Network security situation awareness system and method based on machine learning

Abstract

The present application relates to a network security situation awareness system and method based on machine learning. The method includes: collecting historical data and real-time status data of the network security situation awareness system, and using network data processing and analysis technology based on machine learning to perform data parsing and feature engineering processing on the historical data and the real-time status data, so as to automatically determine whether there are hidden dangers based on the one-way interactive matching semantics between the set of hidden danger sample feature representations obtained by parsing, feature dimension reduction and clustering of the historical data and the real-time status feature representations of the real-time status data. In this way, the real-time status changes in the network security situation can be captured, so as to identify new threat patterns or abnormal behaviors, which helps to improve the accuracy of threat detection.

Description

Technical Field

[0001] The present application relates to the technical field of power system network security, and specifically, to a network security situation awareness system and method based on machine learning. Background Art

[0002] Existing power system cybersecurity risk assessments typically include: communication vulnerability analysis to identify vulnerable nodes in information systems; analysis of cyber attack characteristics to assess the impact of attacks on system operations and quantify risks; and cyber-physical fusion system simulation to test the actual impact of cyber attacks on the system.

[0003] However, in the existing power system network security risk assessment, there are problems such as insufficient description of the impact of network security risks, lack of quantification of security status when not attacked, limited online applications, and missing risk data, which limit the accuracy and practicality of the assessment. In response to this challenge, China's public patent CN111652496A proposes an operation risk assessment method and device based on a network security situation awareness system, which collects and preprocesses historical data to form training and test sets, and then uses machine learning algorithms to train intelligent analysis models. The model combines the power system recovery target algorithm to predict recovery time and loss, and then comprehensively evaluates the risk based on recovery time, loss load and threat probability to obtain a network security operation loss risk value.

[0004] The above-mentioned operational risk assessment method based on the network security situation awareness system is mainly based on historical data to conduct network security loss assessment. However, historical data reflects past events and behavior patterns. If the attacker adopts new or unknown attack methods, the above-mentioned method may not be able to immediately identify these new threats, resulting in delays in detection and response. In addition, the network environment is dynamic, and the method that relies solely on historical data for analysis cannot reflect the latest network security threats and changes in a timely manner, and may not respond quickly enough to real-time or rapidly changing network environments, thereby reducing the accuracy of detection.

[0005] Therefore, an optimized network security situation awareness system is desired. Summary of the invention

[0006] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0007] In a first aspect, the present application provides a network security situation awareness system based on machine learning, the system comprising:

[0008] A network security historical data collection and analysis module is used to collect historical data of the network security situation awareness system and analyze the historical data to obtain historical analysis data;

[0009] A historical analysis data preprocessing module, used for preprocessing the historical analysis data to obtain a set of sample data;

[0010] A sample data feature dimensionality reduction processing module is used to perform feature dimensionality reduction processing on the set of sample data through feature engineering to obtain a set of sample feature representations;

[0011] A sample feature clustering module, used for performing cluster analysis on the set of sample feature representations to obtain a clustering result, wherein the clustering result includes a set of hidden danger sample feature representations and a set of normal sample feature representations;

[0012] A network security real-time status data acquisition module, used to acquire real-time status data from the network security situation awareness system;

[0013] A real-time data analysis and processing module, used for performing analysis and feature engineering on the real-time status data to obtain a real-time status feature representation;

[0014] A real-time state-hidden danger sample feature matching module, used to use the real-time state feature representation as a query feature vector, calculate its one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations to obtain a one-way matching result representation vector as a one-way matching result representation feature;

[0015] The classification result generating module is used to obtain the classification result based on the one-way matching result representation feature, and the classification result is used to indicate whether there is a hidden danger.

[0016] Optionally, the historical analysis data preprocessing module is used to: clean up erroneous records in the historical analysis data and fill in corresponding missing data to obtain the set of sample data.

[0017] Optionally, the real-time state-hidden danger sample feature matching module includes: a real-time state-hidden danger sample semantic similarity calculation unit, which is used to calculate the semantic similarity between the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement coefficients; a real-time state-hidden danger sample coefficient normalization processing unit, which is used to normalize the set of real-time state-hidden danger sample one-way matching semantic measurement coefficients to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement weight values; a real-time state-hidden danger sample data one-way matching interactive feature reshaping unit, which is used to calculate the weighted sum of the set of hidden danger sample feature representations using the set of real-time state-hidden danger sample one-way matching semantic measurement weight values ​​as weights to obtain a real-time state-hidden danger sample data one-way matching interactive reshaping feature vector; a differential feature calculation unit, which is used to calculate the differential feature vector between the real-time state-hidden danger sample data one-way matching interactive reshaping feature vector and the query feature vector as the one-way matching result representation vector.

[0018] Optionally, the real-time state-hidden danger sample semantic similarity calculation unit includes: a cascade processing subunit, used to perform cascade processing on the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations respectively to obtain a set of query-hidden danger sample semantic coding joint feature vectors; a vector calculation subunit, used to respectively calculate the matrix product of each query-hidden danger sample semantic coding joint feature vector in the set of query-hidden danger sample semantic coding joint feature vectors and a weight matrix, and then add the obtained feature vector and the bias vector by position to obtain a set of query-hidden danger sample semantic coding joint bias feature vectors; a vector activation subunit, used to input the set of query-hidden danger sample semantic coding joint bias feature vectors into a sigmoid activation function to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement coefficients.

