Method and system for preventing network content from being synthesized and tampered

Abstract

The invention provides a method and a system for preventing network content from being synthesized and tampered, which solve the problem of data imbalance of a training data set by using an oversampling algorithm and an undersampling algorithm, optimize a depth anomaly detection model, identify attacks such as forged synthesis or tampering by using the depth anomaly detection model, and improve the network content quality. Therefore, data communication security and efficient matching are ensured, and the problem that privacy leakage and security threats are easily caused by a channel disclosed in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and system for preventing network content from being synthetically tampered with. Background Art

[0002] Data communication between network nodes is exposed to attacks such as forgery, synthesis, and tampering. Edge-end collaboration or cloud-edge-end integration architectures, due to their open channels, can also lead to privacy leaks and security threats. How to ensure data communication security and efficient matching in lightweight network scenarios has become an urgent problem to be solved. In addition, how to improve the training efficiency of the model is also an urgent problem to be improved.

[0003] Therefore, there is an urgent need for a method and system for preventing network content from being synthetically tampered with. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for preventing network content from being synthesized and tampered with, using oversampling algorithms and undersampling algorithms to solve the problem of data imbalance in training data sets, optimizing deep anomaly detection models, and using deep anomaly detection models to identify attacks such as forgery, synthesis or tampering, thereby ensuring data communication security and efficient matching.

[0005] In a first aspect, the present application provides a method for preventing network content from being synthetically tampered with, the method comprising:

[0006] Input the training data set and build a deep anomaly detection model;

[0007] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0008] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0009] Clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model to identify whether the traffic data is abnormal. If it is abnormal, continue to analyze the distribution characteristics of the traffic data through inference attacks, and then infer the synthetically tampered location, and guess the true identity of the attacker through the pseudo-identity information carried in the traffic data;

[0010] The identification result, including the synthetically tampered location and the guessed real identity of the attacker, is output and provided to the user.

[0011] In a second aspect, the present application provides a system for preventing network content from being synthetically tampered with, the system comprising: a model building unit, a deep anomaly detection model, a preprocessing unit, and an output unit;

[0012] A model building unit, used to input a training data set and build a deep anomaly detection model;

[0013] The deep anomaly detection model is used to extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0014] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0015] A pre-processing unit, used to clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model;

[0016] The deep anomaly detection model identifies whether the traffic data is abnormal. If it is abnormal, it continues to analyze the distribution characteristics of the traffic data by inferring the attack, and then infers the synthetically tampered location, and guesses the real identity of the attacker through the pseudo-identity information carried in the traffic data;

[0017] The output unit is used to output the identification result, including: the synthetically tampered position and the guessed real identity of the attacker, and provide it to the user.

[0018] In a third aspect, the present application provides a system for preventing network content from being synthetically tampered with, the system comprising: a processor and a memory:

[0019] The memory is used to store program code and transmit the program code to the processor;

[0020] The processor is configured to execute any one of various possible methods of the first aspect according to instructions in the program code.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement any of the various possible methods of the first aspect.

[0022] Beneficial Effects

[0023] The present invention provides a method and system for preventing network content from being synthesized and tampered with. By using an oversampling algorithm and an undersampling algorithm, the problem of data imbalance in a training data set is solved, a deep anomaly detection model is optimized, and the deep anomaly detection model is used to identify attacks such as forgery, synthesis, or tampering, thereby ensuring data communication security and efficient matching, and overcoming the problem that the public channels in the prior art are prone to privacy leakage and security threats.

[0024] The present invention has the following advantages and effects:

[0025] Use oversampling and undersampling algorithms to solve the problem of data imbalance in training data sets;

[0026] It can identify attacks such as forgery, synthesis or tampering, thereby ensuring data communication security and efficient matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 A flow chart of a method for preventing network content from being synthetically tampered with according to the present invention;

[0029] Figure 2 This is an architecture diagram of the system for preventing network content from being synthesized and tampered with according to the present invention. DETAILED DESCRIPTION

[0030] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0031] Figure 1 A general flow chart of a method for preventing network content from being synthetically tampered with provided in this application, the method comprising:

[0032] Input the training data set and build a deep anomaly detection model;

[0033] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0034] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0035] Clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model to identify whether the traffic data is abnormal. If it is abnormal, continue to analyze the distribution characteristics of the traffic data through inference attacks, and then infer the synthetically tampered location, and guess the true identity of the attacker through the pseudo-identity information carried in the traffic data;

[0036] The identification result, including the synthetically tampered location and the guessed real identity of the attacker, is output and provided to the user.

