Network security detection method and device, electronic equipment and storage medium

Abstract

The invention provides a network security detection method and device, electronic equipment and a storage medium, and belongs to the field of artificial intelligence. The method comprises the steps of obtaining sample network data; performing feature extraction on the sample network data through a feature extraction network of a local detection model to obtain sample network features; performing event classification on the sample network features based on a classification network to obtain sample network events of the sample network data; performing network intrusion detection on the sample network event and the sample network feature based on the detection network to obtain sample detection data; training a local detection model based on the sample detection data and the sample network data to obtain a target detection model; network intrusion detection is performed on the target network data through the target detection model to obtain the target detection data, the target detection data is used for representing whether network intrusion exists in the target network data, the accuracy of network intrusion detection can be improved, and the method and the device can be used for a network security detection scene of a financial transaction platform.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a network security detection method and device, an electronic device, and a storage medium. Background Art

[0002] At present, in the field of digital finance, network security is often a part that needs to be focused on. If a financial trading platform is invaded by the network, the network data in the financial trading platform is often at risk of being tampered with, which can easily cause abnormalities in the existing transaction data and payment data on the financial trading platform, which will greatly affect the security and accuracy of transaction data, payment data and other data.

[0003] Deep learning methods are often used in related technologies to detect whether each client has been invaded by the network. This method often has problems such as insufficient sample network data provided by each client, resulting in poor detection accuracy of the trained local detection model. This will cause the local detection model to be unable to fully detect various network attacks, affecting the security of network data. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a network security detection method, a network security detection device, an electronic device and a storage medium, which aim to protect the privacy and security of network data while improving the accuracy of network intrusion detection.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a network security detection method, which is applied to a client, wherein the client stores a pre-trained local detection model, wherein the local detection model includes a feature extraction network, a classification network, and a detection network, and the method includes:

[0006] Get sample network data;

[0007] Extracting features from the sample network data through the feature extraction network to obtain sample network features;

[0008] Performing event classification on the sample network features based on the classification network to obtain sample network events of the sample network data;

[0009] Performing network intrusion detection on the sample network events and the sample network features based on the detection network to obtain sample detection data;

[0010] The local detection model is trained based on the sample detection data and the sample network data to obtain a target detection model; network intrusion detection is performed on the pre-acquired target network data through the target detection model to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

[0011] In some embodiments, performing network intrusion detection on pre-acquired target network data using the target detection model to obtain target detection data includes:

[0012] Extracting features from the target network data based on the feature extraction network to obtain target network traffic features and object behavior features;

[0013] Performing behavior detection on the behavior characteristics of the object based on the detection network to obtain behavior detection data, wherein the behavior detection data is used to characterize whether the behavior of the object generating the target network data is abnormal;

[0014] Performing flow detection on the flow characteristics of the target network based on the detection network to obtain flow detection data, wherein the flow detection data is used to indicate whether the network flow in the target network data is within a preset range;

[0015] The target detection data is obtained based on the behavior detection data and the flow detection data.

[0016] In some embodiments, obtaining the target detection data based on the behavior detection data and the flow detection data includes:

[0017] If the behavior detection data indicates that the behavior of the object is abnormal, and the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is network intrusion in the target network data;

[0018] If the behavior detection data indicates that the behavior of the object is abnormal, or the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is a network intrusion in the target network data;

[0019] If the behavior detection data indicates that there is no abnormality in the behavior of the object, and the traffic detection data indicates that the network traffic is within a preset range, then the target detection data indicates that there is no network intrusion in the target network data.

[0020] In some embodiments, before performing network intrusion detection on the pre-acquired target network data by using the target detection model to obtain target detection data, the method further includes:

[0021] If the target detection data indicates that there is network intrusion in the target network data, obtaining a target network event corresponding to the target network data;

[0022] According to the target network event, alarm prompt information and response strategy information are output.

[0023] In some embodiments, the training of the local detection model based on the sample detection data and the sample network data to obtain the target detection model includes:

[0024] Perform parameter calculation based on the sample detection data and the sample network data to obtain a model loss value and a model accuracy rate;

[0025] Determining local model parameters of the local detection model according to the model loss value;

[0026] Sending the local model parameters, the model accuracy and the number of samples of the sample network data to a server;

[0027] Downloading target model parameters from the server;

[0028] The local model parameters are updated according to the downloaded target model parameters to obtain the target detection model.

[0029] In some embodiments, the performing parameter calculation based on the sample detection data and the sample network data to obtain a model loss value and a model accuracy rate includes:

[0030] Performing gradient calculation based on the sample detection data, the sample network data and a preset learning rate to obtain a model average loss gradient;

[0031] Perform loss calculation based on the average loss gradient of the model to obtain the model loss value;

[0032] The accuracy is calculated based on the reference labels of the sample detection data and the sample network data to obtain the model accuracy.

