Security model library updating method and device, equipment and storage medium

Abstract

The invention discloses a security model library updating method and device, equipment and a storage medium. Comprising the steps of obtaining an equipment log of to-be-detected safety equipment, and determining a target detection model corresponding to the to-be-detected safety equipment from a safety model library; detecting the equipment log through the target detection model to generate alarm data, and determining incremental data according to the alarm data; and generating an incremental model according to the incremental data and the target detection model, and updating the security model library according to the incremental model. The target detection model is subjected to feedback training through incremental data, so that the model can continuously learn and adapt to new security threats and equipment changes, and the adaptability and timeliness of the model are improved. The continuously updated security model library can provide more accurate and effective models for detecting more similar to-be-detected security devices, the security risk is reduced, and the overall security protection level is improved. A closed-loop detection and improvement mechanism can reduce manual intervention, improve working efficiency and guarantee reliable operation of safety equipment.

Description

Technical Field

[0001] The present invention relates to the field of model training technology, and in particular to a security model library updating method, device, equipment and storage medium. Background Art

[0002] In today's era of rapid digitalization and intelligence development, models are being used more extensively and deeply in various fields, from image recognition, natural language processing to predictive analysis, intelligent recommendation, etc. However, traditional model training methods face many challenges.

[0003] In existing technologies, model training often relies on manual feature engineering and parameter adjustment, which not only requires professional knowledge and rich experience, but also consumes a lot of time and energy. The process of manual intervention is prone to subjectivity and errors, resulting in unstable performance and poor repeatability of the model.

[0004] With the explosive growth of data volume and the increasing complexity of models, it has become almost impossible to manually process massive amounts of data and complex model structures. In addition, it is difficult to update and optimize models. When new data appears or business needs change, manually retraining the model is inefficient and difficult to keep up with rapidly changing needs. Summary of the invention

[0005] The present invention provides a security model library updating method, device, equipment and storage medium. By combining model training and feedback mechanism, the automatic updating of the security model library is realized, which can not only help identify and correct model deviations, improve detection accuracy and reduce the risk of false alarms, but also enhance user participation and trust.

[0006] According to one aspect of the present invention, a method for updating a security model library is provided, the method comprising:

[0007] Obtaining the device log of the security device to be tested, and determining the target detection model corresponding to the security device to be tested from the security model library;

[0008] The device log is detected through the target detection model to generate alarm data, and the incremental data is determined based on the alarm data;

[0009] Generate an incremental model based on the incremental data and the target detection model, and update the security model library based on the incremental model.

[0010] Optionally, obtaining a device log of the security device to be tested includes: obtaining a target device identifier input by a user, and using a security device corresponding to the target device identifier as the security device to be tested; obtaining log data of the security device to be tested, and performing structured conversion on the log data to generate a device log.

[0011] Optionally, determining a target detection model corresponding to the security device to be tested from a security model library includes: determining a target device type of the security device to be tested; matching the target device type through the security model library to determine a target detection model corresponding to the security device to be tested, wherein the security model library includes detection models corresponding to each device type.

[0012] Optionally, the device log is detected through a target detection model to generate alarm data, including: inputting the device log into the target detection model for security detection; when the target detection model detects that there is a security issue, outputting the abnormal device log and determining the abnormal safety device identifier corresponding to the abnormal device log; and using the abnormal device log and the abnormal safety device identifier as alarm data.

[0013] Optionally, determining incremental data based on alarm data includes: displaying the alarm data to a user to obtain labeling information input by the user, wherein the labeling information includes real alarms and false alarms; and using alarm data with labeling information as real alarms as incremental data.

[0014] Optionally, an incremental model is generated based on the incremental data and the target detection model, including: generating training data based on a specified period and incremental data; and importing the training data into the target detection model for incremental training through a preset algorithm to generate an incremental model.

[0015] Optionally, the security model library is updated according to the incremental model, including: performing a performance evaluation on the incremental model to determine each performance indicator, and determining a comprehensive score of the model according to each performance indicator, wherein the performance indicators include precision, false alarm rate, recall rate and F1 value; obtaining a historical comprehensive score of the target detection model; when the model comprehensive score is greater than the historical comprehensive score, replacing the target detection model with the incremental model to update the security model library.