[0019] Optionally, the real-time state-hidden danger sample coefficient normalization processing unit is used to: use each real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of real-time state-hidden danger sample one-way matching semantic measurement coefficients as the exponent of a natural constant to calculate an exponential function value with base e to obtain a set of logarithmic values ​​of the real-time state-hidden danger sample one-way matching semantic measurement coefficients; calculate the sum of the logarithmic values ​​of each real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of logarithmic values ​​of the real-time state-hidden danger sample one-way matching semantic measurement coefficients to obtain the total sum of the real-time state-hidden danger sample one-way matching semantic measurement; divide each logarithmic value of the real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of logarithmic values ​​of the real-time state-hidden danger sample one-way matching semantic measurement coefficients by the total sum of the real-time state-hidden danger sample one-way matching semantic measurement to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement weight values.

[0020] Optionally, the classification result generating module is used to: input the one-way matching result representation vector into a classifier based on an SVM model to obtain the classification result, and the classification result is used to indicate whether there is a hidden danger.

[0021] Optionally, a training module is also included for training the classifier based on the SVM model.

[0022] Optionally, the training module includes: a training network security history data collection and analysis unit, which is used to collect training history data of the network security situation awareness system, and analyze the training history data to obtain training history analysis data, as well as whether there is a real value of hidden dangers; a training history analysis data preprocessing unit, which is used to preprocess the training history analysis data to obtain a set of training sample data; a training sample data feature dimensionality reduction processing unit, which is used to perform feature dimensionality reduction processing on the set of training sample data through feature engineering to obtain a set of training sample feature representations; a training sample feature clustering unit, which is used to perform cluster analysis on the set of training sample feature representations to obtain training clustering results, and the training clustering results include a set of training hidden danger sample feature representations and a set of training normal sample feature representations; a training network security real-time status data acquisition unit, which is used to obtain training real-time status data from the network security situation awareness system; a training real-time data analysis processing unit A unit for parsing and feature engineering the training real-time state data to obtain a training real-time state feature representation; a training real-time state-hidden danger sample feature matching unit for taking the training real-time state feature representation as a query feature vector, calculating its one-way attention granular scanning interactive matching result relative to the set of training hidden danger sample feature representations to obtain a training one-way matching result representation vector as a training one-way matching result representation feature; a training classification result generating unit for inputting the training one-way matching result representation vector into the classifier based on the SVM model to obtain a classification result; a training classification loss function value calculating unit for calculating the loss function value between the classification result and the true value to obtain a classification loss function value and a one-way matching result loss function value; a training unit for training the classifier based on the SVM model through gradient back propagation based on the weighted sum of the classification loss function value and the one-way matching result loss function value as the loss function value.

[0023] In a second aspect, the present application provides a network security situation awareness method based on machine learning, the method comprising:

[0024] Collecting historical data of the network security situation awareness system, and parsing the historical data to obtain historical parsed data;

[0025] Preprocessing the historical parsed data to obtain a set of sample data;

[0026] Performing feature dimensionality reduction processing on the set of sample data through feature engineering to obtain a set of sample feature representations;

[0027] Performing cluster analysis on the set of sample feature representations to obtain a clustering result, wherein the clustering result includes a set of hidden danger sample feature representations and a set of normal sample feature representations;

[0028] Acquire real-time status data from the network security situation awareness system;

[0029] Performing analysis and feature engineering on the real-time status data to obtain a real-time status feature representation;

[0030] Taking the real-time state feature representation as a query feature vector, calculating the one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations to obtain a one-way matching result representation vector as a one-way matching result representation feature;

[0031] Based on the one-way matching result representation feature, a classification result is obtained, and the classification result is used to indicate whether there is a hidden danger.

[0032] Optionally, preprocessing the historical parsed data to obtain a set of sample data includes: cleaning up erroneous records in the historical parsed data and filling in corresponding missing data to obtain the set of sample data.

[0033] The above technical solution is adopted to collect historical data and real-time status data of the network security situation awareness system, and adopt network data processing and analysis technology based on machine learning to perform data analysis and feature engineering processing on the historical data and the real-time status data, so as to automatically judge whether there is a hidden danger based on the one-way interactive matching semantics between the set of hidden danger sample feature representations obtained by parsing, feature dimension reduction and clustering of the historical data and the real-time status feature representations of the real-time status data. In this way, the real-time status changes in the network security situation can be captured to identify new threat patterns or abnormal behaviors, which helps to improve the accuracy of threat detection.

[0034] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0036] Figure 1 It is a block diagram of a network security situation awareness system based on machine learning according to an exemplary embodiment.

[0037] Figure 2 The present invention is a flowchart of a network security situation awareness method based on machine learning according to an exemplary embodiment.

[0038] Figure 3 It is a block diagram of an electronic device according to an exemplary embodiment.