[0033] In some embodiments, the target model parameters are generated by the server, and the step of generating the target model parameters by the server includes:

[0034] Obtaining the local model parameters, the model accuracy and the number of samples sent by the multiple clients;

[0035] Determining a weight parameter for each of the clients based on the model accuracy and the sample quantity;

[0036] Performing privacy protection processing on the local model parameters through a preset differential privacy mechanism and Gaussian noise to obtain preliminary model parameters;

[0037] The preliminary model parameters are aggregated based on the weight parameters to obtain the target model parameters.

[0038] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a network security detection device, wherein the client stores a pre-trained local detection model, wherein the local detection model includes a feature extraction network, a classification network, and a detection network, and the device includes:

[0039] A sample data acquisition module is used to acquire sample network data;

[0040] A feature extraction module, used to extract features from the sample network data through the feature extraction network to obtain sample network features;

[0041] An event classification module, used for performing event classification on the sample network features based on the classification network to obtain sample network events of the sample network data;

[0042] A first intrusion detection module, configured to perform network intrusion detection on the sample network events and the sample network features based on the detection network to obtain sample detection data;

[0043] A model training module, used for training the local detection model based on the sample detection data and the sample network data to obtain a target detection model;

[0044] The second intrusion detection module is used to perform network intrusion detection on the pre-acquired target network data through the target detection model to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

[0045] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0046] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0047] The network security detection method, network security detection device, electronic device and storage medium proposed in the present application obtain sample network data; extract features of the sample network data through a feature extraction network to obtain sample network features, and can extract various feature information of the sample network data more comprehensively. Then, based on the classification network, the sample network features are classified into events to obtain sample network events of the sample network data; based on the detection network, network intrusion detection is performed on the sample network events and sample network features to obtain sample detection data, which can more conveniently determine the event type and network intrusion detection result of each sample network data. Finally, the local detection model is trained based on the sample detection data and the sample network data to obtain a target detection model; and the target network data acquired in advance is subjected to network intrusion detection through the target detection model to obtain target detection data. The embodiment of the present application uses the sample network data of each client for model training, which can effectively increase the number of samples for model training, and can use the sample network data of each client to train the target detection model to detect various types of network intrusion behaviors, improve the accuracy and comprehensiveness of the target detection model of the client to detect network intrusion behaviors, thereby reducing the risk of data tampering on the client, and improving the data security of various transaction data and payment data on the client. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 is a flow chart of a network security detection method provided by an embodiment of the present application;

[0049] Figure 2 yes Figure 1 Flow chart of step S105 in FIG.

[0050] Figure 3 yes Figure 2 Flow chart of step S201 in FIG.

[0051] Figure 4 is another flow chart of the network security detection method provided by an embodiment of the present application;

[0052] Figure 5 yes Figure 1 Flow chart of step S106 in FIG.

[0053] Figure 6 yes Figure 5 Flow chart of step S504 in FIG.

[0054] Figure 7 is another flow chart of the network security detection method provided by an embodiment of the present application;

[0055] Figure 8 is a schematic diagram of the structure of a network security detection device provided in an embodiment of the present application;

[0056] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0060] First, some nouns involved in this application are analyzed:

[0061] Artificial intelligence (AI) is a new technical science that studies and develops theories, methods, technologies and application systems for simulating, extending and expanding human intelligence. AI is a branch of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robots, language recognition, image recognition, natural language processing and expert systems. AI can simulate the information process of human consciousness and thinking. AI is also a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0062] Natural language processing (NLP): NLP uses computers to process, understand and apply human languages ​​(such as Chinese and English). NLP is a branch of artificial intelligence and an interdisciplinary subject between computer science and linguistics. It is often referred to as computational linguistics. Natural language processing includes grammatical analysis, semantic analysis, and text understanding. Natural language processing is often used in technical fields such as machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, information intent recognition, information extraction and filtering, text classification and clustering, public opinion analysis and opinion mining. It involves data mining related to language processing, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computing.

[0063] Information Extraction (NER): A text processing technology that extracts specified types of entity, relationship, event and other factual information from natural language text and forms structured data output. Information extraction is a technology that extracts specific information from text data. Text data is composed of some specific units, such as sentences, paragraphs, and chapters. Text information is composed of some small specific units, such as characters, words, phrases, sentences, paragraphs, or a combination of these specific units. Extracting noun phrases, names, place names, etc. from text data are all text information extraction. Of course, the information extracted by text information extraction technology can be various types of information.

[0064] Federated Learning: Also known as joint learning, federated learning. Federated learning is a machine learning framework that can effectively help multiple institutions use data and conduct machine learning modeling while meeting the requirements of user privacy protection, data security, and government regulations. As a distributed machine learning paradigm, federated learning can effectively solve the problem of data silos, allowing participants to jointly model without sharing data, which can technically break the data silos and achieve AI collaboration. Federated learning has three major components: data source, federated learning system, and users. In the federated learning system, each data source preprocesses the data, jointly builds its learning model, and feeds the output results back to the user.

