Data security transmission method and computer equipment based on threat learning model

Abstract

The embodiments of the present application relate to the field of secure data transmission, and specifically to a data security transmission method and computer equipment based on a threat learning model. A specific implementation of the method includes: monitoring the network transmission data of the target website, and performing preliminary data detection on the network transmission data; performing data security detection on the monitored network transmission data to obtain data security detection information; extracting transmission files from the network transmission data, and performing data file detection on the extracted transmission files through a transmission file detection module; generating abnormal transmission codes corresponding to the network transmission data; intercepting data on the network transmission data, and restricting access to the network address or user account of the network transmission information; constructing the current abnormal training sample, and retraining the threat learning model based on the current abnormal training sample to obtain the current threat learning model. This implementation can ensure secure data transmission.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of secure data transmission, and specifically to a data security transmission method and computer equipment based on a threat learning model. Background Art

[0002] The current network attack and defense confrontation is becoming increasingly fierce, and network attacks are gradually developing in the direction of dynamic, hidden, multi-step, and directional, posing a huge security threat to information systems. At present, when performing data security transmission, traditional network threat detection methods based on heuristics or pattern recognition have many problems such as low detection efficiency and poor recognition performance when applied to large-scale network systems with massive multi-source heterogeneous data. Existing threat detection methods based on machine learning also lack the ability to identify unknown network threats, and rarely fully consider the problem of unknown network threat detection in large-scale network systems. In the field of unknown network threat detection, existing related research lacks systematic and comprehensive analysis, and there are also problems such as research fragmentation and difficulty in implementation. Summary of the invention

[0003] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0004] Some embodiments of the present application propose a data security transmission method and a computer device based on a threat learning model to solve one or more of the technical problems mentioned in the above background technology section.

[0005] In a first aspect, some embodiments of the present application provide a data security transmission method based on a threat learning model, the method comprising: monitoring the network transmission data of a target website through a data monitoring module, and performing preliminary data detection on the above network transmission data to obtain preliminary verification results; performing data security detection on the monitored network transmission data through a pre-trained threat learning model set in the transmission data detection module to obtain data security detection information, wherein the training samples of the above threat learning model are jointly constructed by data output by a threat data synchronization module, a user behavior analysis module and a data post-verification module, the above threat data synchronization module is used to synchronize the data threat information of a public website to a database, the above user behavior analysis module generates user behavior features according to the monitored historical network transmission information, and the above data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network anomaly information chain; The invention relates to a method for extracting a transmission file from the transmission data, and performing a data file detection on the extracted transmission file through a transmission file detection module to generate a data file detection result; generating an abnormal transmission code corresponding to the network transmission data according to the preliminary verification result, the data security detection information and the data file detection result; intercepting the network transmission data in response to determining that the abnormal transmission code indicates that the network transmission data has data abnormality, and restricting access to the network address or user account of the network transmission information through an access control module in response to determining that the abnormal transmission code meets a preset access restriction condition; constructing a current abnormal training sample based on the network abnormal information chain corresponding to the network transmission data, the data security detection information and the data file detection result, and retraining the threat learning model according to the current abnormal training sample to obtain the current threat learning model for re-use in data security transmission detection.

[0006] In a second aspect, some embodiments of the present application provide a data security transmission device based on a threat learning model, the device comprising: a data monitoring unit, configured to monitor the network transmission data of a target website through a data monitoring module, and perform preliminary data detection on the above network transmission data to obtain preliminary verification results; a data security detection unit, configured to perform data security detection on the monitored network transmission data through a pre-trained threat learning model set in the transmission data detection module to obtain data security detection information, wherein the training samples of the above threat learning model are jointly constructed by data output by a threat data synchronization module, a user behavior analysis module and a data post-verification module, the threat data synchronization module is used to synchronize the data threat information of a public website to a database, the user behavior analysis module generates user behavior features according to the monitored historical network transmission information, and the data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network anomaly information chain; a data file detection unit is configured to obtain data from the above network transmission data. The invention relates to a method for extracting a transmission file from a network, and performing data file detection on the extracted transmission file through a transmission file detection module to generate a data file detection result; a generation unit is configured to generate an abnormal transmission code corresponding to the network transmission data according to the preliminary verification result, the data security detection information and the data file detection result; a data interception and restriction unit is configured to intercept the network transmission data in response to determining that the abnormal transmission code indicates that there is a data anomaly in the network transmission data, and to restrict access to the network address or user account of the network transmission information through an access control module in response to determining that the abnormal transmission code satisfies a preset access restriction condition; a construction and retraining unit is configured to construct a current abnormal training sample based on the network abnormal information chain, data security detection information and data file detection result corresponding to the network transmission data, and to retrain the threat learning model according to the current abnormal training sample to obtain a current threat learning model for use again in data security transmission detection.

