A gateway access abnormal monitoring and early warning method and system

Abstract

The present invention belongs to the field of communication security technology. A gateway access anomaly monitoring and early warning method and system are provided. The method includes: determining the network terminal type information and historical associated early warning information of several network terminals accessing the target gateway, evaluating them using a Transformer-based abnormal threshold determination model to obtain a first abnormal threshold; obtaining the access anomaly monitoring information of the target gateway in a recent preset time period, determining a sensitivity coefficient based on the access anomaly monitoring information, and using the sensitivity coefficient to correct the first abnormal threshold to obtain a second abnormal threshold; receiving the real-time gateway access information of the target gateway, and using the access anomaly classification model to analyze the real-time gateway access information to obtain an access anomaly evaluation value; if the access anomaly evaluation value is higher than the second abnormal threshold, outputting a gateway access anomaly alarm signal. The present invention realizes more accurate identification and early warning of abnormal gateway access based on dynamic thresholds.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a gateway access anomaly monitoring and early warning method and system. Background Art

[0002] A gateway, also known as an internetwork connector or protocol converter, is a network device or software used to connect two different networks or protocols and exchange data between them. As an important node in the network, once attacked, the gateway may have a serious impact on the security and stability of the entire network. The types of attacks that gateways often suffer include denial of service (DoS) and distributed denial of service (DDoS) attacks, man-in-the-middle (MITM) attacks, phishing attacks, ransomware attacks, etc.

[0003] In order to ensure the security of the gateway, the prior art obtains an abnormal evaluation value by analyzing the access behavior of the access user, and then compares the abnormal evaluation value with the preset abnormal threshold. If the abnormal evaluation value is higher than the preset abnormal threshold, it is determined that the access user has abnormal access behavior, and an early warning is issued at this time, and other processing measures can also be taken. The abnormal threshold in the above-mentioned prior art is fixedly set. In practice, it is actually difficult to determine a particularly suitable abnormal threshold, resulting in too many false alarms or missed alarms, which is difficult to meet actual needs.

[0004] Therefore, how to conduct more accurate analysis of gateway access anomalies and thus improve the accuracy of early warnings is a technical problem that urgently needs to be solved. Summary of the invention

[0005] In response to the above technical problems, the present invention provides a gateway access anomaly monitoring and early warning method, system, electronic device, computer storage medium and computer program product.

[0006] The present invention discloses a gateway access abnormality monitoring and early warning method, which is applied to a target gateway. The method comprises the following steps:

[0007] Determine a number of network terminals connected to the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway;

[0008] Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold;

[0009] receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly assessment value;

[0010] The access abnormality evaluation value is compared with the second abnormality threshold, and if the access abnormality evaluation value is higher than the second abnormality threshold, a gateway access abnormality alarm signal is output.

[0011] Optionally, the using a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway includes:

[0012] Using a convolutional network to extract features from each of the network terminal type information and the historical associated warning information, obtaining network terminal type features and historical associated warning features, matrixing and integrating the network terminal type features and the historical associated warning features, and obtaining network terminal feature information;

[0013] The network-side feature information is input into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway.

[0014] Optionally, inputting the network terminal feature information into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway includes:

[0015] Inputting the network end feature information into the abnormal threshold determination model based on Transformer, and the abnormal threshold determination model outputs a third abnormal threshold of the target gateway;

[0016] Inputting each of the network terminal type information and the historical correlation warning information into an abnormal threshold auxiliary analysis model based on the BERT large model, and the abnormal threshold auxiliary analysis model outputs a fourth abnormal threshold of the target gateway;

[0017] The first abnormal threshold of the target gateway is obtained by weighted calculation according to the third abnormal threshold and the fourth abnormal threshold.

