Risk identification method and device, model, electronic equipment, storage medium and product

Abstract

The invention relates to the technical field of communication, and particularly provides a risk identification method and device, a model, electronic equipment, a storage medium and a product. The method comprises the steps of obtaining network communication data; and processing the network communication data by using the trained first model to obtain a risk identification result, the first model being obtained based on exploration immune mechanism optimization. According to the method, the parameters of the first model are dynamically adjusted by exploring an immune mechanism, so that the problems of gradient disappearance, gradient explosion or falling into a local optimal solution and the like caused by excessive parameter updating are avoided to a certain extent, and the performance of the first model is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a risk identification method and device, a model, an electronic device, a storage medium and a product. Background Art

[0002] At present, due to the complexity and variability of existing network communication data, traditional feature extraction methods may not be able to fully capture the complex feature changes in network communication data, and may encounter problems such as gradient disappearance, gradient explosion, or falling into local optimal solutions, resulting in the features being unable to accurately reflect the true situation of the current network communication data, thereby affecting the recognition ability of the classification model and thus affecting the performance of the classification model. Summary of the invention

[0003] In view of the above problems, the present disclosure is proposed. The present disclosure provides a risk identification method and device, a model, an electronic device, a storage medium and a product.

[0004] According to one aspect of the present disclosure, a risk identification method is provided, including: acquiring network communication data; processing the network communication data using a trained first model to obtain a risk identification result; wherein the first model is optimized based on exploring an immune mechanism.

[0005] According to one aspect of the present disclosure, a risk identification device is provided, including: a data acquisition module for acquiring network communication data; a risk identification module for processing the network communication data using a trained first model to obtain a risk identification result; wherein the first model is optimized based on the exploration of immune mechanism.

[0006] According to one aspect of the present disclosure, a risk identification model is provided, including at least one of the following: a data expansion sub-model, used to perform data expansion on network communication data during the model training phase; a feature extraction sub-model, used to extract features from input data; wherein the feature extraction sub-model is optimized based on the exploration of immune mechanism; a feature dimension reduction sub-model, used to perform feature dimension reduction on input data; and a classifier sub-model, used to classify input data.

[0007] According to another aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in any one of the above embodiments.

[0008] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the method described in any of the above embodiments is implemented.

[0009] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the method described in any of the above embodiments when the computer program / instruction is executed by a processor.

[0010] As will be described in detail below, according to a risk identification method and device, model, electronic device, storage medium and product of an embodiment of the present disclosure. The present disclosure utilizes a trained first model to classify network communication data, thereby obtaining a risk identification result. Among them, the first model is obtained through optimization of the exploratory immune mechanism. Specifically, the present disclosure utilizes the exploratory immune mechanism to dynamically adjust the parameters of the first model, to a certain extent avoiding problems such as gradient disappearance, gradient explosion or falling into a local optimal solution due to excessive parameter updates, thereby improving the performance of the first model. In addition, the feature extraction part of the first model is optimized using the exploratory immune mechanism. For example, the feature extraction sub-model of the first model is optimized using the exploratory immune mechanism, so that the extracted features can more accurately reflect the actual situation of the current network communication data, thereby improving the recognition ability of the subsequent classification model, thereby improving the accuracy of the risk identification results.

[0011] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 It is a flow chart illustrating a risk identification method according to an embodiment of the present disclosure.

[0014] Figure 2 is a flow chart illustrating a risk identification process according to an embodiment of the present disclosure.

[0015] Figure 3 It is a flowchart illustrating a model training process of an embodiment of the present disclosure.

[0016] Figure 4 is a flowchart illustrating a model application process according to an embodiment of the present disclosure.

[0017] Figure 5 A structural block diagram of a risk identification device provided in an embodiment of the present disclosure.

[0018] Figure 6is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0019] Figure 7 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0021] With the rapid development of Internet technology, network communication has become an indispensable part of modern society. It plays an important role in many fields such as finance, education, medical care, social entertainment, and remote office. However, the popularity of network communication also brings security risks, including malware propagation, information leakage, and denial of service attacks. These security threats pose serious challenges to personal privacy, corporate operations, and even national security. Existing network communication risk identification methods often rely on traditional security protection measures, such as firewalls and intrusion detection systems. When facing new and complex network attacks, these methods may have problems such as low recognition rate, slow response speed, and easy omission or false alarm. In addition, with the continuous evolution of attack methods, traditional security protection measures are increasingly difficult to cope with the endless security threats.

[0022] At present, some existing technologies train two classification models and use the two classification models to predict whether a communication user is a harassing user in a specific risk identification scenario, and then use a fusion algorithm to fuse the classification prediction results of the two classification models to obtain a final prediction result of whether the communication user is a communication harassing user. It should be understood that this is only an example of identifying whether a communication user is a harassing user, and the present disclosure is not limited to this risk identification scenario.

[0023] However, existing classifiers may not be able to adapt to the diversity and complexity of network communication data, resulting in insufficient classification accuracy and generalization ability.

[0024] Finally, the existing technologies may not have enough training samples, and the models are prone to overfitting and difficult to generalize to unseen network communication data.

[0025] In order to solve at least part of the above problems, the present disclosure provides a risk identification method. Figure 1 FIG. 1 is a flow chart illustrating a risk identification method according to an embodiment of the present disclosure. Figure 1 As shown, the method may include:

[0026] S101, obtaining network communication data.

[0027] Specifically, network communication data at least includes but is not limited to data packets captured in actual network flows, wherein the data types included in the data packets include but are not limited to at least one of the following: source IP address, destination IP address, transport protocol, source port number, destination port number, data packet size, timestamp, data load, flag information, and encryption status.

[0028] The source IP address indicates the network address of the sender of the data packet. The destination IP address indicates the network address of the receiver of the data packet. The transmission protocol includes but is not limited to at least one of TCP and UDP. The source port number is used to associate with the application of the sender. The destination port number is used to associate with the application of the receiver. The data packet size is used to indicate the byte size of the data packet. The timestamp is used to record the sending time of the data packet. The data payload contains the actual data content of the transmission. The flag information includes but is not limited to at least one of the following: SYN, ACK. The encryption status is used to indicate whether the data packet is encrypted for transmission.

[0029] It should be emphasized that the above is only an illustration of one data format and type provided by the present disclosure. In practical applications, the types of data are usually more than 10, and may even reach dozens or hundreds.

[0030] The method of capturing or collecting network communication data is not limited, and may include but is not limited to at least one of the following: a specific network monitoring tool, an interface call, and a web page analysis.

