Network security detection method and device based on data processing unit, equipment and medium

Abstract

The embodiment of the invention discloses a network security detection method and device based on a data processing unit, equipment and a medium. The method comprises the following steps: acquiring network audit log data; preprocessing the network audit log data to obtain preprocessed network audit log data; generating an audit graph based on the preprocessed network audit log data; and inputting the auditing graph into a network security evaluation model to obtain a network security category behavior. According to the technical scheme, by analyzing the system log data and the auditing graph structure of the mutual relation of the system log data, complex attack modes and abnormal behaviors can be intuitively revealed and recognized, so that the accuracy and efficiency of network security detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security detection method, device, equipment and medium based on a data processing unit. Background Art

[0002] With the continuous deepening of the application of emerging Internet technologies such as big data, cloud computing, the Internet of Things, and the Industrial Internet, the degree of informatization of enterprises is becoming increasingly higher, and the dependence on information systems has reached an unprecedented level. At the same time, it has also led to the frequent occurrence of various new types of network attacks, sensitive information leaks and other malicious information security incidents.

[0003] Among them, advanced persistent threats (APT) involve complex network attack strategies. The characteristics of APT include its long duration, concealment and high concentration of attacks. A prominent feature of APT attacks is the widespread use of zero-day vulnerabilities.

[0004] At present, feature detection technology is mainly used to detect advanced persistent threat (APT) attacks and zero-day vulnerabilities. These feature matching methods identify potential attacks within information systems by matching keywords and key phrases. Currently widely used defense mechanisms, such as Web Application Firewall (WAF) and Endpoint Detection and Response (EDR) systems, capture attack behaviors from HTTP traffic and log information, respectively. However, when facing APT attacks and zero-day vulnerabilities, feature detection technology shows significant limitations: Limited to known features: The effectiveness of feature detection technology depends on the comprehensiveness and accuracy of its feature library. For APT attacks and zero-day vulnerabilities (which are usually not identified and recorded), the lack of clear signature functions may cause these threats to be missed. Moreover, the data of these feature matching methods mainly comes from system logs, and there are problems such as data missing when processing large-scale data. Summary of the invention

[0005] The present invention provides a network security detection method, device, equipment and medium based on a data processing unit, which can intuitively reveal and identify complex attack patterns and abnormal behaviors by analyzing the audit graph structure of system log data and their interrelationships, so as to improve the accuracy and efficiency of network security detection.

[0006] According to one aspect of the present invention, a network security detection method based on a data processing unit is provided, comprising:

[0007] Obtain network audit log data;

[0008] Preprocessing the network audit log data to obtain preprocessed network audit log data;

[0009] Generating an audit graph based on the preprocessed network audit log data;

[0010] The audit graph is input into a network security assessment model to obtain network security category behavior.

[0011] Optionally, preprocessing the network audit log data to obtain preprocessed network audit log data includes:

[0012] Converting the data format of the network audit log data into a standard format to obtain standardized network audit log data;

[0013] The standardized network audit log data is cleaned to obtain pre-processed network audit log data.

[0014] Optionally, generating an audit graph based on the preprocessed network audit log data includes:

[0015] Determine multiple meta-graph information aggregated within a set time period according to the audit log data;

[0016] An audit graph is generated by a graph generator based on the plurality of meta-graph information.

[0017] Optionally, determining multiple meta-graph information aggregated within a set time period according to the audit log data includes:

[0018] Determine a subject node and an object node according to the audit log data;

[0019] A plurality of events are constructed based on the subject node and the object node, and the plurality of events are converted into a plurality of meta-graph information.

[0020] Optionally, generating an audit graph by a graph generator based on the plurality of meta-graph information includes:

[0021] Node information and edge information are extracted from the meta-graph information, and an audit graph is generated by using the node information and the edge information through an image generator.

[0022] Optionally, the network security assessment model is trained in the following manner:

[0023] Obtain network audit log data samples and initial network security assessment models;

[0024] Preprocessing the network audit log data sample to obtain a preprocessed network audit log data sample;

[0025] Generate an audit graph sample and an exception graph sample based on the preprocessed network audit log data sample;

[0026] The initial network security assessment model is trained based on the audit graph samples, the abnormal graph samples and the correlation graph attention network learning method until a network security assessment model is obtained.

[0027] Optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer and an output layer;

[0028] The initial network security assessment model is trained based on the audit graph sample, the abnormal graph sample and the correlation graph attention network learning method until a network security assessment model is obtained, including:

[0029] Inputting the audit graph sample and the abnormal graph sample through the input layer, converting the node information and edge information in the audit graph sample and the abnormal graph sample into node feature data; wherein the edge information includes time data;

[0030] Processing the node feature data through the node relationship anomaly capture layer to determine the attention coefficient between nodes;

[0031] Updating the node feature data according to the attention coefficient, and performing pooling processing on the updated node feature data to obtain pooling data and time data;

[0032] Determine sequence data according to the pooled data and the time data, and process the sequence data through the node time anomaly capture layer to obtain target feature data;

[0033] Processing the target feature data through the activation function of the output layer and outputting initial network security category behavior data;

[0034] The initial network security assessment model is iteratively optimized based on the loss function and the initial network security category behavior data until a network security assessment model is obtained.

