Network security threat detection method and system

Abstract

According to the network security threat detection method and system provided by the invention, the target data security analysis thread is obtained based on deep learning thread assisted configuration, so that the target data security analysis thread has a description vector integration capability; performing description vector extraction on target network service interaction data through a target data security analysis thread to obtain a first description vector; and description vector threat detection is carried out on a plurality of second description vectors obtained after description vector extraction is carried out on a plurality of reference network service interaction data by a target data security analysis thread included in the sample description vector data set, so that similar description vectors can obtain a threat detection result more accurately. Therefore, a network security threat detection result with relatively high accuracy is obtained, threats to network security can be effectively avoided, and the security and reliability of the network are guaranteed.

Description

Technical Field

[0001] The present application relates to the field of data evaluation technology, and in particular, to a network security threat detection method and system. Background Art

[0002] Cyber ​​Security refers to the protection of the hardware, software and data of the network system from damage, change or leakage due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system and uninterrupted network services.

[0003] Nowadays, with the continuous development and progress of informatization, the network has become an extremely important link, which will involve issues such as user privacy security and property security. How to detect danger in advance is a technical problem that is difficult to solve at present. Summary of the invention

[0004] In order to improve the technical problems existing in the related technologies, the present application provides a network security threat detection method and system.

[0005] In a first aspect, a network security threat detection method includes: Extracting description vectors of target network service interaction data through a target data security analysis thread to obtain a first description vector corresponding to the target network service interaction data, wherein the target data security analysis thread is obtained by assisting configuration based on a deep learning thread; The first description vector is subjected to description vector threat detection with several second description vectors included in the sample description vector data set to obtain a network security threat detection result corresponding to the target network service interaction data, wherein the several second description vectors are obtained by extracting description vectors from several reference network service interaction data through the target data security analysis thread.

[0006] Exemplarily, the first description vector may be a user interaction feature, and the second description vector may be understood as a user privacy feature.

[0007] It can be understood that the target data security analysis thread is configured with the assistance of the deep learning thread, so that the target data security analysis thread has the ability to integrate description vectors, and then the first description vector obtained by extracting the description vector of the target network business interaction data through the target data security analysis thread is combined with several second description vectors obtained after the target data security analysis thread included in the sample description vector data set extracts the description vector of several reference network business interaction data, and performs description vector threat detection, so that similar description vectors can obtain threat detection results more accurately, thereby obtaining network security threat detection results with higher accuracy, which can effectively avoid threats to network security and ensure the security and reliability of the network.

[0008] In an independently implemented embodiment, the performing network service interaction data processing on the multiple network service interaction data examples by the deep learning thread to obtain a fourth description vector corresponding to each of the network service interaction data examples includes: Performing description vector classification on the multiple network service interaction data examples through the deep learning thread to obtain a first local description vector and a second local description vector corresponding to each of the network service interaction data examples; The first local description vector and the second local description vector corresponding to each of the network service interaction data examples are concatenated to obtain the fourth description vector corresponding to each of the network service interaction data examples.

[0009] Exemplarily, the first local description vector may be a user's account feature, the second local description vector may be understood as a user's address feature, etc., which will not be described one by one again.

[0010] It can be understood that by performing network service interaction data processing on the multiple network service interaction data examples through the deep learning thread, the problem of inaccurate data processing is avoided, so that the fourth description vector corresponding to each of the network service interaction data examples can be accurately obtained.

[0011] In an independently implemented embodiment, the first network threat assessment indicator includes a first network threat assessment indicator; and determining the first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples includes: Classifying the plurality of network service interaction data examples according to the third description vector corresponding to each of the network service interaction data examples, and determining a first classification regression analysis result corresponding to each of the network service interaction data examples; Classifying the plurality of network service interaction data examples according to the fourth description vector corresponding to each of the network service interaction data examples, and determining a second classification regression analysis result corresponding to each of the network service interaction data examples; The first network threat assessment indicator is determined according to the first classification regression analysis result and the second classification regression analysis result corresponding to each of the network business interaction data examples.

[0012] Exemplarily, regression analysis can be understood as prediction. The third description vector can be understood as information type characteristics. The fourth description vector can be understood as user's shared resource characteristics.

[0013] It can be understood that the first network threat assessment indicator includes the first network threat assessment indicator; when the third description vector and the fourth description vector corresponding to each network business interaction data example are used, the problem of inaccurate regression analysis results is avoided, thereby accurately determining the first network threat assessment indicator.

[0014] In an independently implemented embodiment, classifying the plurality of network service interaction data examples according to the fourth description vector corresponding to each of the network service interaction data examples, and determining a second classification regression analysis result corresponding to each of the network service interaction data examples, includes: Determine, according to the fourth description vector corresponding to each of the network service interaction data examples, an original description vector description knowledge chain corresponding to each of the network service interaction data examples; Using the deep learning thread, the original description vector description knowledge chain corresponding to each of the network service interaction data examples is integrated to obtain an integrated description vector corresponding to each of the network service interaction data examples; The plurality of network service interaction data examples are classified according to the integrated description vector corresponding to each of the network service interaction data examples, and the second classification regression analysis result corresponding to each of the network service interaction data examples is determined.