[0031] Network communication data may include multiple types of data. According to the specific content of the data, a group of network communication data can be annotated. The annotation methods include but are not limited to at least one of the following: manual annotation and automatic annotation. The annotation categories include but are not limited to at least one of the following: normal communication, malware propagation, information leakage, denial of service attack, and other risks. In other words, according to the specific content of each data in the network communication data, the risks that different network flows (regardless of whether they are actual network flows or network flows simulated based on generated data) may face can be identified and classified.

[0032] S102, using the trained first model to process the network communication data to obtain a risk identification result; wherein the first model is optimized based on the exploration of immune mechanism.

[0033] Specifically, the first model and the second model (described in detail later) can be understood as different forms of risk identification models used for risk classification in different application scenarios. For example, in the training scenario, the risk identification model is recorded as the second model, and in the application scenario, the risk identification model is recorded as the first model, which will be described in detail later.

[0034] As described above, in actual applications, network communication data can be input into the first model, and the trained first model can be used to predict the user's network communication status to obtain the risk identification result of the network communication data. Among them, the risk identification result includes at least one of the following: normal communication, malware propagation, information leakage, service denial attack, and other risks. Exemplarily, when the output result of the first model is normal communication, it means that the user's network communication status is normal. For example, when the output result of the first model is malware propagation, it means that malware exists in the network communication data. For example, when the output result of the first model is information leakage, it means that sensitive information exists in the user's network communication data.

[0035] Among them, the risk identification model is optimized based on the exploratory immune mechanism. That is to say, during the training process, both the first model and the second model can be optimized using the exploratory immune mechanism, so as to dynamically adjust the parameters of the first model and the second model, and suppress the number of similar groups by calculating the number of similar individuals in the input data, so as to avoid the model from falling into the local optimal solution. In addition, the exploratory immune mechanism can also avoid the problem of excessive or too small parameter updates, which may lead to gradient disappearance or gradient explosion.

[0036] In summary, the present disclosure utilizes the trained first model to classify network communication data, thereby obtaining risk identification results. Among them, the first model is obtained through optimization of the exploratory immune mechanism. Specifically, the present disclosure utilizes the exploratory immune mechanism to dynamically adjust the parameters of the first model, to a certain extent avoiding problems such as gradient disappearance, gradient explosion, or falling into a local optimal solution due to excessive parameter updates, thereby improving the performance of the first model. In addition, the exploratory immune mechanism is utilized to optimize the feature extraction part of the first model. For example, the exploratory immune mechanism is utilized to optimize the feature extraction sub-model of the first model, so that the extracted features can more accurately reflect the actual situation of the current network communication data, thereby improving the recognition ability of the subsequent classification model, thereby improving the accuracy of the risk identification results.

[0037] The present disclosure also provides a risk identification model. The functions of the risk identification model can be implemented by multiple sub-models.

[0038] The risk identification model may include at least one of the following sub-models: a data expansion sub-model, a feature extraction sub-model, a feature dimension reduction sub-model, and a classifier sub-model. The feature extraction sub-model is optimized based on the exploration of immune mechanism.

[0039] The data expansion sub-model is mainly used to expand the network communication data during the model training phase. Specifically, the data expansion sub-model expands the first training sample based on the input network communication data.

[0040] It should be noted that the data expansion sub-model can only act on the model training scenario of the risk identification model. In other words, when the risk identification model is used to implement a specific risk identification application, the data expansion sub-model may not need to work or participate in the processing. At this time, for the sake of convenience, the present disclosure distinguishes and explains the risk identification model, and the risk identification model involved in the model training scenario is recorded as the second model, and the risk identification model involved in the model application scenario is recorded as the first model. Among them, the first model can apply at least one of the following sub-models: feature extraction sub-model, feature dimensionality reduction sub-model, classifier sub-model; the second model may include at least one of the following sub-models: data expansion sub-model, feature extraction sub-model, feature dimensionality reduction sub-model, classifier sub-model.

[0041] This is because, compared to the first model put into practical application, the second model used for training requires a large amount of data for deep learning. Therefore, in the training scenario, the data expansion submodel in the second model will expand the data, while the first model has been trained in the application scenario and can directly classify network communication data. Therefore, the first model may not include the data expansion submodel, or, when applied, the data expansion submodel in the first model may not work.

[0042] The feature extraction submodel is used to extract features from input data. The feature extraction submodel is trained based on the exploratory immune mechanism; that is, after the input data is input into the feature extraction submodel, the feature extraction submodel outputs relevant information about the features of the input data, and the relevant information about the features includes but is not limited to at least one of the following: feature vector, feature map.

[0043] The feature dimension reduction sub-model is used to perform feature dimension reduction on the input data. That is, after the input data is input into the feature dimension reduction sub-model, the feature dimension reduction sub-model outputs the relevant information of the reduced dimension features of the input data.

[0044] It should be noted that the present disclosure has no particular restrictions on the connection relationship between the feature extraction sub-model and the feature dimensionality reduction sub-model. In this case, there may be the following two possible embodiments:

[0045] In a possible embodiment, the data expansion sub-model, the feature extraction sub-model, the feature dimensionality reduction sub-model, and the classifier sub-model are connected in sequence. That is, feature extraction is performed first, and then the features are reduced in dimensionality. At this time, the output data of the data expansion sub-model (hereinafter collectively referred to as the first training sample) or the network communication data in the application scenario is specifically the input data of the feature extraction sub-model, and the output data of the feature extraction sub-model (that is, the first feature data corresponding to the network communication data) is the input data of the feature dimensionality reduction sub-model, and the output data of the feature dimensionality reduction sub-model (that is, the second feature data obtained by reducing the dimensionality of the first feature data) is the input data of the classifier sub-model. The classifier sub-model can then perform classification based on this to obtain the risk identification result.

[0046] In another possible embodiment, the data expansion sub-model, the feature dimension reduction sub-model, the feature extraction sub-model, and the classifier sub-model are connected in sequence. That is, feature dimension reduction is performed first (which can also be understood as data dimension reduction at this time) and then feature extraction is performed. At this time, the output data of the data expansion sub-model or the network communication data in the application scenario is specifically the input data of the feature dimension reduction sub-model, and the output data of the feature dimension reduction sub-model (that is, the third feature data obtained by reducing the dimension of the network communication data) is the input data of the feature extraction sub-model, and the output data of the feature extraction sub-model (that is, the fourth feature data obtained by extracting the third feature data) is the input data of the classifier sub-model. The classifier sub-model can then perform classification based on this to obtain the risk identification result.

[0047] The classifier sub-model is used to classify the input data. That is, after the input data is input into the classifier sub-model, the classifier sub-model can output the risk identification result of the input data.