[0035] According to another aspect of the present invention, there is provided a network security detection device based on a data processing unit, comprising:

[0036] A data acquisition module is used to obtain network audit log data;

[0037] A data preprocessing module, used to preprocess the network audit log data to obtain preprocessed network audit log data;

[0038] A graph generation module, used to generate an audit graph based on the preprocessed network audit log data;

[0039] The security category acquisition module is used to input the audit graph into a network security assessment model to obtain network security category behavior.

[0040] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0041] at least one processor; and

[0042] a memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security detection method based on the data processing unit described in any embodiment of the present invention.

[0044] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network security detection method based on a data processing unit described in any embodiment of the present invention when executed.

[0045] The technical solution of the embodiment of the present invention obtains network audit log data; pre-processes the network audit log data to obtain pre-processed network audit log data; generates an audit graph based on the pre-processed network audit log data; and inputs the audit graph into a network security assessment model to obtain network security category behavior. This technical solution can intuitively reveal and identify complex attack patterns and abnormal behaviors by analyzing the audit graph structure of system log data and their interrelationships, so as to improve the accuracy and efficiency of network security detection.

[0046] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 is a flow chart of a network security detection method based on a data processing unit provided according to Embodiment 1 of the present invention;

[0049] Figure 2 is a flow chart of a network security detection method based on a data processing unit provided according to Embodiment 2 of the present invention;

[0050] Figure 3 is a structural schematic diagram of a network security detection device based on a data processing unit provided according to Embodiment 3 of the present invention;

[0051] Figure 4 It is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0053] It should be noted that the terms "first", "second" and "target" in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0054] Embodiment 1

[0055] Figure 1 This is a flowchart of a network security detection method based on a data processing unit according to the first embodiment of the present invention. This embodiment is applicable to the case of detecting network security in a network system. The method can be executed by a network security detection device. The network security detection device can be implemented in the form of hardware and / or software. The network security detection device can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0056] The technical solution in this embodiment can be applied to network security detection of power network systems. By adopting data acquisition and preprocessing technology based on a data processing unit (DPU), combined with a system-side network security detection method and a graph learning algorithm, and using an associative graph attention network and a gated recursive unit to capture and analyze complex attack behaviors, the adaptability, accuracy and efficiency of detection can be improved, false alarms can be reduced, and the challenges of large-scale data sets can be effectively addressed. Ultimately, network security defense can be strengthened, and critical infrastructure and organizations can be protected from increasingly complex and hidden network attack threats, so as to improve the accuracy of network security detection.

[0057] S110. Acquire network audit log data based on the data processing unit.

[0058] Among them, the data processing unit (DPU) is a new type of computing acceleration hardware that can perform real-time data collection and analysis, distributed network threat detection, and large-scale data processing difficulties. Network audit log data can understand the records automatically generated by computer systems, devices, or software when specific events or operations occur. Network audit log data can include various operations, events, and state changes in the network system.

[0059] In this embodiment, the network audit log data can be distributedly collected by the data processing unit (DPU) to obtain the network audit log data. In this embodiment, considering that the data collected by the log system is missing and the data volume is large, the network audit log data can be distributedly collected and preprocessed by the data processing unit DPU. The log data processed by the DPU is then gathered to the system threat analysis component for processing. On the one hand, the data collected by the DPU in a distributed manner is closer to the possible threat source, the data is more accurate, the description of the attack threat and environmental characteristics in the data preprocessing is more accurate, and the data attribute transformation range in the data completion is smaller and the accuracy is higher. On the other hand, the data collected and preprocessed by the DPU greatly reduces the network data communication volume compared to centralized collection, and the data collection and transmission efficiency is higher. In this embodiment, by deploying the DPU on the terminal device, the network architecture can be more intelligent and flexible.

[0060] S120: pre-process the network audit log data to obtain pre-processed network audit log data.

[0061] Among them, preprocessing can be understood as processing operations such as data cleaning processing and data format conversion. The preprocessed network audit log data can be data obtained after data format conversion and data cleaning processing. In this embodiment, the network audit log data can be converted into a data format by the DPU, and then preprocessed such as data cleaning processing can be performed to obtain the preprocessed network audit log data.

[0062] In this embodiment, the network audit log data is optionally preprocessed to obtain preprocessed network audit log data, including: converting the data format of the network audit log data into a standard format to obtain standardized network audit log data; and cleaning the standardized network audit log data to obtain preprocessed network audit log data.

[0063] Among them, the standard format can be a CDM format. Standardized network audit log data can refer to network audit log data in a CDM format. Cleaning processing can be understood as a processing operation that deletes duplicate information, corrects existing errors, and provides data consistency. The purpose of converting the data format of the network audit log data into a CDM format in this embodiment is to facilitate the generation of an audit map for subsequent processing.

[0064] In this embodiment, after collecting network audit log data in various formats through DPU, the data format of the network audit log data is converted into CDM format through DPU to obtain standardized network audit log data; then the standardized network audit log data is deleted duplicate information, existing errors are corrected, and data consistency processing operations are provided to obtain pre-processed network audit log data.

[0065] Specifically, in this embodiment, for the data format of the original network audit log data, the tool provided by Darpa TC can be used to convert the data format of the original network audit log data into the CDM format to obtain standardized network audit log data. The original network audit log data usually arrives in the form of a packaged, unreadable binary file. In order to facilitate the readability of the data, the data format is standardized and stored in a SQLite database, and the SQLite build script is used to quickly build a temporary data set.

