sample learning data sequence, and use the sequence to train the network intrusion prediction model. Then, the server can use the trained model to classify the target network intrusion data, generate classification prediction results, and perform security protection enhancement configuration on the data center to be constructed based on the results to improve the security of the data center.

[0087] It is worth noting that the above scenario examples are only to help understand the specific operations of each step. The actual application situation may be more complex and diverse. In the actual implementation process, it is necessary to adjust and optimize according to specific needs and situations. At the same time, in order to ensure the security and privacy of data, the server needs to take corresponding security measures when processing network intrusion data, such as data encryption, access control, etc.

[0088] In a possible implementation, step S110 includes:

[0089] Step S111 : obtaining a reference intrusion log carrying an attack type label from an initial network intrusion log, wherein the attack type label represents a network intrusion category of the reference intrusion log.

[0090] Step S112: Encode the reference intrusion log to generate an intrusion path encoding vector of the reference intrusion log.

[0091] Step S113: determining the first template network intrusion data sequence and the second template network intrusion data sequence based on the intrusion path encoding vector of the benchmark intrusion log.

[0092] In a possible implementation, step S111 includes:

[0093] Step S1111, obtaining the initial intrusion knowledge point of the benchmark intrusion log.

[0094] Step S1112: determining intrusion behavior assessment information based on the initial intrusion knowledge point of the benchmark intrusion log.

[0095] Step S1113: based on the intrusion behavior evaluation information and the intrusion feature template, remove the noise intrusion log from the benchmark intrusion log to generate an updated benchmark intrusion log.

[0096] In this embodiment, the server obtains the benchmark intrusion logs carrying the attack type label from the initial network intrusion logs. These initial network intrusion logs may come from multiple sources such as the security monitoring system within the enterprise, the security agency on the Internet, and the historical data warehouse. The server screens and analyzes these logs to find the benchmark intrusion logs carrying the attack type label.

[0097] For example, the server may obtain a large number of network intrusion logs from the enterprise's internal security monitoring system. These logs record various intrusion events that occurred in the enterprise network, including information such as attack type, attack time, and attack source. The server analyzes these logs to find the baseline intrusion logs that carry attack type tags. These baseline intrusion logs may be some common network intrusion behaviors, such as port scanning, malware infection, etc., or they may be some complex network attack behaviors, such as advanced persistent threat (APT) attacks, cross-site scripting attacks (XSS), etc.

[0098] Next, the obtained benchmark intrusion log is encoded to generate the intrusion path encoding vector of the benchmark intrusion log. This process can help the server better understand and analyze the information in the benchmark intrusion log, thereby improving the efficiency and accuracy of the data center construction.

[0099] For example, the server may use a deep learning-based encoding algorithm to encode the baseline intrusion log. This algorithm can convert the information in the baseline intrusion log into a numerical intrusion path encoding vector. This intrusion path encoding vector can contain information such as the attack type, attack source, and attack target in the baseline intrusion log, as well as the relationship and pattern between these information.

[0100] Based on the intrusion path encoding vector of the benchmark intrusion log, the first template network intrusion data sequence and the second template network intrusion data sequence are determined. This process can help the server better understand and analyze the information in the benchmark intrusion log, thereby improving the efficiency and accuracy of building the data center.

[0101] For example, the server may use a clustering algorithm-based method to perform cluster analysis on the intrusion path encoding vectors of the benchmark intrusion log. This algorithm can classify the intrusion path encoding vectors of the benchmark intrusion log into different categories, each category representing a different network intrusion behavior. The server can determine the first template network intrusion data sequence and the second template network intrusion data sequence based on the results of the cluster analysis. The first template network intrusion data sequence may contain some common network intrusion behaviors, such as port scanning, malware infection, etc., while the second template network intrusion data sequence may contain some complex network attack behaviors, such as advanced persistent threat (APT) attacks, cross-site scripting attacks (XSS), etc.

[0102] The server needs to obtain the baseline intrusion log with the attack type label from the initial network intrusion log. The following is an example of a specific scenario:

[0103] Assume that the server obtains a large number of network intrusion logs from the enterprise's internal security monitoring system. These logs record various intrusion events that occurred in the enterprise network, including attack type, attack time, attack source, etc. The server first screens and analyzes these logs to find the baseline intrusion logs that carry attack type tags.

[0104] The server may use a rule-based screening algorithm to screen the initial network intrusion logs. This algorithm can screen and analyze the initial network intrusion logs according to pre-set rules to find the benchmark intrusion logs that carry attack type labels. For example, the server may set some rules, such as logs with attack types such as port scanning and malware infection as benchmark intrusion logs.

[0105] The server may also use a machine learning-based screening algorithm to screen the initial network intrusion logs. This algorithm can learn and analyze a large number of initial network intrusion logs to find benchmark intrusion logs that carry attack type labels. For example, the server may use a decision tree-based machine learning algorithm to learn and analyze the initial network intrusion logs to find benchmark intrusion logs that carry attack type labels.