[0065] At present, in the field of digital finance, network security is often a part that needs to be focused on. If a financial trading platform is invaded by the network, the network data in the financial trading platform is often at risk of being tampered with, which can easily cause abnormalities in the existing transaction data and payment data on the financial trading platform, which will greatly affect the security and accuracy of transaction data, payment data and other data.

[0066] Deep learning methods are often used in related technologies to detect whether each client has been invaded by the network. This method often has problems such as insufficient sample network data provided by each client, resulting in poor detection accuracy of the trained local detection model. This will cause the local detection model to be unable to fully detect various network attacks, affecting the security of network data.

[0067] Taking a bank as an example, if the network data of Bank A contains network intrusion behaviors including attack type 1 and attack type 2, the local detection model of the client corresponding to Bank A will include the detection function of attack type 1 and attack type 2. If the network data of Bank B contains network intrusion behaviors including attack type 3 and attack type 4, the local detection model of the client corresponding to Bank B will include the detection function of attack type 3 and attack type 4. At this time, since the local detection model of the client corresponding to Bank A does not have log data for detecting attack type 3 and attack type 4, the client corresponding to Bank A often cannot detect network intrusion behaviors of attack type 3 and attack type 4. When network intrusion behaviors of attack type 3 and attack type 4 occur, various transaction data and payment data in the client corresponding to Bank A will be at great risk of being tampered with. Similarly, the client corresponding to Bank B often cannot detect network intrusion behaviors of attack type 1 and attack type 2. This defect will make the detection of the local detection model of each client have great limitations, and it cannot detect different types of network intrusions more comprehensively.

[0068] Based on this, the embodiments of the present application provide a network security detection method, a network security detection device, an electronic device and a storage medium, which aim to protect the privacy and security of network data while improving the accuracy of network intrusion detection.

[0069] The network security detection method and device, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the network security detection method in the embodiments of the present application is described.

[0070] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0071] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0072] The network security detection method provided in the embodiment of the present application relates to the field of artificial intelligence technology. The network security detection method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the network security detection method, etc., but is not limited to the above forms.

[0073] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0074] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to the identity or characteristics of the object, such as object information, object behavior data, object historical data, and object location information, the permission or consent of the object will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the personal information of the object, the separate permission or separate consent of the object will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the separate permission or separate consent of the object, the necessary object-related data for the normal operation of the embodiment of the present application will be obtained.

[0075] Figure 1 is an optional flow chart of the network security detection method provided in the embodiment of the present application. The network intrusion detection method is applied to the client. The client stores a pre-trained local detection model. The local detection model includes a feature extraction network, a classification network and a detection network. Figure 1 The method may include but is not limited to steps S101 to S106.

[0076] Step S101, obtaining sample network data;

[0077] Step S102, extracting features from the sample network data through a feature extraction network to obtain sample network features;

[0078] Step S103, classifying the sample network features based on the classification network to obtain sample network events of the sample network data;

[0079] Step S104, performing network intrusion detection on sample network events and sample network features based on the detection network to obtain sample detection data;

[0080] Step S105, training a local detection model based on the sample detection data and the sample network data to obtain a target detection model;

[0081] Step S106, performing network intrusion detection on the pre-acquired target network data through the target detection model to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

[0082] In the steps S101 to S106 shown in the embodiment of the present application, sample network data is obtained; the sample network data is feature extracted by the feature extraction network to obtain sample network features, and various feature information of the sample network data can be extracted more comprehensively. Then, based on the classification network, the sample network features are classified into events to obtain sample network events of the sample network data; based on the detection network, network intrusion detection is performed on the sample network events and sample network features to obtain sample detection data, which can more conveniently determine the event type and network intrusion detection result of each sample network data. Finally, the local detection model is trained based on the sample detection data and the sample network data to obtain the target detection model; and the target network data acquired in advance is subjected to network intrusion detection through the target detection model to obtain the target detection data. The embodiment of the present application uses the sample network data of each client for model training, which can effectively increase the number of samples for model training, and can use the sample network data of each client to train the target detection model to detect various types of network intrusion behaviors, improve the accuracy and comprehensiveness of the target detection model of the client to detect network intrusion behaviors, thereby reducing the risk of data tampering on the client, and improving the data security of various transaction data and payment data on the client.

[0083] In step S101 of some embodiments, a web crawler can be used to crawl data from a preset data source to obtain sample network data of each client, wherein the preset data source includes but is not limited to transaction details records, consumption behavior records, etc. of the sample object using the client on the financial platform, and the sample network data includes object behavior data, network traffic data, etc. of the sample object.

[0084] Furthermore, by machine labeling or manual labeling, it is determined whether there is network intrusion in the sample network data based on the object behavior data, network traffic data, etc. of the sample object, and a corresponding label is given to each sample network data based on the judgment result.

