Malicious code attack identification method, device and storage medium based on traffic anomaly identification model

Abstract

The embodiments of the present application relate to the field of malicious code attack identification, and specifically to a malicious code attack identification method and device based on a traffic anomaly identification model. A specific implementation of the method includes: determining each initial code scheduling information that meets a first preset missing condition in an initial code scheduling information sequence as a first code scheduling missing information group; performing a first data preprocessing on the initial code scheduling information sequence; determining the initial code scheduling update information that meets a second preset missing condition in an initial code scheduling update information sequence as a second code scheduling missing information; performing a second data preprocessing on the initial code scheduling update information sequence; performing data smoothing processing on the code scheduling preprocessing information sequence; inputting the code scheduling information sequence into a pre-trained traffic anomaly identification model; and sending the anomaly identification result to the alarm terminal for alarm processing. This implementation can improve network security.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of malicious code attack identification, and specifically to a malicious code attack identification method and device based on a traffic anomaly identification model. Background Art

[0002] Identifying whether a program code is malicious code and issuing an alert for the identified malicious code can improve the security of the program code. At present, when performing malicious code attack identification, the commonly used method is to use historical code scheduling information as current code scheduling information, and to identify whether the program code corresponding to the historical code scheduling information is malicious code through a pre-set rule base.

[0003] However, in practice, it is found that when the above method is used to identify malicious code attacks, the following technical problems often occur:

[0004] First, historical code scheduling information is used as current code scheduling information. When the code scheduling information is updated quickly, the accuracy of malicious code identification is low, which reduces network security.

[0005] Second, when malicious code is updated but the preset rule base is not updated, some malicious code is not included in the preset rule base, resulting in low accuracy in malicious code identification and reduced network security. Summary of the invention

[0006] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0007] Some embodiments of the present application propose a malicious code attack identification method and device based on a traffic anomaly identification model to solve one or more of the technical problems mentioned in the above background technology section.

[0008] In a first aspect, some embodiments of the present application provide a method for identifying malicious code attacks based on a traffic anomaly identification model, the method comprising: obtaining an initial code scheduling information sequence; determining each initial code scheduling information in the above initial code scheduling information sequence that meets a first preset missing condition as a first code scheduling missing information group, and obtaining a first code scheduling missing information group set; based on the above first code scheduling missing information group set, performing a first data preprocessing on the above initial code scheduling information sequence to generate an initial code scheduling update information sequence; determining the initial code scheduling update information in the above initial code scheduling update information sequence that meets a second preset missing condition as a second code scheduling missing information, and obtaining a second code scheduling missing information set; based on the above second code scheduling missing information set, performing a second data preprocessing on the above initial code scheduling update information sequence to generate a code scheduling preprocessing information sequence; performing data smoothing processing on the above code scheduling preprocessing information sequence to generate a code scheduling information sequence; inputting the above code scheduling information sequence into a pre-trained traffic anomaly identification model to obtain an anomaly identification result; in response to determining that the above anomaly identification result meets the preset anomaly condition, sending the above anomaly identification result to an alarm terminal for alarm processing.

[0009] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the method described in any implementation of the first aspect.