[0018] Optionally, the acquiring access anomaly monitoring information of the target gateway within a recent preset period of time, and determining a sensitivity coefficient according to the access anomaly monitoring information, includes:

[0019] Obtaining access anomaly monitoring information of the target gateway in a recent preset period, wherein the access anomaly monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-period, and the number of abnormal alarm types;

[0020] Obtain historical access anomaly monitoring information of several similar gateways corresponding to the target gateway, and calculate benchmark access anomaly monitoring information according to each of the historical access anomaly monitoring information, wherein the benchmark access anomaly monitoring information includes a benchmark anomaly alarm number, a benchmark maximum value of the anomaly alarm frequency in each sub-period, and a benchmark anomaly alarm type number;

[0021] Respectively calculating a first difference ratio between the number of abnormal alarms and the benchmark number of abnormal alarms, a second difference ratio between the maximum value and the benchmark maximum value, and a third difference ratio between the number of abnormal alarm types and the benchmark number of abnormal alarm types, and calculating an average of the first difference ratio, the second difference ratio, and the third difference ratio to obtain a fourth difference ratio;

[0022] The fourth difference ratio is compared with a preset comparison table to obtain the sensitivity coefficient.

[0023] Optionally, comparing the fourth difference ratio with a preset comparison table to obtain the sensitivity coefficient includes:

[0024] Comparing the fourth difference ratio with a preset comparison table to obtain a preliminary sensitivity coefficient;

[0025] Determine the time span of the recent preset period, obtain an adjustment coefficient according to the time span matching, and multiply the adjustment coefficient by the preliminary sensitivity coefficient to obtain the final sensitivity coefficient;

[0026] Among them, when the preliminary sensitivity coefficient is less than 1, the adjustment coefficient is greater than 1 and negatively correlated with the time span; when the preliminary sensitivity coefficient is greater than 1, the adjustment coefficient is less than 1 and positively correlated with the time span.

[0027] Optionally, the access anomaly classification model is based on a model of a machine learning algorithm.

[0028] The present invention also discloses a gateway access abnormality monitoring and early warning system, which is applied to a target gateway. The system includes a processing device and a storage device. The computer code stored in the storage device is called and executed by the processing device to implement the following steps:

[0029] Determine a number of network terminals connected to the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway;

[0030] Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold;

[0031] receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly assessment value;

[0032] The access abnormality evaluation value is compared with the second abnormality threshold, and if the access abnormality evaluation value is higher than the second abnormality threshold, a gateway access abnormality alarm signal is output.

[0033] Optionally, the using a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway includes:

[0034] Using a convolutional network to extract features from each of the network terminal type information and the historical associated warning information, obtaining network terminal type features and historical associated warning features, matrixing and integrating the network terminal type features and the historical associated warning features, and obtaining network terminal feature information;

[0035] The network-side feature information is input into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway.

[0036] Optionally, inputting the network terminal feature information into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway includes:

[0037] Inputting the network end feature information into the abnormal threshold determination model based on Transformer, and the abnormal threshold determination model outputs a third abnormal threshold of the target gateway;

[0038] Inputting each of the network terminal type information and the historical correlation warning information into an abnormal threshold auxiliary analysis model based on the BERT large model, and the abnormal threshold auxiliary analysis model outputs a fourth abnormal threshold of the target gateway;

[0039] The first abnormal threshold of the target gateway is obtained by weighted calculation according to the third abnormal threshold and the fourth abnormal threshold.

[0040] Optionally, the acquiring access anomaly monitoring information of the target gateway within a recent preset period of time, and determining a sensitivity coefficient according to the access anomaly monitoring information, includes:

[0041] Obtaining access anomaly monitoring information of the target gateway in a recent preset period, wherein the access anomaly monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-period, and the number of abnormal alarm types;

[0042] Obtain historical access anomaly monitoring information of several similar gateways corresponding to the target gateway, and calculate benchmark access anomaly monitoring information according to each of the historical access anomaly monitoring information, wherein the benchmark access anomaly monitoring information includes a benchmark anomaly alarm number, a benchmark maximum value of the anomaly alarm frequency in each sub-period, and a benchmark anomaly alarm type number;

[0043] Respectively calculating a first difference ratio between the number of abnormal alarms and the benchmark number of abnormal alarms, a second difference ratio between the maximum value and the benchmark maximum value, and a third difference ratio between the number of abnormal alarm types and the benchmark number of abnormal alarm types, and calculating an average of the first difference ratio, the second difference ratio, and the third difference ratio to obtain a fourth difference ratio;

[0044] The fourth difference ratio is compared with a preset comparison table to obtain the sensitivity coefficient.