[0085] In step S102 of some embodiments, since the sample network data includes time-based network traffic data, host-based network traffic data, host behavior data, and communication connection content data, etc. Therefore, when extracting features from the sample network data through the feature extraction network, firstly, according to different data types, the feature extraction network is used to perform multi-dimensional feature extraction on the sample network data to obtain sample communication content features, sample network traffic features, and sample object behavior features. Then, feature splicing is performed on the sample communication content features, sample network traffic features, and sample object behavior features to obtain sample network features.

[0086] In step S103 of some embodiments, when classifying the sample network features based on the classification network to obtain the sample network events of the sample network data, the classification network includes classification functions such as the softmax function. The probability distribution of the sample network data on each preset network event is calculated using the classification function in the classification network to obtain the probability vector corresponding to the sample network data. Since the probability vector can characterize the probability of the sample network data belonging to each preset network event, the preset network event corresponding to the largest probability vector is selected as the sample network event of the sample network data.

[0087] It should be noted that the preset network events include Trojan horse events, vulnerability exploitation events, network worm events, etc.

[0088] In step S104 of some embodiments, when network intrusion detection is performed on sample network events and sample network features based on the detection network, multiple detection methods such as signature detection and rule detection can be used to determine whether the sample network data has network intrusion. Under the judgment of multiple detection methods, if there is a detection method indicating that the sample network data has network intrusion, the obtained sample detection data is that the sample network data has network intrusion.

[0089] It should be noted that signature detection refers to pre-defining some known attack features or attack codes, and detecting whether the sample network features have these attack features or attack codes by scanning network traffic or system files. If the sample network features have these attack features or attack codes, then the sample network data has network intrusion.

[0090] It should be noted that rule detection refers to pre-defining some rules to determine whether the sample network features meet these rules. For example, the pre-defined rule is that if a certain object visits a certain website more than 10 times within five days, it is determined that there is a network intrusion; or the pre-defined rule is that if a certain IP address sends more than 5 requests in one hour, it is determined that there is a network intrusion.

[0091] See also Figure 2 In some embodiments, step S105 may include but is not limited to steps S201 to S205:

[0092] Step S201, performing parameter calculation based on sample detection data and sample network data to obtain a model loss value and a model accuracy rate;

[0093] Step S202, determining local model parameters of the local detection model according to the model loss value;

[0094] Step S203, sending the local model parameters, model accuracy and sample quantity of sample network data to the server;

[0095] Step S204, downloading target model parameters from the server;

[0096] Step S205, updating the local model parameters according to the downloaded target model parameters to obtain the target detection model.

[0097] In step S201 of some embodiments, firstly, a gradient calculation is performed based on the sample detection data, the sample network data and the preset learning rate to obtain the model average loss gradient. Then, a loss calculation is performed based on the model average loss gradient to obtain the model loss value. Finally, an accuracy calculation is performed based on the reference labels of the sample detection data and the sample network data to obtain the model accuracy.

[0098] In step S202 of some embodiments, the local detection model is updated with model parameters according to the model loss value, and the current model parameters w of the local detection model of the cth client are updated. t Updated to That is, the local model parameters are

[0099] In step S203 of some embodiments, local model parameters, model accuracy and sample quantity of sample network data are sent to the server through the federation system, so that the server can aggregate the encrypted data of all clients and generate target model parameters.

[0100] In step S204 of some embodiments, target model parameters are downloaded from the server side through the federation system; wherein the target model parameters are obtained by the server side according to local model parameters sent by multiple clients.

[0101] In step S205 of some embodiments, when updating the local model parameters according to the downloaded target model parameters and training the local detection model, the sample network data is used again to perform model training to obtain the target detection model. The training process is basically the same as the processing process of steps S102 to S105 above, and will not be repeated here.

[0102] Through the above steps S201 to S205, the sample network data of multiple clients can be used to train the local detection model, so that the local detection model can better learn the patterns and distribution of samples with network intrusions and normal samples, thereby improving the training effect of the local detection model, and then improving the detection accuracy of the generated target detection model for network intrusions.

[0103] See also Figure 3 In some embodiments, step S201 may include but is not limited to steps S301 to S303:

[0104] Step S301, performing gradient calculation based on sample detection data, sample network data and a preset learning rate to obtain a model average loss gradient;

[0105] Step S302, performing loss calculation based on the model average loss gradient to obtain a model loss value;

[0106] Step S303, calculating the accuracy based on the reference labels of the sample detection data and the sample network data to obtain the model accuracy.

[0107] In step S301 of some embodiments, the model parameter w may be used to analyze the sample network data (x i ,y i ) to predict the loss, and define the loss function as L(x i ,y i ; w), the preset learning rate is defined as η, where x i is the i-th sample network data, y i is the label of the i-th sample network data. For the c-th client, the local detection model of the c-th client uses a fixed learning rate η and the current model parameter w t Calculate the average loss gradient of the model for all sample network data locally on the client Among them, x c is the sample network data of the cth client, y c is the sample network data label of the cth client.