[0010] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0011] The above-mentioned embodiments of the present application have the following beneficial effects: through the malicious code attack identification method based on the traffic anomaly identification model of some embodiments of the present application, network security can be improved. Specifically, the reason for reducing network security is that the historical code scheduling information is used as the current code scheduling information. When the code scheduling information is updated quickly, the malicious code identification accuracy is low. Based on this, the malicious code attack identification method based on the traffic anomaly identification model of some embodiments of the present application first obtains the initial code scheduling information sequence. Thus, the historical initial code scheduling information sequence can be obtained. Secondly, each initial code scheduling information that meets the first preset missing condition in the above initial code scheduling information sequence is determined as the first code scheduling missing information group to obtain the first code scheduling missing information group set. Then, based on the above first code scheduling missing information group set, the above initial code scheduling information sequence is subjected to the first data preprocessing to generate the initial code scheduling update information sequence. Thus, the initial code scheduling information that is continuously missing in the initial code scheduling information sequence can be subjected to data supplementation processing to obtain a more accurate initial code scheduling update information sequence. Then, the initial code scheduling update information that meets the second preset missing condition in the above-mentioned initial code scheduling update information sequence is determined as the second code scheduling missing information, and the second code scheduling missing information set is obtained. Then, based on the above-mentioned second code scheduling missing information set, the above-mentioned initial code scheduling update information sequence is subjected to a second data preprocessing to generate a code scheduling preprocessing information sequence. Thus, the initial code scheduling update information that represents the missing in the initial code scheduling update information sequence can be subjected to data supplementation processing to obtain a more accurate code scheduling preprocessing information sequence. Afterwards, the above-mentioned code scheduling preprocessing information sequence is subjected to data smoothing processing to generate a code scheduling information sequence. Thus, the code scheduling preprocessing information sequence can be subjected to data smoothing processing to eliminate information such as noise, abnormal values ​​(abrupt spikes) in the code scheduling preprocessing information sequence to obtain a relatively smooth and continuous code scheduling information sequence. Thereafter, the above-mentioned code scheduling information sequence is input into a pre-trained traffic anomaly recognition model to obtain an abnormal recognition result. Thus, a relatively accurate abnormal recognition result can be predicted from a relatively accurate code scheduling information sequence through a traffic anomaly recognition model. Finally, in response to determining that the above abnormal identification result meets the preset abnormal condition, the above abnormal identification result is sent to the alarm terminal for alarm processing. Thus, when the abnormal identification result indicates that the program code is malicious code, the malicious code can be alarmed. Thus, network security can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0013] Figure 1 It is a flowchart of some embodiments of a malicious code attack identification method based on a traffic anomaly identification model according to the present application;

[0014] Figure 2 It is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0015] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0016] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0017] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0018] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0019] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0020] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0021] Figure 1 The flow chart 100 of some embodiments of the malicious code attack identification method based on the traffic anomaly identification model according to the present application is shown. The malicious code attack identification method based on the traffic anomaly identification model includes the following steps:

[0022] Step 101, obtaining an initial code scheduling information sequence.

[0023] In some embodiments, the execution subject of malicious code attack identification based on the traffic anomaly identification model can obtain the initial code scheduling information of the time granularity within the preset time period from the storage terminal through a wired connection or a wireless connection to obtain an initial code scheduling information sequence. Among them, the initial code scheduling information in the initial code scheduling information sequence can represent the QPS (Queries-per-second) of the program code. For example, the preset time period can be: the time period from one hour before the current time to the current time. The time granularity can be: one second.

[0024] It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0025] Step 102: determine each initial code scheduling information satisfying a first preset missing condition in the initial code scheduling information sequence as a first code scheduling missing information group to obtain a first code scheduling missing information group set.

[0026] In some embodiments, the execution subject may determine each initial code scheduling information satisfying the first preset missing condition in the initial code scheduling information sequence as a first code scheduling missing information group, and obtain a first code scheduling missing information group set. The first preset missing condition may be: each initial code scheduling information of a continuous preset missing number in the initial code scheduling information sequence is missing. For example, the preset missing number may be 2.

[0027] Step 103: Based on the first code scheduling missing information group set, perform first data preprocessing on the initial code scheduling information sequence to generate an initial code scheduling update information sequence.

[0028] In some embodiments, the execution subject may perform first data preprocessing on the initial code scheduling information sequence based on the first code scheduling missing information set to generate an initial code scheduling update information sequence.

[0029] In practice, based on the first code scheduling missing information set, the execution subject may perform first data preprocessing on the initial code scheduling information sequence through the following steps to generate an initial code scheduling update information sequence:

[0030] In the first step, for each first code scheduling missing information group in the first code scheduling missing information group set, the following first preprocessing sub-step is performed:

[0031] In the first sub-step, each initial code scheduling information satisfying the first preset position condition in the above-mentioned initial code scheduling information sequence is determined as the first code position information group. The first preset position condition may be: each initial code scheduling information located at the first preset position number before the first code scheduling missing information group and between the first code scheduling missing information group in the initial code scheduling information sequence. For example, the first preset position number may be: 4.

[0032] The second sub-step is to determine each initial code scheduling information satisfying the second preset position condition in the above initial code scheduling information sequence as a second code position information group. The second preset position condition may be: each initial code scheduling information located between the first code scheduling missing information group and the first preset position number after the first code scheduling missing information group in the initial code scheduling information sequence.