[0039] Figure 4 It is an application scenario diagram of a network security situation awareness system based on machine learning according to an exemplary embodiment. DETAILED DESCRIPTION

[0040] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0041] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0042] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0043] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0044] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0045] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0046] The specific implementation of the present application is described in detail below with reference to the accompanying drawings.

[0047] Figure 1FIG. 1 is a block diagram of a network security situation awareness system based on machine learning according to an exemplary embodiment. Figure 1 As shown, the network security situation awareness system 100 includes:

[0048] The network security historical data collection and analysis module 101 is used to collect historical data of the network security situation awareness system and analyze the historical data to obtain historical analysis data;

[0049] A historical analysis data preprocessing module 102, used for preprocessing the historical analysis data to obtain a set of sample data;

[0050] The sample data feature dimension reduction processing module 103 is used to perform feature dimension reduction processing on the set of sample data through feature engineering to obtain a set of sample feature representations;

[0051] The sample feature clustering module 104 is used to perform cluster analysis on the set of sample feature representations to obtain a clustering result, wherein the clustering result includes a set of hidden danger sample feature representations and a set of normal sample feature representations;

[0052] A network security real-time status data acquisition module 105, used to acquire real-time status data from the network security situation awareness system;

[0053] A real-time data analysis and processing module 106 is used to perform analysis and feature engineering on the real-time status data to obtain a real-time status feature representation;

[0054] The real-time state-hidden danger sample feature matching module 107 is used to use the real-time state feature representation as a query feature vector, calculate the one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations to obtain a one-way matching result representation vector as a one-way matching result representation feature;

[0055] The classification result generating module 108 is used to obtain a classification result based on the one-way matching result representation feature, and the classification result is used to indicate whether there is a hidden danger.

[0056] Based on this, the present application proposes a network security situation awareness system based on machine learning, which collects historical data and real-time status data of the network security situation awareness system, and uses network data processing and analysis technology based on machine learning to perform data analysis and feature engineering processing on the historical data and the real-time status data, so as to automatically judge whether there are hidden dangers according to the one-way interactive matching semantics between the set of hidden danger sample feature representations obtained by parsing, feature dimension reduction and clustering of the historical data and the real-time status feature representations of the real-time status data. In this way, the system can learn and characterize the hidden danger sample feature mode and the normal sample feature mode according to the historical data, and respond to network security threats in real time through feature analysis of the real-time status data, rather than relying solely on historical data, that is, the system can capture the real-time status changes in the network security situation, so as to identify new threat patterns or abnormal behaviors, which helps to improve the accuracy of threat detection. At the same time, the interactive matching results between the hidden danger sample features and the real-time status features obtained by historical clustering are used to provide a more comprehensive network security situation view, which can more accurately identify hidden dangers in the network, thereby improving the security of the network.

[0057] Specifically, in the technical solution of the present application, first, historical data of the network security situation awareness system is collected, and the historical data is parsed to obtain historical parsed data. It should be understood that, considering that the historical data includes login information, key file change information, USB access information, CPU usage information, memory usage information, disk usage information, network port status information, device information, etc., these historical data contain past security event records, and these data can provide a baseline for a normal mode. Therefore, in the technical solution of the present application, historical data of the network security situation awareness system is collected. Next, considering that the historical data contains many potential patterns, trends and laws, these potential information are crucial for the judgment of network hidden dangers. Based on this, in order to more accurately understand the evolution process of network security events, in the technical solution of the present application, the historical data is parsed to obtain historical parsed data. In this way, the system can identify security events and potential hidden dangers that occurred in the past, so as to more accurately predict security issues that may occur in the future, and take corresponding measures to prevent them.

[0058] Then, considering that there are some erroneous data and outliers in the historical parsed data, as well as some missing data, and these missing data will affect the accuracy of subsequent feature processing, therefore, in order to make the data more reliable, so as to improve the accuracy and quality of subsequent data processing, in the technical solution of the present application, the historical parsed data is preprocessed to obtain a set of sample data. In particular, in a specific embodiment of the present application, the erroneous records in the historical parsed data are cleaned up and the corresponding missing data are filled in to obtain the set of sample data. In this way, some erroneous records, outliers and noise in the historical parsed data can be cleaned up, the missing data can be filled in, and the data set can be complete, thereby improving the quality of the data.

[0059] In one embodiment of the present application, the historical analysis data preprocessing module is used to: clean up the error records in the historical analysis data and fill in the corresponding missing data to obtain the set of sample data.

[0060] Next, considering that the dimensions of the features in the set of sample data are usually high, and these high-dimensional data feature information will increase the complexity of the calculation, and at the same time, there is some redundant information and noise in the sample data. Therefore, in order to reduce the computing cost and retain the most representative key sample data information, in the technical solution of the present application, the set of sample data is subjected to feature dimensionality reduction processing through feature engineering to obtain a set of sample feature representations. It is worth mentioning that the feature engineering refers to the process of extracting meaningful features for model training and prediction by processing, converting and extracting raw data in machine learning and data analysis. That is, the feature dimensionality reduction processing of the set of sample data through feature engineering can retain the highly correlated sample data features, and can remove these redundancies, thereby improving the performance of the model and the prediction accuracy.