[0066] However, since the data sets converted into CDM format often contain many problems, this implementation can collaboratively clean the standardized network audit log data on the DPU side and the system threat analysis component side. The specific cleaning processing content can include that for some network flow objects that may lack IP addresses, the unique identifier (UUID) of the object can be used to find related records and fill in the missing IP addresses. By querying the relevant `EVENT_Socket` table in the database or data set, matching the UUID of the network flow object, and extracting the IP address stored in the table. Fill the obtained IP address into the missing field. For the case where undefined UUIDs may appear in some records, you can check whether the UUID field is empty or invalid (such as incorrect format) during data processing and delete these records. Ensure that the format of the UUID complies with the specification (such as the 32-bit character UUID standard) through regular expressions or validation mechanisms. If the UUID is found to be empty or does not conform to the format, delete the relevant data directly to avoid introducing data pollution. In the case where duplicate UUIDs may exist in network flow objects, the uniqueness of the UUID can be ensured by first identifying the records with duplicate UUIDs and then modifying the UUID of one of the duplicate objects. In this embodiment, a hash table or other data structure can be used to check the uniqueness of the UUID. If an object with the same UUID is found, the UUID of one of the objects is modified based on certain rules (such as generating a new UUID or using an algorithm to generate a unique ID). In the case of inconsistent URL paths of file objects, in this embodiment, data differences may occur due to different file path formats, so the file path needs to be standardized to unify its format and avoid differences. In this embodiment, the relative path and absolute path can be unified by removing redundant characters in the path, such as unnecessary slashes, case sensitivity, etc., to ensure that the same file has a consistent path representation.

[0067] In this embodiment, through such a setting, after the above-mentioned data cleaning for different situations, the integrity, uniqueness and consistency of the data are ensured, thereby improving the quality of subsequent data processing and analysis.

[0068] S130: Generate an audit graph based on the preprocessed network audit log data.

[0069] Among them, the audit graph can be a graph structure generated by pre-processed network audit log data. The audit graph records the detailed information of various events in the system (such as process creation, file access, and network connection, etc.). The data in the audit graph usually contains detailed information on system processes, application information, and registry editing, which helps to improve the accuracy of identifying attacks. The audit graph in this embodiment may include multiple meta-graph information. Each meta-graph information can be converted from each event in the network audit log data.

[0070] In this embodiment, the specific method of generating an audit graph based on the preprocessed network audit log data of the system can be to determine the node information and the edge information of the audit graph based on the preprocessed network audit log data of the system, form multiple meta-graph information based on the node information and the edge information, and generate an audit graph structure based on the multiple meta-graph information. In this embodiment, the audit graph can track and represent the behavior patterns in the system, including normal network behavior operations and potential malicious behavior operations. In this embodiment, complex attack chains and APT (advanced persistent threat) attack patterns can be identified by analyzing the audit graph.

[0071] S140. Input the audit graph into the network security assessment model to obtain network security category behavior.

[0072] The network security assessment model may be a trained network model, which can be used to detect network security behaviors. The network security category behaviors may include normal network behaviors and abnormal network behaviors.

[0073] In this embodiment, the audit graph generated according to the network audit log data can be input into the trained network security assessment model, and the input audit graph is analyzed and processed according to the network security assessment model to obtain the normal network behavior category or the abnormal network behavior category.

[0074] The technical solution of the embodiment of the present invention obtains network audit log data; pre-processes the network audit log data to obtain pre-processed network audit log data; generates an audit graph based on the pre-processed network audit log data; inputs the audit graph into a network security assessment model to obtain network security category behavior. This technical solution can intuitively reveal and identify complex attack patterns and abnormal behaviors by analyzing the audit graph structure of system log data and their interrelationships, so as to improve the accuracy and efficiency of network security detection.

[0075] Embodiment 2

[0076] Figure 2 This is a flowchart of a network security detection method based on a data processing unit according to the second embodiment of the present invention. This embodiment is optimized based on the above embodiment. The specific optimization is: generating an audit graph based on the pre-processed network audit log data, including: determining multiple meta-graph information aggregated within a set time period according to the network audit log data; generating an audit graph through a graph generator based on multiple meta-graph information. Figure 2 As shown, the method includes:

[0077] S210. Acquire network audit log data based on the data processing unit.

[0078] S220: pre-process the network audit log data to obtain pre-processed network audit log data.

[0079] S230. Determine multiple meta-graph information aggregated within a set time period according to the network audit log data.

[0080] Among them, the set duration can be understood as a set duration. In this embodiment, the set duration can be one minute, two minutes or five minutes of duration data. The meta-graph information can be information converted from each event in the network audit log data. In this embodiment, in the network audit log data in CDM format, each event can be constructed into a meta-graph information. In this embodiment, the corresponding node type can be determined according to the network audit log data, and all meta-graph information derived from each event can be aggregated within the set duration according to the node type to determine multiple meta-graph information within the set duration.

[0081] In this embodiment, optionally, multiple meta-graph information aggregated within a set time period is determined based on the audit log data, including: determining the subject node and the object node based on the audit log data; forming multiple events based on the subject node and the object node, and converting the multiple events into multiple meta-graph information.

