Network risk identification method, system and device, medium and program product

Abstract

The invention discloses a network risk identification method, system and device, a medium and a program product, and the method comprises the steps: obtaining to-be-identified network communication data, carrying out the feature extraction of the to-be-identified network communication data through a pre-trained feature extraction model, obtaining the network feature data of the to-be-identified network communication data, and carrying out the feature extraction of the to-be-identified network communication data; dimensionality reduction is carried out on the network feature data through a pre-trained feature dimensionality reduction model, network feature data after dimensionality reduction are obtained, the feature dimensionality reduction model is obtained through training of a trustworthiness region optimization strategy based on a chaotic sequence, and the network feature data after dimensionality reduction are obtained; and finally, carrying out classification identification on the network feature data after dimension reduction through a pre-trained classifier model to obtain a network risk identification result. According to the invention, the stability of the feature dimension reduction model can be improved, so that the accuracy of network risk identification is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network risk identification method, system, equipment, medium and program product. Background Art

[0002] In today's digital age, cybersecurity has become a global concern. With the development of artificial intelligence (AI), especially machine learning and deep learning, new solutions have been developed for network risk identification. That is, by learning a large amount of network communication data through machine learning models, potential risk patterns and abnormal behaviors can be identified, thereby effectively identifying complex network threats.

[0003] However, with the increasing complexity of the network environment and the increase in the number of protocol types, it is necessary to reduce the dimensionality of high-dimensional network communication data by training machine learning models. However, the training algorithm of the existing feature dimensionality reduction model lacks exploration capabilities and is prone to fall into local optimality, resulting in poor efficiency and stability in the training of the feature dimensionality reduction model. As a result, after the dimensionality reduction process, the data cannot retain key information while reducing the data dimension, affecting the accuracy of subsequent risk identification. Summary of the invention

[0004] The present invention provides a network risk identification method, system, device, medium and program product, which can improve the efficiency and stability of feature dimension reduction model training, thereby improving the accuracy of network risk identification.

[0005] To solve the above technical problems, an embodiment of the present invention provides a network risk identification method, including:

[0006] Obtaining network communication data to be identified;

[0007] Extracting features from the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified;

[0008] The network feature data is reduced in dimension by using a pre-trained feature dimension reduction model to obtain the reduced-dimensional network feature data; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence;

[0009] The network feature data after dimensionality reduction is classified and identified through a pre-trained classifier model to obtain a network risk identification result.

[0010] As an improvement of the above solution, the feature extraction model is trained by the following steps:

[0011] Preprocessing historical network communication training data to construct first network communication training data;

[0012] Expanding the first network communication training data through a quantum generative adversarial network model to obtain second network communication training data;

[0013] Based on the second network communication training data, an adaptive random fractal search algorithm is used to train the pre-built feature extraction model to obtain a trained feature extraction model.

[0014] As an improvement of the above scheme, the quantum generative adversarial network model includes a generator and a discriminator, and the quantum generative adversarial network model is trained by the following steps:

[0015] Inputting the third network communication training data into the generator, performing a quantum gate operation on the original random noise of the third network communication training data to obtain quantum state encoded noise; wherein the quantum gate operation includes a combination of a rotation gate and a superposition gate based on quantum gate operation parameters;

[0016] Based on the noise after quantum state encoding, generating fourth network communication training data through the generator, mixing the fourth network communication training data with the third network communication training data to obtain fifth network communication training data;

[0017] Training the discriminator and the generator according to the fifth network communication training data;

[0018] The quantum gate operation parameters, the parameters of the generator and the parameters of the discriminator are updated according to the target loss function until a preset first stop condition is met to obtain a trained quantum generative adversarial network model.

[0019] As an improvement of the above solution, the target loss function includes a generator loss function, a discriminator loss function and a quantum state regularization loss function;

[0020] The generator loss function is constructed based on the distribution of the original random noise with the goal of minimizing the ability of the discriminator to correctly identify the third network communication training data;

[0021] The discriminator loss function is constructed based on the distribution of the original random noise with the goal of maximizing the ability of the discriminator to distinguish between the third network communication training data and the fourth network communication training data;

[0022] The quantum state regularization loss function is constructed based on the Euclidean distance between the noise encoded by the quantum state and the original random noise.

[0023] As an improvement of the above solution, the method of using an adaptive random fractal search algorithm to train a pre-built feature extraction model to obtain a trained feature extraction model includes:

[0024] Selecting an initial parameter space of the feature extraction model, and setting an initial parameter search point, an initial search granularity, and an initial search radius;

[0025] If the information entropy of the current parameter search point is lower than the preset threshold, the search granularity is updated according to the first adjustment function, the parameter search point with the smallest loss value is found to update the current parameter search point, and the parameter space is updated according to the second adjustment function;

[0026] The current search radius is updated according to the loss function of the current parameter search point until the preset second stop condition is met to obtain a trained feature extraction model;

[0027] Among them, the first adjustment function is determined according to the historical search efficiency index, the information entropy of the current parameter search point and the loss function of the current parameter search point; the second adjustment function is determined according to the loss value of the current search point and the loss values ​​of the surrounding search points of the current search point.

[0028] As an improvement of the above solution, the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence, including:

[0029] The pre-built feature dimension reduction model is trained based on the high-dimensional network feature samples; wherein the high-dimensional network feature samples are obtained by extracting features from network communication data samples using the feature extraction model;

[0030] During the training process, a trust region optimization strategy based on chaotic sequences is used to update the parameters of the feature dimensionality reduction model until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0031] As an improvement of the above scheme, the pre-constructed feature dimensionality reduction model includes an encoder and a decoder. During the training process, a trust region optimization strategy based on a chaotic sequence is used to update the parameters of the feature dimensionality reduction model until a preset third stop condition is met, thereby obtaining a trained feature dimensionality reduction model, including:

[0032] Generate a chaotic sequence in each iterative training, and adjust the size of the trust region according to the chaotic sequence;

[0033] The parameters of the encoder and the decoder are updated according to the size of the trust region until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0034] As an improvement of the above solution, the classifier model is constructed based on a support vector machine, and the classifier model is trained by the following steps:

[0035] Inputting low-dimensional network feature data into a support vector machine, solving the support vector machine using a method combining feature importance weighting and linear programming, screening low-dimensional network feature samples, and constructing a low-dimensional network feature sample set based on the low-dimensional network feature samples;

[0036] The support vector machine is trained based on the low-dimensional network feature sample set, and the parameters of the support vector machine are updated by a cross-validation method until a preset fourth stopping condition is met, thereby obtaining a trained classifier model.

