A rule extraction method and device of a network security anomaly detection model

Abstract

The application relates to the technical field of anomaly detection, in particular to a rule extraction method and device of a network security anomaly detection model, electronic equipment and a storage medium, wherein the method comprises the following steps: based on a root regression tree generation method, using an anomaly probability value output by an original model as a label to train a regression tree model, and generating a root regression tree; performing positioning processing on the root regression tree to obtain a low-confidence area; performing data augmentation processing on the low-confidence area to obtain augmented data; generating a root regression tree subtree based on the augmented data, performing merging processing on the root regression tree and the root regression tree subtree to obtain a merged tree; and performing rule extraction processing on the merged tree to obtain a complete rule set. The method is independent of a specific anomaly detection learning mechanism and is suitable for various anomaly detection models; the extracted rules can effectively assist security experts in model verification, knowledge discovery and decision support, and the transparency and trustworthiness of the anomaly detection system are improved.

Description

Technical Field

[0001] This application relates to the field of anomaly detection technology, and in particular to a rule extraction method, apparatus, electronic device and storage medium for a network security anomaly detection model. Background Technology

[0002] With the rapid development of internet technology, cybersecurity issues have become increasingly prominent, and anomaly detection has become one of the important means of protecting network security. The purpose of anomaly detection is to identify behaviors that significantly differ from normal patterns of behavior. In cybersecurity tasks, these anomalous behaviors refer to potential security threats or system failures. Traditional anomaly detection methods mainly rely on manually defined rules or statistical methods, but these methods have limitations when dealing with large-scale, high-dimensional data and are difficult to adapt to new or unknown attack patterns. In recent years, deep learning technology has shown great potential and advantages in the field of anomaly detection. Deep learning models, due to their excellent feature extraction and pattern recognition capabilities, are widely used in various security-related anomaly detection tasks, such as network intrusion detection, system anomaly state detection, host-based threat detection, and advanced persistent threat detection, etc.

[0003] However, deep learning models suffer from black-box characteristics, meaning their internal mechanisms and decision-making processes are often opaque and difficult to interpret, posing a significant challenge to the practical deployment of cybersecurity applications. Security analysts need to understand the model's decision-making process to ensure that anomaly detection systems can correctly identify genuine threats. This lack of interpretability leads security personnel to doubt the effectiveness of anomaly detection models, making it difficult to determine whether the model has captured expected or reasonable knowledge. To address the interpretability challenges of deep learning models, some interpretation techniques have been proposed in the text and image domains. In cybersecurity, existing methods primarily focus on providing local interpretations for individual samples, neglecting the importance of a global understanding of the model's knowledge. Furthermore, most interpretation methods for supervised models are not suitable for anomaly detection because their learning mechanisms differ from those used in anomaly detection. Summary of the Invention

[0004] This application aims to at least partially address one of the technical problems in the related art.

[0005] Therefore, the first objective of this application is to propose a rule extraction method for a network security anomaly detection model to address the limitations of existing technologies, which are not suitable for anomaly detection.

[0006] The second objective of this application is to provide an apparatus.

[0007] The third objective of this application is to propose an electronic device.

[0008] The fourth objective of this application is to provide a computer-readable storage medium.

[0009] To achieve the above objectives, the first aspect of this application proposes a rule extraction method for a network security anomaly detection model, comprising: Based on the root regression tree generation method, the abnormal probability values ​​output by the original model are used as labels to train the regression tree model and generate the root regression tree. The root regression tree is localized to obtain low-confidence regions; Data augmentation processing is performed on the low-confidence region to obtain augmented data; A root regression tree subtree is generated based on the augmented data, and the root regression tree and the root regression tree subtree are merged to obtain a merged tree; The merged tree is processed to extract rules, resulting in a complete rule set.

[0010] Preferably, the root regression tree generation method, which uses the anomaly probability values ​​output by the original model as labels to train the regression tree model and generate the root regression tree, includes: The training set of the original anomaly detection model is used as input, and a tree model is fitted to obtain the output of the original model; Based on the CART algorithm, a root regression tree is generated by training using the output of the original model.