[0082] The meta-graph information may be composed of events, and each event may be composed of a node type and a process between nodes. A subject node may be a node type in an audit graph. In this embodiment, the node types of an audit graph may include a subject node and an object node. The edges of an audit graph may represent events between a subject node and an object node. In this embodiment, the subject of most edges may be defined as a process.

[0083] In this embodiment, various attribute information of the audit log data can be defined to determine the subject node and the object node. Specifically, in this embodiment, the node types are divided into subjects and objects, corresponding to the subjects and objects in the CDM format information flow. For the subject node, four attributes are defined: device ID, UUID, parent subject ID and local subject ID. For the object node, three attributes are defined: UUID, device ID and object type. Among them, the UUID (universally unique identifier) ​​in the subject node and the object node is used as the identifier of the node, which must be unique. The device ID in the subject and object represents the ID of the device associated with the node. The parent subject ID in the subject node can represent the ID of the parent process of the process. This attribute allows tracking of long-term attack behaviors. The local subject ID in the subject node refers to the user's subject identity, such as root in Linux and Administrator in Windows. The same user subject in the same device has the same ID. The "object type" in "object" can represent the ID of the object type. In this embodiment, objects can be divided into ten types. In addition to common types (common types include folders, files, processes, sockets, network streams, and local entities), the embodiment of the present invention also focuses on inter-process communication (IPC), and proposes three types of IPC: IPC unnamed pipes, IPC socket pairs, and IPC sources and receivers. The object types in this embodiment cover the three most common IPC types in the CDM information format: the source and sink of the IPC data stream, the general one-way communication between the parent process and the child process (unnamed pipe), and the general two-way communication mode (socket pair). For other IPC information, this embodiment can classify them all as unknown types because the data volume is small and basically harmless.

[0084] In this embodiment, multiple events can be formed according to subject nodes and object nodes. The specific method of converting multiple events into multiple meta-graph information can be to define the subject nodes and object nodes determined by various attributes of the network audit log data, and to form multiple events in combination with the execution operations of each object in the network audit log data, and convert multiple events into corresponding multiple meta-graph information. In this embodiment, the most basic component of each event is the node type, where the node type can include subject nodes and object nodes. An event can be an operation performed by a process on another object, for example, reading or writing a file or directory can be an event; in this embodiment, events such as which user accesses which file recorded in the network audit log can be converted into multiple meta-graph information together with other events.

[0085] Through such a setting in this embodiment, the node type in the audit graph can be obtained according to each attribute definition in the network audit log data, and each meta-graph information can be constructed according to the node type, so as to generate an audit graph based on the meta-graph information.

[0086] S240. Generate an audit graph through a graph generator based on the multiple meta-graph information.

[0087] The graph generator may be a tool for generating graphs. In this embodiment, multiple meta-graph information derived from multiple events may be aggregated within a set time period and quickly generated into a graph representation using the graph generator to obtain an audit graph.

[0088] In this embodiment, optionally, an audit graph is generated based on multiple meta-graph information through a graph generator, including: extracting node information and edge information from the meta-graph information, and generating an audit graph with the node information and edge information through an image generator.

[0089] Among them, the node information can be understood as the node type in the meta-graph information, and the edge information can be understood as the process relationship between the nodes. Specifically, in this embodiment, the subject node and the object node can be extracted from the meta-graph information, wherein the parent subject node is generated based on the parent subject ID attribute of the defined subject node and is regarded as an object node of the process type. The subject nodes are generated based on the local subject ID attribute of the defined subject node, and they are regarded as object nodes of the local subject type.

[0090] In this embodiment, due to the rich relationships between nodes, a total of 56 different types of edges are defined for the definition of audit graph edges. They act as edges between nodes to fully draw information-rich graphs. Among them, the edge represents an event between a subject and an object, and it can be defined that the subject of most edges is a process. The object of the event is one of the 10 types of nodes defined by the attributes. In this embodiment, the definition of most edges mainly refers to the audit log data information in the CDM format, which summarizes and organizes possible information. A small number of types of edges focus on the attribute information of the subject. In addition, in order to generate parent subject nodes and local subject nodes in subsequent processes, this embodiment specifically adds two types of edge definitions, SUB_PROCESS and PRINCIPAL_PROCESS, as a supplement to solving the ParentSubject-ID and Local Principle ID in the Subject node.

[0091] In this embodiment, in order to convert the original data into a graph format that can be effectively processed by the model, a graph generator is developed. The graph generator extracts node information and edge information from the meta-graph information stored in a preconfigured SQLite database, so that the graph generator processes the information flow minute by minute to create a graph to generate an audit graph.

[0092] Through such a setting in this embodiment, an audit graph can be generated based on the meta-graph information and the graph generator. By constructing and analyzing the graph structure of entities and their interrelationships in the system log data, complex attack patterns and abnormal behaviors can be intuitively revealed and identified, thereby helping to promptly discover and respond to security threats.

[0093] S250. Input the audit graph into the network security assessment model to obtain network security category behavior.

[0094] In this embodiment, optionally, the training method of the network security assessment model is: obtaining network audit log data samples and an initial network security assessment model; preprocessing the network audit log data samples to obtain preprocessed network audit log data samples; generating audit graph samples and abnormal graph samples based on the preprocessed network audit log data samples; training the initial network security assessment model based on the audit graph samples, abnormal graph samples and correlation graph attention network learning method until the network security assessment model is obtained.