[0106] Then, the obtained benchmark intrusion log needs to be encoded to generate the intrusion path encoding vector of the benchmark intrusion log. The following is an example of a specific scenario:

[0107] Assume that the server obtains some benchmark intrusion logs, which record various intrusion events that occurred in the enterprise network, including attack type, attack time, attack source, etc. The server first preprocesses these benchmark intrusion logs and converts them into a format suitable for encoding.

[0108] The server may use a deep learning-based encoding algorithm to encode the baseline intrusion log. This algorithm can convert the information in the baseline intrusion log into a numerical intrusion path encoding vector. For example, the server may use a convolutional neural network (CNN)-based encoding algorithm to encode the baseline intrusion log. This algorithm can convert the information in the baseline intrusion log into a two-dimensional numerical intrusion path encoding vector, where each element represents an information unit in the baseline intrusion log.

[0109] The server may also use a coding algorithm based on a clustering algorithm to encode the baseline intrusion log. This algorithm can convert the information in the baseline intrusion log into a numerical intrusion path coding vector. For example, the server may use a coding algorithm based on a K-Means clustering algorithm to encode the baseline intrusion log. This algorithm can convert the information in the baseline intrusion log into a numerical intrusion path coding vector, where each element represents an information unit in the baseline intrusion log.

[0110] Next, it is necessary to determine the first template network intrusion data sequence and the second template network intrusion data sequence based on the intrusion path encoding vector of the benchmark intrusion log. The following is an example of a specific scenario:

[0111] Assuming that the server has obtained the intrusion path encoding vectors of some benchmark intrusion logs, the server first performs cluster analysis on these intrusion path encoding vectors and divides them into different categories.

[0112] The server may use a method based on the K-Means clustering algorithm to perform cluster analysis on the intrusion path encoding vectors. This algorithm can classify the intrusion path encoding vectors into different categories, each of which represents a different network intrusion behavior. For example, the server can classify the intrusion path encoding vectors into different categories such as port scanning, malware infection, advanced persistent threat (APT) attack, cross-site scripting attack (XSS), etc.

[0113] The server may also use a method based on a hierarchical clustering algorithm to perform cluster analysis on the intrusion path encoding vectors. This algorithm can divide the intrusion path encoding vectors into different levels, each level representing a different network intrusion behavior. For example, the server can divide the intrusion path encoding vectors into the first level, which is common network intrusion behaviors such as port scanning and malware infection, and the second level, which is complex network attack behaviors such as advanced persistent threat (APT) attacks and cross-site scripting attacks (XSS).

[0114] The server determines the first template network intrusion data sequence and the second template network intrusion data sequence according to the result of cluster analysis. The second template network intrusion data sequence may contain some common network intrusion behaviors, such as port scanning, malware infection, etc., while the first template network intrusion data sequence may contain some complex network attack behaviors, such as advanced persistent threat (APT) attack, cross-site scripting attack (XSS), etc.

[0115] For example, the server can determine the intrusion path encoding vectors belonging to common network intrusion behaviors such as port scanning and malware infection in the clustering analysis results as the second template network intrusion data sequence, and determine the intrusion path encoding vectors belonging to complex network attack behaviors such as advanced persistent threat (APT) attacks and cross-site scripting attacks (XSS) as the first template network intrusion data sequence.

[0116] Through the above steps, the server can obtain the first template network intrusion data sequence and the second template network intrusion data sequence applied to the data center construction. These sequences will be used for the subsequent data center construction and security protection enhancement configuration to improve the security and reliability of the data center.

[0117] The embodiment of the present application obtains template network intrusion data sequences of two different network intrusion categories and performs intelligent processing based on their template configuration scale, so that the method can respond to various network intrusion situations more comprehensively and accurately, and improve the security protection capability of the data middle station service system. By segmenting the first template network intrusion data sequence and determining the extraction scale based on the scale ratio, efficient use of data is achieved, the data processing process is optimized, and the calculation complexity is reduced and the processing speed is improved. By generating a third template network intrusion data sequence and combining it with the second template network intrusion data sequence to generate a sample learning data sequence, the comprehensiveness and accuracy of model learning are guaranteed, and a high-quality data foundation is provided for subsequent model parameter learning. The network intrusion prediction model is modeled using the sample learning data sequence, so that the model can more accurately predict and identify various network intrusion behaviors, thereby enhancing the security protection capability of the data middle station service system. By classifying the target network intrusion data and performing security protection enhancement configuration on the data middle station to be constructed based on the classification prediction results, personalized protection of the data middle station to be constructed is achieved, and the security and stability of the data middle station are effectively improved. As a result, the security protection capabilities of the data middle-office service system can be significantly improved, the data processing process can be optimized, the processing speed can be increased, and a guarantee for the safe and stable operation of the data middle-office can be provided.

[0118] In a possible implementation, step S112 includes:

[0119] Step S1121: construct an initial intrusion knowledge vector of the benchmark intrusion log according to the prior attack behavior record of the benchmark intrusion log, wherein the initial intrusion knowledge vector at least includes an attack type, an attack source, and an attack target.