[0037] To solve the above technical problems, an embodiment of the present invention further provides a network risk identification system, including:

[0038] A data acquisition module, used to acquire network communication data to be identified;

[0039] A feature extraction module, used to extract features of the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified;

[0040] A feature dimension reduction module, used to reduce the dimension of the network feature data by using a pre-trained feature dimension reduction model to obtain the network feature data after dimension reduction; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence;

[0041] The risk identification module is used to classify and identify the network feature data after dimensionality reduction through a pre-trained classifier model to obtain a network risk identification result.

[0042] To solve the above technical problems, an embodiment of the present invention further provides a network risk identification device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the network risk identification method as described in any one of the above when executing the computer program.

[0043] To solve the above technical problems, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the network risk identification methods described above.

[0044] To solve the above technical problems, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the network risk identification method as described in any one of the above.

[0045] Compared with the prior art, the network risk identification method, system, device, medium and program product provided by the embodiment of the present invention first obtains the network communication data to be identified, and extracts the features of the network communication data to be identified through a pre-trained feature extraction model to obtain the network feature data of the network communication data to be identified, and then reduces the dimension of the network feature data through a pre-trained feature dimension reduction model to obtain the network feature data after dimension reduction, wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence, and finally the network feature data after dimension reduction is classified and identified by a pre-trained classifier model to obtain the network risk identification result. The present invention uses a trust region optimization strategy based on a chaotic sequence to train the feature dimension reduction model, which can make it have a global search capability, help find the global optimal solution, thereby enhancing the training efficiency and stability of the feature dimension reduction model, and then using the pre-trained feature dimension reduction model to perform data dimension reduction, which can reduce the data dimension while retaining key information, improve the accuracy of network risk identification, and at the same time reduce the computational complexity of the classification process after feature dimension reduction, and improve the efficiency of network risk identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the present invention, the drawings used in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 It is a flowchart of a network risk identification method provided by an embodiment of the present invention;

[0048] Figure 2 is another flow chart of a network risk identification method provided by an embodiment of the present invention;

[0049] Figure 3 It is a structural block diagram of a network risk identification system provided by an embodiment of the present invention;

[0050] Figure 4 It is a structural block diagram of a network risk identification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] See also Figure 1 , Figure 1 : is a flow chart of a network risk identification method provided by an embodiment of the present invention, wherein the network risk identification method comprises steps S1 to S4:

[0053] S1. Obtaining network communication data to be identified;

[0054] S2. Extracting features from the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified;

[0055] S3, reducing the dimension of the network feature data by using a pre-trained feature dimension reduction model to obtain the network feature data after dimension reduction; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence;

[0056] S4. Classify and identify the network feature data after dimensionality reduction through a pre-trained classifier model to obtain a network risk identification result.

[0057] Exemplarily, the network traffic data to be identified can be preprocessed, and then a trained feature extraction model can be used to extract key features from the preprocessed data. Then, a feature dimension reduction model trained using a trust region optimization strategy based on a chaotic sequence can be used to reduce the dimension of the extracted key features. Furthermore, the reduced feature vector can be input into a trained classifier model to obtain a network risk identification result. Furthermore, a final risk identification report can be generated based on the network risk identification result to help network administrators take corresponding security protection measures.

[0058] In one implementation, the network risk identification results include three categories: normal, suspicious, and malicious.

[0059] In summary, a network risk identification method provided by an embodiment of the present invention adopts a trust region optimization strategy based on chaotic sequences to train a feature dimensionality reduction model, which can enable it to have a global search capability, help find the global optimal solution, and thus enhance the stability of the feature dimensionality reduction model. Then, the pre-trained feature dimensionality reduction model is used to perform data dimensionality reduction, which can reduce the data dimension while retaining key information, thereby improving the accuracy of network risk identification. At the same time, after feature dimensionality reduction, the computational complexity of the classification process is reduced, thereby improving the efficiency of network risk identification.

[0060] In an optional embodiment, the feature extraction model is trained by the following steps:

[0061] Preprocessing historical network communication training data to construct first network communication training data;

[0062] Expanding the first network communication training data through a quantum generative adversarial network model to obtain second network communication training data;

[0063] Based on the second network communication training data, an adaptive random fractal search algorithm is used to train the pre-built feature extraction model to obtain a trained feature extraction model.

[0064] Specifically, the historical network communication training data in the embodiment of the present invention is collected by using a network traffic capture tool to obtain historical network communication data from multiple network layers and protocol types. Preferably, the network traffic capture tool can be Wireshark (network packet analysis tool) or Tcpdump (network packet capture tool).

[0065] Furthermore, the collected data is stored in a structured data format. Preferably, the data storage format may be JSON or XML format.

[0066] In one embodiment, the data packet has the following attributes:

[0067] a x : Source IP address, indicating the source of the data packet.

[0068] a y : Destination IP address, indicating the receiving destination of the data packet.

[0069] a z : Protocol type, such as TCP (Transmission Control Protocol, connection-oriented transmission control protocol), UDP (User Datagram Protocol, message-oriented transport layer protocol), etc., identifies the protocol of network communication.

[0070] aa : Source port number, combined with the source IP address, is used to identify the sender's application.

[0071] a b : Destination port number, combined with the destination IP address, is used to identify the receiving application.

[0072] a c : Transport layer payload size, which indicates the number of bytes of data transmitted in the data packet.

[0073] a d : Session duration, which indicates the duration of a communication.

[0074] a e : Data packet sequence number, used to identify the order in which data packets are sent.

[0075] a f : Confirmation sequence number, used to confirm the received data packet.

[0076] It should be emphasized that the above is only used as an example to illustrate a data format and type used in the embodiment of the present invention. In actual applications, the attributes of data can usually reach dozens or even hundreds.

[0077] Furthermore, the collected data may be manually annotated. Preferably, the annotated categories include normal, suspicious, and malicious.

[0078] It is understandable that in actual model training tasks, the collection, labeling and preprocessing of training data are time-consuming and labor-intensive, and insufficient training samples can easily lead to poor model generalization ability and affect the accuracy of the model. Therefore, the embodiment of the present invention also expands the training data set preprocessed after collection through a quantum generative adversarial network model (a generative adversarial network algorithm based on quantum information quantum state reconstruction) to improve the quality and quantity of training samples.