[0016] According to another aspect of the present invention, there is provided a security model library updating device, the device comprising:

[0017] The target detection model determination module is used to obtain the device log of the security device to be tested and determine the target detection model corresponding to the security device to be tested from the security model library;

[0018] The alarm and incremental data generation module is used to detect the device log through the target detection model to generate alarm data, and determine the incremental data according to the alarm data;

[0019] The security model library update module is used to generate an incremental model based on incremental data and a target detection model, and update the security model library based on the incremental model.

[0020] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0021] at least one processor;

[0022] and a memory communicatively coupled to the at least one processor;

[0023] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a security model library updating method described in any embodiment of the present invention.

[0024] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a security model library updating method described in any embodiment of the present invention when executed.

[0025] The technical solution of the embodiment of the present invention can achieve accurate detection of specific equipment and improve the pertinence and accuracy of detection by obtaining the device log of the security device to be tested and determining the corresponding target detection model. By detecting the device log through the target detection model to generate alarm data, potential problems and abnormal conditions in the security equipment can be discovered in time, and the security and stability of the system can be improved. Determining incremental data based on alarm data helps to focus on key changes and emerging problems, and provide valuable information for subsequent model improvements. Feedback training of the target detection model through incremental data can enable the model to continuously learn and adapt to new security threats and equipment changes, and improve the adaptability and timeliness of the model. The continuously updated security model library can provide more accurate and effective models for detecting more similar security devices to be tested, reduce security risks, and improve the overall security protection level. The closed-loop detection and improvement mechanism can reduce manual intervention, improve work efficiency, and ensure the reliable operation of security equipment.

[0026] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 is a flow chart of a security model library updating method provided according to the first embodiment of the present invention;

[0029] Figure 2 is a flowchart of another security model library updating method provided according to the second embodiment of the present invention;

[0030] Figure 3 is a structural diagram of a security model library updating device provided according to Embodiment 3 of the present invention;

[0031] Figure 4 It is a structural schematic diagram of an electronic device for implementing a security model library updating method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] Embodiment 1

[0035] Figure 1 A flowchart of a security model library updating method is provided for the first embodiment of the present invention. This embodiment is applicable to network security scenarios. The method can be executed by a security model library updating device. The security model library updating device can be implemented in the form of hardware and / or software. The security model library updating device can be configured in a computer controller. Figure 1 As shown, the method includes:

[0036] S110: Obtain a device log of the security device to be tested, and determine a target detection model corresponding to the security device to be tested from a security model library.

[0037] Among them, the security device to be tested refers to the security device that needs to be tested and evaluated for security. The security device to be tested may include firewalls, intrusion detection systems and vulnerability scanners. The device log refers to the record file automatically generated by the security device during operation, which contains various operations, events, state changes and other information of the device. For example, the log of the firewall may record the establishment and disconnection of network connections, the triggering of access control rules, etc. The log of the intrusion detection system may record the detected suspicious activities and attack behaviors. The security model library refers to a database collection that stores various security detection models, in which the security detection models are built based on different security principles and technologies and are used to detect potential security issues in security devices. The security model library may include rule-based models, machine learning-based models, statistical models, etc. For example, DNS tunnel detection, phishing email detection, DGA domain name detection, malicious URL detection, ICMP tunnel detection. Different models are suitable for different types of security devices and security scenarios. By selecting a suitable model from the security model library, the accuracy and efficiency of security detection can be improved. The target detection model refers to a detection model that matches the security device to be tested. The target detection model can be determined based on factors such as the type, function, configuration and security requirements of the security device to be tested. The target detection model is used to analyze and detect device logs to discover potential security issues and anomalies.

[0038] Specifically, security devices will continuously record various events and activities during operation, forming device logs. Device logs can report information such as device status, network traffic, and security events. By obtaining device logs, you can understand the operation of security devices and provide a data basis for subsequent detection and analysis. Different security devices may have different functions, characteristics, and security requirements, so it is necessary to select corresponding target detection models to ensure the accuracy and effectiveness of detection.