[0120] Step S1122: constructing the attack strategy penetration feature of the benchmark intrusion log according to the attack mode of the benchmark intrusion log.

[0121] Step S1123, serializing the initial intrusion knowledge vector and the attack strategy penetration feature of the benchmark intrusion log based on the set time window to fuse the fused initial intrusion knowledge vector and the fused attack strategy penetration feature of different time windows.

[0122] Step S1124, encoding at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion and the attack strategy penetration feature to obtain a first encoding vector of the benchmark intrusion log.

[0123] Step S1125: Process the classification vector in the first encoding vector of the benchmark intrusion log to generate a second encoding vector of the benchmark intrusion log.

[0124] Step S1126: concatenate the first coding vector and the second coding vector of the benchmark intrusion log to generate an intrusion path coding vector of the benchmark intrusion log, where the intrusion path coding vector of the benchmark intrusion log is a numerical intrusion path coding vector.

[0125] In this embodiment, the prior attack behavior records of the benchmark intrusion log can be obtained from the historical database. These prior attack behavior records contain detailed information of various intrusion events that occurred in the past, such as attack type, attack source and attack target.

[0126] The server constructs the initial intrusion knowledge vector of the baseline intrusion log based on the prior attack behavior records. The vector includes at least key information such as attack type, attack source, and attack target. For example, for a port scan attack, the initial intrusion knowledge vector may be expressed as [attack type: port scan, attack source: IP address 192.168.1.10, attack target: server A].

[0127] The server analyzes the attack patterns of the benchmark intrusion logs and extracts the attack strategy penetration features. These features can reflect the attacker's behavior patterns and attack intentions.

[0128] For example, for a malware infection attack, the attack strategy penetration features may include the malware propagation method, infected file types, performed operations, etc. The server constructs these features into a feature vector as the attack strategy penetration features of the baseline intrusion log.

[0129] The server sets a time window and divides the benchmark intrusion log into multiple subsequences in chronological order. For the benchmark intrusion log in each time window, the server serializes its initial intrusion knowledge vector and attack strategy penetration characteristics. This can be achieved by connecting them into a long vector. The server fuses the fused initial intrusion knowledge vectors and fused attack strategy penetration characteristics of different time windows. This can be achieved by connecting them into a longer vector. In this way, the server obtains a fused intrusion knowledge vector and attack strategy penetration characteristics containing information from different time windows.

[0130] The server selects at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion, as well as the attack strategy penetration feature, for encoding. The encoding can be performed in a variety of ways, such as using One-Hot Encoding to convert categorical variables into numerical vectors, or using numerical encoding to convert continuous variables into numerical vectors. The server combines the encoded results into a vector as the first encoded vector of the baseline intrusion log.

[0131] The server extracts the classification vector, i.e., the part representing the attack type, from the first encoding vector. The classification vector is further processed, such as by using a hash function to map it to a smaller numerical range, or by using a dimensionality reduction algorithm to convert it into a low-dimensional vector. The processed classification vector is used as the second encoding vector of the baseline intrusion log.

[0132] The server concatenates the first encoding vector and the second encoding vector to obtain a longer vector as the intrusion path encoding vector of the baseline intrusion log. The intrusion path encoding vector is a numerical vector that contains rich information of the baseline intrusion log, such as attack type, attack source, attack target, attack strategy penetration characteristics, etc. The server stores the intrusion path encoding vector in the database for subsequent analysis and processing.

[0133] Through the above steps, the baseline intrusion log is encoded and the intrusion path encoding vector is generated. This intrusion path encoding vector can be used for subsequent network intrusion prediction model training and prediction, helping the server to better understand and analyze network intrusion behavior and improve the security and reliability of the data center.

[0134] In a possible implementation, step S1124 includes:

[0135] Performing regular transformation on the structured vector in at least one attack strategy penetration feature in the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion. And

[0136] Discretization conversion is performed on at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion and the unstructured vector in the attack strategy penetration feature.

[0137] In this embodiment, the server obtains the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion, as well as the attack strategy penetration characteristics. Then, the structured vectors therein are identified, such as the attack type, attack source, and attack target. According to predefined rules, these structured vectors are converted into regularization. For example, the attack type is converted into the corresponding digital code, and the attack source and attack target are converted into corresponding identifiers or indexes. Through regularization conversion, the server converts the structured vector into a form that is easier to process and analyze.

[0138] Next, the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion, as well as the unstructured vectors in the attack strategy penetration characteristics, are processed. The unstructured vectors may include specific behaviors of the attack, the time series of the attack, etc. The server uses a discretization method to convert these unstructured vectors into discrete numerical representations. For example, the attack behaviors are divided into different categories and a discrete numerical value is assigned to each category. Discretization conversion can help the server convert unstructured information into a quantifiable and comparable form for subsequent analysis and processing.