[0079] In an optional embodiment, the quantum generative adversarial network model includes a generator and a discriminator, and the quantum generative adversarial network model is trained by the following steps:

[0080] Inputting the third network communication training data into the generator, performing a quantum gate operation on the original random noise of the third network communication training data to obtain quantum state encoded noise; wherein the quantum gate operation includes a combination of a rotation gate and a superposition gate based on quantum gate operation parameters;

[0081] Based on the noise after quantum state encoding, generating fourth network communication training data through the generator, mixing the fourth network communication training data with the third network communication training data to obtain fifth network communication training data;

[0082] Training the discriminator and the generator according to the fifth network communication training data;

[0083] The quantum gate operation parameters, the parameters of the generator and the parameters of the discriminator are updated according to the target loss function until a preset first stop condition is met to obtain a trained quantum generative adversarial network model.

[0084] Furthermore, the target loss function includes a generator loss function, a discriminator loss function and a quantum state regularization loss function;

[0085] The generator loss function is constructed based on the distribution of the original random noise with the goal of minimizing the ability of the discriminator to correctly identify the third network communication training data;

[0086] The discriminator loss function is constructed based on the distribution of the original random noise with the goal of maximizing the ability of the discriminator to distinguish between the third network communication training data and the fourth network communication training data;

[0087] The quantum state regularization loss function is constructed based on the Euclidean distance between the noise encoded by the quantum state and the original random noise.

[0088] It should be noted that the third network communication training data is the original real network communication data input into the quantum generative adversarial network model, the fourth network communication training data is the new network communication data generated by the generator, and the fifth network communication training data is a mixture of the real network communication data and the newly generated network communication data.

[0089] It should be noted that the quantum generative adversarial network model adopts a generative adversarial network algorithm based on quantum information quantum state reconstruction, and the generative adversarial network algorithm based on quantum information quantum state reconstruction consists of two parts: a generator (G) and a discriminator (D). The generator is responsible for generating new data that is close to the real network protocol data, and the discriminator attempts to distinguish between the generated data and the real data. Among them, the input of the generator not only includes the random noise of the training data, but also integrates the quantum state coding technology in quantum information processing, which can improve the diversity and quality of the generated data. In addition, the embodiment of the present invention adopts a quantum state regularization loss function to optimize the training process of the generator and the discriminator, which can ensure that the generated data is more in line with the characteristics of quantum physics, thereby improving the effectiveness of data expansion and the generalization ability of the model.

[0090] Exemplarily, the training process of the quantum generative adversarial network model includes steps 201 to 208:

[0091] Step 201: Randomly initialize the parameters of the generator and the discriminator;

[0092] Specifically, the parameters of the generator and the discriminator include their weight parameters and bias parameters, respectively. Preferably, the random initialization method obeys the normal distribution. Among them, both the generator and the discriminator adopt a 3-layer fully connected network, and the number of neurons in the hidden layer is 256 and 512, respectively.

[0093] Step 202: Input the real network communication training data (third network communication training data) into the generator, and perform quantum state encoding on the random noise of the real network communication training data. Specifically, let the random noise vector be z, and the noise vector after quantum state encoding be z q , then the quantum state encoding method can be expressed as:

[0094] z q =U(θ)z;

[0095] Where U(θ) is a quantum gate operation based on parameter θ, which is used to simulate the evolution of the quantum state; z represents the input random noise vector. Preferably, the parameter θ of each quantum gate is initialized by a random variable uniformly distributed in the range [0,2π].

[0096] Preferably, the quantum gate operation U(θ) is a combination of a rotation gate and a superposition gate based on a parameter θ, where θ={θ1,θ2,...,θ n} is the parameter controlling the quantum gate operation, then the calculation method of U(θ) can be expressed as:

[0097] U(θ)=R(θ n )·...·R(θ2)·R(θ1);

[0098] In the formula, R(θ i ) is a revolving door, according to the parameter θ i Perform specific rotation operations on the qubits.

[0099] It should be noted that this step uses the concept of quantum computing to expand the representation capability of noise, converting random noise into a form with quantum information characteristics, thereby enhancing the diversity of generated data.

[0100] Step 203: Receive the quantum state encoded noise vector z through the generator q , and generate new network communication data (fourth network communication training data). Specifically, the generator G receives the noise vector z after quantum state encoding q Generate new network communication data x gen can be expressed as:

[0101] x gen =G(z q ; φ);

[0102] Where φ represents the parameters of the generator G.

[0103] Step 204: Mix the newly generated network communication data with the real network communication data, assuming that the real network communication data set is X real , the newly generated network communication dataset x gen The data is mixed with the real network communication data set to obtain the mixed data set X mix (Fifth network communication training data):

[0104] X mix =X real ∪x gen ;

[0105] Step 205: Based on the mixed data set X mix The discriminator is trained to learn to distinguish between generated network communication data and real network communication data. The goal of the discriminator D is to maximize its ability to distinguish between generated network communication data and real network communication data.

[0106] Preferably, the loss function of the discriminator is set to L D , which is calculated as:

[0107]

[0108] In the formula, ψ represents the parameters of the discriminator D, represents the expected value, and p(z) is the distribution of random noise z.

[0109] Furthermore, the calculation method of the logarithm logD(x;ψ) can be expressed as:

[0110]

[0111] Where f(x; ψ) is the scoring function of the discriminator for the input x under the parameter ψ, which can be expressed as:

[0112] f(x;ψ)=w T x+b;

[0113] Where w and b are the weight and bias parameters of the discriminator, respectively.

[0114] Furthermore, the discriminator's evaluation of the generated data D(G(z q ; φ); ψ) can be calculated as:

[0115]

[0116] In the formula, f(G(z q; φ);ψ) is the scoring function of the discriminator for the generated data, and the calculation method can be expressed as:

[0117] f(G(z q ;φ);ψ)=w T G(z q ;φ)+b;

[0118] Step 206: Use the feedback from the discriminator to train the generator and adjust the parameters of the generator to generate network communication data that is difficult for the discriminator to distinguish. The goal of the generator is to minimize the ability of the discriminator to correctly identify the generated data. Preferably, the loss function L of the generator is G The calculation method can be expressed as:

[0119]

[0120] Step 207: During the training of the generator and the discriminator, the quantum state regularization loss function L is used QR Ensure that the generated data retains the characteristics of the quantum state, while optimizing the training efficiency of the model and the quality of the generated data.

[0121] Preferably, the quantum state regularization loss function L QR The calculation method can be expressed as:

[0122] L QR =λ qr ·(∥z q -U(θ)z∥ 2 );

[0123] In the formula, λ qr is the weight coefficient of the regularization term. Preferably, the parameter λ qr is set to 0.1.

[0124] Furthermore, ∥z q -U(θ)z∥ 2 Represents the noise vector z after quantum state encoding q The square of the Euclidean distance between the random noise vector z and the original input can be expressed as:

[0125]

[0126] In the formula, z qi is the noise vector z after quantum state encoding q The i-th element of n )·...·R(θ1)z) i It is the i-th element of the vector after the quantum gate operation, which represents the transformation result of the i-th element of the original input random noise vector z after the rotation and superposition gate operations.