[0108] In step S302 of some embodiments, when the loss is calculated based on the model average loss gradient to obtain the model loss value, the model average loss gradient and the learning rate are multiplied to obtain the model loss value Update the model parameters of the local detection model according to the model loss value, and change the current model parameters w t Updated to That is, the local model parameters are

[0109] in,

[0110] In step S303 of some embodiments, when calculating the accuracy based on the sample detection data and the reference labels of the sample network data, the total number of sample network data is determined, and then the number of sample network data whose sample detection data is consistent with the reference labels is counted, and the number of sample network data whose sample detection data is consistent with the reference labels is divided by the total number of sample network data to obtain the model accuracy.

[0111] It should be noted that for a group of C clients, since each client has a local data set is the feature vector of the i-th sample network data, is the label of the feature vector of the i-th sample network data, n c Represents the number of clients participating in federated learning. Each C client has its own local dataset. i |=n c . Then the loss function L(x i ,y i ; w) is expressed as shown in formula (1).

[0112]

[0113] Through the above steps S301 to S303, the accuracy and reliability of the sample detection data of the sample network data of each client can be calculated more conveniently, so as to use the accuracy of the sample detection data and the number of samples of each client to determine the weight of each client during global update, which is conducive to improving the rationality and accuracy of the weight configuration.

[0114] See also Figure 4 In some embodiments, the target model parameters are generated by the server, and the steps of generating the target model parameters by the server may include but are not limited to steps S401 to S404:

[0115] Step S401, obtaining local model parameters, model accuracy and sample quantity sent by multiple clients;

[0116] Step S402, determining a weight parameter for each client based on the model accuracy and the number of samples;

[0117] Step S403, performing privacy protection processing on the local model parameters through a preset differential privacy mechanism and Gaussian noise to obtain preliminary model parameters;

[0118] Step S404: Aggregate the preliminary model parameters based on the weight parameters to obtain target model parameters.

[0119] In step S401 of some embodiments, local model parameters, model accuracy, and number of samples sent by each client are obtained through the federal system.

[0120] In step S402 of some embodiments, the model accuracy of all clients is first added together to obtain the sum of model accuracy, and then the model accuracy of each client is divided by the sum of model accuracy to obtain the accuracy weight of each client. Next, the number of samples of all clients is added together to obtain the total number of samples, and then the number of samples of each client is divided by the total number of samples to obtain the sample weight of each client. Finally, the accuracy weight and the sample weight are weighted and summed to obtain the weight parameter of each client.

[0121] In step S403 of some embodiments, when the local model parameters are subjected to privacy protection processing by using the preset differential privacy mechanism and Gaussian noise, the pruning threshold is set to S. If the local model parameters of the client are less than the pruning threshold S, the local model parameters are retained. If the local model parameters of the client are not less than the pruning threshold S, the local model parameters are updated to the pruning threshold S, thereby updating the local model parameters of all clients. Then, the Gaussian noise N(0,σ 2 S 2 ) is added to the update results of all pruned local model parameters, where the Gaussian noise satisfies a normal Gaussian distribution with a mean of 0 and a standard deviation of σS. Specifically, when the local model parameters of the client are not less than the pruning threshold S, the process of updating the local model parameters to the pruning threshold S can be expressed as shown in formula (3).

[0122]

[0123] in, is the mean of the local model parameters, w c are the local model parameters of the cth client.

[0124] In step S404 of some embodiments, the preliminary model parameters are aggregated based on the weight parameters to obtain the target model parameters, which can be expressed as shown in formula (4).

[0125]

[0126] Among them, w t+1 is the target model parameter obtained by aggregating all local model parameters on the server side, w t is the model parameter of the local detection model of the client in the previous iteration. C is the total number of clients participating in federated learning, are the local model parameters of the local detection model of the cth client; is the model accuracy of the cth client.

[0127] Through the above steps S401 to S404, network intrusions of different clients can be detected in real time while occupying fewer resources. At the same time, when the network data and detection data of different clients are used to dynamically adjust the model parameters of the model aggregation, the differential privacy mechanism and Gaussian noise are used to protect the privacy of the model parameters of each client, which can effectively reduce the risk of leakage of object transaction data, payment data and other data of each client, and improve the privacy and security of the data.

[0128] See also Figure 5In some embodiments, step S106 may include but is not limited to steps S501 to S504:

[0129] Step S501, extracting features from target network data based on a feature extraction network to obtain target network traffic features and object behavior features;

[0130] Step S502, performing behavior detection on the behavior features of the object based on the detection network to obtain behavior detection data;

[0131] Step S503, performing flow detection on the target network flow characteristics based on the detection network to obtain flow detection data;

[0132] Step S504, obtaining target detection data based on the behavior detection data and the flow detection data.