[0139] Through the above steps, the server encodes at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion with the penetration characteristics of the attack strategy. Regularization and discretization transformations enable this information to be represented in a more unified and processable way, facilitating the training and application of subsequent network intrusion prediction models.

[0140] Here is a specific scenario example to illustrate these steps:

[0141] Assume that the server receives a series of baseline intrusion logs, which contain information such as attack type, attack source, attack target, and specific attack behavior. The server first constructs an initial intrusion knowledge vector based on the prior attack behavior records, and constructs the attack strategy penetration feature based on the attack pattern.

[0142] For the initial intrusion knowledge vector before fusion, the server identifies the structured vector, such as the attack type is "port scan", the attack source is "IP address 192.168.1.10", and the attack target is "Server A". The server converts the attack type into a digital code "1" according to the rules, and converts the attack source and attack target into corresponding identifiers or indexes.

[0143] For unstructured vectors in the attack strategy penetration characteristics, such as the specific behavior of the attack, the server divides them into different categories, such as "quick scan", "deep scan", etc., and assigns a discrete numerical value to each category.

[0144] Through such an encoding process, at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion and the attack strategy penetration feature are converted into a numerical encoding vector. These encoding vectors can be used for the subsequent training of the network intrusion prediction model. The model can learn the relationship between different attack types, sources and targets, as well as the pattern of attack strategy penetration features, thereby improving the prediction ability of network intrusion.

[0145] This encoding method enables the server to more effectively process and analyze large amounts of intrusion log data, extract valuable information, and provide support for the construction of the data center and security protection enhancement configuration. At the same time, by discretizing unstructured vectors, the server can also better capture and represent the diversity and complexity of attack behaviors.

[0146] In a possible implementation, step S120 includes: when the scale ratio of the first template network intrusion data sequence and the second template network intrusion data sequence is greater than the set ratio, determining the extraction scale based on the set ratio, the template configuration scale of the template network intrusion data subsequence, and the template configuration scale of the second template network intrusion data sequence.

[0147] In this embodiment, the first template network intrusion data sequence is divided into multiple subsequences according to certain rules or algorithms. These subsequences can be of equal length or divided according to certain characteristics or patterns. For example, the server can divide the first template network intrusion data sequence into multiple subsequences in chronological order, and each subsequence represents intrusion data within a period of time.

[0148] Then, the template configuration scale of the first template network intrusion data sequence and the template configuration scale of the second template network intrusion data sequence are obtained, and the ratio of the two scales is calculated. For example, if the template configuration scale of the first template network intrusion data sequence is 1000 and the template configuration scale of the second template network intrusion data sequence is 200, then the scale ratio is 5.

[0149] Next, the set ratio is obtained, and the calculated scale ratio is compared with the set ratio. If the scale ratio is greater than the set ratio, the server executes the next step; otherwise, the server may take other processing methods.

[0150] Based on the set ratio, the template configuration scale of the template network intrusion data subsequence and the template configuration scale of the second template network intrusion data sequence, the extraction scale of each template network intrusion data subsequence is determined. The specific determination method can be designed according to the actual situation. One possible way is to calculate the number of each subsequence that needs to be extracted according to the set ratio and the template configuration scale of the second template network intrusion data sequence. Then, according to the template configuration scale of the template network intrusion data subsequence, the extraction ratio of each subsequence is determined. For example, the set ratio is 3, the template configuration scale of the second template network intrusion data sequence is 200, and the template configuration scale of the template network intrusion data subsequence is 100. Then, the number of subsequences that need to be extracted is 200 / 3 ≈ 67, and the extraction ratio is 67 / 100 = 0.67.

[0151] Through the above steps, the extraction scale of each template network intrusion data subsequence can be determined according to the scale ratio of the first template network intrusion data sequence and the second template network intrusion data sequence. In this way, while ensuring data diversity, reasonable extraction can be performed according to the scale ratio to provide appropriate data samples for subsequent processing and analysis.

[0152] Here is a specific scenario example to illustrate these steps:

[0153] Assume that the server receives the first template network intrusion data sequence, whose template configuration scale is 10000. At the same time, the server also obtains the second template network intrusion data sequence, whose template configuration scale is 2000. Set the ratio to 5.

[0154] The server first divides the first template network intrusion data sequence into a plurality of template network intrusion data subsequences. For example, the server may divide it into 100 subsequences, and the template configuration scale of each subsequence is 100.

[0155] Then, the server calculates the scale ratio, which is 10000 / 2000 = 5. Since the scale ratio is greater than the set ratio of 5, the server enters the step of determining the extraction scale.

[0156] According to the set ratio and the template configuration scale of the second template network intrusion data sequence, the server calculates that the number of subsequences to be extracted is 2000 / 5 = 400. Then, the server determines the extraction ratio of each subsequence to be 400 / 100 = 4 according to the template configuration scale of the template network intrusion data subsequence.

[0157] By such determination method, the server can extract 400 data points from each template network intrusion data subsequence to ensure that the extracted data has certain representativeness and diversity.