[0015] It can be understood that when classifying the multiple network business interaction data examples according to the fourth description vector corresponding to each of the network business interaction data examples, the problem of inaccurate classification is avoided, so that the second classification regression analysis result corresponding to each of the network business interaction data examples can be accurately determined.

[0016] In an independently implemented embodiment, updating the target data security analysis thread according to the first network threat assessment indicator includes: The target data security analysis thread is updated using the first network threat assessment indicator and / or the second network threat assessment indicator.

[0017] It can be understood that by continuously updating the target data security analysis thread, the performance of the target data security analysis thread can be improved.

[0018] In an independently implemented embodiment, determining, according to the fourth description vector corresponding to each of the network service interaction data examples, a second target description vector corresponding to each of the network service interaction data examples to describe a knowledge chain includes: Taking the fourth description vector corresponding to each of the network service interaction data examples as a description vector attribute corresponding to each of the network service interaction data examples, to obtain a plurality of description vector attributes; Using multiple most similar description vector attributes that are closest to the target description vector attribute as the first-level most similar description vector attribute corresponding to the target description vector attribute, wherein the target description vector attribute is the description vector attribute corresponding to the target network service interaction data example, and the target network service interaction data example is a random one of the multiple network service interaction data examples; Using multiple most similar description vector attributes that are closest to each of the first-level most similar description vector attributes as the second-level most similar description vector attributes corresponding to the target description vector attribute; Determine, according to the first-level most similar description vector attribute and the second-level most similar description vector attribute, an original description vector description knowledge chain corresponding to the target network service interaction data example; According to the original description vector description knowledge chain corresponding to the target network service interaction data example, the second target description vector description knowledge chain corresponding to the target network service interaction data example is determined.

[0019] It can be understood that when the fourth description vector corresponding to each of the network business interaction data examples is used, the problem of inaccurate fourth description vector is avoided, so that the second target description vector description knowledge chain corresponding to each of the network business interaction data examples can be determined more accurately.

[0020] In an independently implemented embodiment, the original description vector description knowledge chain corresponding to the target network service interaction data example includes a first description vector attribute set and a first adjacent queue; the determining the original description vector description knowledge chain corresponding to the target network service interaction data example according to the first-level most similar description vector attribute and the second-level most similar description vector attribute includes: According to the target description vector attribute, dimensionlessly simplifying the multiple description vector attributes to obtain multiple description vector attributes after dimensionless simplification; According to the plurality of description vector attributes after dimensionless simplification, including the first-level most similar description vector attribute after dimensionless simplification and the second-level most similar description vector attribute after dimensionless simplification, the first description vector attribute set is formed; For a plurality of description vector attributes in the first description vector attribute set, determining a plurality of most similar description vector attributes having the closest difference to the plurality of description vector attributes from the plurality of description vector attributes after dimensionless simplification; determining a description vector connection between the plurality of description vector attributes and the plurality of most similar description vector attributes, wherein the plurality of most similar description vector attributes are description vector attributes present in the first description vector attribute set; The first adjacent queue is determined according to a matching relationship corresponding to each of the description vector attributes in the first description vector attribute set.

[0021] It can be understood that the original description vector description knowledge chain corresponding to the target network service interaction data example includes a first description vector attribute set and a first adjacent queue; when based on the first-level most similar description vector attributes and the second-level most similar description vector attributes, the problem of inaccurate attributes is improved, so that the original description vector description knowledge chain corresponding to the target network service interaction data example can be determined more accurately.

[0022] In an independently implemented embodiment, the second target description vector description knowledge chain includes a second description vector attribute set and a second adjacent queue; and determining the second target description vector description knowledge chain corresponding to the target network service interaction data example according to the original description vector description knowledge chain corresponding to the target network service interaction data example includes: Loading description vector attributes that are not present in the first description vector attribute set among the plurality of description vector attributes after dimensionless simplification into the first description vector attribute set to form the second description vector attribute set; For a potential description vector attribute in the second description vector attribute set, determining the most similar description vector attribute corresponding to the potential description vector attribute from the multiple description vector attributes after dimensionless simplification, wherein the potential description vector attribute is a random description vector attribute that does not exist in the first description vector attribute set from the multiple description vector attributes after dimensionless simplification; determining a latent description vector connection between the latent description vector attribute and a most similar description vector attribute corresponding to the latent description vector attribute; The second adjacent queue is determined according to the matching relationship corresponding to each of the description vector attributes in the second description vector attribute set.

[0023] It can be understood that the second target description vector describes the knowledge chain including the second description vector attribute set and the second adjacent queue; when the original description vector corresponding to the target network service interaction data example describes the knowledge chain, the problem of low accuracy of the potential description vector attribute is improved, so that the second target description vector description knowledge chain corresponding to the target network service interaction data example can be more accurately determined. In an independently implemented embodiment, the configuration example also includes a real-time directory corresponding to each of the network service interaction data examples, and the second classification regression analysis result corresponding to each of the network service interaction data examples includes a regression analysis directory corresponding to each of the network service interaction data examples; the configuration method of the target data security analysis thread also includes: Determining a second network threat assessment indicator according to the real-time catalog and the regression analysis catalog corresponding to each of the network service interaction data examples; According to the second network threat assessment indicator, the deep learning thread is updated.