[0048] It should be understood that the present disclosure does not specifically limit the functions and number of sub-models included in the risk identification model. Exemplarily, the first model may also include all of the above sub-models. At this time, after the network communication data is input into the first model, the first model can use the feature extraction sub-model and the feature dimension reduction sub-model to perform feature extraction and feature dimension reduction on the first training sample, and input the extracted and dimensionally reduced data into the classifier sub-model to determine which type of network risk the data belongs to, thereby obtaining a risk identification result.

[0049] For easier understanding, please refer to Figure 2 , Figure 2 FIG. 1 is a flow chart illustrating a risk identification process according to an embodiment of the present disclosure. Figure 2As shown, when data collection and annotation operations are performed, the original training data set (i.e., the aforementioned network communication data) can be obtained. Next, the original training data set is used as the input of the data expansion model to obtain a trained data expansion model and an expanded training data set. Next, the expanded training data set is input into the feature extraction model for training to obtain a trained feature extraction model and a training data set after feature extraction. Next, the training data set after feature extraction is input into the feature dimensionality reduction model for training to obtain a trained feature dimensionality reduction model and a training data set after feature dimensionality reduction. Next, the training data set after feature dimensionality reduction is input into the classifier model for training to obtain a trained classifier model. Finally, the trained risk identification model can be put into use for risk identification.

[0050] During the training process of the risk identification model, the first training sample can be input into the risk identification model, and the risk identification model trains the sub-models included therein according to the first training sample until the risk identification model meets the conditions for stopping iteration, and the training of the risk identification model is considered completed. The conditions for stopping iteration include but are not limited to at least one of the following: reaching a preset number of iterations, and the accuracy of the predicted risk identification results meeting a preset threshold.

[0051] For the application process of the risk identification model, please refer to Figure 3 . Figure 3 is a flowchart illustrating a model training process of an embodiment of the present disclosure. Figure 3 As shown, data collection (i.e., the aforementioned collection of network communication data) and annotation can be performed first, and then data expansion can be performed (i.e., the network communication data is input into the data expansion sub-model). Next, the expanded data can be used to train the feature extraction sub-model to obtain the extracted feature data. Next, the extracted feature data is input into the feature dimensionality reduction sub-model for training to reduce the data dimension of the extracted feature data. Finally, the reduced dimensionality data is input into the classifier sub-model to complete the network communication risk identification and obtain the risk identification result.

[0052] When training the risk identification model, different training methods may be used, including but not limited to at least one of the following: separate training and combined training.

[0053] In an illustrative embodiment, multiple sub-models of the second model can be trained separately, that is, the second model can prepare input samples for each sub-model for training, and adjust each sub-model separately according to the output results of each sub-model. In this way, it can be ensured that the output results of each sub-model meet the requirements. In this way, the prediction results of multiple models can be combined to significantly improve the accuracy of the overall prediction. Each model can be more accurate in its specific task.

[0054] Optionally, after the training is completed, the trained multiple sub-models can be combined to obtain the first model. Exemplarily, the trained feature extraction sub-model, feature dimensionality reduction sub-model, and classifier sub-model can be combined to obtain the first model.

[0055] In another exemplary embodiment, multiple sub-models of the second model can be combined for training. That is, during the training process, after the second model obtains the output result of the model, all sub-models are adjusted directly according to the final output result of the second model. In this way, the second model does not need to be specifically designed or adjusted for different sub-models. It is only necessary to adjust the second model as a whole according to the form of input and output, so as to avoid deviations in the output results of the sub-models after being combined to a certain extent.

[0056] It should be understood that the present disclosure does not specifically limit the training method of the second model, and the above two training methods are only embodiments for easy understanding. In actual training, the above two methods can also be used in combination, for example, after the sub-models are trained separately, combined training is performed.

[0057] Among them, for the training process of the risk identification model, the risk identification model can meet at least one of the following: the data expansion sub-model is trained using the quantum state confrontation mechanism; the feature extraction sub-model is trained using the exploration immunity mechanism; the feature dimension reduction sub-model is trained using the expectation propagation mechanism; the classifier sub-model is trained using the extreme learning machine mechanism. Based on this, the risk identification model in the present disclosure can improve the risk identification effect in at least one dimension of training data expansion, feature extraction, feature dimension reduction, and feature classification, which are explained below.

[0058] That is to say, both the first model and the second model can be trained using the above method.

[0059] When the risk identification model trains each sub-model separately, each sub-model can have a different training method.

[0060] In an illustrative embodiment, when the feature extraction sub-model is trained using the exploratory immune mechanism, the multiple sub-models of the second model are trained separately, specifically including the following steps S21-S24:

[0061] The feature extraction sub-model is iteratively trained using the exploratory immune mechanism until the second condition is met:

[0062] S21. Using the neural network parameters, obtain a set of characteristic parameters of the input data.

[0063] In this step, the input data may be input into the feature extraction model to train the feature extraction model.

[0064] It should be noted that, depending on the type and number of sub-models included in the second model, the input data here can be: the first training sample, or the network communication data, or the first training sample after feature dimensionality reduction, or the network communication data after feature dimensionality reduction.

[0065] That is, the feature extraction sub-model may also receive data output by other sub-models. Exemplarily, the feature dimension reduction sub-model may input the first training sample after dimension reduction into the feature extraction sub-model.

[0066] The feature extraction sub-model may be a neural network model, wherein the neural network includes but is not limited to at least one of the following: a convolutional neural network, a fully connected neural network, and a recurrent neural network.

[0067] Exemplarily, a 3-layer fully connected neural network can be used for feature extraction. On this basis, the feature extraction model training provided by the present disclosure integrates an exploratory immune algorithm to simulate the adaptive mechanism of the biological immune system and dynamically adjust the weights of the neural network. To a certain extent, it avoids the problem of gradient disappearance, gradient explosion or falling into the local optimal solution, which affects the stability of training and the performance of the model.

[0068] When training the neural network provided by the present disclosure, first, all weights and biases of the neural network need to be randomly initialized. The weights and biases can be set to smaller values ​​to avoid the gradient vanishing or exploding problem in the early stage of training. Exemplarily, the initialization method of the characteristic parameters of the neural network can be expressed as:

[0069]

[0070] in, represents the initialized characteristic parameter; ∈ represents a small initialization coefficient; Normal(0,I) represents extracting parameter values ​​from a normal distribution with a mean of 0 and a standard deviation of the unit matrix. Preferably, ∈ is set to 10 -3 .