[0158] This method of determining the extraction scale can be adjusted and optimized according to the actual situation to adapt to different data characteristics and analysis requirements. At the same time, the server can also consider other factors, such as data distribution, feature importance, etc., to further improve the method of determining the extraction scale and improve the quality of data and the accuracy of analysis.

[0159] In a possible implementation, step S140 includes:

[0160] Step A110, arbitrarily extract multiple features of each sample learning data in the sample learning data sequence, and input them into the initial learning algorithm to generate a risk-weighted prediction tree.

[0161] Step A120, iteratively executing the step of arbitrarily extracting multiple features of each sample learning data in the sample learning data sequence and inputting an initial learning algorithm to generate a risk-weighted prediction tree, until X risk-weighted prediction trees are generated, where X is a positive integer greater than 1. And

[0162] Step A130: performing ensemble learning on the X risk-weighted prediction trees to generate the network intrusion prediction model.

[0163] In this embodiment, it is assumed that the server receives a sample learning data sequence, which contains a large amount of network intrusion data. These data may come from multiple sources such as the enterprise's internal security monitoring system, the Internet's security agency, and the historical data warehouse.

[0164] The server first preprocesses the sample learning data sequence, including data cleaning, feature engineering, etc. Data cleaning is to remove noise and outliers, and feature engineering is to extract features related to network intrusion.

[0165] Next, the server starts the step of model parameter learning. It arbitrarily extracts multiple features of each sample learning data in the sample learning data sequence and inputs these features into the initial learning algorithm.

[0166] The initial learning algorithm calculates the weight of each feature based on the input features and generates a risk-weighted prediction tree based on these weights. This process is similar to the construction of a decision tree, but the weight of the feature is taken into account when calculating the node split.

[0167] The server iterates this step to continuously generate new risk-weighted prediction trees. In each iteration, it randomly selects a portion of the data from the sample learning data sequence, extracts the features of this data, and then inputs it into the initial learning algorithm.

[0168] In this way, the server will gradually generate multiple risk-weighted prediction trees. For example, it may generate 10 risk-weighted prediction trees.

[0169] After generating multiple risk-weighted prediction trees, the server starts ensemble learning, combining the 10 risk-weighted prediction trees into a whole and making a comprehensive judgment based on the prediction results of these trees.

[0170] There are many methods of ensemble learning, such as averaging method, voting method, etc. In this example, the server can use the voting method, that is, voting according to the prediction results of each risk-weighted prediction tree, and selecting the category with the most votes as the final prediction result.

[0171] For example, for a new network intrusion data, 10 risk-weighted prediction trees give different prediction results. Among them, 6 trees predict category A, 3 trees predict category B, and 1 tree predicts category C. Then, the server will classify the network intrusion data into category A based on the voting results.

[0172] Through this integrated learning process, the server generates a network intrusion prediction model that completes model parameter learning. This model can be used to classify and predict new network intrusion data.

[0173] In actual applications, the server can deploy this model to the data center to monitor network traffic in real time and quickly classify and predict new network intrusion data. Based on the prediction results, the server can take corresponding security measures, such as strengthening firewall rules, restricting access to specific ports, and issuing alarms, to improve the security of the data center.

[0174] In a possible implementation, step S140 further includes:

[0175] Step B110, dividing the sample learning data sequence into a first subsequence and a second subsequence.

[0176] Step B120, performing model parameter learning on the network intrusion prediction model according to the initialization weight information and the first subsequence, wherein the initialization weight information includes the scale of the template network intrusion data subsequence, X, and the scale of the features of each sample learning data arbitrarily extracted from the sample learning data sequence.

[0177] Step B130, learning network intrusion prediction behavior for the network intrusion prediction model.

[0178] Step B140, based on the model parameter information after learning the network intrusion prediction behavior, continue to learn the model parameters of the network intrusion prediction model, generate the network intrusion prediction model that has completed the model parameter learning, and test the network intrusion prediction model that has completed the model parameter learning based on the second subsequence.

[0179] In this embodiment, the sample learning data sequence is divided into a first subsequence and a second subsequence. The first subsequence is used to learn model parameters of the network intrusion prediction model, and the second subsequence is used to test the network intrusion prediction model after the model parameter learning is completed.

[0180] The server learns the model parameters of the network intrusion prediction model based on the initialization weight information and the first subsequence. The initialization weight information includes the scale of the template network intrusion data subsequence, X, and the scale of the features of each sample learning data in the arbitrary extracted sample learning data sequence. By using these initialization weight information, the server can better control the learning process of the model and improve the accuracy and generalization ability of the model.

[0181] During the model parameter learning process, the server learns the network intrusion prediction behavior of the network intrusion prediction model. This means that the server uses the data in the sample learning data sequence to train the model so that it can learn the characteristics and patterns of different network intrusion behaviors. By continuously adjusting the model parameters, the server can improve the model's ability to predict network intrusions.