[0039] Optionally, obtaining a device log of the security device to be tested includes: obtaining a target device identifier input by a user, and using a security device corresponding to the target device identifier as the security device to be tested; obtaining log data of the security device to be tested, and performing structured conversion on the log data to generate a device log.

[0040] Specifically, there are usually multiple security devices in a complex network environment. Users can detect and analyze specific security devices in a targeted manner by entering the target device identifier. The target device identifier can be a unique identifier such as the device name, IP address, serial number, etc. The controller can search for the corresponding security device in the entire network environment based on the resolved target device identifier. If a matching device is found, it will be identified as the security device to be tested. The log data generated by security devices usually exists in various formats and may be unstructured or semi-structured. In order to facilitate subsequent analysis and processing, the controller can convert these log data into a structured form so that useful information can be extracted and detected more efficiently.

[0041] Optionally, determining a target detection model corresponding to the security device to be tested from a security model library includes: determining a target device type of the security device to be tested; matching the target device type through the security model library to determine a target detection model corresponding to the security device to be tested, wherein the security model library includes detection models corresponding to each device type.

[0042] Specifically, the controller can determine the target device type by analyzing the appearance, interface, function description and other features of the security device to be tested, or querying the identification information of the security device to be tested, such as the device model, manufacturer name, etc. By matching the target device type through the security model library, the target detection model corresponding to the security device to be tested can be determined. When building a security model library, it is necessary to analyze and study the configuration information of different types of security devices to understand their working principles, security risks and detection requirements. Developers can develop corresponding detection models based on the configuration information and store them in the security model library. Each detection model is targeted at a specific device type and has specific detection algorithms, rules and parameters.

[0043] Furthermore, the controller can also analyze the security requirements of the security device to be tested based on factors such as the network environment protected by the device and business requirements, and then search for a target detection model that matches the device category and security requirements in the security model library.

[0044] S120: Detect device logs using a target detection model to generate alarm data, and determine incremental data based on the alarm data.

[0045] Specifically, when the target detection model detects a device log, if a potential security issue or abnormal situation is found, alarm data will be generated. Alarm data can include detailed information about the security issue, such as the alarm type (e.g., intrusion alarm, vulnerability alarm, etc.), alarm level (high, medium, low), alarm time, involved device information, etc. Incremental data refers to newly emerged security issues or changed data determined based on alarm data.

[0046] Optionally, the device log is detected through a target detection model to generate alarm data, including: inputting the device log into the target detection model for security detection; when the target detection model detects that there is a security issue, outputting the abnormal device log and determining the abnormal safety device identifier corresponding to the abnormal device log; and using the abnormal device log and the abnormal safety device identifier as alarm data.

[0047] Specifically, before inputting the device log into the target detection model, some data preprocessing steps can be performed, such as cleaning the noise data in the log, formatting the log content, extracting key information, etc., so that the model can better process and analyze the log data. The controller can input the preprocessed device log into the target detection model, and the model will operate according to its internal algorithms and rules. If the model is based on machine learning, the trained model parameters will be used to classify or predict the input data; if it is a rule-based model, the log will be matched and judged according to the predefined rules. The target detection model will determine whether there is a security problem in the input device log based on its detection algorithm and rules. If an anomaly is found, the relevant log will be marked as an abnormal device log. Anomaly detection can be based on a variety of methods, such as comparing log data with known security problem patterns, detecting abnormal behavior characteristics in logs, and analyzing the statistical distribution of logs.

[0048] Optionally, determining incremental data based on alarm data includes: displaying the alarm data to a user to obtain labeling information input by the user, wherein the labeling information includes real alarms and false alarms; and using alarm data with labeling information as real alarms as incremental data.