[0071] Next, a feature parameter set may be generated based on the above feature parameters, and any element in the feature parameter set includes a set of feature parameters. Exemplarily, the relationship between the feature parameter and the feature parameter set may satisfy:

[0072]

[0073] In the formula, is a set of characteristic parameters; is the parameter of the ith element in the feature parameter set; N is the total number of elements. Preferably, the total number of elements N is set to 100.

[0074] S22. Calculate the fitness of each element in the feature parameter set using the fitness mechanism.

[0075] Among them, fitness can be understood as the quality of each element. The higher the fitness, the closer the characteristic parameter represented by the element is to the optimal solution of the characteristic.

[0076] Next, it is necessary to calculate the fitness of each feature in the feature parameter set, so as to measure the quality of each set of feature parameters. Optionally, the fitness mechanism can be used to calculate the fitness of each element in the feature parameter set. The specific steps can be:

[0077] S221. Obtain the predicted label and the true label of each element in the feature parameter set to obtain the cross entropy error.

[0078] Among them, the cross entropy error is used to measure the difference between the true label and the predicted label. The label here and the above are the identifiers assigned to the input data. This step is mainly used to measure the difference between the label predicted based on the set of feature parameters and the true label. The higher the cross entropy error, the greater the difference between the two.

[0079] For example, the relationship between the cross entropy error and the predicted label and the true label can be satisfied as follows:

[0080] E c,i =cross(y true ,y pred,i );

[0081] Among them, cross(y true ,y pred,i ) is the cross entropy error corresponding to the i-th element, y true is the true label; y pred,i The predicted label for the i-th element.

[0082] Furthermore, the cross entropy error can be satisfied as:

[0083]

[0084] Among them, y true,k is the true label of the kth category, y pred,i,k is the model’s predicted probability for the kth class; k is the total number of classes.

[0085] S222. Obtain the inverse of the cross entropy error of each element to obtain the fitness of each element.

[0086] The higher the fitness, the more similar the two are, and the closer the set of characteristic parameters is to the optimal solution. Conversely, the further away from the optimal solution.

[0087] Among them, the cross entropy error is negatively correlated with the fitness. That is, the higher the cross entropy error of a set of feature parameters, the lower the fitness. Otherwise, the fitness is higher.

[0088] For example, the relationship between fitness and cross entropy error can be satisfied as follows:

[0089]

[0090] Among them, F c,i is the fitness of the ith element.

[0091] S23. Using the K elements with the highest fitness and the current mutation rate parameter, update the elements of the feature parameter set; wherein K is an integer greater than 0.

[0092] In this step, the K elements with the highest fitness can be selected for cloning and mutation to generate a new set of feature parameters to explore a wider parameter space, which can be specifically expressed as:

[0093]

[0094] Among them, clone() is a cloning and mutation operation. Represents a new generation of cell collection after cloning and mutation; is the cell set with the highest fitness selected; η rts is the mutation rate. Preferably, η rts The dynamic adjustment method is determined, and the specific adjustment method please refer to step S34.

[0095] Among them, the cloning operation is realized by direct copying, and the mutation operation realizes the diversification of cells by adding Gaussian noise, which can be expressed as:

[0096]

[0097] in, is the characteristic parameter after mutation, θ c,i is the characteristic parameter before selecting the clone; γ bv is the variation intensity factor; σ 2 is the variance of the Gaussian noise, controlling the magnitude of the variation. Preferably, γ bv Set to 0.1.

[0098] S24. Update the mutation rate parameter.

[0099] The specific process of updating the mutation rate parameter may include the following steps S241-S242:

[0100] S241. Obtain the fitness mean and fitness variance of the feature parameter set.

[0101] The mutation rate parameters of the immune algorithm are dynamically adjusted according to the characteristics of the input data to adapt to data changes and improve learning efficiency.

[0102] S242. Utilize the current mutation rate parameter and the product of the inverse of the fitness mean and the fitness variance to obtain an updated mutation rate parameter.

[0103] Specifically, the dynamic adjustment method of mutation rate can be expressed as:

[0104]

[0105] Among them, η rtsnew is the updated mutation rate; var(F c ) and mean(F c ) are the variance and mean of the current fitness set respectively.

[0106] Finally, the above steps S21-S24 are iterated repeatedly until the preset first condition is met, which means that the model training is completed, thereby obtaining the input data after feature extraction. The first condition includes but is not limited to at least one of the following: the preset stop iteration condition is reaching the preset maximum number of iterations, the fitness mean and / or variance of the feature parameter set is less than a preset threshold. Optionally, the preset maximum number of iterations is set to 1000 times.

[0107] The number of iterations of the feature extraction sub-model and other sub-models may be the same or different, and the number of iterations of the two sub-models may be related to the training method of the second model.

[0108] When the training mode of the second model is combined training, the number of iterations of the feature extraction sub-model and the data expansion sub-model is the same. That is, during combined training, in each iteration process, the second model iteratively updates all sub-model parameters.

[0109] When the training method of the second model is separate training, the number of iterations of the feature extraction sub-model and the data expansion sub-model can be different. In other words, the training processes of different sub-models are not related, and the specific number of iterations can be determined according to actual conditions.

[0110] In summary, the present disclosure utilizes the exploration of immune mechanisms and simulates the adaptive mechanism of the biological immune system to dynamically adjust the weights of the neural network. Compared with the traditional feature extraction method, it may not be able to fully capture the complex features in the network communication data, resulting in limited recognition capabilities of the model. In addition, the prior art also lacks the ability to dynamically adjust model parameters according to data characteristics, which may lead to a decrease in model performance when faced with rapid changes in the network communication environment. The present disclosure dynamically adjusts the parameters of the neural network, for example, in constructing the fitness function, the cross entropy error corresponding to the element is combined, and the mutation rate parameters of the immune algorithm are dynamically adjusted according to the characteristics of the input data, so that it can quickly adapt to the new model parameters, thereby improving the operating efficiency of the risk identification model.

[0111] It should be noted that the training mechanism of the feature extraction sub-model involved above is only an embodiment for easy understanding. In actual applications, the feature extraction sub-model can also be directly trained.

[0112] In addition, the training process of multiple sub-models of the second model may also include but is not limited to at least one of the following: using a quantum state adversarial mechanism to train a data expansion sub-model, using an expected propagation mechanism to train a feature dimensionality reduction sub-model, and using an extreme learning machine mechanism to train a classifier sub-model.

[0113] In an illustrative embodiment, when the second model uses the quantum state confrontation mechanism to train the data expansion sub-model, training the multiple sub-models of the second model separately may include the following steps S31-S35:

[0114] The data expansion sub-model is iteratively trained using the quantum state adversarial mechanism until the first condition is met:

[0115] S31. Based on the current quantum bit parameters, convert the network communication data into quantum state data.