[0024] It can be understood that the above configuration method can effectively improve the performance of deep learning threads.

[0025] In an independently implemented embodiment, each reference network service interaction data corresponds to a directory; the first description vector and a plurality of second description vectors included in the sample description vector data set are subjected to description vector threat detection to obtain a network security threat detection result corresponding to the target network service interaction data, including: determining a description vector commonality weight between the first description vector and each of the second description vectors; The second description vector whose commonality weight of the description vector is greater than a preset target value is used as a target second description vector whose threat detection with the first description vector is successful; The directory of the reference network service interaction data corresponding to the target second description vector is used as the network security threat detection result.

[0026] It can be understood that each reference network business interaction data corresponds to a directory; when the first description vector is compared with several second description vectors included in the sample description vector data set for description vector threat detection, the problem of inaccurate description vectors is improved, so that the network security threat detection results corresponding to the target network business interaction data can be obtained more accurately.

[0027] In an independently implemented embodiment, the configuration example of the target data security analysis thread includes multiple network service interaction data examples; the configuration method of the target data security analysis thread is as follows: Performing network service interaction data processing on the multiple network service interaction data examples through the target data security analysis thread to obtain a third description vector corresponding to each of the network service interaction data examples; Performing network service interaction data processing on the multiple network service interaction data examples through the deep learning thread to obtain a fourth description vector corresponding to each of the network service interaction data examples; Determine a first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples; According to the first network threat assessment indicator, updating the target data security analysis thread; The first network threat assessment indicator includes a second network threat assessment indicator; It can be understood that the above-mentioned on-site configuration method can improve the performance and calculation accuracy of the target data security analysis thread.

[0028] The determining a first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples includes: Determine, according to the third description vector corresponding to each of the network service interaction data examples, a first target description vector description knowledge chain corresponding to each of the network service interaction data examples; Determine, according to the fourth description vector corresponding to each of the network service interaction data examples, a second target description vector description knowledge chain corresponding to each of the network service interaction data examples; The second network threat assessment indicator is determined according to the first target description vector description knowledge chain and the second target description vector description knowledge chain corresponding to each of the network service interaction data examples.

[0029] It can be understood that, when the third description vector and the fourth description vector corresponding to each of the network business interaction data examples are used, the problem of low accuracy of the description vectors is improved, so that the first network threat assessment indicator can be determined more accurately.

[0030] In a second aspect, a network security threat detection system is provided, comprising a processor and a memory communicating with each other, wherein the processor is used to read a computer program from the memory and execute it to implement the above method.

[0031] A network security threat detection method and system provided in an embodiment of the present application obtain a target data security analysis thread based on deep learning thread-assisted configuration, so that the target data security analysis thread has the ability to integrate description vectors, and then perform description vector threat detection on a first description vector obtained by extracting description vectors of target network business interaction data through the target data security analysis thread, and a plurality of second description vectors obtained after the target data security analysis thread included in the sample description vector data set extracts description vectors of a plurality of reference network business interaction data, so that similar description vectors can obtain threat detection results more accurately, thereby obtaining network security threat detection results with higher accuracy, which can effectively avoid threats to network security and ensure the security and reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A flowchart of a network security threat detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to better understand the above technical scheme, the technical scheme of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0035] See also Figure 1 , shows a network security threat detection method, which may include the technical solution described in the following steps s11-s12.

[0036] In step S11, a description vector is extracted from the target network service interaction data through a target data security analysis thread to obtain a first description vector corresponding to the target network service interaction data, wherein the target data security analysis thread is obtained by assisting in the configuration based on a deep learning thread.

[0037] By way of example, a description vector is understood to be a feature.

[0038] The data security analysis thread can be obtained by assisting the configuration based on GCN because the deep learning thread (GCN, Graph Convolutional Network) has the ability to integrate description vectors. Therefore, the target data security analysis thread in the embodiment of the present disclosure can be called a pseudo deep learning thread (pseudo GCN). The pseudo GCN is still a conventional convolutional neural network (CNN, Convolutional Neural Network) in terms of network structure, but it has the ability to integrate description vectors. The configuration process of the target data security analysis thread obtained based on the GCN assisted configuration will be described in detail later in conjunction with the possible implementation methods of the present disclosure, which will not be repeated here.

[0039] The network service interaction data may include information such as file transfer between users.

[0040] The target data security analysis thread is used to extract description vectors from the target network service interaction data to obtain a first description vector for subsequent description vector threat detection.

[0041] In step S12, description vector threat detection is performed on the first description vector and several second description vectors included in the sample description vector data set to obtain network security threat detection results corresponding to the target network service interaction data, wherein the several second description vectors are obtained by extracting description vectors of several reference network service interaction data through the target data security analysis thread.

[0042] One reference network service interaction data corresponds to a unique directory, but one directory may correspond to several reference network service interaction data. The directory may be a label.