[0037] In some preferred embodiments, the sublayer uses a regularization method to prevent the model from overfitting.

[0038] In some preferred embodiments, the identifying whether the traffic data is abnormal includes: comparing the label of the received traffic data with the label obtained locally based on the characteristic analysis of the traffic data, determining whether the data packet has been synthetically tampered with, and discarding the traffic data if it is determined to have been synthetically tampered with.

[0039] Figure 2 The architecture diagram of the system for preventing network content from being synthetically tampered with provided by the present application, the system comprising: a model building unit, a deep anomaly detection model, a preprocessing unit and an output unit;

[0040] A model building unit, used to input a training data set and build a deep anomaly detection model;

[0041] The deep anomaly detection model is used to extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0042] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0043] A pre-processing unit, used to clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model;

[0044] The deep anomaly detection model identifies whether the traffic data is abnormal. If it is abnormal, it continues to analyze the distribution characteristics of the traffic data by inferring the attack, and then infers the synthetically tampered location, and guesses the real identity of the attacker through the pseudo-identity information carried in the traffic data;

[0045] The output unit is used to output the identification result, including: the synthetically tampered position and the guessed real identity of the attacker, and provide it to the user.

[0046] The present application provides a system for preventing network content from being synthetically tampered with, the system comprising: a processor and a memory:

[0047] The memory is used to store program code and transmit the program code to the processor;

[0048] The processor is used to execute the method described in any one of all embodiments of the first aspect according to the instructions in the program code.

[0049] The present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement the method described in any one of all the embodiments of the first aspect.

[0050] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment of the present invention. The storage medium may be a disk, an optical disk, a read-only storage memory (abbreviated as: ROM) or a random access memory (abbreviated as: RAM), etc.

[0051] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention or some parts of the embodiments.

[0052] The same and similar parts between the various embodiments of this specification can be referred to each other. In particular, for the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0053] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A method for preventing network content from being synthetically tampered with, characterized in that: The method comprises: Input the training data set and build a deep anomaly detection model; The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies; The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance; Clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model to identify whether the traffic data is abnormal. If it is abnormal, continue to analyze the distribution characteristics of the traffic data through inference attacks, and then infer the synthetically tampered location, and guess the true identity of the attacker through the pseudo-identity information carried in the traffic data; The identification result, including the synthetically tampered location and the guessed real identity of the attacker, is output and provided to the user.

2. The method according to claim 1, characterized in that: The sublayer adopts a regularization method to prevent the model from overfitting.

3. The method according to claim 1, characterized in that: The identifying whether the traffic data is abnormal includes: comparing the label of the received traffic data with the label obtained locally based on the characteristic analysis of the traffic data, determining whether the data packet is synthetically tampered with, and discarding the traffic data if it is determined to be synthetically tampered with.

4. A system for preventing network content from being synthetically tampered with, characterized in that: The system comprises: a model building unit, a deep anomaly detection model, a preprocessing unit and an output unit; A model building unit, used to input a training data set and build a deep anomaly detection model; The deep anomaly detection model is used to extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure; the input layer receives multiple basic features under different sampling time windows; the multiple sublayers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representations and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of features of each category, defines features with a number greater than or equal to the average as majority class features, and defines features with a number less than the average as minority class features, uses an undersampling algorithm for the majority class features, and uses an oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the results into the neural network structure; the neural network structure learns the summarized results and detects anomalies; The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance; A pre-processing unit, used to clean, filter and standardize the traffic data uploaded by the user, and then transmit it to the deep anomaly detection model; The deep anomaly detection model identifies whether the traffic data is abnormal. If it is abnormal, it continues to analyze the distribution characteristics of the traffic data by inferring the attack, and then infers the synthetically tampered location, and guesses the real identity of the attacker through the pseudo-identity information carried in the traffic data; The output unit is used to output the identification result, including: the synthetically tampered position and the guessed real identity of the attacker, and provide it to the user.

5. A system for preventing network content from being synthetically tampered with, characterized in that: The system comprises: a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the method according to any one of claims 1 to 3 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to be executed by a processor to implement the method according to any one of claims 1 to 3.

Images