[0127] Step 208: Repeat the above steps to update the quantum gate operation parameter θ, the parameter φ of the generator and the parameter ψ of the discriminator according to the target loss function until the preset first stop iteration condition is met, indicating that the model training is completed.

[0128] Preferably, during the iteration process, the total objective loss function L total The calculation method can be expressed as:

[0129] L total =L D +L G +L QR ;

[0130] By gradient descent method, L total Perform optimization and update the parameters φ, ψ and θ.

[0131] It should be noted that the preset first stopping iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0132] Furthermore, the data expanded by the quantum generative adversarial network can be input into a pre-built feature extraction model to train the feature extraction model.

[0133] In a preferred embodiment, the method of using an adaptive random fractal search algorithm to train a pre-built feature extraction model to obtain a trained feature extraction model includes:

[0134] Selecting an initial parameter space of the feature extraction model, and setting an initial parameter search point, an initial search granularity, and an initial search radius;

[0135] If the information entropy of the current parameter search point is lower than the preset threshold, the search granularity is updated according to the first adjustment function, the parameter search point with the smallest loss value is found to update the current parameter search point, and the parameter space is updated according to the second adjustment function;

[0136] The current search radius is updated according to the loss function of the current parameter search point until the preset second stop condition is met to obtain a trained feature extraction model;

[0137] Among them, the first adjustment function is determined according to the historical search efficiency index, the information entropy of the current parameter search point and the loss function of the current parameter search point; the second adjustment function is determined according to the loss value of the current search point and the loss values ​​of the surrounding search points of the current search point.

[0138] It should be noted that some existing solutions use neural networks for feature extraction. In some neural network structures, traditional neural network parameter optimization algorithms, such as gradient descent and its variants, mainly rely on calculating the gradient of the loss function relative to each parameter to guide the direction of parameter updating. However, such methods are prone to fall into local optimal solutions when faced with complex, non-convex loss surfaces.

[0139] It is worth noting that the feature extraction model of the embodiment of the present invention includes a 3-layer fully connected neural network, and an adaptive random fractal search algorithm is used to train the feature extraction model. Among them, the adaptive random fractal search algorithm is inspired by the self-similarity and ubiquitous characteristics of fractal structures in nature, as well as the complexity and self-organization in fractal theory. Fractal structures are widely present in nature, such as the shape of snowflakes, the outline of mountains, etc., which show similarities at different scales. The embodiment of the present invention introduces this self-similarity principle into the parameter optimization process of the neural network feature extraction model, and explores the parameter space of the neural network by simulating the generation process of fractal structures in nature, thereby achieving efficient optimization of the weights and bias parameters of the neural network feature extraction model.

[0140] Exemplarily, the pre-built feature extraction model is trained using an adaptive random fractal search algorithm, including steps 301 to 307:

[0141] Step 301, select an initial parameter set, that is, randomly generate a set of parameters as a starting point according to the structure of the neural network, and set the initial granularity and initial radius of the search;

[0142] Specifically, the initial parameter set is set to θ0, including the weight w and bias b of the neural network, and the search granularity δ0 and the search radius r0 are initialized. Preferably, the parameter δ0 is set to 0.1, r0 is set to 1, and the parameter set θ0 is initialized by random initialization.

[0143] Step 302: In each iteration, a group of self-similar exploration points are generated according to the current parameter point to generate a fractal structure. The exploration points are distributed around the current point according to fractal rules to form a pattern similar to the fractal structure in nature.

[0144] Specifically, according to the current parameter point θ i , generate a set of self-similar exploration points {θ i,j}, where j indicates the jth exploration point, and sine and cosine functions are used to generate points distributed on the sphere of a high-dimensional space to simulate the distribution of fractal structures in nature. In one embodiment, the exploration points are distributed in the following form:

[0145] θ i,j =θ i +r i ·δi ·cos(2πj / N)+r i ·δ i sin(2πj / N);

[0146] Where N is the number of exploration points generated in the current iteration, δ i is the current search granularity, r i is the current search radius.

[0147] It should be noted that the two items cos(2πj / N) and sin(2πj / N) actually define the position of a point on a unit circle in a high-dimensional parameter space. In order to make the adjustment so that the distribution of the exploration points can be richer and more flexible, and the exploration points are not only distributed on the standard circular trajectory, but can be adjusted based on the fractal dimension D, preferably, the fractal dimension D is used to adjust the angle distribution. The calculation method can be expressed as:

[0148]

[0149] Where D represents the fractal dimension, which affects the distribution density of exploration points in space and how to adjust the distribution of these exploration points according to fractal theory.

[0150] Step 303: Optimizing the search process of neural network parameters by using a dynamic information entropy feedback mechanism;

[0151] Specifically, let the set of all exploration points in the current iteration be S = {θ i,j}, where i is the number of iterations and j is the index of the exploration point. Further, for each exploration point, calculate its loss function value L(θ i,j ), and normalize the loss function values ​​so that their sum is 1. The normalization process can be expressed as:

[0152]

[0153] In the formula, p(θ i,j ) represents the exploration point θ i,j The normalized weight of .

[0154] Further, calculate the current exploration point set {θ i,j The information entropy H(S) of} can be expressed as:

[0155] H(S)=-∑ j p(θ i,j )log p(θ i,j );

[0156] Furthermore, f(H(S)) and g(H(S)) are defined as adjustment functions based on the information entropy H(S), which are used to adjust the search granularity and search radius respectively. The calculation method can be expressed as:

[0157]

[0158] Wherein, H0 is a preset information entropy threshold. Preferably, the information entropy threshold H0 is set to 0.8.

[0159] It is worth noting that by calculating the information entropy of the current exploration point set, dynamically adjusting the search strategy to respond to the complexity changes of the parameter space, and dynamically adjusting the search granularity and radius, the global search capability and adaptability of the adaptive random fractal search algorithm can be enhanced, thereby exploring the parameter space more effectively.

[0160] Step 304: Adaptively and dynamically adjust the search granularity according to the loss function value of the current exploration point;

[0161] Preferably, if the loss of multiple exploration points is low, the search granularity is reduced to refine the search; if the loss is high, the search granularity is increased to speed up the search.

[0162] Specifically, according to the loss function L(θ i,j ) at the exploration point {θ i,j}, dynamically adjust the search granularity δ i+1 (the first adjustment function) can be expressed as:

[0163]

[0164] In the formula, α self is the reduction factor, β self is the expansion factor, L(θ i ) is the parameter θ i The loss value at this time, Ω is an indicator based on the historical search efficiency. Preferably, the reduction factor α self is set to 0.9, the expansion factor β self is set to 1.1.