[0095] Among them, the network audit log data sample can be the network audit log data within the historical length of time in the system. In this embodiment, the network audit log data within the historical length of time in the system can be obtained as sample data. In this embodiment, the network audit log data of the past month or longer can be distributedly collected by the data processing unit (DPU) as a network audit log data sample. In this embodiment, the network audit log data can be distributedly collected and preprocessed by the data processing unit DPU. The initial network security assessment model can be an initial model that has not been trained and used to detect network security behavior categories. The initial network security assessment model in this embodiment may include an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer.

[0096] Among them, the preprocessing can be processing operations such as data cleaning processing and data format conversion. The preprocessed network audit log data sample can be the data obtained after the network audit log data sample is subjected to data format conversion and data cleaning processing. In this embodiment, the network audit log data sample can be converted into a data format by the DPU, and then preprocessed such as data cleaning processing can be performed to obtain the preprocessed network audit log data sample.

[0097] Among them, the audit graph sample can be a graphical structure composed of information such as various event processes in the preprocessed network audit log data sample. The audit graph sample contains detailed information on various events in the system, such as process creation, file access, and network connection. In this embodiment, the specific method of generating an audit graph sample based on the preprocessed network audit log data sample can be to determine the node information and the edge information of the audit graph based on the network audit log data sample, and to form multiple meta-graph information of the audit graph sample based on the node information and the edge information, and generate the audit graph sample based on the multiple meta-graph information. This embodiment can identify complex attack chains and APT (advanced persistent threat) attack patterns by analyzing the audit graph samples.

[0098] The abnormal graph sample may be a graph structure obtained by re-detecting after copying the initial audit graph. In this embodiment, the specific method of generating the abnormal graph sample based on the pre-processed network audit log data sample is to deeply copy the obtained audit graph, then re-detect the audit graph to find abnormal data, collect the re-detected abnormal data into a graph and assign manual labels to serve as the abnormal graph sample.

[0099] Specifically, this embodiment first evaluates the number of nodes in the input audit graph sample to verify whether there are enough nodes to generate a credible context anomaly. Then, after deep copying the audit graph sample, a re-detection operation is performed. The re-detected anomaly data can be collected into a graph, and then the manual labels are assigned as anomaly graph samples. In this embodiment, the newly created anomalies can also be integrated into the data set respectively, and these modified anomaly graphs are temporarily stored in the specified folder for subsequent processing and analysis. Among them, the specific method of re-detection is: first feature extraction, then context anomaly recognition and structural anomaly recognition, extracting relevant features from the audit graph sample, these features may include node attributes (such as process name and file type, etc.) and edge attributes (such as operation type and timestamp, etc.), and then context anomaly recognition is based on the mismatch between the attribute value and its context environment, identifying or generating anomalies. Then, structural anomaly recognition is performed to identify irregularities in the graph structure, such as unusual connection patterns or sudden increases in network traffic, and then these detected graph structure anomalies are finally collected into a graph to generate anomaly graphs.

[0100] In this embodiment, the abnormal graph samples can simulate possible attack behaviors through anomalies to help the initial network security assessment model learn how to identify abnormal patterns. In this embodiment, the model's ability to identify unknown attacks and variant attacks can be enhanced by adding abnormal graph samples to the training set. The abnormal graph can also contain artificially designed anomalies, so that the model learns more about the characteristics of the attack during the training process, thereby improving the detection rate. In this embodiment, the training model recognizes artificially designed anomalies, which helps to distinguish normal behavior from malicious behavior and reduce false positives.

[0101] In this embodiment, the learning method of the graph attention network (GAT) mainly introduces the attention mechanism based on the graph neural network. In this embodiment, the audit graph samples and the abnormal graph samples can be input into the initial network security assessment model, and the initial network security assessment model can be iteratively trained using the learning method of the graph attention network until the network security assessment model is obtained.

[0102] Through such a setting in this embodiment, the initial network security assessment model can be trained on sample data until a network security assessment model that meets the requirements is obtained. By generating audit graphs and anomaly graphs, the model can better understand and identify normal and abnormal behaviors in the network, thereby improving the accuracy and efficiency of network security detection.

[0103] In this embodiment, optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer and an output layer; the initial network security assessment model is trained based on the audit graph samples, the anomaly graph samples and the correlation graph attention network learning method until the network security assessment model is obtained, including: inputting the audit graph samples and the anomaly graph samples through the input layer, and converting the node information and edge information in the audit graph samples and the anomaly graph samples into node feature data; wherein the edge information includes time data; processing the node feature data through the node relationship anomaly capture layer to determine the attention coefficient between the nodes; updating the node feature data according to the attention coefficient, and pooling the updated node feature data to obtain pooling data and time data; determining the sequence data according to the pooling data and the time data, and processing the sequence data through the node time anomaly capture layer to obtain the target feature data; processing the target feature data through the activation function of the output layer and outputting the initial network security category behavior data; iteratively optimizing the initial network security assessment model based on the loss function and the initial network security category behavior data until the network security assessment model is obtained.

[0104] Among them, the input layer can be used to receive the input of audit graph samples and abnormal graph samples, and convert the information of nodes and edges in the audit graph samples and abnormal graph samples into node feature vectors. The node relationship anomaly capture layer can be used to use the association graph attention network to learn the connection between nodes and evaluate the abnormal information between node relationships. The node time anomaly capture layer can be used to evaluate the abnormality of time information between nodes.