[0033] The third sub-step is to determine the first code scheduling update information group corresponding to the first code scheduling missing information group based on the first code position information group and the second code position information group. The first code scheduling update information in the first code scheduling update information group may correspond to the initial code scheduling information in the initial code scheduling information sequence. In practice, based on the first code position information group and the second code position information group, the execution subject may determine the first code scheduling update information group corresponding to the first code scheduling missing information group by the following formula:

[0034]

[0035] Wherein, l represents the sequence number. m represents the preset missing number. n represents the first preset position number. l Indicates the lth initial code scheduling information in the initial code scheduling information sequence. X′ l Indicates the lth first code scheduling update information in the first code scheduling update information group. [X′ l ,…,X′ l+m-1 ] indicates the first code scheduling update information group. [X l-n , …, X l-1 ] indicates the first code position information group. [X l+m , …, X l+m+n-1 ] represents the second code position information group. H() represents a hash function.

[0036] The second step is to update the above-mentioned initial code scheduling information sequence based on the determined first code scheduling update information groups to generate an initial code scheduling update information sequence. In practice, first, for each initial code scheduling information in the initial code scheduling information sequence, the above-mentioned execution subject can perform the following sub-steps: The first sub-step is, in response to determining that the first code scheduling update information corresponding to the above-mentioned initial code scheduling information exists in the above-mentioned first code scheduling update information groups, determining the first code scheduling update information corresponding to the above-mentioned initial code scheduling information in the above-mentioned first code scheduling update information groups as the initial code scheduling update information. The second sub-step is, in response to determining that the first code scheduling update information corresponding to the above-mentioned initial code scheduling information does not exist in the above-mentioned first code scheduling update information groups, determining the above-mentioned initial code scheduling information as the initial code scheduling update information. Then, the above-mentioned execution subject can determine the determined initial code scheduling update information as the initial code scheduling update information sequence.

[0037] Step 104: determine the initial code scheduling update information that meets the second preset missing condition in the initial code scheduling update information sequence as second code scheduling missing information, and obtain a second code scheduling missing information set.

[0038] In some embodiments, the execution subject may determine the initial code scheduling update information in the initial code scheduling update information sequence that satisfies the second preset missing condition as the second code scheduling missing information to obtain a second code scheduling missing information set. The second preset missing condition may be: the initial code scheduling update information in the initial code scheduling update information sequence is missing.

[0039] Step 105: Based on the second code scheduling missing information set, perform second data preprocessing on the initial code scheduling update information sequence to generate a code scheduling preprocessing information sequence.

[0040] In some embodiments, the execution entity may perform second data preprocessing on the initial code scheduling update information sequence based on the second code scheduling missing information set to generate a code scheduling preprocessing information sequence.

[0041] In practice, based on the second code scheduling missing information set, the execution subject may perform second data preprocessing on the initial code scheduling update information sequence through the following steps to generate a code scheduling preprocessing information sequence:

[0042] In the first step, for each second code scheduling missing information in the second code scheduling missing information set, the following second preprocessing sub-step is performed:

[0043] In a first sub-step, each initial code scheduling update information satisfying the third preset position condition in the above-mentioned initial code scheduling update information sequence is determined as a third code position information group. The third preset position condition may be: each initial code scheduling information located at the second preset position number before the second code scheduling missing information and between the second code scheduling missing information in the initial code scheduling update information sequence. For example, the second preset position number may be 4.

[0044] The second sub-step is to determine each initial code scheduling update information satisfying the fourth preset position condition in the above-mentioned initial code scheduling update information sequence as a fourth code position information group. The fourth preset position condition may be: each initial code scheduling information located between the second code scheduling missing information and the second preset position number after the second code scheduling missing information in the initial code scheduling update information sequence.

[0045] The third sub-step is to determine the second code scheduling update information corresponding to the second code scheduling missing information based on the third code position information group and the fourth code position information group. In practice, the execution subject may perform mean processing on each third code position information in the third code position information group and each fourth code position information in the fourth code position information group by a preset mean algorithm to generate the second code scheduling update information. The second code scheduling update information may correspond to the second code scheduling missing information. For example, the preset mean algorithm may be, but is not limited to, a geometric mean algorithm, a square mean algorithm, and a weighted mean algorithm.