[0182] After completing the model parameter learning, the server generates a network intrusion prediction model that has completed the model parameter learning. This model has learned the knowledge in the sample learning data sequence and can be used to predict new network intrusion data.

[0183] Finally, the server tests the network intrusion prediction model that has completed model parameter learning based on the second subsequence. By applying the model to the data in the second subsequence, the server can evaluate the performance and accuracy of the model. If the model performs well in the test, the server can apply it to actual network intrusion prediction. If the model performs poorly in the test, the server can further adjust the model's parameters or retrain the model to improve its performance.

[0184] The following is a specific scenario example to illustrate these steps:

[0185] Assume that the server receives a sample learning data sequence, which includes a large amount of network intrusion data. The server divides the sample learning data sequence into a first subsequence and a second subsequence.

[0186] The server performs model parameter learning on the network intrusion prediction model according to the initialization weight information and the first subsequence. The initialization weight information includes that the scale of the template network intrusion data subsequence is 1000, X is 10, and the scale of the feature of each sample learning data in the randomly extracted sample learning data sequence is 50.

[0187] During the model parameter learning process, the server learns the network intrusion prediction model for network intrusion prediction behaviors. The server uses the data in the sample learning data sequence to train the model so that it can learn the characteristics and patterns of different network intrusion behaviors. For example, the server may find that certain characteristics are associated with specific types of network intrusion behaviors, and thus adjust the parameters of the model to better predict these behaviors.

[0188] After completing the model parameter learning, the server generates a network intrusion prediction model that has completed the model parameter learning. This model has learned the knowledge in the sample learning data sequence and can be used to predict new network intrusion data.

[0189] Finally, the server tests the network intrusion prediction model that has completed model parameter learning based on the second subsequence. The server applies the model to the data in the second subsequence and evaluates the performance and accuracy of the model. For example, the server may calculate indicators such as the accuracy, recall, and F1 value of the model to evaluate the performance of the model. If the model performs well in the test, the server can apply it to actual network intrusion prediction. If the model performs poorly in the test, the server can further adjust the model's parameters or retrain the model to improve its performance.

[0190] Through the above steps, the server can use the sample learning data sequence to learn the model parameters of the network intrusion prediction model and generate a network intrusion prediction model that has completed the model parameter learning. This model can be used to predict new network intrusion data and improve the security and reliability of the data center.

[0191] In a possible implementation, step S150 includes:

[0192] Step S151, encoding the acquired target network intrusion data set to generate an intrusion path encoding vector of the target network intrusion data.

[0193] Step S152, inputting the intrusion path encoding vector of the target network intrusion data into each of the risk weighted prediction trees in the network intrusion prediction model that has completed model parameter learning, so that each of the risk weighted prediction trees outputs network intrusion classification data.

[0194] Step S153, generating the classification prediction result based on the network intrusion classification data output by each of the risk weighted prediction trees.

[0195] In a possible implementation, the network intrusion classification data includes the confidence that the target network intrusion data belongs to different network intrusion categories, and step S153 includes:

[0196] Step S1531, calculating the scale of the network intrusion classification data whose confidence of each network intrusion category is greater than a preset confidence.

[0197] Step S1532: determine the network intrusion category whose scale is greater than half of X as the classification prediction result.

[0198] In actual applications, the server needs to classify the target network intrusion data to generate classification prediction results. The following is a specific scenario example to illustrate these steps:

[0199] Assume that the server receives a target network intrusion data set, which contains a large amount of network intrusion data. The server first encodes this data set to generate an intrusion path encoding vector of the target network intrusion data. This process can use the method mentioned above to convert the target network intrusion data into a numerical intrusion path encoding vector for subsequent processing and analysis.

[0200] Next, the server inputs the intrusion path encoding vector of the target network intrusion data into each risk-weighted prediction tree in the network intrusion prediction model that has completed model parameter learning. Each risk-weighted prediction tree will output a network intrusion classification data based on the input intrusion path encoding vector. This classification data indicates the confidence that the target network intrusion data belongs to different network intrusion categories.

[0201] For example, suppose there are three risk-weighted prediction trees in the network intrusion prediction model, namely tree 1, tree 2 and tree 3. The server inputs the intrusion path encoding vector of the target network intrusion data into the three trees. The network intrusion classification data output by tree 1 is [0.8, 0.1, 0.1], indicating that the confidence that the target network intrusion data belongs to category 1 is 0.8, the confidence that it belongs to category 2 is 0.1, and the confidence that it belongs to category 3 is 0.1; the network intrusion classification data output by tree 2 is [0.7, 0.2, 0.1], indicating that the confidence that the target network intrusion data belongs to category 1 is 0.7, the confidence that it belongs to category 2 is 0.2, and the confidence that it belongs to category 3 is 0.1; the network intrusion classification data output by tree 3 is [0.6,0.3, 0.1], indicating that the confidence that the target network intrusion data belongs to category 1 is 0.6, the confidence that it belongs to category 2 is 0.3, and the confidence that it belongs to category 3 is 0.1.