[0049] Specifically, users will mark alarm data as true alarms or false alarms. True alarms refer to alarm data that actually has security issues, while false alarms are erroneous alarms caused by false positives of the target detection model or other reasons. By distinguishing true alarms from false alarms, we can better identify the real security issues in the system and avoid unnecessary waste of resources and misoperation. True alarms usually have some obvious characteristics, indicating that there are actual security issues. For example, the logs of abnormal devices may contain clear characteristics of attack behavior, signs of sensitive information leakage, abnormal system behavior, etc. In addition, true alarms may have related abnormal conditions in the logs of multiple devices, or match known security threat patterns. False alarms may be caused by a variety of reasons. For example, unreasonable parameter settings of the target detection model, noise interference in the log data, and normal business activities being misjudged as security issues. False alarms usually have no obvious security problem characteristics or are consistent with the normal operation status of the system. The controller will filter out the alarm data marked as true alarms as incremental data based on the information marked by the user for subsequent analysis and processing.

[0050] S130: Generate an incremental model according to the incremental data and the target detection model, and update the security model library according to the incremental model.

[0051] Among them, the incremental model refers to the one that is retrained based on the target detection model and combined with new alarm data. The incremental model can better adapt to the dynamic changes of security equipment and improve the accuracy and timeliness of security detection. The update of the security model library is a continuous process. By marking and retraining new alarm data (incremental data), the security model library can be continuously updated to improve the ability and effect of security detection and ensure that security equipment can effectively respond to various security threats.

[0052] Optionally, an incremental model is generated based on the incremental data and the target detection model, including: generating training data based on a specified period and incremental data; and importing the training data into the target detection model for incremental training through a preset algorithm to generate an incremental model.

[0053] Specifically, by specifying a cycle, it is possible to ensure that sufficient incremental data is collected within a reasonable time interval for effective training. Within the specified cycle, the incremental data collected may contain various types of security alerts. In order to generate effective training data, the incremental data can be screened and sorted. The alarm can be screened based on factors such as the severity, type, and equipment involved, and those representative and important incremental data can be retained as training data. By automatically importing the alarm data triggered by the target detection model into the security model library training block on a regular basis, the cost of forward iteration of each model in the security model library can be reduced. By shortening the model update cycle, the rapidly changing security needs can be met, and timely responses to emerging threats and attack patterns can be achieved.

[0054] It should be noted that for the filtered incremental data, further annotation may be required so that the model can better learn and identify new security issues. Annotation can include classification and description of the specific type of alarm, attack method, impact range, etc. For example, if the incremental data contains a new network attack alarm, it can be annotated so that the model can learn the characteristics of this attack during training.

[0055] Specifically, incremental training is to use new training data to make local adjustments and optimizations on the basis of the original target detection model to generate an incremental model that adapts to the new situation. The preset algorithm is usually a method that can effectively integrate new data for training without destroying the structure and performance of the original model. Common algorithms include online learning algorithms and incremental learning algorithms. Online learning algorithms can update the model in real time when new data arrives, which is suitable for scenarios with high real-time requirements; incremental learning algorithms can gradually integrate new data into the model, avoiding retraining of the entire data set and saving computing resources and time. During the training process, the model will continuously adjust parameters according to the new data to improve the detection ability of new security issues. After the incremental training is completed, the generated incremental model needs to be evaluated and optimized. Some evaluation indicators, such as accuracy, recall rate, F1 value, etc., can be used to measure the performance of the model. If the model performance does not meet the requirements, it can be optimized by adjusting the training parameters, increasing the amount of training data, improving the algorithm, etc. until a satisfactory incremental model is generated.

[0056] Specific application scenarios: In a specific implementation, the security model library can be updated by combining the Security Information and Event Management (SIEM) platform and the Security Orchestration, Automation and Response (SOAR) platform. SIEM can serve as a centralized collection and analysis center for security data, collect device logs from the security devices to be tested, send them to SOAR for security detection, and then display alarm data to users through SIEM. Users can mark alarms on SIEM and confirm the authenticity of the alarms (the basis for detecting the authenticity of different alarms is different). After this series of review and confirmation processes, the status of the alarm will eventually be changed. The analyzed alarms will be regularly imported into the security model library of SOAR for training. For example, for DNS tunnels, it is first necessary to collect and mark a large amount of network traffic data, and extract key indicators such as query frequency, response time, and returned domain name type through feature extraction technology. Next, these features are trained using the selected algorithm to build a model that can identify DNS tunnel traffic.