[0116] In this step, the network communication data can be input into the data expansion submodel for processing. The data expansion submodel can include a generator and a discriminator. Among them, the generator can be used to generate generated data that is indistinguishable from real data (which can be understood as network communication data), and the discriminator can be used to distinguish real data from generated data, so as to evaluate the first training sample (i.e., step S33). Among them, the first training sample is obtained based on iterative adjustment of the generated data. Please refer to steps S33-S34 for the specific adjustment process.

[0117] The first training sample is obtained based on iterative updating of the generated data. That is, the generated data is the intermediate data of the generator.

[0118] Before using the generator to generate data, first, the initial parameters of the generator and the discriminator need to be initialized. Optionally, the initial parameters can be obtained using a random initialization mechanism.

[0119] Next, you need to initialize the initial state of the quantum bit and convert the network communication data into quantum state data based on the current quantum bit parameters. The specific steps may include:

[0120] S311, performing parameter quantum gate operation on the quantum state parameters to obtain quantum gate representation of the quantum state parameters.

[0121] Specifically, a parameterized quantum circuit can be used to prepare a quantum state, set quantum state parameters, and perform parametric quantum gate operations on the quantum state parameters, thereby obtaining a quantum gate representation of the quantum state parameters.

[0122] In an exemplary embodiment, the specific relationship may be satisfied as follows:

[0123]

[0124] Among them, U() is the parameter quantum gate operation, θ q is the quantum state parameter, σ x It is the Pauli X gate.

[0125] S312, obtaining the product of the quantum gate representation and the current quantum bit state to obtain the quantum state data.

[0126] After obtaining the quantum gate representation, the product of the quantum gate representation and the current quantum bit state may be obtained to obtain the quantum state data.

[0127] Optionally, the specific relationship may be satisfied as:

[0128] ψ(θ q )=U(θ q )*ψ0;

[0129] Among them, ψ(θ q ) is the quantum state data, ψ0 is the initial quantum bit state.

[0130] S32. Using a generator to process the quantum state data to obtain generated data.

[0131] During each iterative training process, the data augmentation sub-model can use the generator to process the quantum state data to obtain generated data.

[0132] Optionally, the specific relationship between the generator and the quantum state data can satisfy:

[0133] x g =G(ψ(θ q ));θg );

[0134] Among them, x g is the generated data generated by the generator, G() is the generating function of the generator, θ g The parameters for the generator.

[0135] Furthermore, the generator function can be expressed as:

[0136] x g =Sig(∑ i w i *h i +b g );

[0137] Among them, h i =tanh(v i *ψ(θ q )) represents the hidden layer representation obtained from the quantum state parameters, v i is the hidden layer weight, w i Output layer weight, b g is the bias, and Sig is the Sigmoid activation function, which is used to generate the final data output.

[0138] S33. Use the discriminator to evaluate the generated data.

[0139] Next, the generated data needs to be evaluated using the discriminator.

[0140] Optionally, the relationship between the discriminator and the generated data can be satisfied as:

[0141] D(x;θ d )=Sig(∑ j u j *x j +b d );

[0142] Among them, u j represents the weight of the discriminator, x j are the characteristics of the input data, b d is the bias of the discriminator.

[0143] Next, the generator needs to be used to calculate the quantum state feedback loss, where the quantum state feedback loss is obtained based on the output of the discriminator and the expected value of the quantum state. The specific relationship can be satisfied as follows:

[0144] L g = -log(D(x g θ d ));

[0145] Among them, L gis the loss of the generator.

[0146] Furthermore, the loss of the generator can be expanded as:

[0147] L g = -log(D(x g θ d ))=-log(Sig(∑ j u j *x g,j +b d ));

[0148] Among them, x g,j To generate the features of the data.

[0149] The discriminator also needs to calculate the loss of its ability to distinguish between real data and generated data. The specific relationship can be satisfied as follows:

[0150] L d = -[log(D(x r θ d ))+log(1-D(x g θ d ))];

[0151] Among them, L d is the loss of the discriminator.

[0152] Furthermore, the loss of the discriminator can be expanded as:

[0153] L d = = -log(Sig(∑ j u j *x r,j +b d ))+log(1-Sig(∑ j u j *x g,j +b d ))];

[0155] Among them, x r,j is the characteristic of real data.

[0156] S34. Using the gradient descent principle, update the parameters of the generator and the discriminator.

[0157] In this step, the gradient descent method can be used to update the generator parameters and the discriminator parameters in a back-propagation manner, and the specific relationship can be satisfied as follows:

[0158]

[0159] Among them, α g, α d are the learning rates of the generator and the discriminator, respectively. It is used to characterize the gradient of the loss function L with respect to the parameter θ. The learning rates of the generator and the discriminator can be determined according to the actual situation. Optionally, the learning rate of the generator can be 0.001, and the learning rate of the discriminator can be 0.005.

[0160] S35. Update quantum bit parameters.

[0161] The specific relationship can be satisfied as follows:

[0162]

[0163] Among them, α q is the learning rate of the quantum state parameters. The learning rate of the quantum state parameters can be determined according to the actual situation. Optionally, the learning rate of the generator can be 0.005.

[0164] Furthermore, the chain rule can be used to decompose the derivative of the composite function, the gradient and

[0165] The calculation method can be further expanded as:

[0166]

[0167] According to the result of back propagation, the state of the quantum bit is adjusted and updated to a new quantum state. Specifically, the way to adjust the quantum state using quantum gate operation can be expressed as:

[0168] ψ(θ q )←U(θ q )ψ0

[0169] Finally, the above steps S31-S35 are iterated repeatedly until the aforementioned second condition is met, indicating that the model training is completed, thereby obtaining the first training sample. The second condition includes but is not limited to at least one of the following: the preset stop iteration condition is reaching the preset maximum number of iterations, the generator and / or discriminator loss value is less than a preset threshold. Optionally, the preset maximum number of iterations is set to 1000 times.

[0170] In summary, the present invention utilizes the quantum confrontation mechanism to expand network communication data, converts network communication data into quantum state data, optimizes the diversity and fidelity of generated data through the superposition and entanglement characteristics of quantum states, and effectively reduces the problem of mode collapse.

[0171] It should be noted that the training mechanism of the data expansion sub-model involved above is only an embodiment for easy understanding. In practical applications, the data expansion sub-model can also be directly trained.