[0007] In a third aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0008] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation manner of the first aspect is implemented.

[0009] The above-mentioned embodiments of the present application have the following beneficial effects: through the data security transmission method based on the threat learning model of some embodiments of the present application, the detection efficiency and recognition performance of the system can be improved, thereby ensuring the secure transmission of data. Specifically, the reason for the existence of network threat problems is that the current network attack and defense confrontation is becoming increasingly fierce, and network attacks are gradually developing in the direction of dynamics, concealment, multi-step, and orientation, which brings huge security threats to information systems. Specifically: When traditional network threat detection methods based on heuristics or pattern recognition are applied to large-scale network systems with massive multi-source heterogeneous data, there are many problems such as low detection efficiency and poor recognition performance. Existing threat detection methods based on machine learning also lack the ability to identify unknown network threats, and rarely fully consider the problem of unknown network threat detection in large-scale network systems. In the field of unknown network threat detection, existing related research lacks systematic comprehensive analysis, and there are also problems such as research fragmentation and difficulty in implementation. Based on this, the data security transmission method based on the threat learning model of some embodiments of the present application introduces a data security transmission system. The above-mentioned data security transmission system includes: a data monitoring module, a threat data synchronization module, a transmission data detection module, a transmission file detection module, an access control module, a user behavior analysis module, and a data post-verification module. First, considering the dynamic nature of network attacks, by introducing a threat data synchronization module, data threat information can be dynamically updated so as to update and iterate security threats and improve the security detection performance of the system. Then, considering the concealment of network attacks, the transmission process of data attacks can be retraced by introducing a data post-verification module. Thus, it can be used to discover hidden attack methods for security protection. Next, considering the multi-step nature of network attacks, the network abnormal information chain generated by combining multiple steps such as preliminary data detection, data security detection, and data file detection can be used to deal with the multi-step nature of possible network attacks. Afterwards, the problem of low efficiency in detecting network attacks was considered. By introducing a threat learning model, the efficiency of data security detection can be greatly improved. Then, by introducing a user behavior analysis module, it can be used to restrain the directional characteristics of network attacks. Finally, by also constructing the current abnormal training sample, it can be used to update the recognition performance of the threat learning model in real time. Furthermore, the detection efficiency and recognition performance of network transmission data are improved to ensure the secure transmission of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0011] Figure 1is a schematic diagram of a data security transmission system architecture according to some embodiments of the data security transmission method based on a threat learning model of the present application;

[0012] Figure 2 Flow charts of some embodiments of the data security transmission method based on the threat learning model according to the present application;

[0013] Figure 3 It is a structural schematic diagram of some embodiments of a data security transmission device based on a threat learning model according to the present application;

[0014] Figure 4 It is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0015] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0016] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0017] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0018] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0019] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0020] With regard to the collection, storage, and use of user personal information (such as user portraits and historical user behaviors) involved in this application, before performing the corresponding operations, the relevant organizations or individuals shall fulfill their obligations, including conducting personal information security impact assessments, fulfilling the obligation to inform the personal information subject, and obtaining the authorization and consent of the personal information subject in advance.

[0021] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0022] Figure 1 1 is a schematic diagram of a data security transmission system architecture according to some embodiments of the data security transmission method based on the threat learning model of the present application. Figure 1 As shown, the data security transmission system 100 applied by the data security transmission method based on the threat learning model may include: a data monitoring module 101, a threat data synchronization module 102, a transmission data detection module 103, a transmission file detection module 104, an access control module 105, a user behavior analysis module 106, and a data post-verification module 107.

[0023] Among them, the above-mentioned data security transmission system 100 can use a distributed computing framework, such as Apache Hadoop or Apache Spark. To process and analyze these massive heterogeneous data. Data storage is achieved through the Hadoop Distributed File System (HDFS). Efficient data processing is performed using the MapReduce programming model. The in-memory computing characteristics provided by Spark are used to accelerate iterative algorithms and real-time data analysis. Real-time data stream processing uses message queue technologies such as Apache Kafka to establish a high-throughput data stream channel. It can ensure the rapid collection and transmission of real-time data. Combined with stream processing frameworks such as Apache Storm or Spark Streaming, real-time processing and analysis of data streams can be achieved, and network security threats can be discovered and responded to in a timely manner. In addition, in order to enhance the consistency and accuracy of data, the system also introduces distributed consistency protocols, such as Raft or Paxos. To ensure state synchronization between database replicas in a distributed environment.