[0045] Optionally, comparing the fourth difference ratio with a preset comparison table to obtain the sensitivity coefficient includes:

[0046] Comparing the fourth difference ratio with a preset comparison table to obtain a preliminary sensitivity coefficient;

[0047] Determine the time span of the recent preset period, obtain an adjustment coefficient according to the time span matching, and multiply the adjustment coefficient by the preliminary sensitivity coefficient to obtain the final sensitivity coefficient;

[0048] Among them, when the preliminary sensitivity coefficient is less than 1, the adjustment coefficient is greater than 1 and negatively correlated with the time span; when the preliminary sensitivity coefficient is greater than 1, the adjustment coefficient is less than 1 and positively correlated with the time span.

[0049] Optionally, the access anomaly classification model is based on a model of a machine learning algorithm.

[0050] The present invention also discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement any of the above methods.

[0051] The present invention also discloses a computer storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above methods.

[0052] The present invention also discloses a computer program product, which includes computer codes. When the computer codes are executed by a processor of an electronic device, any of the above methods is implemented.

[0053] The beneficial effect of the present invention is at least that: the scheme of the present invention comprehensively analyzes the type information of each network terminal accessed by the target gateway and the recent access anomaly monitoring situation of the target gateway to obtain a more appropriate dynamic anomaly threshold, and based on the dynamic anomaly threshold, real-time monitoring and early warning are performed on whether the target gateway has access abnormal behavior, which can significantly improve the accuracy of the early warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 It is a schematic diagram of the structure of the antibacterial aluminum plate disclosed in an embodiment of the present invention;

[0056] Figure 2 It is a schematic diagram of obtaining a first abnormal threshold by cooperating with a convolutional network and an abnormal threshold determination model disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following is a description of the implementation of the present application by specific specific embodiments. People familiar with the technology can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0058] In addition, the technical features involved in the different embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0059] In order to ensure the security of the gateway, the prior art obtains an abnormal evaluation value by analyzing the access behavior of the access user, and then compares the abnormal evaluation value with the preset abnormal threshold. If the abnormal evaluation value is higher than the preset abnormal threshold, it is determined that the access user has abnormal access behavior, and an early warning is issued at this time, and other processing measures can also be taken. The abnormal threshold in the above-mentioned existing method is fixedly set. In practice, it is actually difficult to determine a particularly suitable abnormal threshold, resulting in too many false alarms or missed alarms, which is difficult to meet actual needs. Therefore, how to perform more accurate abnormal analysis on gateway access anomalies and thus improve the accuracy of early warning is a technical problem that urgently needs to be solved.

[0060] like Figure 1 As shown, in view of the above technical problems, an embodiment of the present invention discloses a gateway access abnormality monitoring and early warning method, which is applied to a target gateway. The method comprises the following steps:

[0061] Determine a number of network terminals connected to the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway;

[0062] Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold;

[0063] receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly assessment value;

[0064] The access abnormality evaluation value is compared with the second abnormality threshold, and if the access abnormality evaluation value is higher than the second abnormality threshold, a gateway access abnormality alarm signal is output.

[0065] Compared with the existing method of abnormal gateway access warning based on fixed thresholds introduced in the background technology, the present invention adopts dynamic thresholds to analyze and judge abnormal access behaviors in the gateway, thereby improving the accuracy of abnormal access monitoring and warning. The specific introduction is as follows:

[0066] First, retrieve all network terminals connected to the target gateway (it should be noted that all network terminals connected to the target gateway are dynamically changing), and determine the network terminal type information of these network terminals, including but not limited to ordinary servers, financial system servers, transportation system servers, etc. Different types of network terminals have different security requirements for the target gateway; and also obtain the historical correlation warning information of these network terminals. The historical correlation warning information refers to the network terminals involved in the access abnormality warning in the target gateway. For example, network terminal A involves thousands of access abnormality warnings in each analysis cycle, and network terminal B involves hundreds of access abnormality warnings in each analysis cycle. Create an abnormal threshold determination model based on Transformer in advance, and use the abnormal threshold determination model to comprehensively evaluate the aforementioned network terminal type information and historical correlation warning information to obtain the first abnormal threshold of the target gateway.