[0172] In another exemplary embodiment, when the feature dimension reduction sub-model is trained using the expectation propagation mechanism, the multiple sub-models of the second model are trained separately, specifically including the following steps S41-S44:

[0173] The feature dimensionality reduction sub-model is iteratively trained using the expectation propagation mechanism until the second condition is met:

[0174] The feature dimensionality reduction sub-model is iteratively trained using the expectation propagation mechanism until the third condition is met:

[0175] S41. Use the encoder to process the input data to obtain latent space data.

[0176] In this step, depending on the type and number of sub-models included in the second model, the input data may include but is not limited to at least one of the following: network communication data, the first training sample, the first training sample after feature extraction, and the network communication data after feature extraction.

[0177] Exemplarily, when the sub-models in the second model are arranged in sequence according to the data expansion sub-model, the feature extraction sub-model, and the feature dimension reduction sub-model, the input data of the feature dimension reduction sub-model may be: the first training sample after feature extraction.

[0178] Exemplarily, when the sub-models in the second model are arranged in sequence according to the feature extraction sub-model and the feature dimension reduction sub-model, the input data of the feature dimension reduction sub-model may be network communication data after feature extraction.

[0179] The feature dimensionality reduction sub-model at least includes: an encoder and a decoder. The encoder is used to map the input data to a low-dimensional latent space, while the decoder reconstructs the low-dimensional representation back to the original data space.

[0180] First, the parameters of the encoder and decoder of the autoencoder need to be initialized. The parameters of the encoder and decoder can be determined according to actual conditions, and the present disclosure does not make any specific restrictions here.

[0181] Next, under the current parameters, the posterior probability of each feature in the latent space can be calculated to update the latent space data to better reflect the statistical characteristics of the input data.

[0182] The specific relationship can be satisfied as follows:

[0183]

[0184] in; is the encoder function, e xIt is used to identify the data features of each data; z is the latent space data.

[0185] S42. Using latent space data, obtain the posterior distribution.

[0186] In this step, the posterior distribution can be understood as the probability of the current parameter occurring after observing the input data.

[0187] The method of using the latent space data to obtain the posterior distribution specifically includes steps S421 and S422:

[0188] S421. Using the latent space data, obtain the mean and variance of the latent space data.

[0189] Mean μ(z) and variance σ 2 (z) is calculated from the potential representation z, and the specific relationship can be satisfied as follows:

[0190]

[0191] Among them, μ(z) is the mean of the posterior probability; σ 2 (z) is the variance of the posterior probability.

[0192] Furthermore, the mean and variance are output by two different parts of the encoder and are expressed as:

[0193]

[0194] in, and They are the two output heads of the encoder network, and the parameters θ μ and θ σ corresponds to the network weights for computing the mean and variance, respectively.

[0195] S422. Using the mean and variance of the latent space data, obtain the posterior distribution.

[0196] Next, we use the mean and variance of the latent space data to obtain the posterior distribution. The specific relationship can be satisfied as follows:

[0197]

[0198] Among them, p(z|e x ) is the posterior probability of z, where the posterior probability follows a Gaussian distribution.

[0199] S43. Evaluate the input data after dimensionality reduction using the posterior distribution and the prior distribution of the input data.

[0200] Next, the posterior probabilities obtained in the above expectation step can be used to adjust the parameters of the encoder and decoder to minimize the reconstruction error and the difference between the posterior distribution and the prior distribution of the latent space.

[0201] Specifically, in the propagation step, the parameters of the encoder and decoder are updated to minimize the reconstruction error and the KL divergence between the posterior distribution and the prior distribution. The reconstruction error is defined as the input data e x The mean square error between the data reconstructed by the decoder can be expressed as:

[0202]

[0203] in, is a function of the decoder; θ ds are the decoder parameters. is the minimum reconstruction error.

[0204] Furthermore, KL divergence is used to measure the difference between the posterior distribution and the prior distribution of the potential representation. The prior distribution is assumed to be a standard normal distribution, and the relationship between the two can be satisfied as follows:

[0205]

[0206] Where D KL is the KL divergence calculation formula, and I is the identity matrix.

[0207] Further, KL divergence is used to measure the difference between the posterior distribution and the prior distribution of the potential representation. In one embodiment, for a Gaussian distribution, the calculation of KL divergence can be expressed as:

[0208]

[0209] Where J is the dimension of the latent space, μ j and are the mean and variance of the j-th dimension of the posterior distribution, respectively.

[0210] S44. Utilize the annealing mechanism to update the parameters of the encoder and decoder.

[0211] Next, the present disclosure uses an annealing mechanism to update the parameters of the encoder and decoder. In the iterative process, the learning rate is gradually reduced, and the regularization parameter is adjusted according to a predetermined annealing plan to promote the stable convergence of the model.

[0212] Specifically, during the training process, the annealing strategy is used to adjust the learning rate and regularization parameters, which can be expressed as:

[0213] α t+1 =α t ×δ;

[0214] λ t+1 =λ t ×γ;

[0215] Wherein, δ and γ are the annealing coefficients of the learning rate and regularization parameter, respectively, and t represents the current number of iterations. α is the learning rate, and λ is the regularization parameter of the annealing strategy. Wherein, α, λ, γ, and δ can be set according to actual conditions, and the present disclosure does not make specific restrictions here. γ can be set to 0.1.

[0216] Among them, the annealing adjustment of the learning rate α and the regularization parameter λ can be specifically expressed as:

[0217] α t+1 =α t ×(1-δ t );

[0218] λ t+1 =λ t ×(1-γ t );

[0219] In the formula, δ t and γ t are the learning rate and the annealing rate of the regularization parameter at the tth iteration, respectively.

[0220] Finally, the above steps S41-S44 are iterated repeatedly until the preset third condition is met, which means that the model training is completed, thereby obtaining the input data after feature dimension reduction. The second condition includes but is not limited to at least one of the following: the preset stop iteration condition is reaching the preset maximum number of iterations and the reconstruction error is less than the preset threshold. Optionally, the preset maximum number of iterations is set to 1000 times.

[0221] The number of iterations of the feature dimensionality reduction sub-model and other sub-models may be the same or different. The number of iterations of the two may be related to the training method of the second model. Please refer to the above for details, which will not be elaborated here.

[0222] It should be noted that the training mechanism of the feature dimensionality reduction sub-model involved above is only an embodiment for easy understanding. In practical applications, the feature dimensionality reduction sub-model can also be directly trained.