[0043] By using the target data security analysis thread, description vectors are extracted for each reference network business interaction data to obtain a number of second description vectors. By using the number of second description vectors, a sample description vector data set can be constructed.

[0044] When performing target analysis on the target network business interaction data, the first description vector corresponding to the target network business interaction data is subjected to description vector threat detection with several second description vectors included in the sample description vector data set, thereby obtaining a network security threat detection result corresponding to the target network business interaction data.

[0045] Compared with the related art, which only extracts description vectors and performs description vector threat detection on target network service interaction data and several reference network service interaction data based on ordinary CNN. In the embodiment of the present disclosure, the target data security analysis thread is obtained based on the GCN assisted configuration, so that the target data security analysis thread has the ability to integrate description vectors, and then the first description vector obtained by extracting description vectors from the target network service interaction data through the target data security analysis thread and the several second description vectors obtained after the target data security analysis thread included in the sample description vector data set extracts description vectors from several reference network service interaction data are used for description vector threat detection, so that similar description vectors can obtain threat detection results more accurately, thereby obtaining network security threat detection results with higher accuracy, which can effectively avoid threats to network security and ensure the security and reliability of the network.

[0046] In a possible implementation, each reference network service interaction data corresponds to a directory, and a description vector threat detection is performed on a first description vector and a plurality of second description vectors included in a sample description vector data set to obtain a network security threat detection result corresponding to the target network service interaction data, including: determining a description vector commonality weight between the first description vector and each second description vector; using a second description vector whose description vector commonality weight is greater than a preset target value as a target second description vector that successfully detects a threat with the first description vector; using a directory of reference network service interaction data corresponding to the target second description vector as a network security threat detection result. The directory can be understood as a label.

[0047] By using the description vector commonality weight, a target second description vector whose description vector commonality weight with the first description vector is greater than a preset target value can be determined among a plurality of second description vectors, and then the directory of the reference network service interaction data corresponding to the target second description vector can be used as the network security threat detection result corresponding to the target network service interaction data. In other words, the reference network service interaction data corresponding to the target second description vector and the target network service interaction data are different network service interaction data corresponding to the same object and have the same directory.

[0048] The following is a detailed description of the configuration process of obtaining the target data security analysis thread based on GCN-assisted configuration in an embodiment of the present disclosure.

[0049] In one possible implementation, the configuration example of the target data security analysis thread includes N network business interaction data examples; the configuration method of the target data security analysis thread is as follows: the target data security analysis thread performs network business interaction data processing on the N network business interaction data examples to obtain a third description vector corresponding to each network business interaction data example; the deep learning thread performs network business interaction data processing on the N network business interaction data examples to obtain a fourth description vector corresponding to each network business interaction data example; determines a first network threat assessment indicator based on the third description vector and the fourth description vector corresponding to each network business interaction data example; and updates the target data security analysis thread based on the first network threat assessment indicator.

[0050] Before configuring the target data security analysis thread, a configuration example is constructed. The configuration example includes N network service interaction data examples, each of which is network service interaction data that has been ID-labeled. The specific value of N can be set according to actual conditions, and this disclosure does not specifically limit this.

[0051] The target network structure includes two branches: a GCN branch and a CNN branch. During the configuration process, the GCN branch and the CNN branch are alternately configured to achieve auxiliary configuration of the CNN branch based on the GCN branch, so that the CNN branch obtained after configuration can be used as the target data security analysis thread of the embodiment of the present disclosure to perform target analysis on the target network service interaction data to be identified.

[0052] The GCN branch and the CNN branch are configured alternately, that is, in the alternating iteration process, the GCN branch and the CNN branch are configured separately. Specifically, in the process of configuring the GCN branch, the network parameters of the CNN branch are fixed and unchanged, and only the network parameters of the GCN branch are adjusted; in the process of configuring the CNN branch, the network parameters of the GCN branch are fixed and unchanged, and only the network parameters of the CNN branch are adjusted. The configuration of the GCN branch and the CNN branch are introduced in detail below.

[0053] The following first introduces the configuration process of the CCN branch.

[0054] The original description vector of D dimension corresponding to each network service interaction data example is input into the GCN branch and the CNN branch respectively. The CNN branch further extracts the description vector of D dimension corresponding to each network service interaction data example to obtain the third description vector corresponding to each network service interaction data example; the GCN branch further extracts the description vector of D dimension corresponding to each network service interaction data example to obtain the fourth description vector corresponding to each network service interaction data example.

[0055] The CNN branch extracts a global description vector from an original description vector of D dimension corresponding to each network business interaction data example to obtain a third description vector corresponding to each network business interaction data example.

[0056] In one possible implementation, network business interaction data processing is performed on N network business interaction data examples through a deep learning thread to obtain a fourth description vector corresponding to each network business interaction data example, including: description vector classification is performed on N network business interaction data examples through a deep learning thread to obtain a first local description vector and a second local description vector corresponding to each network business interaction data example; the first local description vector and the second local description vector corresponding to each network business interaction data example are spliced ​​to obtain a fourth description vector corresponding to each network business interaction data example.