[0067] Then, the above-mentioned first abnormality threshold is a basic threshold adapted to the overall security requirements of all network terminals connected to the target gateway, which does not take into account the situation of the target gateway itself. In this regard, the present invention further obtains the access abnormality monitoring information of the target gateway in a recent preset time period. The access abnormality monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-time period (the preset time period is divided into multiple sub-time periods), the number of abnormal alarm types, etc. The sensitivity coefficient is determined based on these access abnormality monitoring information. The sensitivity coefficient can be used to characterize the development trend of the access abnormality of the target gateway in the near future. The modified second abnormality threshold can be obtained by multiplying the sensitivity coefficient by the first abnormality threshold obtained above.

[0068] Next, the target gateway is monitored in real time, and the monitored real-time gateway access information is analyzed using a preset access anomaly classification model to obtain an access anomaly assessment value; if the access anomaly assessment value is higher than the second anomaly threshold, it is determined that the target gateway has an access anomaly, and a gateway access anomaly alarm signal is output at this time to enable relevant personnel or handling procedures to intervene.

[0069] Therefore, the solution of the present invention comprehensively analyzes the type information of each network terminal accessed by the target gateway and the recent access anomaly monitoring situation of the target gateway to obtain a more appropriate dynamic anomaly threshold, and based on the dynamic anomaly threshold, real-time monitoring and early warning are performed on whether the target gateway has access abnormal behavior, which can significantly improve the accuracy of the early warning.

[0070] Optionally, the using a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway includes:

[0071] Using a convolutional network to extract features from each of the network terminal type information and the historical associated warning information, obtaining network terminal type features and historical associated warning features, matrixing and integrating the network terminal type features and the historical associated warning features, and obtaining network terminal feature information;

[0072] The network-side feature information is input into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway.

[0073] In this embodiment, the abnormal threshold determination model of the present invention may not directly analyze and process the network terminal type information and historical related warning information, but firstly extract the features of the network terminal type information and historical related warning information by a separately constructed convolutional network to obtain the network terminal type features and historical related warning features, and then matrix process and merge the information to obtain the network terminal feature information, such as Figure 2 As shown. Then, the abnormal threshold determination model is used to analyze and process the network end feature information, thereby obtaining the first abnormal threshold of the target gateway. Such a setting can avoid building a feature extraction module in the abnormal threshold determination model, reduce the volume of the abnormal threshold determination model, and improve the analysis rate.

[0074] Transformer is a deep learning model based on the self-attention mechanism, which completely changes the processing method of sequence-to-sequence (Seq2Seq) tasks. Through the self-attention mechanism, Transformer can effectively capture long-distance dependencies, and the parallel computing characteristics of the multi-head attention mechanism greatly improve the training and reasoning efficiency. Therefore, the present invention uses Transformer to construct the above-mentioned abnormal threshold determination model. Correspondingly, the abnormal threshold determination model includes an encoder structure and a decoder structure. Among them, the encoder structure is composed of a plurality of encoder layers stacked, each encoder layer includes a multi-head self-attention layer and a feedforward neural network layer, as well as residual connections and layer normalization operations. The decoder structure is also composed of a plurality of decoder layers stacked, each decoder layer includes a masked self-attention layer, an encoder-decoder self-attention layer and a feedforward neural network layer, as well as residual connections and layer normalization operations.

[0075] Optionally, inputting the network terminal feature information into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway includes:

[0076] Inputting the network end feature information into the abnormal threshold determination model based on Transformer, and the abnormal threshold determination model outputs a third abnormal threshold of the target gateway;

[0077] Inputting each of the network terminal type information and the historical correlation warning information into an abnormal threshold auxiliary analysis model based on the BERT large model, and the abnormal threshold auxiliary analysis model outputs a fourth abnormal threshold of the target gateway;

[0078] The first abnormal threshold of the target gateway is obtained by weighted calculation according to the third abnormal threshold and the fourth abnormal threshold.