[0057] The technical solution of the embodiment of the present invention can achieve accurate detection of specific equipment and improve the pertinence and accuracy of detection by obtaining the device log of the security device to be tested and determining the corresponding target detection model. By detecting the device log through the target detection model to generate alarm data, potential problems and abnormal conditions in the security equipment can be discovered in time, and the security and stability of the system can be improved. Determining incremental data based on alarm data helps to focus on key changes and emerging problems, and provide valuable information for subsequent model improvements. Feedback training of the target detection model through incremental data can enable the model to continuously learn and adapt to new security threats and equipment changes, and improve the adaptability and timeliness of the model. The continuously updated security model library can provide more accurate and effective models for detecting more similar security devices to be tested, reduce security risks, and improve the overall security protection level. The closed-loop detection and improvement mechanism can reduce manual intervention, improve work efficiency, and ensure the reliable operation of security equipment.

[0058] Embodiment 2

[0059] Figure 2 This is a flowchart of a security model library update method provided in the second embodiment of the present invention. This embodiment adds a specific process of updating the security model library according to the incremental model on the basis of the above-mentioned first embodiment. Among them, the specific contents of steps S210-S220 are roughly the same as steps S110-S120 in the first embodiment, so they will not be repeated in this embodiment. Figure 2 As shown, the method includes:

[0060] S210: Obtain a device log of the security device to be tested, and determine a target detection model corresponding to the security device to be tested from a security model library.

[0061] Optionally, obtaining a device log of the security device to be tested includes: obtaining a target device identifier input by a user, and using a security device corresponding to the target device identifier as the security device to be tested; obtaining log data of the security device to be tested, and performing structured conversion on the log data to generate a device log.

[0062] Optionally, determining a target detection model corresponding to the security device to be tested from a security model library includes: determining a target device type of the security device to be tested; matching the target device type through the security model library to determine a target detection model corresponding to the security device to be tested, wherein the security model library includes detection models corresponding to each device type.

[0063] S220: Detect device logs using a target detection model to generate alarm data, and determine incremental data based on the alarm data.

[0064] Optionally, the device log is detected through a target detection model to generate alarm data, including: inputting the device log into the target detection model for security detection; when the target detection model detects that there is a security issue, outputting the abnormal device log and determining the abnormal safety device identifier corresponding to the abnormal device log; and using the abnormal device log and the abnormal safety device identifier as alarm data.

[0065] Optionally, determining incremental data based on alarm data includes: displaying the alarm data to a user to obtain labeling information input by the user, wherein the labeling information includes real alarms and false alarms; and using alarm data with labeling information as real alarms as incremental data.

[0066] S230: Generate an incremental model according to the incremental data and the target detection model.

[0067] Optionally, an incremental model is generated based on the incremental data and the target detection model, including: generating training data based on a specified period and incremental data; and importing the training data into the target detection model for incremental training through a preset algorithm to generate an incremental model.

[0068] S240, performing performance evaluation on the incremental model to determine various performance indicators, and determining a comprehensive model score based on the various performance indicators, wherein the performance indicators include precision, false alarm rate, recall rate, and F1 value.

[0069] Among them, precision refers to the proportion of true positive examples among all samples predicted as positive examples. Precision can measure the accuracy of model prediction. High precision means that the model rarely misclassifies negative examples as positive examples. The calculation formula of precision is: precision = true positive examples / (true positive examples + false positive examples). False alarm rate refers to the proportion of negative examples that are mistakenly predicted as positive examples, which is used to reflect the false alarm situation of the model. A low false alarm rate means that the model will not easily misclassify normal situations as security incidents. False alarm rate = false positive examples / (true positive examples + false positive examples + true negative examples + false negative examples). Recall rate, also known as recall rate, refers to the proportion of samples that are correctly predicted as positive examples among all samples that are actually positive examples. It is used to measure the model's ability to identify positive examples. A high recall rate means that the model can discover as many security incidents as possible. Recall rate = true positive examples / (true positive examples + false negative examples). F1 value is the harmonic mean of precision and recall rate. The higher the F1 value, the better the balance between precision and recall rate is achieved. F1 value = 2*precision*recall / (precision+recall).