[0061] Then, considering that different sample feature representations in the set of sample feature representations contain different data potential structures and patterns, therefore, in order to divide each sample feature representation in the set of sample feature representations into different groups and features, so as to facilitate the subsequent judgment of network anomalies, in the technical solution of the present application, the set of sample feature representations is clustered to obtain clustering results, and the clustering results include a set of hidden danger sample feature representations and a set of normal sample feature representations. In other words, by clustering the set of sample feature representations, implicit sample feature information can be obtained from the set of sample feature representations, which is useful for the subsequent identification and judgment of real-time status data, that is, to help identify abnormal data points in real-time status data, that is, data points that are not very similar to other data points, so as to discover potential abnormal situations or hidden dangers.

[0062] Next, real-time status data from the network security situation awareness system is obtained.

[0063] Similarly, considering that there are missing values, outliers or noise in the real-time status data, these missing values, outliers and noise will affect the accuracy of subsequent network anomaly judgment. In addition, the real-time status data contains a large amount of original information. Therefore, in order to focus on the key network data information in the real-time status data so as to better understand the rules and patterns in the real-time status data, in the technical solution of the present application, the real-time status data is parsed and feature engineered to obtain a real-time status feature representation with high data quality.

[0064] Furthermore, in order to use the set of hidden danger sample feature representations as a reference to achieve more accurate similarity calculation and correlation matching of real-time state feature representations, in the technical solution of the present application, the real-time state feature representation is used as a query feature vector, and its one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations is calculated to obtain a one-way matching result representation vector. It is worth mentioning that the one-way attention granular scanning interactive matching weights each hidden danger sample feature representation set by respectively calculating the similarity information of the real-time state feature representation and each hidden danger sample feature representation, and calculates the difference between the weighted feature and the real-time state feature representation. In this way, the query feature vector can interact with the set of hidden danger sample feature representations, so that the model can more finely capture the key matching degree between the query feature and the hidden danger sample feature. In detail, first, by evaluating the semantic similarity between the query feature vector and each hidden danger sample feature representation, the semantic measurement coefficient between the two is calculated. This step aims to quantify the semantic proximity between the query feature vector and the hidden danger sample feature representation. Subsequently, these coefficients are normalized and converted into weights to adjust and strengthen the hidden danger sample feature representation that is most closely related to the query feature vector. Through this weighting process, the module synthesizes a comprehensive real-time state-hidden danger sample data one-way matching interactive reshaping feature vector, which emphasizes the semantic features that are most similar to the query feature vector. Finally, the synthesized feature is compared and analyzed with the original query feature vector to identify and quantify the differences between them, so as to accurately evaluate the semantic matching degree between the set of hidden danger sample feature representations and the real-time state feature representation, ensuring the accuracy and reliability of the matching and evaluation process.

[0065] In one embodiment of the present application, the real-time state-hidden danger sample feature matching module includes: a real-time state-hidden danger sample semantic similarity calculation unit, which is used to calculate the semantic similarity between the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement coefficients; a real-time state-hidden danger sample coefficient normalization processing unit, which is used to normalize the set of real-time state-hidden danger sample one-way matching semantic measurement coefficients to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement weight values; a real-time state-hidden danger sample data one-way matching interactive feature reshaping unit, which is used to calculate the weighted sum of the set of hidden danger sample feature representations using the set of real-time state-hidden danger sample one-way matching semantic measurement weight values ​​as weights to obtain a real-time state-hidden danger sample data one-way matching interactive reshaping feature vector; a differential feature calculation unit, which is used to calculate the differential feature vector between the real-time state-hidden danger sample data one-way matching interactive reshaping feature vector and the query feature vector as the one-way matching result representation vector.

[0066] Furthermore, in one embodiment of the present application, the real-time state-hidden danger sample semantic similarity calculation unit includes: a cascade processing subunit, which is used to perform cascade processing on the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations to obtain a set of query-hidden danger sample semantic coding joint feature vectors; a vector calculation subunit, which is used to calculate the matrix product of each query-hidden danger sample semantic coding joint feature vector in the set of query-hidden danger sample semantic coding joint feature vectors and a weight matrix, and then add the obtained feature vector and the bias vector by position to obtain a set of query-hidden danger sample semantic coding joint bias feature vectors; a vector activation subunit, which is used to input the set of query-hidden danger sample semantic coding joint bias feature vectors into a sigmoid activation function to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement coefficients.

[0067] Furthermore, in one embodiment of the present application, the real-time state-hidden danger sample coefficient normalization processing unit is used to: use each real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of the real-time state-hidden danger sample one-way matching semantic measurement coefficient as the exponent of the natural constant to calculate the exponential function value with base e to obtain a set of logarithmic values ​​of the real-time state-hidden danger sample one-way matching semantic measurement coefficient; calculate the sum of the logarithmic values ​​of each real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of the real-time state-hidden danger sample one-way matching semantic measurement coefficient to obtain the total sum of the real-time state-hidden danger sample one-way matching semantic measurement; divide each logarithmic value of the real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of the real-time state-hidden danger sample one-way matching semantic measurement coefficient by the total sum of the real-time state-hidden danger sample one-way matching semantic measurement to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement weight values.