[0079] In this embodiment, the present invention constructs two different types of models, namely, an abnormal threshold determination model based on Transformer and an abnormal threshold auxiliary analysis model based on the BERT large model. Among them, the abnormal threshold determination model cannot directly analyze and process the type information of each network terminal and the historical correlation warning information, but first uses a convolutional network to analyze and obtain the network terminal feature information, and then analyzes the network terminal feature information. Obviously, the abnormal threshold determination model is a conventional vertical model; and the abnormal threshold auxiliary analysis model is obtained by fine-tuning the BERT large model. The BERT large model itself has powerful semantic analysis capabilities and semantic understanding capabilities. The abnormal threshold auxiliary analysis model obtained after fine-tuning training can directly perform comprehensive semantic analysis on the relevant information of these network terminals connected to the target gateway, and then obtain another abnormal threshold, namely the fourth abnormal threshold.

[0080] Then, the obtained third abnormal threshold and fourth abnormal threshold are weighted and fused, and the interface obtains the final first abnormal threshold of the target gateway. The sum of the weighted values ​​of the third abnormal threshold and the fourth abnormal threshold can be 1, and the size of the two weighted values ​​can be determined according to the analysis accuracy of the corresponding model. The higher the analysis accuracy, the larger the corresponding weighted value, and vice versa.

[0081] Optionally, the acquiring access anomaly monitoring information of the target gateway within a recent preset period of time, and determining a sensitivity coefficient according to the access anomaly monitoring information, includes:

[0082] Obtaining access anomaly monitoring information of the target gateway in a recent preset period, wherein the access anomaly monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-period, and the number of abnormal alarm types;

[0083] Obtain historical access anomaly monitoring information of several similar gateways corresponding to the target gateway, and calculate benchmark access anomaly monitoring information according to each of the historical access anomaly monitoring information, wherein the benchmark access anomaly monitoring information includes a benchmark anomaly alarm number, a benchmark maximum value of the anomaly alarm frequency in each sub-period, and a benchmark anomaly alarm type number;

[0084] Respectively calculating a first difference ratio between the number of abnormal alarms and the benchmark number of abnormal alarms, a second difference ratio between the maximum value and the benchmark maximum value, and a third difference ratio between the number of abnormal alarm types and the benchmark number of abnormal alarm types, and calculating an average of the first difference ratio, the second difference ratio, and the third difference ratio to obtain a fourth difference ratio;

[0085] The fourth difference ratio is compared with a preset comparison table to obtain the sensitivity coefficient.

[0086] In this embodiment, the access anomaly monitoring information of the target gateway obtained in a recent preset period ("recent" is, for example, one month) includes, but is not limited to, the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-period, and the number of abnormal alarm types. Among them, the abnormal alarm types include denial of service (DoS) and distributed denial of service (DDoS) attacks, man-in-the-middle (MITM) attacks, phishing attacks, ransomware attacks, etc.

[0087] At the same time, the historical access anomaly monitoring information of other gateways of similar types to the target gateway is also obtained, and the content included in the historical access anomaly monitoring information is of the same type as the content included in the access anomaly monitoring information of the target gateway. Other gateways of similar types refer to gateways whose types and numbers of network terminals accessed are highly similar to those of the target gateway. The historical access anomaly monitoring information of these similar gateways is subjected to mean calculation, median calculation, and other methods to obtain benchmark access anomaly monitoring information, including the benchmark anomaly alarm number, the benchmark maximum value of the anomaly alarm frequency in each sub-period, and the number of benchmark anomaly alarm types.

[0088] Then, the access anomaly monitoring information in the target gateway and the contents in the reference access anomaly monitoring information are calculated one by one by difference ratio, and the difference ratio refers to the absolute value of the difference of the same content divided by the average value of the sum of the same content, for example, the first difference ratio = |abnormal alarm times - reference abnormal alarm times | / ((abnormal alarm times + reference abnormal alarm times) / 2), and the average of the three difference ratios is compared with the preset comparison table to obtain the sensitivity coefficient. The preset comparison table includes the correspondence between the average of multiple groups of difference ratios measured in advance and the sensitivity coefficient.