[0133] In step S501 of some embodiments, the specific implementation process of obtaining the target network data is similar to the above-mentioned step S101, and will not be repeated to save space. Since the target network data contains host-based network traffic data, time-based network traffic data, object behavior data based on object behavior, etc. Therefore, feature extraction can be performed separately for different data types in the target network data. Specifically, based on the feature extraction network, behavioral features are extracted from the target network data to obtain object behavior features. Similarly, based on the feature extraction network, time traffic features are extracted from the target network data to obtain time-based network traffic features, and based on the feature extraction network, host traffic features are extracted from the target network data to obtain host-based network traffic features; the host-based network traffic features and the time-based network traffic features are feature spliced ​​to obtain the final target network traffic features.

[0134] It should be noted that time-based network traffic features refer to the statistics and analysis of events in network traffic. Among them, time-based network traffic features include: number of connection attempts, number of login failures, number of window scans, number of active connections, etc. These time-based network traffic features are used to analyze network traffic to determine whether there is network intrusion in the target network data.

[0135] It should be noted that object behavior characteristics refer to login behavior, access behavior, data transmission behavior, etc.

[0136] It should be noted that the host-based network traffic characteristics may include the host's inbound and outbound traffic, transmission protocol, source IP address, destination IP address, source port and destination port, etc. Information derived from data packets. The host-based network traffic characteristics may also include the number of connections, connection duration, connection type, connection direction, etc. of the host for recording each connection. The host-based network traffic characteristics may also include session information such as the number of sessions between hosts, session duration, and session type.

[0137] In step S502 of some embodiments, the detection network includes a detection function. The detection function can be used to perform behavior detection on the object behavior feature. The detection function is a binary classification function, such as a softmax function, etc. The detection function is used to calculate the abnormality score of the object behavior feature in the behavior detection task, and the object behavior feature can be used to detect whether there is network intrusion in the target network data from the object behavior that generates the target network data. If the abnormality score is higher than a preset first threshold, the behavior detection data is determined as the object behavior is abnormal; if the abnormality score is not higher than the preset first threshold, the behavior detection data is determined as the object behavior does not have abnormal behavior. The behavior detection data is used to characterize whether there is abnormality in the object behavior that generates the target network data, wherein the abnormal object behavior includes abnormal login, abnormal access, and abnormal data transmission, etc.

[0138] In step S503 of some embodiments, reference traffic features corresponding to normal network traffic data are stored in the detection network. Specifically, a preset similarity algorithm or other preset algorithm is used to perform difference detection on the reference traffic features in the detection network and the target network traffic features, and the inverse of the similarity is used as the difference detection value. Then, the difference detection value is compared with a preset second threshold value. If the difference detection value is less than the second threshold value, the traffic detection data indicates that the network traffic in the target network data is within a preset range; if the difference detection value is not less than the second threshold value, the traffic detection data indicates that the network traffic in the target network data is not within a preset range. The traffic detection data is used to characterize whether the network traffic in the target network data is within a preset range.

[0139] In other embodiments, a signature-based detection method can also be used in the detection network to determine whether the network traffic is within a preset range. Specifically, some known attack features or attack codes are predefined to detect whether the target network traffic features contain these attack features or attack codes. If the target network traffic features contain these attack features or attack codes, the traffic detection data will indicate that the network traffic of the target network data is abnormal. If the target network traffic features do not contain these attack features and attack codes, the traffic detection data will indicate that the network traffic of the target network data is normal.

[0140] In step S504 of some embodiments, in order to improve detection accuracy, when at least one of the behavior detection data and the flow detection data has an abnormal detection, the target detection data may be determined as target network data having network intrusion.

[0141] It should be noted that the network intrusion in the embodiments of the present application includes but is not limited to Trojan attacks, denial of service attacks, network worm attacks, port scanning attacks, SQL injection attacks, common service vulnerability attacks, etc.

[0142] Through the above steps S501 to S504, various feature information in the target network data can be extracted more conveniently, and different detection methods can be adopted to perform network detection according to different feature information. The final detection data can be generated by combining the detection results of various features to determine whether there is network intrusion in the target network data, which can improve the accuracy and reliability of network intrusion detection in the target network data.

[0143] See also Figure 6 In some embodiments, step S504 includes but is not limited to steps S601 to S603:

[0144] Step S601, if the behavior detection data indicates that the behavior of the target is abnormal, and the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is a network intrusion in the target network data;

[0145] Step S602: If the behavior detection data indicates that the behavior of the target is abnormal, or the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is a network intrusion in the target network data;

[0146] Step S603, if the behavior detection data indicates that the target behavior is not abnormal, and the traffic detection data indicates that the network traffic is within a preset range, then the target detection data indicates that there is no network intrusion in the target network data.