[0223] In summary, the present disclosure adopts an autoencoder neural network algorithm based on expectation propagation to achieve effective dimensionality reduction while maintaining the essential characteristics of the data. Compared with the prior art that learns the compressed representation of data by minimizing the reconstruction error between input and output, the autoencoder neural network algorithm based on expectation propagation proposed in the present disclosure introduces the expectation propagation mechanism, which not only considers the reconstruction error, but also optimizes the data representation in the latent space to better capture the intrinsic structure of the data. At the same time, in order to avoid the local minimum problem during the training process and improve the generalization ability of the model, the autoencoder neural network algorithm based on expectation propagation is combined with an annealing strategy. By gradually reducing the learning rate and adjusting the regularization parameter, the algorithm can quickly explore the parameter space in the early stage of training, and make detailed adjustments in the later stage of training to achieve better model performance. In addition, when the second model includes a feature dimensionality reduction sub-model and a classifier sub-model, the model can also improve the efficiency and accuracy of subsequent classifiers.

[0224] When the present disclosure uses the ELM mechanism to train the classifier sub-model, the multiple sub-models of the second model are trained separately, specifically including steps S51-S52:

[0225] The classifier sub-model is iteratively trained using the ELM mechanism until the fourth condition is met:

[0226] S51. Evaluate the output data of the ELM mechanism using the self-adjusting mechanism.

[0227] In this step, depending on the type and number of sub-models included in the second model, the input data may include but is not limited to at least one of the following: a first training sample, a first training sample after feature extraction, a first training sample after feature extraction and dimensionality reduction, and a first training sample after feature dimensionality reduction.

[0228] Exemplarily, when the second model also includes other sub-models, the input data may include: the first training sample after feature extraction and dimension reduction, and the network communication data after feature extraction and dimension reduction. That is, after the input data is input into the second model, it may be processed by other sub-models, and the output data is then input into the classifier sub-model.

[0229] According to the input data, the feature vector set obtained is X = {x1, x2, ..., x N}, where N is the number of samples, each feature vector x i Corresponding to an input data sample. The target output vector set is T = {t1, t2, ..., t N}, where each t i is x i Corresponding classification labels. In the present disclosure, the number of hidden layer nodes is set to H.

[0230] First, before training the ELM model, it is necessary to set the initial parameters of the ELM model, including the number of hidden layer nodes, the initial covariate matrix structure and the learning rate.

[0231] The output data of the ELM mechanism evaluated by the self-adjusting mechanism includes:

[0232] S511. Use the performance evaluation mechanism to obtain the performance index of the current ELM mechanism.

[0233] The specific relationship can be satisfied as follows:

[0234] W = rand(D,H);

[0235] b = rand(1,H);

[0236] Among them, H is the number of hidden layer nodes, W is the weight matrix, and b is the bias vector. The dimension of the weight matrix W is D×H, and the dimension of the bias vector b is H; rand() is the random matrix generation function, for example, rand(m,n) means generating an m×n random matrix.

[0237] Next, the data is forward propagated in the ELM model. It is necessary to calculate the activation value of each hidden layer node and the prediction result of the output layer. Specifically, the method of calculating the hidden layer output H can be expressed as:

[0238] H = Sig(XW+b);

[0239] S512: Obtain an adjustment amount of the hidden layer by using the difference between a preset target performance indicator and a performance indicator of the current ELM mechanism.

[0240] Next, according to the preset self-adjustment strategy, analyze the training performance of the current model, such as classification accuracy and error rate. If the performance does not meet the expected goal, adjust the number of hidden layer nodes and the structure of the covariate matrix according to the feedback results. Specifically, according to the performance feedback during the training process, dynamically adjust the number of hidden layer nodes and the size and value of the weight matrix, set a performance evaluation function f(T,O), where O is the predicted output of the output layer, calculate the performance of the current model, and adjust the number of hidden layer nodes according to the performance feedback.

[0241] Among them, adjust() represents the adjustment strategy.

[0242] Optionally, the adjustment amount may be based on a function of the difference between the current performance of the model and the expected performance, and the relationship may be:

[0243] ΔH=λ p ·(Per target -Percurrent );

[0244] Where ΔH is the adjustment amount determined according to the performance evaluation function, λ p is the sensitivity adjustment parameter, Per target and Per current Represent the target performance index and the performance index of the current model respectively. Preferably, adjust the sensitivity parameter λ p is 0.1.

[0245] 513. The updated number of hidden layers is obtained by using the sum of the current number of hidden layers and the adjustment amount. The specific relationship between the updated number of hidden layers and the hidden layer adjustment amount can satisfy:

[0246] H′=H+ΔH;

[0247] Among them, H′ is the number of hidden layers after update.

[0248] The specific relationship between the updated weight matrix and the hidden layer adjustment amount can be satisfied as follows:

[0249] W′=adjust(W,ΔH);

[0250] Among them, W′ is the number of hidden layers after update.

[0251] S52. Update relevant parameters of the ELM mechanism; wherein the relevant parameters include at least: the number of hidden layers, the covariate matrix structure, the weight, and the bias.

[0252] Next, the back-propagation algorithm is used to calculate the model error, and the model parameters, including weights and bias terms, are updated based on the error results.

[0253] Specifically, the error back propagation algorithm can be used to update the weight matrix and bias. The error E = TO, where O is the output of the network, and the update method of the weight and bias can be expressed as:

[0254]

[0255] Among them, η e is the learning rate, is the gradient. The learning rate can be determined according to the actual situation. Preferably, the learning rate is set to 0.01.

[0256] Among them, the method of calculating the weight update gradient can satisfy:

[0257]

[0258] in, represents the transpose of the hidden layer output, and OT represents the error between the output layer prediction and the actual target.

[0259] Next, calculate the bias update gradient can be expressed as:

[0260]

[0261] Among them, i and t i Denote the predicted output and actual target of a single sample respectively, and the summation operation traverses all training samples to calculate the total gradient of the bias.

[0262] Finally, the above steps S51-S52 are iterated repeatedly until the preset fourth condition is met, which means that the model training is completed, thereby obtaining the input data after feature extraction. The fourth condition includes but is not limited to at least one of the following: the preset stop iteration condition is reaching the preset maximum number of iterations and the error is less than the preset threshold. Optionally, the preset maximum number of iterations is set to 1000 times.

[0263] The number of iterations of the classifier sub-model and other sub-models can be the same or different. The number of iterations of the two can be related to the training method of the second model. Please refer to the previous article for details.

[0264] In summary, the present invention adopts a self-adjusting strategy to dynamically adjust the parameters of the covariate matrix and the extreme learning machine, which can dynamically adjust the covariate matrix and the extreme learning machine parameters to adapt to changes in the characteristics of different network communication data and improve classification accuracy and model generalization ability.

[0265] It should be noted that the training mechanism of the classifier sub-model involved above is only an embodiment for easy understanding. In actual applications, the classifier sub-model can also be directly trained.