[0011] Preferably, the step of locating the root regression tree to obtain low-confidence regions includes: Low-confidence regions that appear when fitting the original model using outlier scores or probability measures; The impurity of leaf nodes is used to measure the low-confidence regions that appear during root regression tree fitting; Define anomaly score threshold and impurity quantile threshold, and use the anomaly score threshold and impurity score threshold to locate low confidence regions.

[0012] Preferably, the step of performing data augmentation processing on the low-confidence region to obtain augmented data includes: Sample augmentation is performed in two directions. For each low-confidence leaf node, multiple iterations are conducted using the original training set. Based on the gradient information of the model, the samples from the previous iteration are continuously modified to obtain samples with inconsistent decisions.

[0013] Preferably, the calculation formula for the iteration is:

[0014] in, and Based on Augmented normal and abnormal sample sets, and For the first The normal and abnormal sample sets generated by the round of iterations To modify the hyperparameters of the step size, For the upper realm, To concentrate on the training and fall into the first The sample set in the training set of the low-confidence leaf nodes This is the original anomaly detection model.

[0015] Preferably, generating the root regression subtree based on the augmented data includes: When iteratively modifying sample feature values ​​based on gradient information, all feature values ​​contained in the predecessor nodes from the root node to the low-confidence leaf corresponding to the sample are fixed, and features not used on the decision path are modified. For each low-confidence leaf node, the augmented samples obtained in all iterations will be fitted to generate a subtree using the same method as the root regression tree.

[0016] Preferably, the step of merging the root regression tree and its subtrees to obtain a merged tree includes: Replace the low-confidence leaf nodes corresponding to the root regression tree with the subtrees of the root regression tree and discretize the continuous values ​​in the leaf nodes. Perform a recursive traversal from the deepest non-leaf node upwards to the root node.

[0017] To achieve the above objectives, a second aspect of this application provides a rule extraction device for a network security anomaly detection model, comprising: The root regression tree generation module, based on the root regression tree generation method, uses the anomaly probability values ​​output by the original model as labels to train the regression tree model and generate the root regression tree; The positioning module performs positioning processing on the root regression tree to obtain low-confidence regions; The augmentation module performs data augmentation processing on the low-confidence region to obtain augmented data; The merging module generates a root regression tree subtree based on the augmented data, and merges the root regression tree and the root regression tree subtree to obtain a merged tree; The rule extraction module performs rule extraction processing on the merged tree to obtain a complete rule set.

[0018] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method described in any of the preceding descriptions.

[0019] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium, comprising computer-executable instructions stored therein, which, when executed by a processor, are used to implement the method described in any of the above embodiments.

[0020] This application provides a rule extraction method for a network security anomaly detection model. It extracts comprehensive and accurate global rules from a deep learning model by generating a root regression tree. Data augmentation is performed on low-confidence regions to facilitate subtree generation. The subtrees are then merged with the root regression tree to ensure consistency with the decision boundaries of the original model, thus providing reliable interpretations for security experts. This method should be independent of specific anomaly detection learning mechanisms and applicable to various anomaly detection models. Finally, the extracted rules should effectively assist security experts in model validation, knowledge discovery, and decision support, improving the transparency and trustworthiness of the anomaly detection system.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of a first specific embodiment of a rule extraction method for a network security anomaly detection model provided by the present invention; Figure 2 This is the overall flowchart of this method; Figure 3 A comparison chart of the rule interpretation quality generated by this method; Figure 4 This is a structural block diagram of a rule extraction device for a network security anomaly detection model provided in an embodiment of the present invention. Detailed Implementation

[0023] The core of this invention is to provide a rule extraction method, apparatus, electronic device, and storage medium for a network security anomaly detection model. By extracting rules from a deep learning model, fine-grained detection rules representing the model's decision-making logic are generated, which helps security personnel understand the model's decision-making process.