[0024] Secondly, the data monitoring module 101 can monitor the network transmission data of the target website and perform preliminary data detection on the network transmission data. The network transmission data is input into the pre-trained threat learning model set in the transmission data detection module 103, and the monitored network transmission data is subjected to data security detection to obtain data security detection information. Here, the data threat information of the public website is also synchronized to the database through the threat data synchronization module 102, so as to facilitate the update of system protection. At the same time, the user behavior analysis module 106 and the data post-verification module 107 can better combine multi-source data as training samples of the threat learning model to improve the data security detection capability of the threat learning model. In addition, the transmission file is extracted from the network transmission data, and the data file detection module 104 is used to perform data file detection on the extracted transmission file to generate a data file detection result. Then, the abnormal transmission code corresponding to the network transmission data is output through the preset judgment method in the data security transmission system 100. Then, when the data is determined to be abnormal, the access control module 105 is used to intercept the data and restrict access. In this way, network attacks are avoided. Finally, the threat learning model is updated in time by constructing the current abnormal training sample. This will further improve the data security detection capabilities of the threat learning model and ensure secure data transmission.

[0025] Figure 2 The process 200 of some embodiments of the data security transmission method based on the threat learning model according to the present application is shown. The data security transmission method based on the threat learning model includes the following steps:

[0026] Step 201, monitor the network transmission data of the target website through the data monitoring module, and perform preliminary data detection on the network transmission data.

[0027] In some embodiments, the executor of the data security transmission method based on the threat learning model (for example, the data security transmission system 100) can monitor the network transmission data of the target website through the above-mentioned data monitoring module in a wired or wireless manner, and perform preliminary data detection on the above-mentioned network transmission data.

[0028] As an example, if the target website is a shopping website, the network transmission data may be data used to access the shopping website. For example, the network transmission data is a request to add a shopping cart sent by a user to the shopping website. Then, the network transmission data may include: a request line, a request header, and a request body. For example, the request line may be POST / cart / add HTTP / 1.1. The request header may include: target host address Host: www.abcdshop.com, media type of the request body: Content-Type: application / x-www-form-urlencoded, byte length of the request body: Content-Length: 45, request body: product_id = 12345&quantity = 1&submit = Add+to+Cart.

[0029] It should be noted that the above wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0030] In some optional implementations of some embodiments, the execution subject performs preliminary data detection on the network transmission data, which may include the following steps:

[0031] The above network transmission data is subjected to transmission anomaly check to generate preliminary data detection results. Preliminary data detection can be used to preliminarily determine whether the data has abnormal transmission content errors, thereby avoiding misidentification as a network attack.

[0032] As an example, the transmission anomaly check may include, but is not limited to, at least one of the following: a parity check, a cyclic redundancy check, a longitudinal redundancy check (Longitudinal Redundancy Check), an XOR check, and the like.

[0033] Step 202: Perform data security detection on the monitored network transmission data through the pre-trained threat learning model set in the transmission data detection module to obtain data security detection information.

[0034] In some embodiments, the above-mentioned execution subject can perform data security detection on the monitored network transmission data through the pre-trained threat learning model set in the above-mentioned transmission data detection module to obtain data security detection information. Among them, the training samples of the above-mentioned threat learning model can be jointly constructed by the data output by the above-mentioned threat data synchronization module, the above-mentioned user behavior analysis module and the above-mentioned data post-verification module. The above-mentioned threat data synchronization module can be used to synchronize the data threat information of the public website to the database. The above-mentioned user behavior analysis module can generate user behavior features based on the historical network transmission information monitored. The above-mentioned data post-verification module can be used to perform attack backtracking on the detected abnormal network transmission data to generate a network anomaly information chain.

[0035] Optionally, the user behavior analysis module generates user behavior features according to the monitored historical network transmission information, which may include the following steps:

[0036] For each historical network transmission information, the user behavior analysis module performs user behavior analysis through the following steps:

[0037] The first step is to extract the user behavior pattern identifier, identity authentication information, terminal node identifier, and historical transmission data information of the above historical network transmission information. Among them, each item of information in the historical network transmission information can correspond to an attribute field. Therefore, the user behavior pattern identifier, identity authentication information, terminal node identifier, and historical transmission data information in the historical network transmission information can be indexed through the attribute field. Here, the user can refer to the node of the user terminal, or the node of the website, etc. The user behavior pattern identifier can characterize the data transmission behavior of the node where the historical network transmission information is located. The identity authentication information can be data or credentials used to confirm the identity of the user node or system.

[0038] The second step is to quantify the historical transmission data information to generate quantified historical transmission data information. The data quantification can be to digitize the text information in the historical transmission data. For example, quantify network traffic, data packet size and other features.