[0046] In the second step, based on the determined respective second code scheduling update information, the above-mentioned initial code scheduling update information sequence is updated to generate a code scheduling preprocessing information sequence. In practice, the above-mentioned execution subject may update the initial code scheduling update information in the above-mentioned initial code scheduling update information sequence that meets the second preset missing condition to the target second code scheduling update information, so as to update the above-mentioned initial code scheduling update information sequence and obtain the code scheduling preprocessing information sequence. Here, the target second code scheduling update information may be the second code scheduling update information corresponding to the above-mentioned respective second code scheduling update information and the initial code scheduling update information.

[0047] Step 106: Perform data smoothing processing on the code scheduling preprocessing information sequence to generate a code scheduling information sequence.

[0048] In some embodiments, the execution entity may perform data smoothing processing on the code scheduling preprocessing information sequence to generate a code scheduling information sequence.

[0049] In practice, the execution subject may perform data smoothing processing on the code scheduling preprocessing information sequence through the following steps to generate a code scheduling information sequence:

[0050] The first step is to split the above-mentioned code scheduling preprocessing information sequence to generate a first code scheduling preprocessing information sequence and a second code scheduling preprocessing information sequence. In practice, first. The above-mentioned execution subject can determine the first preset number of each code scheduling preprocessing information in the above-mentioned code scheduling preprocessing information sequence as the first code scheduling preprocessing information sequence. Then, the above-mentioned execution subject can determine the individual code scheduling preprocessing information in the above-mentioned code scheduling preprocessing information sequence after removing the above-mentioned first code scheduling preprocessing information sequence as the second code scheduling preprocessing information. For example, the preset number can be: one third of the number of each code scheduling preprocessing information in the code scheduling preprocessing information sequence.

[0051] The second step is to determine a code scheduling information prediction model based on the first code scheduling preprocessing information sequence.

[0052] In the third step, for each code scheduling preprocessing information in the above code scheduling preprocessing information sequence, the following smoothing steps are performed:

[0053] The first smoothing step, in response to determining that the code scheduling preprocessing information is in the first code scheduling preprocessing information sequence, determines the code scheduling preprocessing information as the code scheduling information.

[0054] The second smoothing step, in response to determining that the code scheduling preprocessing information is in the second code scheduling preprocessing information sequence, performs the following determination steps:

[0055] In the first determination step, each code scheduling preprocessing information satisfying the preset selection condition in the above-mentioned code scheduling preprocessing information sequence is input into the code scheduling information prediction model to obtain the code scheduling prediction information. The preset selection condition may be: a preset continuous number of each code scheduling preprocessing information in the code scheduling preprocessing information sequence before the above-mentioned code scheduling preprocessing information. For example, the preset continuous number may be: 5.

[0056] The second determination step is to determine the code scheduling information corresponding to the code scheduling prediction information and the code scheduling preprocessing information. In practice, the execution subject may perform mean processing on the code scheduling prediction information and the code scheduling preprocessing information by the preset mean algorithm to generate the code scheduling information.

[0057] The fourth step is to determine the generated code scheduling information as a code scheduling information sequence.

[0058] In practice, based on the first code scheduling preprocessing information sequence, the execution subject may determine the code scheduling information prediction model through the following steps:

[0059] In the first step, the first code scheduling preprocessing information sequence is split to generate a sample code scheduling preprocessing information set. The sample code scheduling preprocessing information in the sample code scheduling preprocessing information set may include but is not limited to: a sample code scheduling input information sequence and a sample code scheduling prediction information. In practice, first, the execution subject may classify the first code scheduling preprocessing information sequence through a preset classification algorithm to generate a sample code scheduling input information sequence set. The preset classification algorithm may be to determine each of the first code scheduling preprocessing information of a preset classification number in the first code scheduling preprocessing information sequence as a sample code scheduling input information sequence. For example, the preset classification number may be: 5. Secondly, for each sample code scheduling input information sequence in the sample code scheduling input information sequence set, the execution subject may determine the first code scheduling preprocessing information after the sample code scheduling input information sequence in the first code scheduling preprocessing information sequence as the sample code scheduling prediction information, and may determine the sample code scheduling input information sequence and the sample code scheduling prediction information as the sample code scheduling preprocessing information. Then, the execution subject may determine each of the determined sample code scheduling preprocessing information as a sample code scheduling preprocessing information set.