[0024] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Please refer to Figure 1 , Figure 1 The flowchart shows a first specific embodiment of the rule extraction method for a network security anomaly detection model provided by the present invention; the specific operation steps are as follows: Step S101: Based on the root regression tree generation method, use the anomaly probability values ​​output by the original model as labels to train the regression tree model and generate the root regression tree; The training set of the original anomaly detection model is used as input, and a tree model is fitted to obtain the output of the original model; Based on the CART algorithm, a root regression tree is generated by training using the output of the original model.

[0026] Step S102: Perform localization processing on the root regression tree to obtain low-confidence regions; Low-confidence regions that appear when fitting the original model using outlier scores or probability measures; The impurity of leaf nodes is used to measure the low-confidence regions that appear during root regression tree fitting; Define anomaly score threshold and impurity quantile threshold, and use the anomaly score threshold and impurity score threshold to locate low confidence regions.

[0027] Step S103: Perform data augmentation processing on the low-confidence region to obtain augmented data; Sample augmentation is performed in two directions. For each low-confidence leaf node, multiple iterations are conducted using the original training set. Based on the gradient information of the model, the samples from the previous iteration are continuously modified to obtain samples with inconsistent decisions.

[0028] The calculation formula for the iteration is:

[0029] in, and Based on Augmented normal and abnormal sample sets, and For the first The normal and abnormal sample sets generated by the round of iterations To modify the hyperparameters of the step size, For the upper realm, To concentrate on the training and fall into the first The sample set in the training set of the low-confidence leaf nodes This is the original anomaly detection model.

[0030] Step S104: Generate a root regression tree subtree based on the augmented data, and merge the root regression tree and the root regression tree subtree to obtain a merged tree; When iteratively modifying sample feature values ​​based on gradient information, all feature values ​​contained in the predecessor nodes from the root node to the low-confidence leaf corresponding to the sample are fixed, and features not used on the decision path are modified. For each low-confidence leaf node, the augmented samples obtained in all iterations will be fitted to generate a subtree using the same method as the root regression tree.

[0031] Replace the low-confidence leaf nodes corresponding to the root regression tree with the subtrees of the root regression tree and discretize the continuous values ​​in the leaf nodes. Perform a recursive traversal from the deepest non-leaf node upwards to the root node.

[0032] Step S105: Perform rule extraction processing on the merged tree to obtain a complete rule set.

[0033] This embodiment provides a rule extraction method for a network security anomaly detection model. It extracts comprehensive and accurate global rules from a deep learning model by generating a root regression tree. Low-confidence regions are augmented to facilitate subtree generation. These subtrees are then merged with the root regression tree to ensure consistency with the decision boundaries of the original model, thus providing reliable interpretations for security experts. This method should be independent of specific anomaly detection learning mechanisms and applicable to various anomaly detection models. Finally, the extracted rules should effectively assist security experts in model validation, knowledge discovery, and decision support, improving the transparency and trustworthiness of the anomaly detection system.

[0034] Based on the above embodiments, this embodiment describes the rule extraction method of the network security anomaly detection model, as follows: Figure 2 As shown, the details are as follows: First, this method treats the deep learning anomaly detection model to be interpreted as a black box, using the same training data as the original model as input, and training a regression tree model, called the root tree, using the anomaly probability values ​​output by the corresponding original model as labels. Due to limitations in the distribution of the original training data, the root tree may not be perfectly consistent with the original model in certain data distributions or local feature spaces. Therefore, this method locates regions corresponding to inconsistent decision samples, which correspond to specific leaf nodes on the root regression tree, called low-confidence regions or leaf nodes. To eliminate decision inconsistencies caused by low-confidence regions, the low-confidence leaf nodes need to be replaced with high-fidelity rules. Therefore, this method further designs a training data augmentation strategy for low-confidence regions and generates a subtree for each low-confidence interval based on this. Next, each low-confidence leaf in the root tree is replaced with the corresponding subtree, forming a merged tree. Considering that in real-world scenarios, security personnel tend to focus more on rules indicating anomalies or normality, or a general anomaly severity classification, rather than specific anomaly scores, this method further simplifies the rule branches of the merged tree. The simplified merged tree is divided into normal and abnormal rule sets, and the decision thresholds in non-leaf nodes can be simplified to increase the readability of the interpretation results.