[0039] The third step is to encode the above-mentioned identity authentication information to generate a user identity code. The encoding can be to combine the port number of the identity authentication information and whether to perform identity authentication into the user identity code. Here, whether to perform identity authentication can be replaced by 0 and 1.

[0040] The fourth step is to combine the user behavior pattern identifier, the terminal node identifier, the historical transmission data quantification information and the user identity code into a user behavior feature vector. The user behavior pattern identifier, the terminal node identifier, the historical transmission data quantification information and the user identity code can be combined into a user behavior feature vector in a preset combination order. Here, the user behavior feature vector is a multidimensional vector.

[0041] Optionally, the data post-verification module may perform attack backtracking on the detected abnormal network transmission data to generate a network abnormality information chain through the following steps:

[0042] The above data post-verification module generates a network anomaly information chain through the following steps:

[0043] The first step is to obtain the network access node of the network transmission data as a node of the network anomaly information chain, wherein the network access node can be the network address of the user terminal.

[0044] The second step is to fill the network transmission data into the corresponding node to record the attack path and data transmission time point. Here, the corresponding node means: the source IP address included in the network transmission data is the same as the network address of the node in the network anomaly information chain.

[0045] The third step is to add node pointers to the nodes of each network abnormality information chain according to the transmission direction of the network transmission data to generate a network abnormality information chain. The network abnormality information chain is stored in the form of a linked list.

[0046] Specifically, in this linked list structure, each node can represent a stage or step of a network attack. The node pointer can indicate the sequence and process of the attack steps. First, according to the transmission direction of the network transmission data, node pointers can be added to the nodes of each network anomaly information chain to create a text file. For example, a plaintext file. Then, the text file is converted into a network anomaly information chain through a pre-set programming code.

[0047] As an example, a text file may include three nodes (a / b / c). Node a may be the starting point of an attack chain, representing a phishing attack, where the attacker disguises himself as a trusted entity to trick the user into clicking a malicious link or downloading a malicious attachment, thereby obtaining the user's sensitive information (such as an email address, user account, etc.). Node b is the second node in the attack chain, indicating that after the phishing attack is successful, the attacker injects malware (such as a trojan horse, virus, etc.) into the user's computer through a malicious attachment or link in an email. Node c is the end point of the attack chain, indicating that after the malware is successfully implanted into the user's computer, the attacker uses the malware to steal data from a sensitive database. Each node contains detailed information about the attack event, and points to the next node through the Next pointer, thus forming a complete attack chain.

[0048] Optionally, the training samples of the threat learning model are constructed by using the data output by the threat data synchronization module, the user behavior analysis module and the data post-verification module, and may include the following steps:

[0049] The first step is to obtain the historical user behavior feature set output by the user behavior analysis module, the network anomaly information chain set output by the data post-verification module, and the network threat data set stored by the threat data synchronization module. Each network threat data in the network threat data set may include an abnormal node and an abnormal code. Here, the abnormal code may indicate the mode of network attack.

[0050] In the second step, for each historical user behavior feature information and the corresponding network anomaly information chain and network threat data, the following steps are used to construct training samples:

[0051] 1. Extract the linked list nodes from the linked list structure in the above network anomaly information chain and establish the corresponding linked list node feature vector for each linked list node in chronological order. The linked list node feature vector may be established according to the order of the linked list nodes on the time axis. Each data in the linked list node feature vector corresponds to a linked list node. The data in the linked list node feature vector may be a node identifier.

[0052] 2. Select the network threat data corresponding to each of the above-mentioned linked list nodes from the above-mentioned network threat data set, and quantify each of the selected network threat data to obtain a quantized network threat data set. Among them, the network threat data corresponding to the same linked list node in the network threat data set can be selected. Secondly, quantization can be to quantize the abnormal code in the network threat data into a corresponding numerical value, and replace the abnormal code with the numerical value as the quantized network threat data.

[0053] 3. The quantified network threat data group is fused with the linked list node feature vector bit by bit according to the linked list node to obtain the fused linked list node feature vector. Here, the fusion can be to fill the quantified network threat data into the linked list node feature vector corresponding to the same linked list node position to obtain the fused linked list node feature vector.

[0054] 4. Determine the above-mentioned fused linked list node feature vector and the user behavior feature vector corresponding to each linked list node in the above-mentioned fused linked list node feature vector as the sample data of the above-mentioned training sample. Among them, the fused linked list node feature vector may include the features of multiple linked list nodes. Each linked list node may correspond to a user behavior feature vector. Thus, the user behavior feature vectors corresponding to each linked list node on the fused linked list node feature vector may be combined into a user behavior feature matrix. Finally, the fused linked list node feature vector and the user behavior feature matrix are used as sample data.