[0060] The second step is to determine the initial code scheduling information prediction model. The initial code scheduling information prediction model can be a multivariate linear equation. For example, the initial code scheduling information prediction model can be a five-variable linear equation.

[0061] The third step is to select target sample code scheduling preprocessing information from the sample code scheduling preprocessing information set. In practice, the execution subject may randomly select sample code scheduling preprocessing information from the sample code scheduling preprocessing information set as the target sample code scheduling preprocessing information.

[0062] The fourth step is to input the sample code scheduling input information sequence included in the selected target sample code scheduling preprocessing information into the initial code scheduling information prediction model to obtain the initial code scheduling prediction information.

[0063] The fifth step is to determine the prediction difference value between the initial code scheduling prediction information and the sample code scheduling prediction information included in the selected target sample code scheduling preprocessing information based on the preset prediction loss function. The preset prediction loss function may be, but is not limited to, mean square error loss function (MSE), hinge loss function (SVM), cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0064] In step 6, in response to determining that the predicted difference value is greater than or equal to the preset predicted difference value, the parameters of the initial code scheduling information prediction model are adjusted. For example, the predicted difference value and the preset predicted difference value may be differentiated. On this basis, the parameters of the initial code scheduling information prediction model are adjusted using methods such as back propagation and gradient descent. For example, the preset predicted difference value may be 0.1.

[0065] Optionally, in response to determining that the prediction difference value is less than the preset prediction difference value, the initial code scheduling information prediction model is determined as the trained code scheduling information prediction model.

[0066] Step 107, input the code scheduling information sequence into a pre-trained traffic anomaly recognition model to obtain an anomaly recognition result.

[0067] In some embodiments, the execution subject may input the code scheduling information sequence into a pre-trained traffic anomaly identification model to obtain an anomaly identification result. The traffic anomaly identification model may be a pre-trained neural network model that takes the code scheduling information sequence as input and the anomaly identification result as output. The anomaly identification result may indicate that the program code is malicious code. The anomaly identification result may indicate that the program code is not malicious code.

[0068] Optionally, before inputting the code scheduling information sequence into a pre-trained traffic anomaly recognition model to obtain an anomaly recognition result, the method further includes:

[0069] The first step is to obtain the training sample set.

[0070] In some embodiments, the execution subject may obtain the training sample set from the terminal device via a wired connection or a wireless connection. The training samples in the training sample set may include but are not limited to: sample code scheduling information sequence and sample anomaly recognition results.

[0071] The second step is to determine the initial traffic anomaly recognition model.

[0072] In some embodiments, the execution subject may determine an initial traffic anomaly recognition model, wherein the initial traffic anomaly recognition model may include: an initial diffusion convolution model, an initial prediction model, and an initial recognition model.

[0073] Here, the initial diffusion convolution model can be a diffusion convolution recurrent neural network model that takes the sample code scheduling information as input and takes the initial convolution information as output. For example, the initial diffusion convolution model can refer to the following formula:

[0074]

[0075] Where k represents the sequence number. Here, k∈{1,…,K}. For example, K can be 5. represents. B represents the initial convolution information. A represents the sample code scheduling information. θ K，1 and θ K，2 Represents the filter parameters. and represents the diffusion migration matrix. For example, Can be Can be For example, A can be B can be

[0076] The initial prediction model may be a neural network model that takes the initial convolution information set as input and the initial prediction information as output. For example, the initial prediction model may be an optimized GRU (Gated Recurrent Unit) model. Here, the transfer relationship between each layer included in the initial prediction model may be expressed by the following formula:

[0077]

[0078] Where t represents the sequence number of the network layer of the initial prediction model. t+T Represents the initial prediction information. (t) H represents the input features of the tth layer. t-1 represents the hidden state of the t-1th layer. W represents the weight matrix. t Indicates the gate state of the tth layer control reset. t represents the gated state of the control update of the tth layer. t Represents the output of the tth layer. b r Indicates that the tth layer is r The bias matrix in t. b u The tth layer is in u t The bias matrix in b. C Indicates that the tth layer is in C tThe bias matrix in . σ represents the Sigmoid function. ⊙ represents the Hadamard product.