[0165] Furthermore, the calculation method of the index Ω based on historical search efficiency is as follows:

[0166]

[0167] Where k represents the number of historical iterations.

[0168] It is worth noting that the method of adaptively and dynamically adjusting the search granularity can ensure that the search granularity is refined when a better solution is found, and is increased when it is difficult to find a better solution, so as to speed up the exploration.

[0169] Step 305: According to the loss function value L(θ i,j ), select the point with the smallest loss as the new current point, which can be expressed as:

[0170]

[0171] In the formula, θ i+1 is the optimal parameter exploration point of the current iteration, and T(θ,Λ) is the transformation function.

[0172] Furthermore, in the transformation function T(θ,Λ), θ represents a point in the original parameter space, Λ represents a transformation parameter set, and the purpose of the transformation function T(θ,Λ) is to map the original parameter space to a new space so as to search in the new space. The transformation function can be expressed as:

[0173] T(θ,Λ)=θ·exp(λ(θ,Λ));

[0174] Where λ(θ,Λ) is a dynamic adjustment function based on the current point θ and the transformation parameter set Λ, which is used to control the local enlargement or reduction of the parameter space.

[0175] Furthermore, the dynamic adjustment function λ(θ,Λ) (second adjustment function) adjusts the strength of the transformation according to the loss value of the current search point and the loss values ​​of its surrounding points. The calculation method can be expressed as:

[0176]

[0177] In the formula, κ is a regulating factor, Σ -1 It is the inverse of the loss gradient covariance matrix of the current exploration point set, which is used to measure the heterogeneity of the loss function changes in different directions in the parameter space.

[0178] It is worth noting that the dynamic adjustment function improves the search efficiency and accuracy of the algorithm in different areas by dynamically adjusting the representation of the parameter space, that is, by dynamically nonlinearly transforming the parameter space, the algorithm can more effectively adapt to the local characteristics of the loss function. The dynamic nonlinear transformation can be regarded as the use of an adaptive mirror in the parameter space. The adaptive mirror dynamically adjusts its shape according to the local characteristics of the loss function, thereby achieving local enlargement or reduction of the search space and accelerating the algorithm to find the optimal solution.

[0179] Step 306: dynamically adjust the search radius according to the effect of the current iteration;

[0180] Specifically, the search radius is dynamically adjusted according to the degree of improvement of the loss function, and the adjustment method r i+1 (The third adjustment function) can be expressed as:

[0181]

[0182] In the formula, ΔL=L(θ i )-L(θ i+1 ),∈ ad is a threshold value set to determine whether the loss function has been significantly improved. Preferably, the expansion factor γ ad is set to 1.05, the reduction factor λ ad is set to 0.95, ∈ ad Set to 0.01.

[0183] In order to make the adjustment of the search radius more detailed, so that the search radius can be adaptively adjusted according to the actual improvement of the loss function, in another embodiment, a nonlinear adjustment factor Φ(ΔL,∈) is defined to consider the relationship between the loss function improvement ΔL and the threshold ∈, which can be expressed as:

[0184]

[0185] The search radius is adjusted by the nonlinear adjustment factor, which can be expressed as:

[0186] r i+1 =r i ·(γ·Φ(ΔL,∈)+λ·(1-Φ(ΔL,∈)));

[0187] It is worth noting that dynamically adjusting the search radius can further optimize the breadth and depth of the search to explore the parameter space more effectively.

[0188] Step 307, repeat the above steps until the preset second stop iteration condition is met, which means that the model training is completed.

[0189] It should be noted that the preset second stopping iteration condition is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0190] It should be noted that the adaptive random fractal search algorithm used in the embodiment of the present invention does not rely on gradient information, but uses a self-similar exploration mode to search in the parameter space, so that the algorithm has a higher probability of jumping out of the local optimal solution and exploring a wider parameter space. In addition, the adaptive random fractal search algorithm adopts an adaptive mechanism to dynamically adjust the granularity and direction of the search according to the current search state, so as to more flexibly adapt to different task scenarios, and can effectively improve the parameter optimization efficiency of the neural network.

[0191] In a preferred embodiment, the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence, including:

[0192] The pre-built feature dimension reduction model is trained based on the high-dimensional network feature samples; wherein the high-dimensional network feature samples are obtained by extracting features from network communication data samples using the feature extraction model;

[0193] During the training process, a trust region optimization strategy based on chaotic sequences is used to update the parameters of the feature dimensionality reduction model until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0194] In another preferred embodiment, the pre-constructed feature dimensionality reduction model includes an encoder and a decoder. During the training process, a trust region optimization strategy based on a chaotic sequence is used to update the parameters of the feature dimensionality reduction model until a preset third stop condition is met to obtain a trained feature dimensionality reduction model, including:

[0195] Generate a chaotic sequence in each iterative training, and adjust the size of the trust region according to the chaotic sequence;

[0196] The parameters of the encoder and the decoder are updated according to the size of the trust region until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0197] It should be noted that the embodiment of the present invention adopts an improved autoencoder structure, which consists of two main parts: an encoder and a decoder. Among them, the encoder is responsible for compressing the input feature vector into a low-dimensional representation, and the decoder is responsible for reconstructing this low-dimensional representation back to the original high-dimensional feature vector. At the same time, the encoder and decoder are trained using a trust region optimization strategy based on chaotic sequences to optimize and update their parameters, ensuring that each step of optimization can effectively explore the parameter space, thereby improving the coding efficiency.

[0198] Exemplarily, the training process of the feature dimensionality reduction model constructed by the encoder and the decoder includes steps 401 to 407:

[0199] Step 401: Initialize the parameters of encoder E and decoder D, that is, their weights W e and W d , bias b e and b d Initialize; the initialization method is:

[0200]

[0201] In the formula, ~ is a symbol that obeys a specific distribution, Represents a normal distribution in the interval (0,0.01).

[0202] Step 402: obtain a high-dimensional network feature vector through the trained feature extraction model, and input the high-dimensional network feature vector into a pre-built feature dimension reduction model, and compress the input feature vector into a low-dimensional representation through an encoder using a nonlinear transformation;

[0203] Among them, the input high-dimensional feature vector x is obtained by the encoder to obtain the low-dimensional representation z as follows:

[0204] z=Sig(W e x+b e );

[0205] Where Sig() is the Sigmoid activation function.