[0070] Specifically, by evaluating the performance of the incremental model and determining the values ​​of these performance indicators, we can fully understand the performance of the model. Then, according to the preset weights or algorithms, the performance indicators are combined to determine the comprehensive score of the model.

[0071] S250: Obtain the historical comprehensive score of the target detection model.

[0072] S260: When the comprehensive score of the model is greater than the historical comprehensive score, the target detection model is replaced by the incremental model to update the security model library.

[0073] Specifically, the historical comprehensive score of the target detection model is obtained in order to compare it with the comprehensive score of the incremental model. When the comprehensive score of the incremental model is greater than the historical comprehensive score, it means that the incremental model has improved in performance. At this time, by replacing the target detection model with the incremental model, the security model library can be updated to improve the effect of security detection. The way of updating the security model library by this implementation method can ensure that the security model library always maintains a high performance level and constantly adapts to new security threats and data changes.

[0074] The technical solution of the embodiment of the present invention can achieve accurate detection of specific equipment and improve the pertinence and accuracy of detection by obtaining the device log of the security device to be tested and determining the corresponding target detection model. By detecting the device log through the target detection model to generate alarm data, potential problems and abnormal conditions in the security equipment can be discovered in time, and the security and stability of the system can be improved. Determining incremental data based on alarm data helps to focus on key changes and emerging problems, and provide valuable information for subsequent model improvements. Feedback training of the target detection model through incremental data can enable the model to continuously learn and adapt to new security threats and equipment changes, and improve the adaptability and timeliness of the model. The continuously updated security model library can provide more accurate and effective models for detecting more similar security devices to be tested, reduce security risks, and improve the overall security protection level. The closed-loop detection and improvement mechanism can reduce manual intervention, improve work efficiency, and ensure the reliable operation of security equipment.

[0075] Embodiment 3

[0076] Figure 3 This is a schematic diagram of the structure of a security model library updating device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a target detection model determination module 310, which is used to obtain a device log of the security device to be tested and determine a target detection model corresponding to the security device to be tested from a security model library;

[0077] An alarm and incremental data generation module 320 is used to detect device logs through a target detection model to generate alarm data, and determine incremental data based on the alarm data;

[0078] The security model library updating module 330 is used to generate an incremental model according to the incremental data and the target detection model, and update the security model library according to the incremental model.

[0079] Optionally, the target detection model determination module 310 specifically includes: a device log acquisition unit, used to: obtain the target device identifier input by the user, and use the security device corresponding to the target device identifier as the security device to be tested; obtain the log data of the security device to be tested, and perform structured conversion on the log data to generate a device log.

[0080] Optionally, the target detection model determination module 310 specifically includes: a target detection model determination unit, used to: determine the target device type of the security device to be tested; match the target device type through a security model library to determine the target detection model corresponding to the security device to be tested, wherein the security model library includes detection models corresponding to each device type.

[0081] Optionally, the alarm and incremental data generation module 320 specifically includes: an alarm data generation unit, used to: input the device log into the target detection model for security detection; when the target detection model detects that there is a security issue, output the abnormal device log, and determine the abnormal safety device identifier corresponding to the abnormal device log; use the abnormal device log and the abnormal safety device identifier as alarm data.

[0082] Optionally, the alarm and incremental data generation module 320 specifically includes: an incremental data generation unit, used to: display the alarm data to the user to obtain the labeling information input by the user, wherein the labeling information includes real alarms and false alarms; and use the alarm data with the labeling information as real alarms as incremental data.

[0083] Optionally, the security model library update module 330 specifically includes: an incremental model generation unit, used to: generate training data according to a specified period and incremental data; import the training data into the target detection model for incremental training through a preset algorithm to generate an incremental model.

[0084] Optionally, the security model library update module 330 specifically includes: a security model library update unit, which is used to: perform performance evaluation on the incremental model to determine each performance indicator, and determine the model comprehensive score based on each performance indicator, wherein the performance indicators include precision, false alarm rate, recall rate and F1 value; obtain the historical comprehensive score of the target detection model; when the model comprehensive score is greater than the historical comprehensive score, replace the target detection model with the incremental model to update the security model library.