[0055] 5. Determine the sample labels corresponding to the above historical user behavior feature information, and combine them with the above sample data into training samples.

[0056] In practice, by using two different forms of data as sample data, multimodal features can be introduced to train the model, thereby improving the recognition ability of the model.

[0057] Step 203: extracting a transmission file from the network transmission data, and performing data file detection on the extracted transmission file through a transmission file detection module to generate a data file detection result.

[0058] In some embodiments, the execution subject may extract a transmission file from the network transmission data, and perform data file detection on the extracted transmission file through the transmission file detection module to generate a data file detection result.

[0059] In some optional implementations of some embodiments, the execution subject extracts the transmission file from the network transmission data, and performs data file detection on the extracted transmission file through the transmission file detection module to generate a data file detection result, which may include the following steps:

[0060] The first step is to perform a static scan on the above transmission to generate a static scan result. The static scan can be to analyze and check the code or structure of the program or file without executing it. Here, a static scan can be performed using a pre-set static analysis tool to generate a static scan result. The integrity and authenticity of the file can also be ensured by verifying its digital signature. The static scan result can be a static scan mark indicating whether the static scan has passed or failed.

[0061] The second step is to input the above-mentioned transmission file into the sandbox simulation environment in the above-mentioned transmission file detection module, simulate the operation process of the above-mentioned transmission file, so as to dynamically analyze the above-mentioned transmission file and obtain the dynamic analysis result. Among them, the dynamic analysis can be to execute the transmission file in the sandbox simulation environment to monitor whether the data output and accessed during the analysis process are abnormal. Here, the dynamic analysis result can be a dynamic scanning mark indicating whether the dynamic scanning has passed or failed.

[0062] The third step is to generate a data file detection result using the static scanning result and the dynamic analysis result. If at least one of the static scanning result and the dynamic analysis result indicates that the scan failed, the file scan failed flag is determined as the data file detection result.

[0063] Step 204, generating an abnormal transmission code corresponding to the network transmission data according to the preliminary verification result, the data security detection information and the data file detection result.

[0064] In some embodiments, the execution entity may generate an abnormal transmission code corresponding to the network transmission data based on the preliminary verification result, the data security detection information and the data file detection result.

[0065] In some optional implementations of some embodiments, the execution subject generates the abnormal transmission code corresponding to the network transmission data according to the data security detection information and the data file detection result, which may include the following steps:

[0066] An abnormal transmission code that matches the data security detection information and the data file detection result is selected from a preset abnormal transmission code table. The data security detection information may include a data security detection identifier. The data file detection result may include a data file detection identifier. The abnormal transmission code table may include but is not limited to the following three fields: a data security detection identifier field, a data file detection identifier, and an abnormal transmission code field. Secondly, the match may be the abnormal transmission code field value associated with the data security detection identifier and the data file detection identifier in the abnormal transmission code table.

[0067] In practice, the abnormal transmission code table may be pre-set based on the abnormal transmission codes corresponding to the data security detection identification field and the data file detection identification in different situations.

[0068] Step 205, in response to determining that the abnormal transmission code indicates that there is a data anomaly in the network transmission data, data is intercepted on the network transmission data, and in response to determining that the abnormal transmission code meets the preset access restriction condition, access restriction is imposed on the network address or user account of the network transmission information through the access control module.

[0069] In some embodiments, the execution subject may intercept the network transmission data in response to determining that the abnormal transmission code indicates that the network transmission data has data anomalies, and in response to determining that the abnormal transmission code meets the preset access restriction conditions, restrict access to the network address or user account of the network transmission information through the access control module. The access restriction may include multiple levels of restrictions. For example, restrictions such as limiting traffic, limiting access time, limiting access methods, or prohibiting access.

[0070] Step 206, based on the network anomaly information chain, data security detection information and data file detection results corresponding to the network transmission data, construct the current anomaly training sample, and retrain the threat learning model according to the current anomaly training sample to obtain the current threat learning model for use again in data security transmission detection.

[0071] In some embodiments, the execution subject may construct the current abnormal training sample based on the network abnormal information chain, data security detection information and data file detection results corresponding to the network transmission data, and retrain the threat learning model according to the current abnormal training sample to obtain the current threat learning model for data security transmission detection again. Among them, the construction method of the current abnormal training sample and the technical effect that can be achieved can be shown in the construction step 202 of the training sample and its related content. No more details are given.