[0206] Step 403: The low-dimensional representation z is reconstructed back to the original high-dimensional feature vector x′ through the decoder. In this process, the optimal sparse expression strategy is used to optimize the reconstruction quality and realize the sparse representation of the data:

[0207] x′=Sig(W d z+b d );

[0208] Step 404: In each iteration, generate a chaotic sequence c t , as part of the trust region optimization strategy, is used to adjust the optimization search direction and enhance the global search capability.

[0209] Preferably, the chaotic sequence c t The generation method is:

[0210] c t =4c t-1 (1-c t-1 );

[0211] In the formula, c t-1 is the chaotic sequence value generated in the previous step, and the initial value c0 is set between (0,1). Preferably, c0 is set to 0.7.

[0212] In generating the chaotic sequence c t Based on the trust region size, the increment Δ t The calculation method is:

[0213] Δ t =Δ t-1 ·(1+β ty ·c t );

[0214] In the formula, β ty is the chaotic sequence adjustment factor. Preferably, β ty Set to 0.3.

[0215] Step 405: Calculate the loss function L(x, x′) according to the difference between the reconstructed high-dimensional feature vector x′ and the original input feature vector x; wherein the loss function L(x, x′) includes not only the above difference but also a regularization term of sparse representation;

[0216] Specifically, the loss function L(x,x′) is calculated as:

[0217]

[0218] In the formula, ∥∥2 represents the L2 norm, ∥∥1 represents the L1 norm, and λ s is the sparse regularization coefficient. Preferably, λ s Set to 0.3.

[0219] Furthermore, the regularization term ∥z∥1 of the sparse representation is calculated as:

[0220]

[0221] Where ∥z∥1 is the L1 norm of the low-dimensional representation z, that is, the sum of the absolute values ​​of all elements, n is the dimension of the low-dimensional representation, and z i is the i-th element in z.

[0222] Step 406: according to the gradient of the loss function, update the parameters of the encoder and the decoder using a trust region optimization strategy based on chaotic sequences;

[0223] Specifically, the method of updating the parameters of the encoder and decoder using the trust region optimization strategy based on chaotic sequences is as follows:

[0224]

[0225] In the formula, is the loss function for the encoder and decoder parameters (the weights W of the encoder respectively e and bias b e , the decoder weight W d , and bias b d ), the gradient of TRCO(), the optimization function of each parameter;

[0226] Specifically, the optimization function TRCO() optimizes the parameters through the gradient descent method and adjusts the size of the trust region, which can be expressed as:

[0227]

[0228]

[0229] Where η es is the learning rate, They are respectively the loss function L with respect to the encoder weight W e , encoder bias b e , decoder weight W d , decoder bias b d The gradient of t is the trust region size in the current iteration, are respectively the updated encoder weight, encoder bias, decoder weight, and decoder bias. Preferably, η es Set to 0.01.

[0230] Step 407, repeat the above steps until the preset third stop iteration condition is met, which means that the model training is completed.

[0231] It should be noted that the preset third condition for stopping iteration is reaching a preset maximum number of iterations. Preferably, the preset maximum number of iterations is set to 1000 times.

[0232] It is worth noting that the present invention adopts a trust region optimization strategy based on chaotic sequences in the training process of the encoder and decoder, that is, a chaotic sequence is generated in each step of the encoder and decoder parameter optimization, and the size of the trust region is adjusted with the generated chaotic sequence, thereby enhancing the randomness of the parameter search and the global exploration ability, thereby avoiding falling into the local optimum. In addition, in the decoder, by adopting the optimal sparse expression strategy, the reconstructed feature vector can achieve a higher compression ratio while maintaining the original information as much as possible, thereby improving the generalization ability of the model.

[0233] Furthermore, after completing the training of the feature dimensionality reduction model, low-dimensional network feature data is obtained through the trained feature dimensionality reduction model so as to train the pre-built classifier model.

[0234] In a preferred embodiment, the classifier model is constructed based on a support vector machine, and the classifier model is trained by the following steps:

[0235] Inputting low-dimensional network feature data into a support vector machine, solving the support vector machine using a method combining feature importance weighting and linear programming, screening low-dimensional network feature samples, and constructing a low-dimensional network feature sample set based on the low-dimensional network feature samples;

[0236] The support vector machine is trained based on the low-dimensional network feature sample set, and the parameters of the support vector machine are updated by a cross-validation method until a preset fourth stopping condition is met, thereby obtaining a trained classifier model.

[0237] Exemplarily, the training step of the classifier includes steps 501 to 504:

[0238] Step 501: inputting the low-dimensional feature vector data obtained from the feature dimension reduction model into a classifier model; wherein the classifier model is pre-built based on a support vector machine;

[0239] Specifically, let the input low-dimensional feature vector set be X = {x1, x2, ..., x N}, where each is the low-dimensional feature vector obtained after training the above feature dimensionality reduction model.

[0240] Step 502: Initialize the parameters of the classifier model;

[0241] Specifically, in the support vector machine, the radial basis function is selected as the kernel function, and the parameters of the classifier model are the weight w and bias b of the support vector machine.

[0242] Step 503: Solve the support vector machine by combining feature importance weighting with linear programming, select the most useful low-dimensional network feature samples for classification, and construct a low-dimensional network feature sample set based on the low-dimensional network feature samples;

[0243] Specifically, a linear programming method is used to solve the initial support vector and classification plane, and the objective function and constraints are constructed to maximize the interval between two categories.

[0244] In one embodiment, the objective function A is:

[0245]

[0246] The constraints of the objective function A are:

[0247] y i (w T x i +b)≥1-ξ i ;

[0248]

[0249] In the formula, y i For sample x i The label, C is the regularization parameter of the support vector machine, ξ i is a slack variable used to deal with the situation of incomplete separability.

[0250] In another preferred embodiment, an integer variable z is used to transform the optimization problem into a mixed integer linear programming problem, and the objective function B is:

[0251]

[0252] The constraints of objective function B are:

[0253] y i (w T x i +b)≥1-ξ i ;

[0254]

[0255] In the formula, z j Select indicator variables for features, λ ed is the regularization parameter for feature selection. Preferably, λ ed Set to 0.3.

[0256] It should be noted that the regularization parameter C controls the balance between the edge of the decision boundary and the classification error. Preferably, the value of C is determined by cross-validation. During the cross-validation process, the candidate value of C may traverse a predefined range, such as:

[0257] C∈{10 -3 ,10 -2 ,...,10 3};

[0258] In the embodiment of the present invention, the C value that minimizes the cross-validation error is selected as the final choice.