[0202] Then, the server generates a classification prediction result based on the network intrusion classification data output by each risk-weighted prediction tree. In one possible implementation, the server calculates the scale of network intrusion classification data for each network intrusion category whose confidence is greater than a preset confidence. For example, assuming that the preset confidence is 0.5, the server calculates the scale of network intrusion classification data for each network intrusion category whose confidence is greater than 0.5. In this example, the scale of network intrusion classification data for category 1 with a confidence greater than 0.5 is 3, the scale of network intrusion classification data for category 2 with a confidence greater than 0.5 is 2, and the scale of network intrusion classification data for category 3 with a confidence greater than 0.5 is 1.

[0203] Finally, the server determines the network intrusion category with a scale greater than half of X as the classification prediction result. In this example, X is 3 and half of X is 1.5. Since the scale of the network intrusion classification data with a confidence score greater than 0.5 for category 1 is 3, which is greater than 1.5, the server determines category 1 as the classification prediction result.

[0204] Through the above steps, the target network intrusion data can be classified based on the network intrusion prediction model that has completed model parameter learning, and a classification prediction result can be generated. This classification prediction result can be used for subsequent security protection enhancement configuration to improve the security and reliability of the data center.

[0205] Further, Figure 2 FIG. 1 is a schematic diagram showing a hardware structure of a data middle station service system 100 for implementing the method provided in an embodiment of the present application. Figure 2 As shown, the data middle station service system 100 may include at least one processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 and a controller 108 for communication functions. It can be understood by those skilled in the art that Figure 2 The structure shown is for illustration only and does not limit the structure of the data middle station service system 100. For example, the data middle station service system 100 may also include Figure 2 More or fewer components as shown, or with Figure 2 Different configurations shown.

[0206] The memory 104 can be used to store software programs and modules of application software, such as program instructions corresponding to the above-mentioned method embodiments in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned data processing method applied to the construction of the data middle platform. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the data middle platform service system 100 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0207] The transmission device 106 is used to obtain or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the data middle platform service system 100. In one example, the transmission device 106 includes a network adapter, which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency module, which is used to communicate with the Internet wirelessly.

[0208] It should be noted that the order of the above embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of the embodiments of the present application. Other embodiments are within the scope of the attached claims. In some cases, the exceptions or steps recorded in the claims can be performed according to an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or can be advantageous.

[0209] Each embodiment in the embodiments of the present application is described in a progressive manner, and the parts that are consistent and similar between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above different embodiments, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0210] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program. The above program may be stored in a computer-readable storage medium, and the above storage medium may be a read-only memory, a disk or an optical disk, etc.

Claims

1. A data processing method applied to data center construction, characterized in that: Applied to the data middle platform service system, the method includes: Acquire a first template network intrusion data sequence and a second template network intrusion data sequence applied to the data middle platform construction, the first template network intrusion data sequence and the second template network intrusion data sequence have different network intrusion categories, and the template configuration scale of the first template network intrusion data sequence is greater than the template configuration scale of the second template network intrusion data sequence; Dividing the first template network intrusion data sequence into a plurality of template network intrusion data subsequences, and determining an extraction scale of each of the template network intrusion data subsequences based on a scale ratio of a template configuration scale of the first template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence; Extracting data from each of the template network intrusion data subsequences based on the extraction scale to generate a third template network intrusion data sequence, and generating a sample learning data sequence based on the third template network intrusion data sequence and the second template network intrusion data sequence, wherein a scale ratio of a template configuration scale of the third template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence is less than a set ratio; Performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning; Based on the network intrusion prediction model that has completed model parameter learning, the target network intrusion data is classified to generate a classification prediction result of the target network intrusion data, and based on the classification prediction result of the target network intrusion data, a security protection enhancement configuration is performed on the data middle platform to be constructed, and the classification prediction result represents the network intrusion category of the target network intrusion data.

2. The data processing method for data center construction according to claim 1 is characterized in that: The obtaining of the first template network intrusion data sequence and the second template network intrusion data sequence applied to the data middle platform construction includes: Acquire a reference intrusion log carrying an attack type label from an initial network intrusion log, wherein the attack type label represents a network intrusion category of the reference intrusion log; Encoding the benchmark intrusion log to generate an intrusion path encoding vector of the benchmark intrusion log; The first template network intrusion data sequence and the second template network intrusion data sequence are determined based on the intrusion path encoding vector of the benchmark intrusion log.

3. The data processing method applied to data middle platform construction according to claim 2 is characterized in that: The step of obtaining a reference intrusion log carrying an attack type label from an initial network intrusion log includes: Obtaining initial intrusion knowledge points of the benchmark intrusion log; Determining intrusion behavior assessment information based on the initial intrusion knowledge points of the benchmark intrusion log; Based on the intrusion behavior assessment information and the intrusion feature template, the noise intrusion log is removed from the benchmark intrusion log to generate an updated benchmark intrusion log.