[0057] The local description vector of network service interaction data can better reflect the detailed information of network service interaction data. Therefore, in the GCN branch, the description vector classification method can be adopted to obtain the local description vector reflecting the detailed information of network service interaction data, and then the local description vectors are spliced ​​to obtain the global description vector reflecting the detailed information of different network service interaction data, so as to update the fourth description vector corresponding to each network service interaction data example obtained by the description vector extraction of the GCN branch, and then update the description vector integration capability of the GCN branch.

[0058] When the network service interaction data example is a vehicle network service interaction data example, the first local description vector may be a local description vector containing information such as a window or a driver, and the second local description vector may be a local description vector containing information such as a wheel or a license plate.

[0059] The first local description vector and the second local description vector corresponding to each network service interaction data example are concatenated to obtain a fourth description vector corresponding to each network service interaction data example.

[0060] In one example, the GCN branch may also directly perform a global description vector extraction on an original description vector of D dimensions corresponding to each network service interaction data example to obtain a fourth description vector corresponding to each network service interaction data example, which is not specifically limited in the present disclosure.

[0061] In a possible implementation, the first network threat assessment indicator includes a second network threat assessment indicator; the first network threat assessment indicator is determined according to the third description vector and the fourth description vector corresponding to each network business interaction data example, including: determining the first target description vector description knowledge chain corresponding to each network business interaction data example according to the third description vector corresponding to each network business interaction data example; determining the second target description vector description knowledge chain corresponding to each network business interaction data example according to the fourth description vector corresponding to each network business interaction data example; determining the second network threat assessment indicator according to the first target description vector description knowledge chain and the second target description vector description knowledge chain corresponding to each network business interaction data example.

[0062] In order to assist the configuration of the CNN branch based on the GCN branch so that the CNN branch has the ability to integrate description vectors, according to the third description vector and the fourth description vector corresponding to each network business interaction data example, a first target description vector description knowledge chain of each network business interaction data example in the CNN branch and a second target description vector description knowledge chain in the GCN branch are constructed respectively.

[0063] The way in which the CNN branch constructs the first target description vector to describe the knowledge chain is similar to the way in which the GCN branch constructs the second target description vector to describe the knowledge chain. The following only takes the GCN branch as an example to describe in detail the process of the GCN branch constructing the second target description vector to describe the knowledge chain. The process of the CNN branch constructing the first target description vector to describe the knowledge chain is not repeated.

[0064] In a possible implementation, according to the fourth description vector corresponding to each network business interaction data example, a second target description vector description knowledge chain corresponding to each network business interaction data example is determined, including: taking the fourth description vector corresponding to each network business interaction data example as a description vector attribute corresponding to each network business interaction data example, to obtain N description vector attributes; taking the P most similar description vector attributes with the closest difference to the target description vector attribute as the first-level most similar description vector attribute corresponding to the target description vector attribute, wherein the target description vector attribute is the description vector attribute corresponding to the target network business interaction data example, and the target network business interaction data example is a random one of several network business interaction data examples; taking the Q most similar description vector attributes with the closest difference to each first-level most similar description vector attribute as the second-level most similar description vector attribute corresponding to the target description vector attribute; according to the first-level most similar description vector attribute and the second-level most similar description vector attribute, an original description vector description knowledge chain corresponding to the target network business interaction data example is determined; according to the original description vector description knowledge chain corresponding to the target network business interaction data example, a second target description vector description knowledge chain corresponding to the target network business interaction data example is determined.

[0065] The fourth description vector corresponding to each network service interaction data example can be regarded as a description vector attribute. Since the configuration example includes N network service interaction data examples, N description vector attributes are obtained.

[0066] A random network service interaction data example is used as a target network service interaction data example, that is, the description vector attribute corresponding to the target network service interaction data example is the target description vector attribute. Based on the target description vector attribute, an original description vector description knowledge chain corresponding to the target network service interaction data example is constructed.

[0067] In a possible implementation, the original description vector description knowledge chain corresponding to the target network service interaction data example includes a first description vector attribute set and a first adjacent queue; according to the first-level most similar description vector attribute and the second-level most similar description vector attribute, the original description vector description knowledge chain corresponding to the target network service interaction data example is determined, including: according to the target description vector attribute, performing dimensionless simplification on the N description vector attributes to obtain the dimensionless simplified N description vector attributes; according to the dimensionless simplified first-level most similar description vector attribute and the dimensionless simplified second-level most similar description vector attribute, the dimensionless simplified first-level most similar description vector attribute and the dimensionless simplified second-level most similar description vector attribute are obtained. The second-level most similar description vector attributes after dimension simplification constitute the first description vector attribute set; for the ith description vector attribute in the first description vector attribute set, the m most similar description vector attributes with the closest difference to the ith description vector attribute are determined among the N description vector attributes after dimensionless simplification; the connection between the description vectors is determined between the ith description vector attribute and the jth most similar description vector attribute, wherein the jth most similar description vector attribute is a description vector attribute existing in the first description vector attribute set; and the first adjacent queue is determined according to the matching relationship corresponding to each description vector attribute in the first description vector attribute set.