[0079] The initial recognition model may be a neural network model that takes the initial prediction information as input and takes the initial abnormality recognition result as output. For example, the initial recognition model may be a support vector machine (SVM) model.

[0080] The third step is to select target training samples from the above training sample set.

[0081] In some embodiments, the execution entity may select a target training sample from the training sample set. In practice, the execution entity may randomly select a target training sample from the training sample set.

[0082] In the fourth step, each sample code scheduling information in the sample code scheduling information sequence included in the selected target training sample is input into the initial diffusion convolution model to generate initial convolution information and obtain an initial convolution information set.

[0083] In some embodiments, the execution entity may input each sample code scheduling information in the sample code scheduling information sequence included in the selected target training sample into the initial diffusion convolution model to generate initial convolution information and obtain an initial convolution information set.

[0084] In the fifth step, the initial convolution information set is input into the initial prediction model to generate initial prediction information.

[0085] In some embodiments, the execution entity may input the initial convolution information set into an initial prediction model to generate initial prediction information.

[0086] In the sixth step, the initial prediction information is input into the initial recognition model to obtain the initial anomaly recognition result.

[0087] In some embodiments, the execution entity may input the initial prediction information into an initial recognition model to obtain an initial abnormality recognition result.

[0088] In the seventh step, based on a preset loss function, a difference value between the initial anomaly recognition result and the sample anomaly recognition result included in the selected target training sample is determined.

[0089] In some embodiments, the execution subject may determine the difference between the initial abnormality recognition result and the sample abnormality recognition result included in the selected target training sample based on a preset loss function. The preset loss function may be, but is not limited to, mean square error loss function (MSE), hinge loss function (SVM), cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0090] In an eighth step, in response to determining that the difference value is greater than or equal to a preset difference value, adjusting network parameters of the initial traffic anomaly identification model.

[0091] In some embodiments, the execution subject may adjust the network parameters of the initial traffic anomaly identification model in response to determining that the difference value is greater than or equal to the preset difference value. For example, the difference value and the preset difference value may be calculated. On this basis, the network parameters of the initial traffic anomaly identification model are adjusted using methods such as back propagation and gradient descent. For example, the preset difference value may be 0.1.

[0092] Optionally, in response to determining that the difference value is less than the preset difference value, the initial traffic anomaly recognition model is determined as the trained traffic anomaly recognition model.

[0093] In some embodiments, in response to determining that the difference value is less than the preset difference value, the execution entity may determine the initial traffic anomaly recognition model as the trained traffic anomaly recognition model.

[0094] The relevant content of step 107, as an inventive point of an embodiment of the present application, solves the second technical problem mentioned in the background technology, "reduced network security". Among them, the factors that reduce network security are often as follows: when the malicious code is updated and the preset rule base is not updated, part of the malicious code is not in the preset rule base, resulting in low accuracy in malicious code recognition. If the above factors are solved, the effect of improving network security can be achieved. In order to achieve this effect, the present application can first train an initial diffusion convolution model to model the sample code scheduling information for spatial dependency. Secondly, the initial convolution information set can be modeled for time dependency by training an initial prediction model. Thus, the initial diffusion convolution model and the initial prediction model can be used to predict the initial prediction information that represents the current code scheduling information more accurately under time and space dependency based on the historical code scheduling information sequence. Afterwards, a more accurate initial anomaly recognition result can be identified based on the more accurate initial prediction information by training the initial recognition model. Therefore, a relatively accurate traffic anomaly recognition model can be trained by training an initial traffic anomaly recognition model including an initial diffusion convolution model, an initial prediction model, and an initial recognition model, so that a relatively accurate anomaly recognition result can be recognized by a relatively accurate traffic anomaly recognition model, so that an alarm processing can be performed on the anomaly recognition result that indicates that the program code is malicious code in the subsequent relatively accurate anomaly recognition result. Thus, network security can be improved.

[0095] Step 108, in response to determining that the abnormal identification result meets the preset abnormal condition, the abnormal identification result is sent to the alarm terminal for alarm processing.