[0105] Among them, the node feature data can be understood as the node feature vector obtained by transforming the information of each node and the edge information in the audit graph sample and the abnormal graph sample. The attention coefficient can be used to characterize the importance between nodes. In this embodiment, the node feature data can be analyzed and processed by the node relationship abnormality capture layer to determine the attention coefficient between each node.

[0106] Specifically, in this embodiment, the node relationship anomaly information capture layer processes node information through the associative graph attention network. Assume that the input audit graph sample passes through the audit graph sample node relationship anomaly information capture layer for L times during a model training, and define the number of iterations l∈{1, 2,..., L}. In each iteration, the audit graph sample node relationship anomaly information capture layer calculates the attention coefficient and updates the node features, and performs global average pooling and global maximum pooling. For the lth iteration of the audit graph sample node relationship anomaly information capture layer, H is defined as the node feature matrix after the embedding layer and B is defined as the edge index set. For the H nodes in the input audit graph sample, each node i has a feature vector h i ∈H. For the edge index Edge(i, j)∈B between node i and node j, it has edge type e ij ∈R E , where E is the total number of edge types. The attention mechanism is then used to update the nodes while taking the edge types into account. For nodes i and j, α ij is the attention coefficient between nodes i and j, reflecting the importance of node j relative to node i. The attention coefficient α ij The calculation of is as follows:

[0107]

[0108] Among them, R(i) represents the set of neighboring nodes of node i, a is a learnable weight vector, W is the linear transformation matrix from input features to hidden representation, Is edge type e ij The embedding vector of ,|| represents the concatenation of matrices.

[0109] Next, the weighted sum of the adjacent node features is calculated, the updated node feature matrix is ​​defined as H′, and the node feature data is updated according to the attention coefficient, which calculates the updated node feature h′i The specific form of ∈H′ can be:

[0110] h′ i =ReLU(∑ j∈O(i) α ij W j )#(2);

[0111] Among them, the pooling process can be an average pooling process and a maximum pooling process. The pooling data can be a global average vector and a maximum pooling vector obtained by performing global average pooling and global maximum pooling according to the updated node features. The time data can be the time point information corresponding to the graph sample information. The audit log data in this embodiment has corresponding timestamp information, and the corresponding time data can be determined according to the timestamp information.

[0112] Specifically, in this embodiment, the specific method of obtaining pooled data by performing pooling processing on the updated node feature data can be to calculate the global average pooling and global maximum pooling of the updated node information, and use the squeeze operation to remove all dimensions of size 1 in the tensor. Then, these two types of pooling results are connected with the graph attributes. This helps to capture global features at the entire graph level and provide a more comprehensive information perspective for prediction.

[0113] In this embodiment, for the first iteration of the node relationship abnormal information capture layer, the global average vector is calculated:

[0114]

[0115] Calculate the global maximum vector

[0116]

[0117] Among them, X (l) is the feature matrix of the node updated by the attention coefficient in the mth layer of the audit graph node relationship anomaly information capture layer, A is the batch vector, and f mean is the global average pooling function, f max is the global maximum pooling function. squ() represents the squeezing operation.

[0118] Then, the global average vector and the global maximum vector obtained from each iteration of the node relationship anomaly information capture layer are connected to provide sequential data for the time series processing layer - each time point corresponds to the representation of the graph. In this embodiment, the specific method of determining the sequence data based on the pooled data and the time data is to assume that the audit graph node relationship anomaly information capture layer is cycled L times in total, and the cascaded sequence data is defined as S, || represents the cascade of the matrix, and the corresponding sequence data S is determined based on the pooled data and the time data.

[0119]

[0120] Each round of audit graph node relationship anomaly information capture layer iteration captures different levels of feature abstraction from the graph data. Earlier layers can capture more local graph structure information, while deeper layers may capture higher-level global graph structure patterns. By concatenating the features obtained from global average pooling and global maximum pooling after each audit graph sample node relationship anomaly information capture layer, a richer graph representation can be constructed to help the model understand and learn various properties of the graph. Combining features at different levels can make the model more expressive when performing graph classification, thereby integrating more contextual information.

[0121] The target feature data may be feature data obtained after being processed by the node time anomaly capture layer. In this embodiment, the sequence data is processed by the node time anomaly capture layer to obtain the target feature data in a specific manner as follows: an input sequence S=(s 1 ,s 2 ,…,s L ), through the node time anomaly capture layer, this layer uses a gated recurrent neural network to capture the long-term dependencies in the input sequence. Assume that s t ∈R n represents the input feature at time step t, and n is the dimension of the input. Here, sig is defined as the S-shaped activation function, and b z Defined as the bias term, the hidden state at time t is defined as h t , and let ⊙ represent element-wise multiplication. For each time step t, the gated recurrent neural network operates as follows:

[0122] Put W z and U z Defined as a learnable weight matrix, z t Defined as the update gate, its calculation formula is as follows:

[0123] z t =sig(W z s t +U z h t-1 +b z )#(6);

[0124] Put W r and U r Defined as a learnable weight matrix, r t Defined as the reset gate, its calculation formula is as follows:

[0125] r t =sig(W r st +U r h t-1 +b r )#(7);

[0126] Put W h and U h Defined as a learnable weight matrix, Defined as a candidate hidden state. The calculation formula is as follows:

[0127]

[0128] The final hidden state calculation formula is as follows:

[0129]

[0130] Finally, the hidden state at time step t is updated based on the hidden state at time step t-1, and the time series processing layer updates the hidden state at all time steps to finally obtain a new representation of the graph features, namely the target feature data.