[0259] It should be noted that for the feature selection indicator variable z j , the purpose of integer programming is to select the most useful feature subset for classification in order to train the classifier model, then the feature subset can be expressed as:

[0260]

[0261] The constraints are:

[0262]

[0263] In the formula, λ j is the cost or importance weight associated with feature j, which is preset manually.

[0264] Step 504: adjust the weight and bias of the support vector machine according to each iteration result until the fourth preset stop condition is met to obtain a trained classifier model.

[0265] Preferably, a gradient descent method can be used to solve the above objective function A or B, thereby obtaining the optimal support vector machine weight w and bias b.

[0266] It is worth mentioning that the reduced-dimensional data is input into the support vector machine for classifier training, and the support vector machine classification algorithm based on mixed integer linear programming is adopted. According to the robust optimization principle and combined with feature importance weighting, the sensitivity of the classification boundary to the key features is adjusted, so that the trained classifier model has better resistance to outliers and noise.

[0267] Finally, the trained models are used to complete the network risk identification task.

[0268] In summary, see Figure 2 , Figure 2 is another flow chart of a network risk identification method provided by an embodiment of the present invention, such as Figure 2 As shown, first, network communication data is collected and manually labeled, and then the labeled data is expanded on this basis. The feature extraction model is first trained based on the expanded data, and then the high-dimensional network feature data obtained from the feature extraction model training is used as the input of the feature dimensionality reduction model, so as to train the feature dimensionality reduction model, and then the low-dimensional network feature data obtained from the feature dimensionality reduction model training is used as the input of the classifier model, and finally the classifier model is trained, and the trained classifier model is applied to the network risk identification task.

[0269] See also Figure 3 , Figure 3 : is a structural block diagram of a network risk identification system 200 provided in an embodiment of the present invention, wherein the network risk identification system 200 comprises:

[0270] A data acquisition module 21 is used to acquire network communication data to be identified;

[0271] A feature extraction module 22 is used to extract features of the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified;

[0272] The feature dimension reduction module 23 is used to reduce the dimension of the network feature data by using a pre-trained feature dimension reduction model to obtain the network feature data after dimension reduction; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence;

[0273] The risk identification module 24 is used to classify and identify the network feature data after dimension reduction through a pre-trained classifier model to obtain a network risk identification result.

[0274] In one embodiment, the feature extraction module 22 further includes a feature extraction model training module, and the feature extraction model training module includes:

[0275] A data preprocessing unit, used to preprocess the historical network communication training data to construct the first network communication training data;

[0276] A data expansion unit, configured to expand the first network communication training data through a quantum generative adversarial network model to obtain second network communication training data;

[0277] The feature extraction model training unit is used to train the pre-built feature extraction model based on the second network communication training data by using an adaptive random fractal search algorithm to obtain a trained feature extraction model.

[0278] The quantum generative adversarial network model includes a generator and a discriminator, and the quantum generative adversarial network model is trained by the following steps:

[0279] Inputting the third network communication training data into the generator, performing a quantum gate operation on the original random noise of the third network communication training data to obtain quantum state encoded noise; wherein the quantum gate operation includes a combination of a rotation gate and a superposition gate based on quantum gate operation parameters;

[0280] Based on the noise after quantum state encoding, generating fourth network communication training data through the generator, mixing the fourth network communication training data with the third network communication training data to obtain fifth network communication training data;

[0281] Training the discriminator and the generator according to the fifth network communication training data;

[0282] The quantum gate operation parameters, the parameters of the generator and the parameters of the discriminator are updated according to the target loss function until a preset first stop condition is met to obtain a trained quantum generative adversarial network model.

[0283] Furthermore, the objective loss function includes a generator loss function, a discriminator loss function, and a quantum state regularization loss function;

[0284] The generator loss function is constructed based on the distribution of the original random noise with the goal of minimizing the ability of the discriminator to correctly identify the third network communication training data;

[0285] The discriminator loss function is constructed based on the distribution of the original random noise with the goal of maximizing the ability of the discriminator to distinguish between the third network communication training data and the fourth network communication training data;

[0286] The quantum state regularization loss function is constructed based on the Euclidean distance between the noise encoded by the quantum state and the original random noise.

[0287] In one implementation, the feature extraction model training unit is specifically used to:

[0288] Selecting an initial parameter space of the feature extraction model, and setting an initial parameter search point, an initial search granularity, and an initial search radius;

[0289] If the information entropy of the current parameter search point is lower than the preset threshold, the search granularity is updated according to the first adjustment function, the parameter search point with the smallest loss value is found to update the current parameter search point, and the parameter space is updated according to the second adjustment function;

[0290] updating the current search radius according to the third adjustment function until a preset second stop condition is met, thereby obtaining a trained feature extraction model;

[0291] Among them, the first adjustment function is determined according to the historical search efficiency index, the information entropy of the current parameter search point and the loss function of the current parameter search point; the second adjustment function is determined according to the loss value of the current search point and the loss values ​​of the search points around the current search point; the third adjustment function is determined according to the information entropy of the current parameter search point and the loss function of the current parameter search point.

[0292] In one embodiment, the feature dimension reduction module 23 further includes a feature dimension reduction model training module, which is used to:

[0293] The pre-built feature dimension reduction model is trained based on the high-dimensional network feature samples; wherein the high-dimensional network feature samples are obtained by extracting features from network communication data samples using the feature extraction model;

[0294] During the training process, a trust region optimization strategy based on chaotic sequences is used to update the parameters of the feature dimensionality reduction model until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0295] Preferably, the pre-constructed feature dimension reduction model includes an encoder and a decoder. During the training process, a trust region optimization strategy based on a chaotic sequence is used to update the parameters of the feature dimension reduction model until a preset third stop condition is met to obtain a trained feature dimension reduction model, including:

[0296] Generate a chaotic sequence in each iterative training, and adjust the size of the trust region according to the chaotic sequence;

[0297] The parameters of the encoder and the decoder are updated according to the size of the trust region until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

[0298] In one embodiment, the risk identification module 24 further includes a classifier model training module for training a classifier model constructed based on a support vector machine, including:

[0299] Inputting low-dimensional network feature data into a support vector machine, solving the support vector machine using a method combining feature importance weighting and linear programming, screening low-dimensional network feature samples, and constructing a low-dimensional network feature sample set based on the low-dimensional network feature samples;

[0300] The support vector machine is trained based on the low-dimensional network feature sample set, and the parameters of the support vector machine are updated by a cross-validation method until a preset fourth stopping condition is met, thereby obtaining a trained classifier model.

[0301] It should be noted that a network risk identification system provided in an embodiment of the present invention is used to execute all process steps of a network risk identification method in the above embodiment, and the working principles and beneficial effects of the two correspond one to one, so they will not be repeated here.