[0068] In a possible implementation, the second target description vector description knowledge chain includes a second description vector attribute set and a second adjacent queue; according to the original description vector description knowledge chain corresponding to the target network service interaction data example, the second target description vector description knowledge chain corresponding to the target network service interaction data example is determined, including: the description vector attributes that do not exist in the first description vector attribute set among the N description vector attributes after dimensionless simplification are loaded into the first description vector attribute set to form a second description vector attribute set; for the potential description vector attributes in the second description vector attribute set, the most similar description vector attribute corresponding to the potential description vector attribute is determined among the N description vector attributes after dimensionless simplification, wherein the potential description vector attribute is a random description vector attribute that does not exist in the first description vector attribute set among the N description vector attributes after dimensionless simplification; the connection between the potential description vector attribute and the most similar description vector attribute corresponding to the potential description vector attribute is determined; and the second adjacent queue is determined according to the matching relationship corresponding to each description vector attribute in the second description vector attribute set.

[0069] For a random potential description vector attribute in the second description vector attribute set, the most similar description vector attribute corresponding to the potential description vector attribute is determined from the N description vector attributes after dimensionless simplification, and the connection between the potential description vector attribute and the most similar description vector attribute corresponding to the potential description vector attribute is determined.

[0070] Based on the above-mentioned method for determining the connection of potential description vectors, each potential description vector attribute in the second description vector attribute set is traversed to obtain the matching relationship corresponding to each potential description vector attribute in the second description vector attribute set, which will not be described in detail here. According to the matching relationship corresponding to each description vector attribute in the second description vector attribute set, the second adjacent queue included in the second target description vector description knowledge chain can be obtained to indicate that there is a connection between the description vector between the i-th description vector attribute and the j-th description vector attribute in the second target description vector description knowledge chain. It is used to indicate that there is a connection between the potential description vector between the i-th description vector attribute and the j-th description vector attribute in the second target description vector description knowledge chain.

[0071] Since the first target description vector description knowledge chain obtained in the CNN branch for each network service interaction data example and the second target description vector description knowledge chain obtained in the GCN branch both include the N description vector attributes corresponding to all N network service interaction data examples. Therefore, the first target description vector description knowledge chain on the CNN branch and the second target description vector description knowledge chain on the GCN branch for each network service interaction data example achieve description vector attribute alignment.

[0072] According to the first target description vector description knowledge chain and the second target description vector description knowledge chain corresponding to each network service interaction data example, the second network threat assessment indicator included in the first network threat assessment indicator is determined.

[0073] According to the first target description vector description knowledge chain and the second target description vector description knowledge chain corresponding to each network business interaction data example, a graph distillation network threat assessment indicator between the two description vector description knowledge chains can be determined, and the graph distillation network threat assessment indicator is the second network threat assessment indicator included in the first network threat assessment indicator.

[0074] In a possible implementation, the first network threat assessment indicator includes a first network threat assessment indicator; determining the first network threat assessment indicator according to a third description vector and a fourth description vector corresponding to each network business interaction data example, including: classifying N network business interaction data examples according to the third description vector corresponding to each network business interaction data example, and determining a first classification regression analysis result corresponding to each network business interaction data example; classifying N network business interaction data examples according to the fourth description vector corresponding to each network business interaction data example, and determining a second classification regression analysis result corresponding to each network business interaction data example; determining the first network threat assessment indicator according to the first classification regression analysis result and the second classification regression analysis result corresponding to each network business interaction data example.

[0075] In a possible implementation, N network business interaction data examples are classified according to the fourth description vector corresponding to each network business interaction data example, and a second classification regression analysis result corresponding to each network business interaction data example is determined, including: determining the original description vector description knowledge chain corresponding to each network business interaction data example according to the fourth description vector corresponding to each network business interaction data example; utilizing a deep learning thread to integrate the description vectors of the original description vector description knowledge chain corresponding to each network business interaction data example to obtain an integrated description vector corresponding to each network business interaction data example; and classifying N network business interaction data examples according to the integrated description vector corresponding to each network business interaction data example to determine the second classification regression analysis result corresponding to each network business interaction data example.

[0076] Since the GCN branch has the ability to integrate description vectors, the deep learning thread is used to integrate the original description vector description knowledge chain corresponding to each network business interaction data example to obtain the integrated description vector corresponding to each network business interaction data example.

[0077] Among them, according to the fourth description vector corresponding to each network service interaction data example, the original description vector corresponding to each network service interaction data example is determined to describe the knowledge chain method. Please refer to the detailed description of the above embodiment and it will not be repeated here.

[0078] In a possible implementation, updating the target data security analysis thread according to the first network threat assessment indicator includes: updating the target data security analysis thread according to the first network threat assessment indicator and / or the second network threat assessment indicator.

[0079] In one possible implementation, the configuration example also includes a real-time directory corresponding to each network business interaction data example, and the second classification regression analysis result corresponding to each network business interaction data example includes a regression analysis directory corresponding to each network business interaction data example; the configuration method of the target data security analysis thread also includes: determining a second network threat assessment indicator based on the real-time directory and regression analysis directory corresponding to each network business interaction data example; and updating the deep learning thread based on the second network threat assessment indicator.