[0131] The initial network security category behavior data may be normal category behavior and abnormal category behavior. The activation function may be a ReLU activation function.

[0132] In this embodiment, the target feature data can be processed by the activation function of the output layer after two layers of linear transformation to output the initial network security category behavior data. Specifically, the initial network security category behavior data in this embodiment is output in the prediction label result output layer, in which the ReLU activation function is used as a hidden layer to increase nonlinearity. The Sigmoid activation function is used to output the final prediction result of the graph. f Defined as the graphical feature representation processed by the time series processing layer, the corresponding result is obtained after two layers of linear transformation That is, the initial network security category behavior data can be expressed as:

[0133]

[0134] Where Sigmoid represents the sigmoid activation function, ReLU represents the ReLU activation function, and Linear 1 and Linear 2 Represent the first and second layer linear transformation functions respectively.

[0135] In this embodiment, the results of the output of the training initial network security assessment model are continuously searched for model optimization based on the results. In this embodiment, the specific method of iteratively optimizing the initial network security assessment model based on the loss function and the initial network security category behavior data can be defined as the number of samples in the initial network security assessment model training is N, y n is the actual label of the Nth sample, p n is the predicted label of the Nth sample, log is the natural logarithm, then the binary cross entropy loss formula is as follows:

[0136]

[0137] In this embodiment, the derivative of the loss function with respect to the output layer activation function is calculated in the back propagation, and the partial derivative (gradient) of the loss function with respect to each parameter is calculated based on the chain rule. Finally, the calculated gradient and learning rate are used to update the parameters of the initial network security assessment model.

[0138] The final output of the initial network security assessment model is defined as Y, and the initial network security assessment model parameters are defined as θ. For each parameter, the gradient of the loss function is Based on the binary cross entropy loss (BCELoss) calculated by formula (11), and using the chain rule to calculate the derivative of the composite function, the expression can be:

[0139]

[0140] After the calculation is completed, the results are input back into the initial network security assessment model by applying the chain rule, and the chain rule is continuously applied to calculate the gradient of each parameter relative to the loss function and update the parameters of the model. Subsequently, the next training cycle is performed based on the updated parameters until the network security assessment model is obtained.

[0141] In this embodiment, the DPU performs distributed collection and preprocessing of network audit log data, and the processed log data is then aggregated to the system threat analysis component for processing, and a metagraph is created using each event in the collected and cleaned data. By aggregating events of a set duration, the attack graph is quickly modeled using a graph generator to obtain an audit graph and an anomaly graph, and the significant functions of the relevance graph attention network are used to manage complex relationships and its adaptive relationship modeling function to capture node relationship anomaly information. In addition, by combining the efficient and direct structure of the gate recursive unit, the algorithm is suitable for sequence data, which can effectively capture node time anomaly information and continuously train to obtain a network security assessment model. This embodiment has better efficiency and accuracy in APT attack detection. By comparing with the model that does not contain the anomaly information capture layer, the anomaly information capture layer shows better performance in the precision-recall curve, highlighting the importance of gate recursive unit integration to improve the performance of binary classification tasks. These results not only verify the robustness and practicality of the network security assessment model based on the audit graph in actual APT attack scenarios, but also demonstrate its scalability and efficiency when processing large-scale data sets.

[0142] The technical solution of the embodiment of the present invention obtains network audit log data; pre-processes the network audit log data to obtain pre-processed network audit log data; determines multiple meta-graph information aggregated within a set time period according to the audit log data; generates an audit graph through a graph generator based on multiple meta-graph information; inputs the audit graph into a network security assessment model to obtain network security category behavior. This technical solution can intuitively reveal and identify complex attack patterns and abnormal behaviors by analyzing the audit graph structure of system log data and their interrelationships, so as to improve the accuracy and efficiency of network security detection.

[0143] Embodiment 3

[0144] Figure 3 FIG. 1 is a schematic diagram of a network security detection device based on a data processing unit according to Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0145] A data acquisition module 310, for acquiring network audit log data based on a data processing unit;

[0146] The data preprocessing module 320 is used to preprocess the network audit log data to obtain the preprocessed network audit log data;

[0147] A graph generation module 330, for generating an audit graph based on the preprocessed network audit log data;

[0148] The security category acquisition module 340 is used to input the audit graph into the network security assessment model to obtain the network security category behavior.

[0149] Optionally, the data preprocessing module 320 is specifically used to convert the data format of the network audit log data into a standard format to obtain standardized network audit log data; and clean the standardized network audit log data to obtain preprocessed network audit log data.

[0150] Optionally, the graphics generation module 330 includes:

[0151] A meta-graph information determination unit, used to determine a plurality of meta-graph information aggregated within a set time period according to the audit log data;

[0152] The graph generation unit is used to generate an audit graph through a graph generator based on multiple meta-graph information.

[0153] Optionally, the meta-graph information determination unit is specifically used to determine the subject node and the object node according to the audit log data; construct multiple events according to the subject node and the object node, and convert the multiple events into multiple meta-graph information.