4. The data processing method applied to data middle platform construction according to claim 2 is characterized in that: The step of encoding the benchmark intrusion log to generate an intrusion path encoding vector of the benchmark intrusion log includes: According to the prior attack behavior record of the benchmark intrusion log, construct an initial intrusion knowledge vector of the benchmark intrusion log, wherein the initial intrusion knowledge vector at least includes an attack type, an attack source, and an attack target; Constructing the attack strategy penetration feature of the benchmark intrusion log according to the attack mode of the benchmark intrusion log; Based on a set time window, the initial intrusion knowledge vector and the attack strategy penetration feature of the benchmark intrusion log are serialized to fuse the fused initial intrusion knowledge vector and the fused attack strategy penetration feature of different time windows; Encoding at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion with the attack strategy penetration feature to obtain a first encoding vector of the benchmark intrusion log; Processing the classification vector in the first encoding vector of the benchmark intrusion log to generate a second encoding vector of the benchmark intrusion log; The first coding vector and the second coding vector of the benchmark intrusion log are concatenated to generate an intrusion path coding vector of the benchmark intrusion log, where the intrusion path coding vector of the benchmark intrusion log is a numerical intrusion path coding vector.

5. The data processing method for data center construction according to claim 4 is characterized in that: The step of encoding at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion with the attack strategy penetration feature to obtain a first encoding vector of the benchmark intrusion log includes: Performing regularization conversion on a structured vector in at least one attack strategy penetration feature in the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion; and Discretization conversion is performed on at least one of the initial intrusion knowledge vector before fusion and the initial intrusion knowledge vector after fusion and the unstructured vector in the attack strategy penetration feature.

6. The data processing method for data platform construction according to any one of claims 1 to 5, characterized in that: The step of dividing the first template network intrusion data sequence into a plurality of template network intrusion data subsequences, and determining the extraction scale of each of the template network intrusion data subsequences based on a scale ratio of a template configuration scale of the first template network intrusion data sequence to a template configuration scale of the second template network intrusion data sequence, comprises: When the scale ratio of the first template network intrusion data sequence and the second template network intrusion data sequence is greater than the set ratio, the extraction scale is determined based on the set ratio, the template configuration scale of the template network intrusion data subsequence and the template configuration scale of the second template network intrusion data sequence.

7. The data processing method for data platform construction according to any one of claims 1 to 5, characterized in that: The performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning comprises: arbitrarily extracting multiple features of each sample learning data in the sample learning data sequence, and inputting them into an initial learning algorithm to generate a risk-weighted prediction tree; Iteratively executing the step of arbitrarily extracting multiple features of each sample learning data in the sample learning data sequence and inputting an initial learning algorithm to generate a risk-weighted prediction tree until X risk-weighted prediction trees are generated, where X is a positive integer greater than 1; and Performing integrated learning on the X risk-weighted prediction trees to generate the network intrusion prediction model.

8. The data processing method for data center construction according to claim 7 is characterized in that: The performing model parameter learning on the network intrusion prediction model based on the sample learning data sequence to generate the network intrusion prediction model after completing the model parameter learning comprises: Dividing the sample learning data sequence into a first subsequence and a second subsequence; Performing model parameter learning on the network intrusion prediction model according to the initialization weight information and the first subsequence, the initialization weight information including the scale of the template network intrusion data subsequence, the X and the scale of the feature of each sample learning data arbitrarily extracted from the sample learning data sequence; Performing network intrusion prediction behavior learning on the network intrusion prediction model; According to the model parameter information after learning the network intrusion prediction behavior, continue to learn the model parameters of the network intrusion prediction model to generate the network intrusion prediction model that has completed the model parameter learning, and test the network intrusion prediction model that has completed the model parameter learning according to the second subsequence; And, classifying the target network intrusion data based on the network intrusion prediction model that has completed model parameter learning to generate a classification prediction result of the target network intrusion data includes: Encoding the acquired target network intrusion data set to generate an intrusion path encoding vector of the target network intrusion data; Inputting the intrusion path encoding vector of the target network intrusion data into each of the risk weighted prediction trees in the network intrusion prediction model that has completed model parameter learning, so that each of the risk weighted prediction trees outputs network intrusion classification data; The classification prediction result is generated based on the network intrusion classification data output by each of the risk-weighted prediction trees.

9. The data processing method for data center construction according to claim 8 is characterized in that: The network intrusion classification data includes the confidence that the target network intrusion data belongs to different network intrusion categories, and the network intrusion classification data output based on each risk weighted prediction tree generates the classification prediction result, including: Calculating the scale of the network intrusion classification data whose confidence level of each network intrusion category is greater than a preset confidence level; The network intrusion category whose scale is greater than half of X is determined as the classification prediction result.

10. A data middle platform service system, characterized in that: The data middle platform service system includes a processor and a readable storage medium, and the readable storage medium stores a program, which, when executed by the processor, implements the data processing method applied to the construction of the data middle platform as described in any one of claims 1-9.

Images