[0089] Among them, the sensitivity coefficient is a value near 1, such as [0.6, 1.5]. When the sensitivity coefficient is less than 1, it is used to appropriately lower the first abnormal threshold, which indicates that the security requirements of the network end connected to the target gateway at the current stage are relatively high, and a more stringent, i.e., a smaller abnormal threshold is needed to decide whether to output an alarm signal. When the sensitivity coefficient is greater than 1, it is used to appropriately increase the first abnormal threshold, which indicates that the security requirements of the network end connected to the target gateway at the current stage are relatively low, and a more relaxed, i.e., a larger abnormal threshold is needed to decide whether to output an alarm signal.

[0090] Optionally, comparing the fourth difference ratio with a preset comparison table to obtain the sensitivity coefficient includes:

[0091] Comparing the fourth difference ratio with a preset comparison table to obtain a preliminary sensitivity coefficient;

[0092] Determine the time span of the recent preset period, obtain an adjustment coefficient according to the time span matching, and multiply the adjustment coefficient by the preliminary sensitivity coefficient to obtain the final sensitivity coefficient;

[0093] Among them, when the preliminary sensitivity coefficient is less than 1, the adjustment coefficient is greater than 1 and negatively correlated with the time span; when the preliminary sensitivity coefficient is greater than 1, the adjustment coefficient is less than 1 and positively correlated with the time span.

[0094] In this embodiment, the time span of the aforementioned recent preset time period is adjustable. When the time span is larger, the confidence of the above-mentioned access anomaly monitoring information obtained is higher, the accuracy of the fourth difference ratio obtained by subsequent analysis is higher, and the rationality of the preliminary sensitivity coefficient is higher. Therefore, at this time, the intervention adjustment of the preliminary sensitivity coefficient should be minimized. When the time span is smaller, the confidence of the above-mentioned access anomaly monitoring information obtained is lower (individual significant access anomalies will cause the access anomaly monitoring information to have a larger anomaly as a whole), the accuracy of the fourth difference ratio obtained by subsequent analysis is lower, and the rationality of the preliminary sensitivity coefficient is lower. Therefore, at this time, the intervention adjustment of the preliminary sensitivity coefficient should be increased to avoid excessive correction of the first abnormal threshold by the preliminary sensitivity coefficient.

[0095] Therefore, the present invention specifically sets: when the initial sensitivity coefficient is less than 1, the adjustment coefficient is set to be greater than 1 and negatively correlated with the time span; when the initial sensitivity coefficient is greater than 1, the adjustment coefficient is set to be less than 1 and positively correlated with the time span. In other words, when the time span is larger, the accuracy of the initial sensitivity coefficient is higher, and the correction of the initial sensitivity coefficient is reduced at this time, and the adjustment coefficient is set closer to 1 accordingly; and when the time span is smaller, the accuracy of the initial sensitivity coefficient is lower, and the correction of the initial sensitivity coefficient is increased at this time, and the adjustment coefficient is set further away from 1 accordingly.

[0096] Optionally, the access anomaly classification model is based on a model of a machine learning algorithm.

[0097] In this embodiment, the access anomaly classification model of the present invention is preferably constructed using a machine learning algorithm, and the machine learning algorithm includes but is not limited to logistic regression, support vector machine (SVM), naive Bayes, random forest, gradient boosting tree, etc.

[0098] The embodiment of the present invention further discloses a gateway access abnormality monitoring and early warning system, which is applied to a target gateway. The system includes a processing device and a storage device. The computer code stored in the storage device is called and executed by the processing device to implement the following steps:

[0099] Determine a number of network terminals connected to the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway;

[0100] Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold;

[0101] receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly assessment value;

[0102] The access abnormality evaluation value is compared with the second abnormality threshold, and if the access abnormality evaluation value is higher than the second abnormality threshold, a gateway access abnormality alarm signal is output.

[0103] Optionally, the using a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway includes:

[0104] Using a convolutional network to extract features from each of the network terminal type information and the historical associated warning information, obtaining network terminal type features and historical associated warning features, matrixing and integrating the network terminal type features and the historical associated warning features, and obtaining network terminal feature information;

[0105] The network-side feature information is input into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway.