[0080] The above implementation method is used to determine the second classification regression analysis result corresponding to each network business interaction data example (the specific determination method is as described above and will not be repeated here), wherein the second classification regression analysis result corresponding to each network business interaction data example includes the regression analysis directory corresponding to each network business interaction data example.

[0081] The final updated CNN branch has the ability to integrate description vectors and can be deployed as a target data security analysis thread in target analysis application scenarios to improve the recognition accuracy of target analysis.

[0082] Based on the above, a network security threat detection system is shown, including a processor and a memory that communicate with each other, and the processor is used to read a computer program from the memory and execute it to implement the above method.

[0083] Based on the above, a computer-readable storage medium is also provided, on which a computer program stored implements the above method when running.

[0084] In summary, based on the above scheme, the target data security analysis thread is obtained based on the deep learning thread assisted configuration, so that the target data security analysis thread has the ability to integrate description vectors, and then the first description vector obtained by extracting the description vector of the target network business interaction data through the target data security analysis thread is combined with the target data security analysis thread included in the sample description vector data set. The obtained description vectors are extracted for several reference network business interaction data and several second description vectors are obtained to perform description vector threat detection, so that similar description vectors can obtain threat detection results more accurately, thereby obtaining network security threat detection results with higher accuracy, which can effectively avoid threats to network security and ensure the security and reliability of the network.

[0085] It should be understood that the system and its modules shown above can be implemented in various ways. For example, in some embodiments, the system and its modules can be implemented by hardware, software, or a combination of software and hardware. Among them, the hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or a dedicated design hardware. Those skilled in the art will understand that the above methods and systems can be implemented using computer executable instructions and / or included in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application can not only be implemented by hardware circuits such as ultra-large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but can also be implemented by software such as executed by various types of processors, and can also be implemented by a combination of the above hardware circuits and software (e.g., firmware).

[0086] It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may be produced may be any one or a combination of the above, or any other possible beneficial effects.

Claims

1. A network security threat detection method, characterized in that: include: Extracting description vectors of target network service interaction data through a target data security analysis thread to obtain a first description vector corresponding to the target network service interaction data, wherein the target data security analysis thread is obtained by assisting configuration based on a deep learning thread; The first description vector is subjected to description vector threat detection with several second description vectors included in the sample description vector data set to obtain a network security threat detection result corresponding to the target network service interaction data, wherein the several second description vectors are obtained by extracting description vectors from several reference network service interaction data through the target data security analysis thread.

2. The method according to claim 1, characterized in that The performing network service interaction data processing on the multiple network service interaction data examples by the deep learning thread to obtain a fourth description vector corresponding to each of the network service interaction data examples includes: Performing description vector classification on the multiple network service interaction data examples through the deep learning thread to obtain a first local description vector and a second local description vector corresponding to each of the network service interaction data examples; The first local description vector and the second local description vector corresponding to each of the network service interaction data examples are concatenated to obtain the fourth description vector corresponding to each of the network service interaction data examples.

3. The method according to claim 2, characterized in that The first network threat assessment indicator includes a first network threat assessment indicator; the determining the first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples includes: Classifying the plurality of network service interaction data examples according to the third description vector corresponding to each of the network service interaction data examples, and determining a first classification regression analysis result corresponding to each of the network service interaction data examples; Classifying the plurality of network service interaction data examples according to the fourth description vector corresponding to each of the network service interaction data examples, and determining a second classification regression analysis result corresponding to each of the network service interaction data examples; The first network threat assessment indicator is determined according to the first classification regression analysis result and the second classification regression analysis result corresponding to each of the network business interaction data examples.

4. The method according to claim 3, characterized in that The classifying the plurality of network service interaction data examples according to the fourth description vector corresponding to each of the network service interaction data examples, and determining a second classification regression analysis result corresponding to each of the network service interaction data examples, includes: Determine, according to the fourth description vector corresponding to each of the network service interaction data examples, an original description vector description knowledge chain corresponding to each of the network service interaction data examples; Using the deep learning thread, the original description vector description knowledge chain corresponding to each of the network service interaction data examples is integrated to obtain an integrated description vector corresponding to each of the network service interaction data examples; The plurality of network service interaction data examples are classified according to the integrated description vector corresponding to each of the network service interaction data examples, and the second classification regression analysis result corresponding to each of the network service interaction data examples is determined.

5. The method according to claim 3, characterized in that: The updating of the target data security analysis thread according to the first network threat assessment indicator includes: The target data security analysis thread is updated using the first network threat assessment indicator and / or the second network threat assessment indicator.