[0068] Specifically, the real-time state feature representation is used as the query feature vector, and the one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations is calculated using the following interactive matching formula to obtain a one-way matching result representation vector; wherein the interactive matching formula is:

[0069]

[0070] in, and are the query feature vector and the hidden danger sample feature representation set. The characteristic of hidden danger samples is expressed as follows: It is cascade processing. is the weight matrix, is the bias vector, is the sigmoid function, is the first in the set of semantic metric coefficients of the one-way matching of the real-time status-hidden danger sample Real-time status-hidden danger sample one-way matching semantic measurement coefficient, Indicated by natural constant The exponential function with base , is the number of hidden danger sample feature representations in the set of hidden danger sample feature representations, is the first in the set of semantic metric weight values ​​of the one-way matching of the real-time status-hidden danger sample Real-time status-hidden danger sample one-way matching semantic measurement weight value, is the real-time status-hidden danger sample data one-way matching interactive reshaping feature vector, It means subtracting by position. is the one-way matching result representation vector.

[0071] Then, the one-way matching result representation vector is input into a classifier based on the SVM model to obtain a classification result, and the classification result is used to indicate whether there are hidden dangers. That is, the one-way matching result representation feature obtained by performing a single interactive matching using the set of the real-time state feature representation and the hidden danger sample feature representation is classified to automatically determine whether there are hidden dangers. In this way, the system can respond to network security threats in real time, rather than relying solely on historical data. That is, the system can capture real-time state changes in the network security situation to identify emerging threat patterns or abnormal behaviors, which helps to improve the accuracy of threat detection. At the same time, the interactive matching between the hidden danger samples obtained by historical clustering and the real-time data can provide a more comprehensive view of the network security situation, which can more accurately identify hidden dangers in the network, thereby improving the security of the network.

[0072] In one embodiment of the present application, the classification result generation module is used to: input the one-way matching result representation vector into a classifier based on an SVM model to obtain the classification result, and the classification result is used to indicate whether there is a hidden danger.

[0073] Here, considering that the real-time state feature representation vector and the set of hidden danger sample feature representations respectively represent the state parsing features of the real-time state data and the clustering representation of the sample data set based on the historical parsing data, therefore, when the real-time state feature representation is used as the query feature vector and its one-way attention granular scanning interaction matching result relative to the set of hidden danger sample feature representations is calculated, the real-time state feature representation vector and the set of hidden danger sample feature representations will have feature representation differences under sample domain coverage differences and feature engineering dimension differences. Therefore, the one-way matching result representation vector has a diversified set expression distribution attributed to the complex feature representation. Therefore, it is expected to improve the overall expression logical dependency of the set of one-way matching result representation vectors based on the diversified set distribution, thereby improving the accuracy of the classification results obtained by the classifier.

[0074] Based on this, the present application optimizes the set of one-way matching result representation vectors. That is, in a preferred example, the one-way matching result representation vector is input into a classifier based on an SVM model to obtain the classification result, including the following steps:

[0075] Cascading each one-way matching result representation vector in the set of one-way matching result representation vectors to obtain a one-way matching result cascade representation vector;

[0076] Determine a first weight matrix and a second weight matrix, wherein the first weight matrix and the second weight matrix are The eigenvalues ​​are the first The eigenvalue and The square root of the correlation value and the L2 distance value of the eigenvalue:

[0077]

[0078] in, and Respectively represent the first The eigenvalue and The square root of the correlation value and the L2 distance value of the eigenvalue, represents the first weight matrix Eigenvalues, represents the second weight matrix Eigenvalue;

[0079] Performing matrix multiplication on the one-way matching result cascade representation vector and the first weight matrix to obtain a first intermediate vector, performing matrix multiplication on the one-way matching result cascade representation vector and the second weight matrix to obtain a second intermediate vector, and performing dot multiplication on the first weight matrix and the second weight matrix and then performing matrix multiplication on the one-way matching result cascade representation vector to obtain a third intermediate vector;

[0080] The first intermediate vector, the second intermediate vector and the third intermediate vector are denoted by a dot, so as to obtain an optimized one-way matching result cascade representation vector.

[0081] For example, the one-way matching result cascade representation vector is a row vector, then the optimized one-way matching result cascade representation vector It is expressed as:

[0082]

[0083] in, represents the one-way matching result representation vector, represents the first weight matrix, represents the second weight matrix, Indicates point addition, represents matrix multiplication, , and represent the first intermediate vector, the second intermediate vector and the third intermediate vector respectively, Representing an optimized one-way matching result representation vector; finally, inputting the optimized one-way matching result representation vector into a classifier based on the SVM model to obtain the classification result.