[0096] In some embodiments, the execution subject may, in response to determining that the abnormal identification result satisfies a preset abnormal condition, send the abnormal identification result to an alarm terminal for alarm processing. The preset abnormal condition may be: the abnormal identification result indicates that the program code is malicious code. The alarm terminal may be: a terminal that displays warning text corresponding to the abnormal identification result or emits a prompt sound corresponding to the abnormal identification result.

[0097] The above-mentioned embodiments of the present application have the following beneficial effects: through the malicious code attack identification method based on the traffic anomaly identification model of some embodiments of the present application, network security can be improved. Specifically, the reason for reducing network security is that the historical code scheduling information is used as the current code scheduling information. When the code scheduling information is updated quickly, the malicious code identification accuracy is low. Based on this, the malicious code attack identification method based on the traffic anomaly identification model of some embodiments of the present application first obtains the initial code scheduling information sequence. Thus, the historical initial code scheduling information sequence can be obtained. Secondly, each initial code scheduling information that meets the first preset missing condition in the above initial code scheduling information sequence is determined as the first code scheduling missing information group to obtain the first code scheduling missing information group set. Then, based on the above first code scheduling missing information group set, the above initial code scheduling information sequence is subjected to the first data preprocessing to generate the initial code scheduling update information sequence. Thus, the initial code scheduling information that is continuously missing in the initial code scheduling information sequence can be subjected to data supplementation processing to obtain a more accurate initial code scheduling update information sequence. Then, the initial code scheduling update information that meets the second preset missing condition in the above-mentioned initial code scheduling update information sequence is determined as the second code scheduling missing information, and the second code scheduling missing information set is obtained. Then, based on the above-mentioned second code scheduling missing information set, the above-mentioned initial code scheduling update information sequence is subjected to a second data preprocessing to generate a code scheduling preprocessing information sequence. Thus, the initial code scheduling update information that represents the missing in the initial code scheduling update information sequence can be subjected to data supplementation processing to obtain a more accurate code scheduling preprocessing information sequence. Afterwards, the above-mentioned code scheduling preprocessing information sequence is subjected to data smoothing processing to generate a code scheduling information sequence. Thus, the code scheduling preprocessing information sequence can be subjected to data smoothing processing to eliminate information such as noise, abnormal values ​​(abrupt spikes) in the code scheduling preprocessing information sequence to obtain a relatively smooth and continuous code scheduling information sequence. Thereafter, the above-mentioned code scheduling information sequence is input into a pre-trained traffic anomaly recognition model to obtain an abnormal recognition result. Thus, a relatively accurate abnormal recognition result can be predicted from a relatively accurate code scheduling information sequence through a traffic anomaly recognition model. Finally, in response to determining that the above abnormal identification result meets the preset abnormal condition, the above abnormal identification result is sent to the alarm terminal for alarm processing. Thus, when the abnormal identification result indicates that the program code is malicious code, the malicious code can be alarmed. Thus, network security can be improved.

[0098] The present application also provides a computer device 200. Figure 2As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0099] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0100] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0101] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0102] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned malicious code attack identification method based on the traffic anomaly identification model. That is, the memory 203 stores instructions for executing the aforementioned malicious code attack identification based on the traffic anomaly identification model.

[0103] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0104] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned malicious code attack identification method based on the traffic anomaly identification model.

[0105] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk), etc. The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned malicious code attack identification method based on the traffic anomaly identification model.