[0302] See also Figure 4 , Figure 4 : is a structural block diagram of a network risk identification device 300 provided in an embodiment of the present invention, and the network risk identification device 300 includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. When the processor 31 executes the computer program, the steps in the above-mentioned embodiments of the network risk identification method are implemented, such as steps S1 to S4.

[0303] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the network risk identification device 300.

[0304] The network risk identification device 300 may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art will appreciate that the schematic diagram is merely an example of the network risk identification device 300 and does not constitute a limitation on the network risk identification device 300. The network risk identification device 300 may include more or fewer components than shown in the figure, or may combine certain components, or different components. For example, the network risk identification device 300 may also include input and output devices, network access devices, buses, and the like.

[0305] The processor 31 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 31 is the control center of the network risk identification device 300, and uses various interfaces and lines to connect various parts of the entire network risk identification device 300.

[0306] The memory 32 can be used to store the computer program and / or module. The processor 31 realizes various functions of the network risk identification device 300 by running or executing the computer program and / or module stored in the memory 32 and calling the data stored in the memory 32. The memory 32 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory 32 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0307] Wherein, if the module / unit integrated in the network risk identification device 300 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor 31, the steps of the above-mentioned method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0308] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network risk identification method, characterized in that: include: Obtaining network communication data to be identified; Extracting features from the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified; The network feature data is reduced in dimension by using a pre-trained feature dimension reduction model to obtain the reduced-dimensional network feature data; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence; The network feature data after dimensionality reduction is classified and identified through a pre-trained classifier model to obtain a network risk identification result.

2. The network risk identification method according to claim 1, characterized in that: The feature extraction model is trained by the following steps: Preprocessing historical network communication training data to construct first network communication training data; Expanding the first network communication training data through a quantum generative adversarial network model to obtain second network communication training data; Based on the second network communication training data, an adaptive random fractal search algorithm is used to train the pre-built feature extraction model to obtain a trained feature extraction model.

3. The network risk identification method according to claim 2, characterized in that: The quantum generative adversarial network model includes a generator and a discriminator, and the quantum generative adversarial network model is trained by the following steps: Inputting the third network communication training data into the generator, performing a quantum gate operation on the original random noise of the third network communication training data to obtain quantum state encoded noise; wherein the quantum gate operation includes a combination of a rotation gate and a superposition gate based on quantum gate operation parameters; Based on the noise after quantum state encoding, generating fourth network communication training data through the generator, mixing the fourth network communication training data with the third network communication training data to obtain fifth network communication training data; Training the discriminator and the generator according to the fifth network communication training data; The quantum gate operation parameters, the parameters of the generator and the parameters of the discriminator are updated according to the target loss function until a preset first stop condition is met to obtain a trained quantum generative adversarial network model.

4. The network risk identification method according to claim 3, characterized in that: The target loss function includes a generator loss function, a discriminator loss function and a quantum state regularization loss function; The generator loss function is constructed based on the distribution of the original random noise with the goal of minimizing the ability of the discriminator to correctly identify the third network communication training data; The discriminator loss function is constructed based on the distribution of the original random noise with the goal of maximizing the ability of the discriminator to distinguish between the third network communication training data and the fourth network communication training data; The quantum state regularization loss function is constructed based on the Euclidean distance between the noise encoded by the quantum state and the original random noise.

5. The network risk identification method according to claim 2, 3 or 4, characterized in that: The method of using an adaptive random fractal search algorithm to train a pre-built feature extraction model to obtain a trained feature extraction model includes: Selecting an initial parameter space of the feature extraction model, and setting an initial parameter search point, an initial search granularity, and an initial search radius; If the information entropy of the current parameter search point is lower than the preset threshold, the search granularity is updated according to the first adjustment function, the parameter search point with the smallest loss value is found to update the current parameter search point, and the parameter space is updated according to the second adjustment function; The current search radius is updated according to the third adjustment function until a preset second stop condition is met, thereby obtaining a trained feature extraction model; Among them, the first adjustment function is determined according to the historical search efficiency index, the information entropy of the current parameter search point and the loss function of the current parameter search point; the second adjustment function is determined according to the loss value of the current search point and the loss values ​​of the search points around the current search point; the third adjustment function is determined according to the information entropy of the current parameter search point and the loss function of the current parameter search point.

6. The network risk identification method according to claim 1, characterized in that: The feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence, and includes: The pre-built feature dimension reduction model is trained based on the high-dimensional network feature samples; wherein the high-dimensional network feature samples are obtained by extracting features from network communication data samples using the feature extraction model; During the training process, a trust region optimization strategy based on chaotic sequences is used to update the parameters of the feature dimensionality reduction model until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

7. The network risk identification method according to claim 6, characterized in that: The pre-built feature dimension reduction model includes an encoder and a decoder. During the training process, a trust region optimization strategy based on a chaotic sequence is used to update the parameters of the feature dimension reduction model until a preset third stop condition is met to obtain a trained feature dimension reduction model, including: Generate a chaotic sequence in each iterative training, and adjust the size of the trust region according to the chaotic sequence; The parameters of the encoder and the decoder are updated according to the size of the trust region until a preset third stopping condition is met, thereby obtaining a trained feature dimensionality reduction model.

8. The network risk identification method according to claim 1, characterized in that: The classifier model is constructed based on a support vector machine, and the classifier model is trained by the following steps: Inputting low-dimensional network feature data into a support vector machine, solving the support vector machine using a method combining feature importance weighting and linear programming, screening low-dimensional network feature samples, and constructing a low-dimensional network feature sample set based on the low-dimensional network feature samples; The support vector machine is trained based on the low-dimensional network feature sample set, and the parameters of the support vector machine are updated by a cross-validation method until a preset fourth stopping condition is met, thereby obtaining a trained classifier model.

9. A network risk identification system, characterized in that: include: A data acquisition module, used to acquire network communication data to be identified; A feature extraction module, used to extract features of the network communication data to be identified by using a pre-trained feature extraction model to obtain network feature data of the network communication data to be identified; A feature dimension reduction module, used to reduce the dimension of the network feature data by using a pre-trained feature dimension reduction model to obtain the network feature data after dimension reduction; wherein the feature dimension reduction model is trained by a trust region optimization strategy based on a chaotic sequence; The risk identification module is used to classify and identify the network feature data after dimensionality reduction through a pre-trained classifier model to obtain a network risk identification result.

10. A network risk identification device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the network risk identification method according to any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the network risk identification method according to any one of claims 1 to 8.

12. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method for identifying network risks as described in any one of claims 1 to 8 is implemented.

Images