[0084] That is, by taking the one-way matching result cascade representation vector as its statistical reference-free distribution response framework based on the self-association matrix and the self-distance matrix, and constructing it based on the retrieval-enhanced reverse response of the one-way matching result cascade representation vector to avoid simple repetition of feature distribution, and by ensuring the intrinsic mapping logic of the one-way matching result cascade representation vector based on the retrieval-response context to avoid its surface combinatorial mapping, the semantic logical dependency mapping of the one-way matching result cascade representation vector is achieved while maintaining the intuitive response correlation, thereby improving the accuracy of the classification results obtained by the classifier.

[0085] Furthermore, in one embodiment of the present application, the network security situation awareness system based on machine learning also includes a training module for training the classifier based on the SVM model. The training module includes: a training network security history data collection and analysis unit, which is used to collect training history data of the network security situation awareness system, and parse the training history data to obtain training history analysis data, as well as whether there is a true value of hidden dangers; a training history analysis data preprocessing unit, which is used to preprocess the training history analysis data to obtain a set of training sample data; a training sample data feature dimension reduction processing unit, which is used to perform feature dimension reduction processing on the set of training sample data through feature engineering to obtain a set of training sample feature representations; a training sample feature clustering unit, which is used to perform cluster analysis on the set of training sample feature representations to obtain training clustering results, and the training clustering results include a set of training hidden danger sample feature representations and a set of training normal sample feature representations; a training network security real-time status data acquisition unit, which is used to obtain the training real-time status data of the network security situation awareness system; a training real-time data analysis processing unit, Used to perform parsing and feature engineering processing on the training real-time state data to obtain the training real-time state feature representation; a training real-time state-hidden danger sample feature matching unit, used to use the training real-time state feature representation as a query feature vector, calculate its one-way attention granular scanning interaction matching result relative to the set of training hidden danger sample feature representations to obtain a training one-way matching result representation vector as a training one-way matching result representation feature; a training classification result generation unit, used to input the training one-way matching result representation vector into the SVM model-based classifier to obtain a classification result; a training classification loss function value calculation unit, used to calculate the loss function value between the classification result and the true value to obtain a classification loss function value and a one-way matching result loss function value; a training unit, used to train the SVM model-based classifier through gradient back propagation based on the weighted sum of the classification loss function value and the one-way matching result loss function value as the loss function value.

[0086] Therefore, in a preferred embodiment of the present application, in training the classifier based on the SVM model based on the classification loss function value and through back propagation of gradient descent, a one-way matching result loss function value other than the classification loss function value is further introduced, that is, training the model through gradient back propagation based on the weighted sum of the classification loss function value and the one-way matching result loss function value as the loss function value includes the following steps:

[0087] Calculate a first one-way matching result weight matrix and a second one-way matching result weight matrix based on the training one-way matching result representation vector, wherein the first one-way matching result weight matrix The feature value of the position is the first Eigenvalues ​​and The mean of the eigenvalues, and the weight matrix of the second one-way matching result The feature value of the position is the first Eigenvalues ​​and One-half the absolute value of the difference in eigenvalues;

[0088] Performing query matrix multiplication of the training one-way matching result representation vector and the first and second one-way matching result weight matrices respectively to obtain a first one-way matching result query vector and a second one-way matching result query vector;

[0089] Calculating the vector inner product of the first and second one-way matching result intermediate vectors to obtain a first one-way matching result loss term;

[0090] The first and second one-way matching result weight matrices are matrix multiplied, and the product matrix is ​​calculated. norm to obtain a second one-way matching result loss term; and

[0091] The first one-way matching result loss term is subtracted from the product of a predetermined weight hyperparameter and the second one-way matching result loss term to obtain the one-way matching result loss function value.

[0092] The one-way matching result loss function value is specifically expressed as:

[0093]

[0094] in, is the training one-way matching result representation vector, and They are respectively the first and The eigenvalues ​​at the positions, and are the first one-way matching result weight matrix and the second one-way matching result weight matrix. The eigenvalues ​​of the positions, and are respectively the first one-way matching result weight matrix and the second one-way matching result weight matrix, is the predetermined weight hyperparameter, is the norm of the matrix being calculated, is matrix multiplication, is the one-way matching result loss function value, Represents the transposed vector or matrix of a vector or matrix.

[0095] That is, the present application uses the structured feature representation of the short-range-long-range cross-scale detail link of the training one-way matching result representation vector to perform the query composition of the detail inner product space within the training one-way matching result representation vector, so as to approximate the low-rank independent observable composition of the link detail composition provided by the structured detail interaction of the training one-way matching result representation vector. In this way, by training with the one-way matching result loss function, the distributed detail group of the training one-way matching result representation vector can be used to decompose the detail group on the basis of detail complexity, so as to promote the classification regression decomposition recognition of the training one-way matching result representation vector based on complex feature representation, and improve the accuracy of the classification result. In this way, the system can respond to network security threats in real time, rather than relying solely on historical data, that is, the system can capture real-time state changes in the network security situation, so as to identify emerging threat patterns or abnormal behaviors, which helps to improve the accuracy of threat detection. At the same time, the interactive matching between the hidden danger samples obtained by historical clustering and the real-time data can provide a more comprehensive view of the network security situation, which can more accurately identify hidden dangers in the network, thereby improving the security of the network.