[0106] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0107] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A malicious code attack identification method based on a traffic anomaly identification model, comprising: Obtaining the initial code scheduling information sequence; Determine each initial code scheduling information satisfying a first preset missing condition in the initial code scheduling information sequence as a first code scheduling missing information group, to obtain a first code scheduling missing information group set; Based on the first code scheduling missing information group set, performing first data preprocessing on the initial code scheduling information sequence to generate an initial code scheduling update information sequence; Determine the initial code scheduling update information that meets the second preset missing condition in the initial code scheduling update information sequence as second code scheduling missing information, and obtain a second code scheduling missing information set; Based on the second code scheduling missing information set, performing a second data preprocessing on the initial code scheduling update information sequence to generate a code scheduling preprocessing information sequence; Performing data smoothing processing on the code scheduling preprocessing information sequence to generate a code scheduling information sequence; Inputting the code scheduling information sequence into a pre-trained traffic anomaly recognition model to obtain an anomaly recognition result; In response to determining that the abnormality identification result meets a preset abnormality condition, sending the abnormality identification result to an alarm terminal for alarm processing; The step of performing first data preprocessing on the initial code scheduling information sequence based on the first code scheduling missing information group set to generate an initial code scheduling update information sequence includes: For each first code scheduling missing information group in the first code scheduling missing information group set, the following first pre-processing step is performed: Determine each initial code scheduling information satisfying a first preset position condition in the initial code scheduling information sequence as a first code position information group; Determine each initial code scheduling information satisfying a second preset position condition in the initial code scheduling information sequence as a second code position information group; Determine, based on the first code position information group and the second code position information group, a first code scheduling update information group corresponding to the first code scheduling missing information group; Based on the determined first code scheduling update information groups, updating the initial code scheduling information sequence to generate an initial code scheduling update information sequence; The step of performing data smoothing on the code scheduling preprocessing information sequence to generate a code scheduling information sequence includes: The first step is to split the code scheduling preprocessing information sequence to generate a first code scheduling preprocessing information sequence and a second code scheduling preprocessing information sequence; The second step is to determine a code scheduling information prediction model based on the first code scheduling preprocessing information sequence; In the third step, for each piece of code scheduling preprocessing information in the code scheduling preprocessing information sequence, the following smoothing steps are performed: A first smoothing step, in response to determining that the code scheduling preprocessing information is in the first code scheduling preprocessing information sequence, determining the code scheduling preprocessing information as code scheduling information; The second smoothing step, in response to determining that the code scheduling preprocessing information is in the second code scheduling preprocessing information sequence, performs the following determining steps: In a first determination step, each code scheduling preprocessing information satisfying a preset selection condition in the code scheduling preprocessing information sequence is input into a code scheduling information prediction model to obtain code scheduling prediction information; A second determination step is to determine the code scheduling information corresponding to the code scheduling prediction information and the code scheduling preprocessing information; The fourth step is to determine the generated code scheduling information as a code scheduling information sequence.

2. According to the method for identifying malicious code attacks based on the traffic anomaly identification model of claim 1, The step of performing a second data preprocessing on the initial code scheduling update information sequence based on the second code scheduling missing information set to generate a code scheduling preprocessing information sequence includes: For each second code scheduling missing information in the second code scheduling missing information set, the following second pre-processing step is performed: Determine each piece of initial code scheduling update information satisfying a third preset position condition in the initial code scheduling update information sequence as a third code position information group; Determine each initial code scheduling update information satisfying a fourth preset position condition in the initial code scheduling update information sequence as a fourth code position information group; Determine, based on the third code position information group and the fourth code position information group, second code scheduling update information corresponding to the second code scheduling missing information; Based on the determined second code scheduling update information, the initial code scheduling update information sequence is updated to generate a code scheduling pre-processing information sequence.

3. The malicious code attack identification method based on the traffic anomaly identification model according to claim 1, wherein: The determining of a code scheduling information prediction model based on the first code scheduling preprocessing information sequence includes: Splitting the first code scheduling preprocessing information sequence to generate a sample code scheduling preprocessing information set, wherein the sample code scheduling preprocessing information in the sample code scheduling preprocessing information set includes: a sample code scheduling input information sequence and sample code scheduling prediction information; Determine an initial code scheduling information prediction model; Selecting target sample code scheduling preprocessing information from a sample code scheduling preprocessing information set; Inputting the sample code scheduling input information sequence included in the selected target sample code scheduling preprocessing information into the initial code scheduling information prediction model to obtain initial code scheduling prediction information; Determine, based on a preset prediction loss function, a prediction difference value between the initial code scheduling prediction information and the sample code scheduling prediction information included in the selected target sample code scheduling preprocessing information; In response to determining that the prediction difference value is greater than or equal to a preset prediction difference value, a parameter of the initial code scheduling information prediction model is adjusted.

4. The method for identifying malicious code attacks based on a traffic anomaly identification model according to claim 3, wherein: The method further comprises: In response to determining that the prediction difference value is less than the preset prediction difference value, the initial code scheduling information prediction model is determined as the trained code scheduling information prediction model.

5. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images