[0072] Optionally, first of all, considering that the identification object of the threat learning model is divided into two different features, namely, the fused linked list node feature vector and the corresponding user behavior feature matrix. In order to better fuse the two features for network attack identification, the above threat learning model is set as a multimodal model. It can include a first network branch, a second network branch, an attention mechanism layer, a feature fusion layer, and an output layer.

[0073] Then, considering that the fused linked list node feature vector not only reflects the chain behavior of the network attack in the time series, but also comes with features such as the network traffic and attack methods required for different network attack stages. Therefore, in order to better utilize this feature, a recurrent neural network layer that is better at identifying the properties of time series is used for the first network branch. Here, the first network branch may include an input layer, a hidden layer, and an output layer. The input layer accepts the multi-dimensional fused linked list node feature vector and passes the output feature vector to the hidden layer. Feature extraction is performed through multiple hidden units and activation functions of the hidden layer. Finally, the features are classified by the softmax function of the output layer to obtain the first network classification feature.

[0074] Next, considering that the user behavior feature matrix includes the behavior features of each linked list node, which is the feature of the graph structure. Therefore, the Graph Neural Network Layer is used as the second network branch. In this way, the behavior features corresponding to each node in the user behavior feature matrix can be better extracted. Here, the user behavior feature matrix can be input into the second network branch and linearly transformed with the learnable weight matrix in the network to obtain the transformed matrix. The attention weight between each linked list node and its neighboring nodes is also calculated by using the attention mechanism. Here, the attention weight can be calculated by the LeakyReLU activation function and a learnable vector to calculate the similarity of the concatenation of the two node feature vectors. Then, the softmax function is used to normalize the attention weight to ensure that the sum of the weights of all neighboring nodes is 1. In this way, the stability of the numerical value is improved in the subsequent feature aggregation process. By calculating the weighted sum and applying a nonlinear activation function (such as ReLU), the normalized attention weight is weighted and summed with the user behavior feature vector of the adjacent linked list nodes on the fused linked list node feature vector to obtain the updated feature representation of each linked list node.

[0075] Then, in order to enhance the expressiveness and stability of the model, an attention mechanism layer is introduced. Thus, the attention scores of the first network branch and the second network branch are calculated through the attention mechanism layer. The features output by the two branches are weighted according to the attention scores to generate a weighted feature representation. Then, the weighted feature representations are fused to generate a multimodal attention fusion feature. Through the above output layer (classifier or decoder), the final recognition result of the model is output.

[0076] Finally, the cross entropy loss value between the above final recognition result and the sample data of the training sample is determined. If the cross entropy loss value is greater than the preset threshold, the model parameters are adjusted by back propagation. Thus, the training of the threat learning model is completed. Therefore, the security detection capability of the trained threat learning model for network transmission data can be improved through the above steps.

[0077] In addition, during each retraining process, if the cross entropy loss value generated is too large, there is a sample error or sample offset. Therefore, the model parameters can be left unchanged.

[0078] The above-mentioned embodiments of the present application have the following beneficial effects: through the data security transmission method based on the threat learning model of some embodiments of the present application, the detection efficiency and recognition performance of the system can be improved, thereby ensuring the secure transmission of data. Specifically, the reason for the existence of network threat problems is that the current network attack and defense confrontation is becoming increasingly fierce, and network attacks are gradually developing in the direction of dynamics, concealment, multi-step, and orientation, which brings huge security threats to information systems. Specifically: When traditional network threat detection methods based on heuristics or pattern recognition are applied to large-scale network systems with massive multi-source heterogeneous data, there are many problems such as low detection efficiency and poor recognition performance. Existing threat detection methods based on machine learning also lack the ability to identify unknown network threats, and rarely fully consider the problem of unknown network threat detection in large-scale network systems. In the field of unknown network threat detection, existing related research lacks systematic comprehensive analysis, and there are also problems such as research fragmentation and difficulty in implementation. Based on this, the data security transmission method based on the threat learning model of some embodiments of the present application introduces a data security transmission system. The above-mentioned data security transmission system includes: a data monitoring module, a threat data synchronization module, a transmission data detection module, a transmission file detection module, an access control module, a user behavior analysis module, and a data post-verification module. First, considering the dynamic nature of network attacks, by introducing a threat data synchronization module, data threat information can be dynamically updated so as to update and iterate security threats and improve the security detection performance of the system. Then, considering the concealment of network attacks, the transmission process of data attacks can be retraced by introducing a data post-verification module. Thus, it can be used to discover hidden attack methods for security protection. Next, considering the multi-step nature of network attacks, the network abnormal information chain generated by combining multiple steps such as preliminary data detection, data security detection, and data file detection can be used to deal with the multi-step nature of possible network attacks. Afterwards, the problem of low efficiency in detecting network attacks was considered. By introducing a threat learning model, the efficiency of data security detection can be greatly improved. Then, by introducing a user behavior analysis module, it can be used to restrain the directional characteristics of network attacks. Finally, by also constructing the current abnormal training sample, it can be used to update the recognition performance of the threat learning model in real time. Furthermore, the detection efficiency and recognition performance are improved, ensuring the secure transmission of data.