[0096] In summary, the above scheme is adopted to collect historical data and real-time status data of the network security situation awareness system, and adopt network data processing and analysis technology based on machine learning to perform data analysis and feature engineering processing on the historical data and the real-time status data, so as to automatically judge whether there are hidden dangers according to the one-way interactive matching semantics between the set of hidden danger sample feature representations obtained by parsing, feature dimension reduction and clustering of the historical data and the real-time status feature representations of the real-time status data. In this way, the system can learn and characterize the hidden danger sample feature pattern and the normal sample feature pattern based on historical data, and respond to network security threats instantly through feature analysis of real-time status data, instead of relying solely on historical data.

[0097] Figure 2is a flow chart of a network security situation awareness method based on machine learning according to an exemplary embodiment. Figure 2 As shown, the method includes:

[0098] Step S201: collecting historical data of the network security situation awareness system, and parsing the historical data to obtain historical parsed data;

[0099] Step S202: preprocess the historical parsed data to obtain a set of sample data;

[0100] Step S203, performing feature dimensionality reduction processing on the set of sample data through feature engineering to obtain a set of sample feature representations;

[0101] Step S204: performing cluster analysis on the set of sample feature representations to obtain a clustering result, wherein the clustering result includes a set of hidden danger sample feature representations and a set of normal sample feature representations;

[0102] Step S205: Acquire real-time status data from the network security situation awareness system;

[0103] Step S206: performing parsing and feature engineering processing on the real-time status data to obtain a real-time status feature representation;

[0104] Step S207: using the real-time state feature representation as a query feature vector, calculating the one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations to obtain a one-way matching result representation vector as a one-way matching result representation feature;

[0105] Step S208: obtaining a classification result based on the one-way matching result representation feature, wherein the classification result is used to indicate whether there is a hidden danger.

[0106] In one embodiment of the present application, preprocessing the historical parsed data to obtain a set of sample data includes: cleaning up erroneous records in the historical parsed data and filling in corresponding missing data to obtain the set of sample data.

[0107] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present application. The terminal device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0108] like Figure 3 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0109] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0110] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0111] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0112] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0113] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0114] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0115] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0116] The modules involved in the embodiments described in this application can be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the test parameter acquisition module can also be described as a "module for acquiring device test parameters corresponding to the target device".

[0117] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0118] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0119] Figure 4 FIG. 1 is an application scenario diagram of a network security situation awareness system based on machine learning according to an exemplary embodiment. Figure 4 As shown, in this application scenario, first, historical data of the network security situation awareness system is collected (for example, Figure 4 C1 as shown in the figure); obtain the real-time status data from the network security situation awareness system (for example, Figure 4 Then, the acquired historical data and real-time status data are input into a server that is deployed with a network security situation awareness algorithm based on machine learning (for example, Figure 4 In the S) shown in , the server can process the historical data and the real-time status data based on a network security situation awareness algorithm based on machine learning to obtain a classification result, and the classification result is used to indicate whether there is a hidden danger.

[0120] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

[0121] In addition, although each operation is described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or to be performed in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the application. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0122] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely exemplary forms of implementation. With respect to the apparatus in the above-mentioned embodiments, the specific manner in which each module performs the operation has been described in detail in the embodiments related to the method, and will not be described in detail here.