[0106] Optionally, inputting the network terminal feature information into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway includes:

[0107] Inputting the network end feature information into the abnormal threshold determination model based on Transformer, and the abnormal threshold determination model outputs a third abnormal threshold of the target gateway;

[0108] Inputting each of the network terminal type information and the historical correlation warning information into an abnormal threshold auxiliary analysis model based on the BERT large model, and the abnormal threshold auxiliary analysis model outputs a fourth abnormal threshold of the target gateway;

[0109] The first abnormal threshold of the target gateway is obtained by weighted calculation according to the third abnormal threshold and the fourth abnormal threshold.

[0110] Optionally, the acquiring access anomaly monitoring information of the target gateway within a recent preset period of time, and determining a sensitivity coefficient according to the access anomaly monitoring information, includes:

[0111] Obtaining access anomaly monitoring information of the target gateway in a recent preset period, wherein the access anomaly monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-period, and the number of abnormal alarm types;

[0112] Obtain historical access anomaly monitoring information of several similar gateways corresponding to the target gateway, and calculate benchmark access anomaly monitoring information according to each of the historical access anomaly monitoring information, wherein the benchmark access anomaly monitoring information includes a benchmark anomaly alarm number, a benchmark maximum value of the anomaly alarm frequency in each sub-period, and a benchmark anomaly alarm type number;

[0113] Respectively calculating a first difference ratio between the number of abnormal alarms and the benchmark number of abnormal alarms, a second difference ratio between the maximum value and the benchmark maximum value, and a third difference ratio between the number of abnormal alarm types and the benchmark number of abnormal alarm types, and calculating an average of the first difference ratio, the second difference ratio, and the third difference ratio to obtain a fourth difference ratio;

[0114] The fourth difference ratio is compared with a preset comparison table to obtain the sensitivity coefficient.

[0115] Optionally, comparing the fourth difference ratio with a preset comparison table to obtain the sensitivity coefficient includes:

[0116] Comparing the fourth difference ratio with a preset comparison table to obtain a preliminary sensitivity coefficient;

[0117] Determine the time span of the recent preset period, obtain an adjustment coefficient according to the time span matching, and multiply the adjustment coefficient by the preliminary sensitivity coefficient to obtain the final sensitivity coefficient;

[0118] Among them, when the preliminary sensitivity coefficient is less than 1, the adjustment coefficient is greater than 1 and negatively correlated with the time span; when the preliminary sensitivity coefficient is greater than 1, the adjustment coefficient is less than 1 and positively correlated with the time span.

[0119] Optionally, the access anomaly classification model is based on a model of a machine learning algorithm.

[0120] An embodiment of the present invention further discloses an electronic device, comprising: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method described in the above embodiment.

[0121] An embodiment of the present invention further discloses a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is executed by a processor to implement the method described in the above embodiment.

[0122] An embodiment of the present invention further discloses a computer program product, which includes computer code. When the computer code is executed by a processor of an electronic device, the method described in the above embodiment is implemented.

[0123] The computer-readable storage medium described above may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0124] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0125] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A gateway access abnormality monitoring and early warning method, characterized in that: The method comprises the following steps: Determine a number of network terminals accessing the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway; Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold; Receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly evaluation value; Comparing the access abnormality assessment value with the second abnormality threshold, and outputting a gateway access abnormality alarm signal if the access abnormality assessment value is higher than the second abnormality threshold; Acquiring access anomaly monitoring information of the target gateway within a recent preset time period, and determining a sensitivity coefficient according to the access anomaly monitoring information, including: Acquire access anomaly monitoring information of the target gateway in a recent preset time period, wherein the access anomaly monitoring information includes but is not limited to the number of abnormal alarms, the maximum value of the abnormal alarm frequency in each sub-time period, and the number of abnormal alarm types; Acquire historical access anomaly monitoring information of several similar gateways corresponding to the target gateway, and calculate benchmark access anomaly monitoring information according to each of the historical access anomaly monitoring information, wherein the benchmark access anomaly monitoring information includes a benchmark anomaly alarm number, a benchmark maximum value of the anomaly alarm frequency in each sub-period, and a benchmark anomaly alarm type number; Respectively calculating a first difference ratio between the number of abnormal alarms and the benchmark number of abnormal alarms, a second difference ratio between the maximum value of the abnormal alarm frequency in each sub-period and the benchmark maximum value of the abnormal alarm frequency in each sub-period, and a third difference ratio between the number of abnormal alarm types and the benchmark number of abnormal alarm types, and calculating an average of the first difference ratio, the second difference ratio, and the third difference ratio to obtain a fourth difference ratio; The fourth difference ratio is compared with a preset comparison table to obtain the sensitivity coefficient.