[0079] Further references Figure 3 As an implementation of the methods shown in the above figures, the present application provides some embodiments of a data security transmission device based on a threat learning model. These device embodiments are similar to Figure 2 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0080] like Figure 3As shown, the data security transmission device 200 based on the threat learning model of some embodiments includes: a data monitoring unit 301, a data security detection unit 302, a data file detection unit 303, a generation unit 304, a data interception and restriction unit 305, and a construction and retraining unit 306. Among them, the data monitoring unit 301 is configured to monitor the network transmission data of the target website through the data monitoring module, and perform preliminary data detection on the above network transmission data to obtain preliminary verification results; the data security detection unit 302 is configured to perform data security detection on the monitored network transmission data through the pre-trained threat learning model set in the transmission data detection module to obtain data security detection information, wherein the training samples of the above threat learning model are jointly constructed by the data output by the threat data synchronization module, the user behavior analysis module and the data post-verification module, the threat data synchronization module is used to synchronize the data threat information of the public website to the database, the user behavior analysis module generates user behavior features according to the monitored historical network transmission information, and the data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network abnormality information chain; the data file detection unit 303 is configured to extract the transmission file from the above network transmission data, and through the transmission file detection module , perform data file detection on the extracted transmission file to generate a data file detection result; a generation unit 304 is configured to generate an abnormal transmission code corresponding to the above-mentioned network transmission data according to the above-mentioned preliminary verification result, the above-mentioned data security detection information and the above-mentioned data file detection result; a data interception and restriction unit 305 is configured to intercept the above-mentioned network transmission data in response to determining that the above-mentioned abnormal transmission code represents that the above-mentioned network transmission data has data abnormality, and in response to determining that the abnormal transmission code meets the preset access restriction condition, restrict access to the network address or user account of the above-mentioned network transmission information through the access control module; a construction and retraining unit 306 is configured to construct a current abnormal training sample based on the network abnormal information chain corresponding to the above-mentioned network transmission data, the data security detection information and the data file detection result, and retrain the above-mentioned threat learning model according to the above-mentioned current abnormal training sample to obtain the current threat learning model for use again in data security transmission detection.

[0081] It is understood that the units described in the device 300 are similar to those described in the reference Figure 2 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 300 and the units contained therein, and will not be described in detail here.

[0082] The present application also provides a computer device 400. Figure 4As shown, the computer device 400 includes: a bus 401, a processor 402, a memory 403 and a communication interface 404. The processor 402, the memory 403 and the communication interface 404 communicate with each other through the bus 401. The computer device 400 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 400.

[0083] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The bus 401 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 401 may include a path for transmitting information between various components of the computer device 400 (for example, the memory 403, the processor 402, and the communication interface 404).

[0084] The processor 402 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0085] The memory 403 may include a volatile memory, such as a random access memory (RAM). The memory 403 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0086] The memory 403 stores executable program codes, and the processor 402 executes the executable program codes to respectively implement the functions of the acquisition module, the sampling module, the determination module, and the mixing module, thereby implementing the method for secure data transmission based on the threat learning model. That is, the memory 403 stores instructions for executing the method for secure data transmission based on the threat learning model.

[0087] The communication interface 404 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 400 and other devices or a communication network.

[0088] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned method for secure data transmission based on a threat learning model.

[0089] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned method for secure data transmission based on a threat learning model.