Claims

1. A network security situation awareness system based on machine learning, characterized in that: include: A network security historical data collection and analysis module is used to collect historical data of the network security situation awareness system and analyze the historical data to obtain historical analysis data; A historical analysis data preprocessing module, used for preprocessing the historical analysis data to obtain a set of sample data; A sample data feature dimensionality reduction processing module is used to perform feature dimensionality reduction processing on the set of sample data through feature engineering to obtain a set of sample feature representations; A sample feature clustering module, used for performing cluster analysis on the set of sample feature representations to obtain a clustering result, wherein the clustering result includes a set of hidden danger sample feature representations and a set of normal sample feature representations; A network security real-time status data acquisition module, used to acquire real-time status data from the network security situation awareness system; A real-time data analysis and processing module, used for performing analysis and feature engineering on the real-time status data to obtain a real-time status feature representation; A real-time state-hidden danger sample feature matching module, used to use the real-time state feature representation as a query feature vector, calculate its one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations to obtain a one-way matching result representation vector as a one-way matching result representation feature; A classification result generating module, used to obtain a classification result based on the one-way matching result representation feature, wherein the classification result is used to indicate whether there is a hidden danger; The historical analysis data preprocessing module is used to: clean up the error records in the historical analysis data and fill in the corresponding missing data to obtain the set of sample data; Wherein, the real-time status-hidden danger sample feature matching module includes: A real-time state-hidden danger sample semantic similarity calculation unit, used to calculate the semantic similarity between the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement coefficients; A real-time state-hidden danger sample coefficient normalization processing unit, used for normalizing the set of real-time state-hidden danger sample one-way matching semantic measurement coefficients to obtain a set of real-time state-hidden danger sample one-way matching semantic measurement weight values; A real-time state-hidden danger sample data one-way matching interactive feature reshaping unit, used to calculate the weighted sum of the set of hidden danger sample feature representations using the set of real-time state-hidden danger sample one-way matching semantic metric weight values ​​as weights to obtain a real-time state-hidden danger sample data one-way matching interactive reshaping feature vector; A differential feature calculation unit, used for calculating a differential feature vector between the real-time status-hidden danger sample data one-way matching interactive reshaping feature vector and the query feature vector as the one-way matching result representation vector; Wherein, the real-time status-hidden danger sample semantic similarity calculation unit includes: A cascade processing subunit, configured to perform cascade processing on the query feature vector and each hidden danger sample feature representation in the set of hidden danger sample feature representations to obtain a set of query-hidden danger sample semantic coding joint feature vectors; A vector calculation subunit, for respectively calculating the matrix product of each query-hidden danger sample semantic coding joint feature vector in the set of query-hidden danger sample semantic coding joint feature vectors and a weight matrix, and then adding the obtained feature vectors and the bias vector by position to obtain a set of query-hidden danger sample semantic coding joint bias feature vectors; A vector activation subunit, used for inputting the set of query-hidden danger sample semantic coding joint bias feature vectors into a sigmoid activation function to obtain the set of real-time state-hidden danger sample one-way matching semantic metric coefficients; Wherein, the real-time status-hidden danger sample coefficient normalization processing unit is used to: Using each real-time state-hidden danger sample one-way matching semantic measurement coefficient in the set of real-time state-hidden danger sample one-way matching semantic measurement coefficients as an exponent of a natural constant to calculate an exponential function value with e as the base to obtain a set of logarithmic values ​​of real-time state-hidden danger sample one-way matching semantic measurement coefficients; Calculate the sum of the logarithmic values ​​of the one-way matching semantic metric coefficients of the real-time state-hidden danger samples in the set of the logarithmic values ​​of the one-way matching semantic metric coefficients of the real-time state-hidden danger samples to obtain the total sum of the one-way matching semantic metric values ​​of the real-time state-hidden danger samples; Divide each logarithm of the one-way matching semantic metric coefficient of the real-time state-hidden danger sample in the set of logarithm of the one-way matching semantic metric coefficient of the real-time state-hidden danger sample by the total sum of the one-way matching semantic metric of the real-time state-hidden danger sample to obtain a set of weight values ​​of the one-way matching semantic metric of the real-time state-hidden danger sample; The real-time state feature representation is used as the query feature vector, and the one-way attention granular scanning interactive matching result relative to the set of hidden danger sample feature representations is calculated using the following interactive matching formula to obtain a one-way matching result representation vector; wherein the interactive matching formula is: in, and are the query feature vector and the hidden danger sample feature representation set. The characteristic of hidden danger samples is expressed as follows: It is cascade processing. is the weight matrix, is the bias vector, is the sigmoid function, is the first in the set of semantic metric coefficients of the one-way matching of the real-time status-hidden danger sample Real-time status-hidden danger sample one-way matching semantic measurement coefficient, Indicated by natural constant The exponential function with base , is the number of hidden danger sample feature representations in the set of hidden danger sample feature representations, is the first in the set of semantic metric weight values ​​of the one-way matching of the real-time status-hidden danger sample Real-time status-hidden danger sample one-way matching semantic measurement weight value, is the real-time status-hidden danger sample data one-way matching interactive reshaping feature vector, It means subtracting by position. is the one-way matching result representation vector; The classification result generating module is used to: input the one-way matching result representation vector into a classifier based on the SVM model to obtain the classification result, and the classification result is used to indicate whether there is a hidden danger; Wherein, it also includes a training module for training the classifier based on the SVM model; Wherein, the training module includes: A training network security history data collection and analysis unit is used to collect training history data of the network security situation awareness system, and analyze the training history data to obtain training history analysis data, as well as a true value of whether there is a hidden danger; A training history parsing data preprocessing unit, used for preprocessing the training history parsing data to obtain a set of training sample data; A training sample data feature dimensionality reduction processing unit, used to perform feature dimensionality reduction processing on the set of training sample data through feature engineering to obtain a set of training sample feature representations; A training sample feature clustering unit, used for performing cluster analysis on the set of training sample feature representations to obtain a training clustering result, wherein the training clustering result includes a set of training hidden danger sample feature representations and a set of training normal sample feature representations; A training network security real-time status data acquisition unit, used to acquire training real-time status data from the network security situation awareness system; A training real-time data analysis and processing unit, used for performing analysis and feature engineering on the training real-time state data to obtain a training real-time state feature representation; A training real-time state-hidden danger sample feature matching unit is used to use the training real-time state feature representation as a query feature vector, calculate its one-way attention granular scanning interactive matching result relative to the set of training hidden danger sample feature representations to obtain a training one-way matching result representation vector as a training one-way matching result representation feature; A training classification result generating unit, used for inputting the training one-way matching result representation vector into the SVM model-based classifier to obtain a classification result; A training classification loss function value calculation unit is used to calculate the loss function value between the classification result and the true value to obtain a classification loss function value and a one-way matching result loss function value; A training unit is used to train the SVM model-based classifier through gradient back propagation based on the weighted sum of the classification loss function value and the one-way matching result loss function value as the loss function value.

Images