[0154] Optionally, a graph generation unit is specifically used to extract node information and edge information from the meta-graph information, and generate an audit graph using the node information and edge information through an image generator.

[0155] On the basis of the above solution, optionally, the network security detection device may further include the following model to train a network security assessment model:

[0156] A sample data acquisition module is used to obtain network audit log data samples and an initial network security assessment model;

[0157] The sample data preprocessing module is used to preprocess the network audit log data sample to obtain the preprocessed network audit log data sample;

[0158] A sample graph generation module is used to generate audit graph samples and abnormal graph samples based on the preprocessed network audit log data samples;

[0159] The model training module is used to train the initial network security assessment model based on the audit graph samples, the abnormal graph samples and the correlation graph attention network learning method until the network security assessment model is obtained.

[0160] Optionally, the initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer, and an output layer;

[0161] The model training module is specifically used to input audit graph samples and anomaly graph samples through the input layer, and convert node information and edge information in the audit graph samples and anomaly graph samples into node feature data; wherein the edge information includes time data; the node feature data is processed through the node relationship anomaly capture layer to determine the attention coefficient between the nodes; the node feature data is updated according to the attention coefficient, and the updated node feature data is pooled to obtain pooled data and time data; the sequence data is determined according to the pooled data and time data, and the sequence data is processed through the node time anomaly capture layer to obtain the target feature data; the target feature data is processed through the activation function of the output layer and the initial network security category behavior data is output; the initial network security assessment model is iteratively optimized based on the loss function and the initial network security category behavior data until the network security assessment model is obtained.

[0162] A network security detection device based on a data processing unit provided in an embodiment of the present invention can execute a network security detection method based on a data processing unit provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0163] Embodiment 4

[0164] Figure 4 1 is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0165] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0166] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0167] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a network security detection method based on a data processing unit.

[0168] In some embodiments, the network security detection method based on the data processing unit can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network security detection method based on the data processing unit described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the network security detection method based on the data processing unit in any other appropriate manner (for example, by means of firmware).

[0169] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0170] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0171] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0172] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0173] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0174] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0175] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0176] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security detection method based on a data processing unit, characterized in that: include: Acquiring network audit log data based on the data processing unit; Preprocessing the network audit log data to obtain preprocessed network audit log data; Generating an audit graph based on the preprocessed network audit log data; The audit graph is input into a network security assessment model to obtain network security category behavior.

2. The method according to claim 1, characterized in that Preprocessing the network audit log data to obtain preprocessed network audit log data includes: Converting the data format of the network audit log data into a standard format to obtain standardized network audit log data; The standardized network audit log data is cleaned to obtain pre-processed network audit log data.

3. The method according to claim 1, characterized in that Generating an audit graph based on the preprocessed network audit log data includes: Determine multiple meta-graph information aggregated within a set time period according to the network audit log data; An audit graph is generated by a graph generator based on the plurality of meta-graph information.

4. The method according to claim 3, characterized in that Determining multiple meta-graph information aggregated within a set time period according to the audit log data, including: Determine a subject node and an object node according to the audit log data; A plurality of events are constructed based on the subject node and the object node, and the plurality of events are converted into a plurality of meta-graph information.

5. The method according to claim 3, characterized in that: Generating an audit graph by a graph generator based on the plurality of meta-graph information includes: Node information and edge information are extracted from the meta-graph information, and an audit graph is generated by using the node information and the edge information through an image generator.

6. The method according to claim 1, characterized in that The training method of the network security assessment model is: Obtain network audit log data samples and initial network security assessment models; Preprocessing the network audit log data sample to obtain a preprocessed network audit log data sample; Generate an audit graph sample and an exception graph sample based on the preprocessed network audit log data sample; The initial network security assessment model is trained based on the audit graph samples, the abnormal graph samples and the correlation graph attention network learning method until a network security assessment model is obtained.

7. The method according to claim 6, characterized in that The initial network security assessment model includes an input layer, a node relationship anomaly capture layer, a node time anomaly capture layer and an output layer; The initial network security assessment model is trained based on the audit graph sample, the abnormal graph sample and the correlation graph attention network learning method until a network security assessment model is obtained, including: Inputting the audit graph sample and the abnormal graph sample through the input layer, converting the node information and edge information in the audit graph sample and the abnormal graph sample into node feature data; wherein the edge information includes time data; Processing the node feature data through the node relationship anomaly capture layer to determine the attention coefficient between nodes; Updating the node feature data according to the attention coefficient, and performing pooling processing on the updated node feature data to obtain pooling data and time data; Determine sequence data according to the pooled data and the time data, and process the sequence data through the node time anomaly capture layer to obtain target feature data; Processing the target feature data through the activation function of the output layer and outputting initial network security category behavior data; The initial network security assessment model is iteratively optimized based on the loss function and the initial network security category behavior data until a network security assessment model is obtained.

8. A network security detection device based on a data processing unit, characterized in that: include: A data acquisition module, used for acquiring network audit log data based on a data processing unit; A data preprocessing module, used to preprocess the network audit log data to obtain preprocessed network audit log data; A graph generation module, used to generate an audit graph based on the preprocessed network audit log data; The security category acquisition module is used to input the audit graph into a network security assessment model to obtain network security category behavior.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security detection method based on a data processing unit according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network security detection method based on a data processing unit according to any one of claims 1 to 7 when executed.

Images