[0035] Root regression tree generation: This method uses a tree-based interpretable model because it contains multiple rules from the root to the leaf nodes, and rules are a widely used form of domain knowledge representation in the security field. When training the tree model, the same training set as the original anomaly detection model is used as input, and the tree model is fitted to simulate the output of the original model. This method first trains a regression tree to approximate the output probability (i.e., anomaly score) of the original anomaly detection model; this is called the root tree in this method. In this way, the tree model can fit the different anomaly levels and probability distributions learned by the original model, rather than just discrete binary classification results, thus improving fidelity. This method trains the root tree based on the CART (Classification And Regression Tree) algorithm. CART includes algorithms for constructing classification and regression tree models. When constructing the regression tree, the training objective of CART is to predict a given continuous output value as accurately as possible. The principle of the regression tree in CART is to divide the input space into different regions, ensuring that the variance of the predicted values ​​in each region is minimized. The CART regression tree uses mean squared error (MSE) as the default partitioning criterion, and the error of all predicted values ​​in each node is called impurity. When splitting a regression tree, the best split is chosen from all possible partitions, selecting the one with the lowest impurity. Each non-leaf node in a trained regression tree contains features and a decision threshold, while leaf nodes represent anomaly scores (probabilities) similar to the output of the original anomaly model. The decision paths from the root node to each leaf node form a rule that explains the relationships between the features and thresholds used by the original model to reach its final decision.

[0036] Low-confidence area localization: After generating the root tree, the proposed method identifies the feature subspaces where the decisions of the explanatory model and the original model are inconsistent. From the perspective of the tree model, it is necessary to find and correct the decisions corresponding to the currently unreliable leaf nodes. Such feature subspaces or leaf nodes are referred to as low-confidence intervals or leaves in this method.

[0037] The existence of low-confidence regions stems from two causes: one is low-confidence regions appearing during the fitting of the original model, and the other is low-confidence regions appearing during the root tree fitting process. The low-confidence regions of the original model can be measured using anomaly scores or probabilities. In reconstruction-based anomaly detection, the goal of the model during training is to reduce the reconstruction error of normal samples. Therefore, the lower the anomaly score (reconstruction error), the more prevalent the sample is in the normal data distribution. Conversely, the higher the anomaly score, the more likely the sample is outside the normal data distribution. Therefore, regions with high anomaly scores (leaf nodes) can be directly selected as low-confidence regions of the original model. On the other hand, low-confidence regions appearing during root tree fitting are due to some leaf nodes not fitting the original model's decisions well, regardless of the anomaly scores corresponding to these decisions. These underfitting decisions (leaf nodes) directly lead to inconsistencies between the two models' decisions, and such low-confidence regions can be directly measured by the impurity of the leaf nodes. This method defines two key parameters. and This is used to locate two types of low-confidence regions, representing quantile thresholds for outlier scores and impurity, respectively. For example, if... Then, the anomaly scores of all training samples and the 99th percentile of the impurity of all leaf nodes are set as two thresholds. If the predicted probability or impurity of a leaf node in the root tree is greater than either of the corresponding thresholds, the leaf node will be labeled as a low-confidence leaf node.

[0038] Low-confidence region data augmentation and subtree generation: After locating low-confidence regions, this method eliminates inconsistencies within these regions by generating fine-grained rules for each region. This method proposes a data augmentation approach based on the gradient of the original model. Its core idea is to generate samples that explain the inconsistencies between the original and explanatory model decisions. Specifically, it uses... Indicates that the training set falls into the first... The sample set in the training set of the low-confidence leaf nodes, used This represents the original anomaly detection model. Since the decisions obtained from low-confidence leaf nodes are unreliable, regardless of whether the original decision for each sample at the low-confidence leaf node is normal or abnormal, this method augments the samples in two directions (abnormal or normal), denoted as . and , respectively representing based on The augmented dataset consists of normal and abnormal sample sets. The specific augmentation process is as follows: for each low-confidence leaf node, the sample set is adjusted using samples from the original training set... Use it as a seed for multiple iterations. The normal or abnormal sample set generated by round iteration is denoted as and The augmentation process continuously modifies the samples from the previous iteration based on the model's gradient information, searching for samples that lead to inconsistent decisions. The initialization method for the augmentation process is to let... In each of the following rounds (hereinafter referred to as...), In any non-initial iteration round, the iterative modification method is shown in the following equation:

[0039] The two lines in the above formula represent the update methods for the two gradient directions, and the second term in each line calculates how to modify the gradient in each direction (normal or abnormal). `step` is a hyperparameter representing the step size for modification. In the normal (negative) direction, the reconstruction error gradient of the samples from the previous iteration needs to be calculated and subtracted, because the samples to be augmented when augmenting normal samples have smaller reconstruction errors. In the abnormal (positive) direction, reducing the reconstruction error of the model input and output is difficult, but increasing it is very easy. Therefore, in addition to reversing the gradient direction, it is also necessary to limit the upper bound of the reconstruction error to prevent numerical explosion. Therefore, the ReLU function and an upper bound are introduced when increasing the reconstruction error. Based on experience, it is set to twice the anomaly threshold of the original model, that is, optimization stops when the reconstruction error increases to twice the anomaly threshold of the original model.

[0040] In a tree model, each leaf node corresponds to a feature subspace. Since this method only augments samples within the low-confidence feature subspace, it's necessary to limit the scope of the augmented samples. To achieve this, when iteratively modifying sample feature values ​​based on gradient information, all feature values ​​from the root node to the predecessor node of the corresponding low-confidence leaf are fixed, and only features not used on that decision path are modified. For example... Figure 2 As shown, for the low-confidence leaf node (0.9) on the first root tree, since the first feature dimension has already been used by the root tree, only the last two features are modified during augmentation. Similarly, for the second low-confidence leaf node (0.3), only the third feature dimension can be modified. This method ensures that the rules for non-low-confidence leaf nodes are not modified. The iteration process continues until there is no gradient on the modified feature dimensions. Finally, for each low-confidence leaf node, the augmented samples obtained from all iterations will be fitted to generate a subtree using the same method as generating the root tree in the first step.

[0041] Tree merging and rule generation: After the above steps, this method obtains a root tree and several subtrees corresponding to low-confidence leaf nodes. Next, they need to be merged into a single tree to represent a complete rule set. Because the features in the decision path are not changed during the data augmentation step, the corresponding low-confidence leaf nodes can be directly replaced with subtrees, ultimately forming a merged tree. Similar to the root tree, non-leaf nodes in the merged tree represent the relationship between the features used for decision-making and the decision threshold, while leaf nodes represent the anomaly score corresponding to that decision. In practical applications, security personnel are more concerned with whether a rule is anomalous (or a relatively coarse-grained anomaly level) rather than the specific value of the anomaly probability. Therefore, this method discretizes the continuous values ​​in the leaf nodes into ranges representing different levels or degrees of anomaly to simplify the complexity of the merged tree. The discretization process involves recursively traversing from the deepest non-leaf node upwards to the root node, each time determining whether the values ​​of the left and right leaf nodes belong to the same anomaly range. If they do, they are merged into a single leaf node representing that anomaly range. The division of the anomaly range needs to be analyzed specifically based on the network security scenario and application requirements.

[0042] The final step is rule generation and simplification. This method extracts each rule from the discretized merged tree. Each path from the root node to a leaf node is a rule, and the rules are ranked according to their importance based on different degrees of anomaly. Each rule contains several features, a decision threshold, and the relationship between them. To further improve the readability of the generated rules, the decision thresholds for continuous features can also be discretized. Figure 2 The simple example in the text demonstrates how the relationship between features and decision thresholds can be divided into two types: "too large" and "too small".