[0147] In step S601 and step S602 of some embodiments, if the behavior detection data indicates that the behavior of the object is abnormal, it indicates that the behavior of the object generating the target network data may have network intrusion; if the flow detection data indicates that the network flow is not within a preset range, it indicates that the target network data may have network intrusion. Therefore, when the behavior detection data indicates that the behavior of the object is abnormal, and / or the flow detection data indicates that the network flow is not within a preset range, the target detection data indicates that the target network data has network intrusion.

[0148] In step S603 of some embodiments, if the behavior detection data indicates that the behavior of the object is not abnormal, it indicates that the behavior of the object generating the target network data does not have a network intrusion; if the flow detection data indicates that the network flow is within a preset range, it indicates that the target network data does not have a network intrusion. Therefore, when the behavior detection data indicates that the behavior of the object is not abnormal, and the flow detection data indicates that the network flow is within a preset range, the target detection data indicates that the target network data does not have a network intrusion.

[0149] Through the above steps S601 to S603, it is possible to more conveniently combine the flow detection data and the behavior detection data to determine whether there is network intrusion in the target network data, thereby improving the accuracy and efficiency of network intrusion detection.

[0150] See also Figure 7 In some embodiments, after step S106, the network security detection method may further include but is not limited to steps S701 to S702:

[0151] Step S701, if the target detection data indicates that there is a network intrusion in the target network data, then a target network event corresponding to the target network data is obtained;

[0152] Step S702: output alarm prompt information and response strategy information according to the target network event.

[0153] In step S701 of some embodiments, if the target detection data indicates that there is a network intrusion in the target network data, the target network data is classified and processed by the classification network of the target detection model to obtain the target network event corresponding to the target network data. This process is similar to the specific implementation process of the above-mentioned step S103 and will not be repeated here to save space.

[0154] In step S702 of some embodiments, in order to effectively distinguish the difference of target network data, different alarm prompt information is set for different target network events, and the alarm prompt information can be in the form of sound prompt or light prompt, etc., without limitation. After determining the target network event corresponding to the target network data, a series of optional policy information is pre-set for different network events, and the policy information corresponding to the target network event is selected from the preset policy information as the response policy information, so that corresponding response measures can be taken for the network intrusion behavior of the target network data based on the response policy information, such as isolating abnormal traffic, blocking the attack source, etc., so as to protect network security.

[0155] Through the above steps S701 to S702, network intrusion behavior can be detected more conveniently, and an alarm reminder for the network intrusion behavior can be issued and corresponding countermeasures can be taken, which can improve the processing efficiency of the network intrusion behavior.

[0156] See also Figure 8 The embodiment of the present application further provides a network security detection device, which can implement the above network security detection method. The network security detection device is applied to a client, and the client stores a pre-trained local detection model. The local detection model includes a feature extraction network, a classification network and a detection network. The network security detection device includes:

[0157] The sample data acquisition module 801 is used to acquire sample network data;

[0158] A feature extraction module 802 is used to extract features from sample network data through a feature extraction network to obtain sample network features;

[0159] An event classification module 803 is used to classify sample network features based on a classification network to obtain sample network events of sample network data;

[0160] A first intrusion detection module 804 is used to perform network intrusion detection on sample network events and sample network features based on a detection network to obtain sample detection data;

[0161] A model training module 805 is used to train a local detection model based on sample detection data and sample network data to obtain a target detection model;

[0162] The second intrusion detection module 806 is used to perform network intrusion detection on the pre-acquired target network data through a target detection model to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

[0163] The specific implementation of the network security detection device is basically the same as the specific implementation of the above-mentioned network security detection method, and will not be repeated here.

[0164] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above network security detection method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0165] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0166] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0167] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the network security detection method of the embodiment of this application;

[0168] Input / output interface 903, used to implement information input and output;

[0169] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0170] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0171] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0172] An embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the above-mentioned network security detection method.

[0173] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0174] The network security detection method, network security detection device, electronic device and computer-readable storage medium provided in the embodiment of the present application obtain sample network data; extract features of the sample network data through a feature extraction network to obtain sample network features, and can extract various feature information of the sample network data more comprehensively. Then, based on the classification network, the sample network features are classified into events to obtain sample network events of the sample network data; based on the detection network, network intrusion detection is performed on the sample network events and sample network features to obtain sample detection data, which can more conveniently determine the event type and network intrusion detection result of each sample network data. Finally, the local detection model is trained based on the sample detection data and the sample network data to obtain a target detection model; and the target network data acquired in advance is subjected to network intrusion detection through the target detection model to obtain target detection data. The embodiment of the present application uses the sample network data of each client for model training, which can effectively increase the number of samples for model training, and can use the sample network data of each client to train the target detection model to detect various types of network intrusion behaviors, improve the accuracy and comprehensiveness of the target detection model of the client to detect network intrusion behaviors, thereby reducing the risk of data tampering on the client, and improving the data security of various transaction data and payment data on the client.