[0090] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0091] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security transmission method based on threat learning model, applied to a data security transmission system, characterized in that: The data security transmission system includes: a data monitoring module, a threat data synchronization module, a transmission data detection module, a transmission file detection module, an access control module, a user behavior analysis module, and a data post-verification module. The method includes: By means of the data monitoring module, the network transmission data of the target website is monitored, and a preliminary data detection is performed on the network transmission data to obtain a preliminary verification result; Through the pre-trained threat learning model set in the transmission data detection module, the monitored network transmission data is subjected to data security detection to obtain data security detection information, wherein the training samples of the threat learning model are jointly constructed by the data output by the threat data synchronization module, the user behavior analysis module and the data post-verification module, the threat data synchronization module is used to synchronize the data threat information of the public website to the database, the user behavior analysis module generates user behavior features according to the monitored historical network transmission information, and the data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network abnormality information chain; Extracting a transmission file from the network transmission data, and performing data file detection on the extracted transmission file through the transmission file detection module to generate a data file detection result; Generate an abnormal transmission code corresponding to the network transmission data according to the preliminary verification result, the data security detection information and the data file detection result; In response to determining that the abnormal transmission code indicates that the network transmission data has data anomalies, data interception is performed on the network transmission data; and in response to determining that the abnormal transmission code meets a preset access restriction condition, access restriction is performed on the network address or user account of the network transmission data through the access control module; Based on the network anomaly information chain, data security detection information and data file detection results corresponding to the network transmission data, a current anomaly training sample is constructed, and according to the current anomaly training sample, the threat learning model is retrained to obtain the current threat learning model for use again in data security transmission detection.

2. The method according to claim 1, characterized in that The performing preliminary data detection on the network transmission data includes: The network transmission data is checked for transmission anomalies to generate preliminary data detection results.

3. The method according to claim 1, characterized in that The user behavior analysis module generates user behavior features based on the monitored historical network transmission information, including: For each historical network transmission information, the user behavior analysis module performs user behavior analysis through the following steps: Extracting user behavior pattern identifiers, identity authentication information, terminal node identifiers, and historical transmission data information of the historical network transmission information; quantizing the historical transmission data information to generate historical transmission data quantization information; Encoding the identity authentication information to generate a user identity code; The user behavior pattern identifier, the terminal node identifier, the historical transmission data quantification information and the user identity code are combined into a user behavior feature vector.

4. The method according to claim 1, characterized in that The data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network abnormality information chain, including: The data post-verification module generates a network anomaly information chain through the following steps: Acquire a network access node of the network transmission data as a node of a network anomaly information chain; Fill the network transmission data into the corresponding nodes to record the attack path and data transmission time point; According to the transmission direction of the network transmission data, a node pointer is added to the node of each network abnormal information chain to generate a network abnormal information chain, wherein the network abnormal information chain is stored in the form of a linked list.

5. The method according to claim 1, characterized in that Extracting a transmission file from the network transmission data, and performing data file detection on the extracted transmission file through the transmission file detection module to generate a data file detection result, including: Performing a static scan on the transmission file to generate a static scan result; Inputting the transmission file into the sandbox simulation environment in the transmission file detection module to simulate the running process of the transmission file so as to dynamically analyze the transmission file and obtain a dynamic analysis result; The data file detection result is generated by using the static scanning result and the dynamic analysis result.

6. The method according to claim 1, characterized in that The generating, according to the preliminary verification result, the data security detection information and the data file detection result, an abnormal transmission code corresponding to the network transmission data comprises: An abnormal transmission code that matches the data security detection information and the data file detection result is selected from a preset abnormal transmission code table, wherein the data security detection information includes a data security detection identifier, the data file detection result includes a data file detection identifier, and the abnormal transmission code table includes the following three fields: a data security detection identifier field, a data file detection identifier, and an abnormal transmission code field.

7. A data security transmission device based on a threat learning model, comprising: The data monitoring unit is configured to monitor the network transmission data of the target website through the data monitoring module, and perform preliminary data detection on the network transmission data to obtain a preliminary verification result; A data security detection unit is configured to perform data security detection on the monitored network transmission data through a pre-trained threat learning model set in the transmission data detection module to obtain data security detection information, wherein the training sample of the threat learning model is jointly constructed by the data output by the threat data synchronization module, the user behavior analysis module and the data post-verification module, the threat data synchronization module is used to synchronize the data threat information of the public website to the database, the user behavior analysis module generates user behavior features according to the monitored historical network transmission information, and the data post-verification module is used to perform attack backtracking on the detected abnormal network transmission data to generate a network abnormality information chain; a data file detection unit, configured to extract a transmission file from the network transmission data, and perform data file detection on the extracted transmission file through a transmission file detection module to generate a data file detection result; a generating unit configured to generate an abnormal transmission code corresponding to the network transmission data according to the preliminary verification result, the data security detection information and the data file detection result; a data interception and restriction unit, configured to intercept the network transmission data in response to determining that the abnormal transmission code indicates that the network transmission data has data anomalies, and to restrict access to the network address or user account of the network transmission data through the access control module in response to determining that the abnormal transmission code meets a preset access restriction condition; The construction and retraining unit is configured to construct a current abnormal training sample based on the network abnormal information chain, data security detection information and data file detection results corresponding to the network transmission data, and retrain the threat learning model according to the current abnormal training sample to obtain the current threat learning model for use again in data security transmission detection.

8. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images