[0043] This embodiment of the method provides a rule extraction method for a network security anomaly detection model. This method treats the deep learning anomaly detection model to be interpreted as a black box, using the same training data as the original model as input. It trains a regression tree model using the anomaly probability values ​​output by the corresponding original model as labels. By generating a root regression tree, it extracts comprehensive and accurate global rules from the deep learning model. Data augmentation is performed on low-confidence regions to facilitate the generation of subtrees. These subtrees are then merged with the root regression tree to ensure consistency with the decision boundaries of the original model, thus providing a reliable interpretation for security experts. This method should be independent of specific anomaly detection learning mechanisms and applicable to various anomaly detection models. Finally, this method should be able to effectively assist security experts in model validation, knowledge discovery, and decision support through the extracted rules, improving the transparency and trustworthiness of the anomaly detection system.

[0044] Based on the above embodiments, this embodiment provides specific experiments to illustrate the method, as follows: First, our method was compared with several existing tree-based rule extraction methods in terms of interpretation quality on three public datasets for traffic intrusion detection: CICIDS2017, Kitsune, and Kyoto2006+, as well as the public dataset for log anomaly detection, HDFS. The results are as follows: Figure 3 As shown in the figure, the horizontal axis represents the maximum number of rules generated, limiting the number of rules extracted by different methods. The vertical axis represents the consistency / reliability of abnormal / normal rules, measuring the fidelity of the generated rules compared to the original anomaly detection model. Consistency refers to the proportion of decisions in the generated rules that are consistent with the original model; reliability refers to how many decisions in the generated rules are reliable (consistent with the original model). The results show that this method achieves better fidelity with fewer rules compared to other methods.

[0045] Secondly, this method was deployed and tested in the State Grid environment. The security protection system of the State Grid's power monitoring system continuously monitors critical equipment and generates logs, which can be divided into two categories: collection logs periodically record relevant equipment information (such as CPU and memory utilization, fan speed, etc.); trigger logs record relevant events occurring on the equipment (such as USB insertion and removal, directory changes, etc.). Each log entry is risk-classified according to industry standards and expert knowledge, categorized as dangerous, important, and general. Dangerous logs and some important logs are reported in real time for operators to analyze and process. Therefore, the log classification can be viewed as a rule set based on expert knowledge. Furthermore, this method is used to extract detection rules from a deep learning-based log anomaly model. Then, expert knowledge and model knowledge are fused, and the detection effects of using expert knowledge, model knowledge alone, and the fusion of both types of knowledge using this method are compared. The results are shown in Table 1, displaying the number of false alarms and false negatives on the two devices.

[0046] Table 1. Deployment test results under the State Grid environment

[0047] It can be seen that while using only the danger level logs for detection will not produce false positives, it will miss a large number of important anomalies (for example, device 2 has no dangerous level logs, so no anomalies were detected). On the other hand, classifying all important level logs as anomalies will introduce a large number of false positives. Detection based on deep learning models can better balance false positives and false negatives, but there is still considerable room for performance improvement. The detection effect is best when combining rules based on models and expert knowledge.

[0048] Please refer to Figure 4 , Figure 4 This is a structural block diagram of a rule extraction device for a network security anomaly detection model provided in an embodiment of the present invention; the specific device may include: The root regression tree generation module 100, based on the root regression tree generation method, uses the anomaly probability values ​​output by the original model as labels to train the regression tree model and generate the root regression tree; The positioning module 200 performs positioning processing on the root regression tree to obtain low-confidence regions; Augmentation module 300 performs data augmentation processing on the low-confidence region to obtain augmented data; The merging module 400 generates a root regression tree subtree based on the augmented data, and merges the root regression tree and the root regression tree subtree to obtain a merged tree; The rule extraction module 500 performs rule extraction processing on the merged tree to obtain a complete rule set.

[0049] This embodiment of the rule extraction device for a network security anomaly detection model is used to implement the aforementioned rule extraction method for a network security anomaly detection model. Therefore, the specific implementation of the rule extraction device for a network security anomaly detection model can be found in the embodiment section of the rule extraction method for a network security anomaly detection model mentioned above. For example, the root regression tree generation module 100, the localization module 200, the augmentation module 300, the merging module 400, and the rule extraction module 500 are respectively used to implement steps S101, S102, S103, S104, and S105 in the rule extraction method for a network security anomaly detection model. Therefore, its specific implementation can be referred to the description of the corresponding embodiments, which will not be repeated here.