[0175] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0176] It can be understood by those skilled in the art that Figure 1-7 The technical solutions shown in the figure do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than those shown in the figure, or a combination of certain steps, or different steps.

[0177] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0178] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0179] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0180] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0181] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0182] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0184] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0185] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A network security detection method, characterized in that: Applied to a client, the client stores a pre-trained local detection model, the local detection model includes a feature extraction network, a classification network and a detection network, and the method includes: Get sample network data; Extracting features from the sample network data through the feature extraction network to obtain sample network features; Performing event classification on the sample network features based on the classification network to obtain sample network events of the sample network data; Performing network intrusion detection on the sample network events and the sample network features based on the detection network to obtain sample detection data; Training the local detection model based on the sample detection data and the sample network data to obtain a target detection model; The target detection model is used to perform network intrusion detection on the pre-acquired target network data to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

2. The network security detection method according to claim 1, characterized in that: The performing network intrusion detection on the pre-acquired target network data by using the target detection model to obtain target detection data includes: Extracting features from the target network data based on the feature extraction network to obtain target network traffic features and object behavior features; Performing behavior detection on the behavior characteristics of the object based on the detection network to obtain behavior detection data, wherein the behavior detection data is used to characterize whether the behavior of the object generating the target network data is abnormal; Performing flow detection on the flow characteristics of the target network based on the detection network to obtain flow detection data, wherein the flow detection data is used to indicate whether the network flow in the target network data is within a preset range; The target detection data is obtained based on the behavior detection data and the flow detection data.

3. The network security detection method according to claim 2, characterized in that: The obtaining the target detection data based on the behavior detection data and the flow detection data includes: If the behavior detection data indicates that the behavior of the object is abnormal, and the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is network intrusion in the target network data; If the behavior detection data indicates that the behavior of the object is abnormal, or the traffic detection data indicates that the network traffic is not within a preset range, then the target detection data indicates that there is a network intrusion in the target network data; If the behavior detection data indicates that there is no abnormality in the behavior of the object, and the traffic detection data indicates that the network traffic is within a preset range, then the target detection data indicates that there is no network intrusion in the target network data.

4. The network security detection method according to claim 3, characterized in that: Before performing network intrusion detection on the pre-acquired target network data by using the target detection model to obtain target detection data, the method further includes: If the target detection data indicates that there is network intrusion in the target network data, obtaining a target network event corresponding to the target network data; According to the target network event, alarm prompt information and response strategy information are output.

5. The network security detection method according to any one of claims 1 to 4, characterized in that: The training of the local detection model based on the sample detection data and the sample network data to obtain the target detection model includes: Perform parameter calculation based on the sample detection data and the sample network data to obtain a model loss value and a model accuracy rate; Determining local model parameters of the local detection model according to the model loss value; Sending the local model parameters, the model accuracy and the number of samples of the sample network data to a server; Downloading target model parameters from the server; The local model parameters are updated according to the downloaded target model parameters to obtain the target detection model.

6. The network security detection method according to claim 5, characterized in that: The performing parameter calculation based on the sample detection data and the sample network data to obtain a model loss value and a model accuracy rate includes: Performing gradient calculation based on the sample detection data, the sample network data and a preset learning rate to obtain a model average loss gradient; Perform loss calculation based on the average loss gradient of the model to obtain the model loss value; The accuracy is calculated based on the reference labels of the sample detection data and the sample network data to obtain the model accuracy.

7. The network security detection method according to claim 5, characterized in that: The target model parameters are generated by the server, and the step of generating the target model parameters by the server includes: Obtaining the local model parameters, the model accuracy and the number of samples sent by the multiple clients; Determining a weight parameter for each of the clients based on the model accuracy and the sample quantity; Performing privacy protection processing on the local model parameters through a preset differential privacy mechanism and Gaussian noise to obtain preliminary model parameters; The preliminary model parameters are aggregated based on the weight parameters to obtain the target model parameters.

8. A network security detection device, characterized in that: Applied to a client, the client stores a pre-trained local detection model, the local detection model includes a feature extraction network, a classification network and a detection network, and the device includes: A sample data acquisition module is used to acquire sample network data; A feature extraction module, used to extract features from the sample network data through the feature extraction network to obtain sample network features; An event classification module, used for performing event classification on the sample network features based on the classification network to obtain sample network events of the sample network data; A first intrusion detection module, configured to perform network intrusion detection on the sample network event and the sample network feature based on the detection network to obtain sample detection data; A model training module, used for training the local detection model based on the sample detection data and the sample network data to obtain a target detection model; The second intrusion detection module is used to perform network intrusion detection on the pre-acquired target network data through the target detection model to obtain target detection data, wherein the target detection data is used to characterize whether there is network intrusion in the target network data.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the network security detection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network security detection method according to any one of claims 1 to 7 is implemented.

Images