6. The method according to claim 1, characterized in that The step of determining, according to the fourth description vector corresponding to each of the network service interaction data examples, a second target description vector corresponding to each of the network service interaction data examples to describe a knowledge chain includes: Taking the fourth description vector corresponding to each of the network service interaction data examples as a description vector attribute corresponding to each of the network service interaction data examples, to obtain a plurality of description vector attributes; Using multiple most similar description vector attributes that are closest to the target description vector attribute as the first-level most similar description vector attribute corresponding to the target description vector attribute, wherein the target description vector attribute is the description vector attribute corresponding to the target network service interaction data example, and the target network service interaction data example is a random one of the multiple network service interaction data examples; Using multiple most similar description vector attributes that are closest to each of the first-level most similar description vector attributes as the second-level most similar description vector attributes corresponding to the target description vector attribute; Determine, according to the first-level most similar description vector attribute and the second-level most similar description vector attribute, an original description vector description knowledge chain corresponding to the target network service interaction data example; Determining the second target description vector description knowledge chain corresponding to the target network service interaction data example according to the original description vector description knowledge chain corresponding to the target network service interaction data example; The original description vector description knowledge chain corresponding to the target network service interaction data example includes a first description vector attribute set and a first adjacent queue; the original description vector description knowledge chain corresponding to the target network service interaction data example is determined according to the first-level most similar description vector attribute and the second-level most similar description vector attribute, including: According to the target description vector attribute, dimensionlessly simplifying the multiple description vector attributes to obtain multiple description vector attributes after dimensionless simplification; According to the plurality of description vector attributes after dimensionless simplification, including the first-level most similar description vector attribute after dimensionless simplification and the second-level most similar description vector attribute after dimensionless simplification, the first description vector attribute set is formed; For a plurality of description vector attributes in the first description vector attribute set, determining a plurality of most similar description vector attributes having the closest difference to the plurality of description vector attributes from the plurality of description vector attributes after dimensionless simplification; determining a description vector connection between the plurality of description vector attributes and the plurality of most similar description vector attributes, wherein the plurality of most similar description vector attributes are description vector attributes present in the first description vector attribute set; determining the first adjacent queue according to a matching relationship corresponding to each of the description vector attributes in the first description vector attribute set; The second target description vector description knowledge chain includes a second description vector attribute set and a second adjacent queue; and determining the second target description vector description knowledge chain corresponding to the target network service interaction data example according to the original description vector description knowledge chain corresponding to the target network service interaction data example includes: Loading description vector attributes that are not present in the first description vector attribute set among the plurality of description vector attributes after dimensionless simplification into the first description vector attribute set to form the second description vector attribute set; For a potential description vector attribute in the second description vector attribute set, determining the most similar description vector attribute corresponding to the potential description vector attribute from the multiple description vector attributes after dimensionless simplification, wherein the potential description vector attribute is a random description vector attribute that does not exist in the first description vector attribute set from the multiple description vector attributes after dimensionless simplification; determining a latent description vector connection between the latent description vector attribute and a most similar description vector attribute corresponding to the latent description vector attribute; The second adjacent queue is determined according to the matching relationship corresponding to each of the description vector attributes in the second description vector attribute set.

7. The method according to claim 4, characterized in that The configuration example also includes a real-time directory corresponding to each of the network service interaction data examples, and the second classification regression analysis result corresponding to each of the network service interaction data examples includes a regression analysis directory corresponding to each of the network service interaction data examples; The configuration method of the target data security analysis thread also includes: Determining a second network threat assessment indicator according to the real-time catalog and the regression analysis catalog corresponding to each of the network service interaction data examples; According to the second network threat assessment indicator, the deep learning thread is updated.

8. The method according to claim 1 or 2, characterized in that: Each reference network service interaction data corresponds to a directory; the first description vector and a plurality of second description vectors included in the sample description vector data set are subjected to description vector threat detection to obtain a network security threat detection result corresponding to the target network service interaction data, including: determining a description vector commonality weight between the first description vector and each of the second description vectors; The second description vector whose commonality weight of the description vector is greater than a preset target value is used as a target second description vector whose threat detection with the first description vector is successful; The directory of the reference network service interaction data corresponding to the target second description vector is used as the network security threat detection result.

9. The method according to claim 1, characterized in that: The configuration example of the target data security analysis thread includes multiple network service interaction data examples; the configuration method of the target data security analysis thread is as follows: Performing network service interaction data processing on the multiple network service interaction data examples through the target data security analysis thread to obtain a third description vector corresponding to each of the network service interaction data examples; Performing network service interaction data processing on the multiple network service interaction data examples through the deep learning thread to obtain a fourth description vector corresponding to each of the network service interaction data examples; Determine a first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples; According to the first network threat assessment indicator, updating the target data security analysis thread; The first network threat assessment indicator includes a second network threat assessment indicator; The determining a first network threat assessment indicator according to the third description vector and the fourth description vector corresponding to each of the network service interaction data examples includes: Determine, according to the third description vector corresponding to each of the network service interaction data examples, a first target description vector description knowledge chain corresponding to each of the network service interaction data examples; Determine, according to the fourth description vector corresponding to each of the network service interaction data examples, a second target description vector description knowledge chain corresponding to each of the network service interaction data examples; The second network threat assessment indicator is determined according to the first target description vector description knowledge chain and the second target description vector description knowledge chain corresponding to each of the network service interaction data examples.

10. A network security threat detection system, characterized in that: The invention comprises a processor and a memory communicating with each other, wherein the processor is used to read a computer program from the memory and execute the computer program to implement the method according to any one of claims 1 to 9.

Images