[0050] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0051] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0052] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0053] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0054] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0055] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0056] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0057] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0058] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0059] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0060] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0061] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0062] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0063] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A rule extraction method for a network security anomaly detection model, characterized in that, include: Based on the root regression tree generation method, the abnormal probability values ​​output by the original model are used as labels to train the regression tree model and generate the root regression tree. The root regression tree is localized to obtain low-confidence regions; Data augmentation processing is performed on the low-confidence region to obtain augmented data; The data augmentation process includes: augmenting samples from two directions; performing multiple iterations on each low-confidence leaf node using the original training set; continuously modifying the samples from the previous iteration based on the model's gradient information; and obtaining samples with inconsistent decisions. The calculation formula for the iteration is: in, and Based on Augmented normal and abnormal sample sets, and For the first The normal and abnormal sample sets generated by the round of iterations To modify the hyperparameters of the step size, For the upper realm, To concentrate on the training and fall into the first The sample set in the training set of the low-confidence leaf nodes This is the original anomaly detection model; A root regression tree subtree is generated based on the augmented data, and the root regression tree and the root regression tree subtree are merged to obtain a merged tree; The merged tree is processed to extract rules, resulting in a complete rule set.

2. The rule extraction method for the network security anomaly detection model according to claim 1, characterized in that, The root regression tree generation method uses the anomaly probability values ​​output by the original model as labels to train the regression tree model, and the generation of the root regression tree includes: The training set of the original anomaly detection model is used as input, and a tree model is fitted to obtain the output of the original model; Based on the CART algorithm, a root regression tree is generated by training using the output of the original model.

3. The rule extraction method for the network security anomaly detection model according to claim 1, characterized in that, The step of locating the root regression tree to obtain low-confidence regions includes: Low-confidence regions that appear when fitting the original model using outlier scores or probability measures; The impurity of leaf nodes is used to measure the low-confidence regions that appear during root regression tree fitting; Define anomaly score threshold and impurity quantile threshold, and use the anomaly score threshold and impurity score threshold to locate low confidence regions.

4. The rule extraction method for the network security anomaly detection model according to claim 1, characterized in that, The generation of the root regression subtree based on the augmented data includes: When iteratively modifying sample feature values ​​based on gradient information, all feature values ​​contained in the predecessor nodes from the root node to the low-confidence leaf corresponding to the sample are fixed, and features not used on the decision path from the root node to the low-confidence leaf corresponding to the sample are modified. For each low-confidence leaf node, the augmented samples obtained in all iterations will be fitted to generate a subtree using the same method as the root regression tree.

5. The rule extraction method for the network security anomaly detection model according to claim 1, characterized in that, The step of merging the root regression tree and its subtrees to obtain a merged tree includes: Replace the low-confidence leaf nodes corresponding to the root regression tree with the subtrees of the root regression tree and discretize the continuous values ​​in the leaf nodes. Perform a recursive traversal from the deepest non-leaf node upwards to the root node.

6. A rule extraction device for a network security anomaly detection model, characterized in that, include: The root regression tree generation module, based on the root regression tree generation method, uses the anomaly probability values ​​output by the original model as labels to train the regression tree model and generate the root regression tree; The positioning module performs positioning processing on the root regression tree to obtain low-confidence regions; The augmentation module performs data augmentation processing on the low-confidence region to obtain augmented data; The data augmentation process includes: augmenting samples from two directions; performing multiple iterations on each low-confidence leaf node using the original training set; continuously modifying the samples from the previous iteration based on the model's gradient information; and obtaining samples with inconsistent decisions. The calculation formula for the iteration is: in, and Based on Augmented normal and abnormal sample sets, and For the first The normal and abnormal sample sets generated by the round of iterations To modify the hyperparameters of the step size, For the upper realm, To concentrate on the training and fall into the first The sample set in the training set of the low-confidence leaf nodes This is the original anomaly detection model; The merging module generates a root regression tree subtree based on the augmented data, and merges the root regression tree and the root regression tree subtree to obtain a merged tree; The rule extraction module performs rule extraction processing on the merged tree to obtain a complete rule set.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-5.

Images