[0085] The technical solution of the embodiment of the present invention can achieve accurate detection of specific equipment and improve the pertinence and accuracy of detection by obtaining the device log of the security device to be tested and determining the corresponding target detection model. By detecting the device log through the target detection model to generate alarm data, potential problems and abnormal conditions in the security equipment can be discovered in time, and the security and stability of the system can be improved. Determining incremental data based on alarm data helps to focus on key changes and emerging problems, and provide valuable information for subsequent model improvements. Feedback training of the target detection model through incremental data can enable the model to continuously learn and adapt to new security threats and equipment changes, and improve the adaptability and timeliness of the model. The continuously updated security model library can provide more accurate and effective models for detecting more similar security devices to be tested, reduce security risks, and improve the overall security protection level. The closed-loop detection and improvement mechanism can reduce manual intervention, improve work efficiency, and ensure the reliable operation of security equipment.

[0086] A security model library updating device provided in an embodiment of the present invention can execute a security model library updating method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0087] Embodiment 4

[0088] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0089] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0091] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a security model library update method.

[0092] In some embodiments, a security model library update method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security model library update method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a security model library update method in any other appropriate manner (e.g., by means of firmware).

[0093] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0094] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0095] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0096] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0097] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0098] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0099] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0100] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for updating a security model library, characterized in that: include: Obtaining a device log of a security device to be tested, and determining a target detection model corresponding to the security device to be tested from a security model library; Detecting the device log by using the target detection model to generate alarm data, and determining incremental data according to the alarm data; An incremental model is generated according to the incremental data and the target detection model, and the security model library is updated according to the incremental model.

2. The method according to claim 1, characterized in that The step of obtaining the device log of the security device to be tested includes: Obtaining a target device identifier input by a user, and using a security device corresponding to the target device identifier as a security device to be tested; The log data of the security device to be tested is obtained, and the log data is structured and converted to generate the device log.

3. The method according to claim 2, characterized in that The step of determining the target detection model corresponding to the security device to be tested from the security model library includes: Determining a target device type of the security device to be tested; The target device type is matched through the security model library to determine a target detection model corresponding to the security device to be tested, wherein the security model library includes a detection model corresponding to each device type.

4. The method according to claim 1, characterized in that The detecting the device log by the target detection model to generate alarm data includes: Inputting the device log into the target detection model for security detection; When the target detection model detects that there is a security problem, an abnormal device log is output, and an abnormal security device identifier corresponding to the abnormal device log is determined; The abnormal device log and the abnormal safety device identifier are used as the alarm data.

5. The method according to claim 4, characterized in that The determining of the incremental data according to the alarm data comprises: Displaying the alarm data to a user to obtain annotation information input by the user, wherein the annotation information includes real alarms and false alarms; The alarm data whose label information is a real alarm is used as the incremental data.

6. The method according to claim 1, characterized in that The generating an incremental model according to the incremental data and the target detection model includes: Generate training data according to the specified period and the incremental data; Through a preset algorithm, the training data is imported into the target detection model for incremental training to generate the incremental model.

7. The method according to claim 6, characterized in that The updating of the security model library according to the incremental model includes: Performing performance evaluation on the incremental model to determine various performance indicators, and determining a comprehensive model score based on the various performance indicators, wherein the performance indicators include precision, false alarm rate, recall rate, and F1 value; Obtaining a historical comprehensive score of the target detection model; When the model comprehensive score is greater than the historical comprehensive score, the target detection model is replaced by the incremental model to update the security model library.

8. A security model library updating device, characterized in that: include: A target detection model determination module is used to obtain a device log of a security device to be tested and determine a target detection model corresponding to the security device to be tested from a security model library; An alarm and incremental data generation module, configured to detect the device log through the target detection model to generate alarm data, and determine incremental data according to the alarm data; The security model library updating module is used to generate an incremental model according to the incremental data and the target detection model, and update the security model library according to the incremental model.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

Images