2. A gateway access abnormality monitoring and early warning method according to claim 1, characterized in that: Using a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical correlation warning information to obtain a first abnormal threshold of the target gateway, including: Using a convolutional network to extract features from each of the network terminal type information and the historical associated warning information, obtaining network terminal type features and historical associated warning features, matrixing and integrating the network terminal type features and the historical associated warning features, and obtaining network terminal feature information; The network-side feature information is input into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway.

3. A gateway access abnormality monitoring and early warning method according to claim 2, characterized in that: Inputting the network end feature information into the abnormal threshold determination model based on Transformer to obtain the first abnormal threshold of the target gateway includes: Inputting the network end feature information into the abnormal threshold determination model based on Transformer, and the abnormal threshold determination model outputs the third abnormal threshold of the target gateway; Inputting each of the network terminal type information and the historical correlation warning information into an abnormal threshold auxiliary analysis model based on the BERT large model, and the abnormal threshold auxiliary analysis model outputs a fourth abnormal threshold of the target gateway; The first abnormal threshold of the target gateway is obtained by weighted calculation according to the third abnormal threshold and the fourth abnormal threshold.

4. A gateway access abnormality monitoring and early warning method according to claim 1, characterized in that: Comparing the fourth difference ratio with a preset comparison table to obtain the sensitivity coefficient includes: Comparing the fourth difference ratio with a preset comparison table to obtain a preliminary sensitivity coefficient; Determine the time span of the recent preset period, obtain an adjustment coefficient according to the time span matching, and multiply the adjustment coefficient by the preliminary sensitivity coefficient to obtain the final sensitivity coefficient; Among them, when the preliminary sensitivity coefficient is less than 1, the adjustment coefficient is greater than 1 and negatively correlated with the time span; when the preliminary sensitivity coefficient is greater than 1, the adjustment coefficient is less than 1 and positively correlated with the time span.

5. A gateway access abnormality monitoring and early warning method according to claim 4, characterized in that: The access anomaly classification model is based on a model of a machine learning algorithm.

6. A gateway access abnormality monitoring and early warning system, the system comprising a processing device and a storage device, characterized in that: The computer code stored in the storage device is called and executed by the processing device to implement the gateway access abnormality monitoring and early warning method according to claim 1: Determine a number of network terminals connected to the target gateway and their network terminal type information and historical associated warning information, and use a Transformer-based abnormal threshold determination model to evaluate each of the network terminal type information and the historical associated warning information to obtain a first abnormal threshold of the target gateway; Acquire access anomaly monitoring information of the target gateway in a recent preset time period, determine a sensitivity coefficient according to the access anomaly monitoring information, and use the sensitivity coefficient to correct the first anomaly threshold to obtain a second anomaly threshold; Receiving real-time gateway access information of the target gateway, and analyzing the real-time gateway access information using an access anomaly classification model to obtain an access anomaly evaluation value; The access abnormality evaluation value is compared with the second abnormality threshold, and if the access abnormality evaluation value is higher than the second abnormality threshold, a gateway access abnormality alarm signal is output.

7. An electronic device comprising: At least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the method according to any one of claims 1 to 5.

8. A computer storage medium storing a computer program, characterized in that: The computer program is executed by a processor to implement the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that: The computer program product includes computer codes, and when the computer codes are executed by a processor of an electronic device, the method according to any one of claims 1 to 5 is implemented.

Images