[0266] The above is a training method for each sub-model in the risk identification model provided by the present disclosure. It should be noted that the present disclosure does not specifically limit the number of sub-models in the risk identification model.

[0267] In an exemplary embodiment, the risk identification model may include the feature extraction sub-model, feature dimension reduction sub-model and classifier sub-model. Figure 4 , Figure 4 is a flow chart illustrating a model application process of an embodiment of the present disclosure. Figure 4As shown, the risk identification model may include a trained feature extraction sub-model, a trained feature dimension reduction sub-model, and a trained classifier sub-model. After obtaining a new sample to be classified (i.e., unlabeled network communication data), it can be input into the trained feature extraction sub-model for feature extraction to obtain a new sample after feature extraction. Next, the new sample after feature extraction is input into the trained feature dimension reduction sub-model to obtain a new sample after feature dimension reduction. Finally, the new sample after feature dimension reduction is input into the trained classifier sub-model to obtain a network communication risk identification result.

[0268] The present disclosure also provides a risk identification device. Figure 5 A structural block diagram of a risk identification device provided by an embodiment of the present disclosure, such as Figure 5 As shown, the risk identification device 500 includes:

[0269] Data acquisition module 501, used to acquire network communication data;

[0270] The risk identification module 502 is used to process the network communication data using the trained first model to obtain a risk identification result; wherein the first model is optimized based on the exploration of immune mechanism.

[0271] In an exemplary embodiment, the risk identification device 500 is also configured to: train multiple sub-models of the second model separately; the second model includes at least one of the following: a data expansion sub-model, a feature extraction sub-model, a feature dimension reduction sub-model, and a classifier sub-model; wherein the data expansion sub-model is used to expand network communication data during the model training stage; wherein the feature extraction sub-model is used to extract features from input data; wherein the feature extraction sub-model is trained based on the exploration of immune mechanism; wherein the feature dimension reduction sub-model is used to reduce the features of input data; wherein the classifier sub-model is used to classify input data; the trained feature extraction sub-model, the feature dimension reduction sub-model, and the classifier sub-model are combined to obtain the first model.

[0272] In an exemplary embodiment, the risk identification device 500 is also configured to: use the exploratory immune mechanism to iteratively train the feature extraction sub-model as follows until the first condition is met: use the neural network parameters to obtain a feature parameter set of the input data; use the fitness mechanism to calculate the fitness of each element in the feature parameter set; the fitness is related to the cross-entropy error of each element; use the K elements with the highest fitness and the current mutation rate parameter to update the elements of the feature parameter set; wherein K is an integer greater than 0; and update the mutation rate parameter.

[0273] In an exemplary embodiment, the risk identification device 500 is further configured to: obtain the predicted label and the true label of each element in the feature parameter set to obtain the cross entropy error; obtain the inverse of the cross entropy error of each element to obtain the fitness of each element.

[0274] In an exemplary embodiment, the risk identification device 500 is further configured to: obtain the fitness mean and fitness variance of the characteristic parameter set; and obtain the updated mutation rate parameter using the current mutation rate parameter and the product of the inverse of the fitness mean and the fitness variance.

[0275] In an exemplary embodiment, the risk identification device 500 is further configured to: train the data expansion sub-model using the quantum state adversarial mechanism; train the feature dimension reduction sub-model using the expected propagation mechanism; and train the classifier sub-model using the extreme learning machine mechanism.

[0276] In an exemplary embodiment, the risk identification device 500 is also configured to: use the quantum state adversarial mechanism to iteratively train the data expansion sub-model as follows until the second condition is met: based on the current quantum bit parameters, convert the network communication data into quantum state data; use the generator to process the quantum state data to obtain generated data; use the discriminator to evaluate the generated data; use the gradient descent principle to update the parameters of the generator and the discriminator; and update the quantum bit parameters.

[0277] In an exemplary embodiment, the risk identification device 500 is further configured to: perform parameter quantum gate operation on the quantum state parameters to obtain a quantum gate representation of the quantum state parameters; obtain the product of the quantum gate representation and the current quantum bit state to obtain the quantum state data.

[0278] In an exemplary embodiment, the risk identification device 500 is also configured to: use the expected propagation mechanism to iteratively train the feature dimensionality reduction sub-model as follows until the third condition is met: use the encoder to process the network communication data to obtain latent space data; use the latent space data to obtain the posterior distribution; use the posterior distribution and the prior distribution of the network communication data to evaluate the reduced network communication data; use the annealing mechanism to update the parameters of the encoder and decoder.

[0279] In an exemplary embodiment, the risk identification device 500 is further configured to: the use of latent space data to obtain a posterior distribution includes: using the latent space data to obtain the mean and variance of the latent space data; using the mean and variance of the latent space data to obtain the posterior distribution.

[0280] In an exemplary embodiment, the risk identification device 500 is also configured to: train the multiple sub-models of the second model separately, including: using the extreme learning machine mechanism to perform the following iterative training on the classifier sub-model until the fourth condition is met: using the self-adjustment mechanism to evaluate the output data of the extreme learning machine mechanism; updating the relevant parameters of the extreme learning machine mechanism; wherein the relevant parameters include at least: the number of hidden layers, the covariate matrix structure, the weights, and the bias.

[0281] In an exemplary embodiment, the risk identification device 500 is also configured as follows: the updating of the number of hidden layers includes: using a performance evaluation mechanism to obtain the performance index of the current extreme learning machine mechanism; using the difference between a preset target performance index and the performance index of the current extreme learning machine mechanism to obtain the adjustment amount of the hidden layer; using the sum of the current number of hidden layers and the adjustment amount to obtain the updated number of hidden layers.

[0282] In an exemplary embodiment, the risk identification device 500 is also configured as follows: the network communication data includes at least one of the following: source address, destination address, transmission protocol, source port number, destination port number, data packet size, timestamp, data load, flag information, and encryption status.

[0283] In an exemplary embodiment, the risk identification device 500 is further configured to: the risk identification result includes at least one of the following: normal communication, malware propagation, information leakage, service denial attack, and other risks.

[0284] Figure 6 The electronic device 600 according to the embodiment of the present disclosure includes at least a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to implement the signal transmission method described in any of the above embodiments.

[0285] Figure 6 The electronic device 600 shown specifically includes: a central processing unit (CPU) 601, a graphics processing unit (GPU) 602 and a memory 603. These units are interconnected via a bus 604. The central processing unit (CPU) 601 and / or the graphics processing unit (GPU) 602 can be used as the above-mentioned processor, and the memory 603 can be used as the above-mentioned memory for storing computer-readable instructions. In addition, the electronic device 600 may also include a communication unit 605, a storage unit 606, an output unit 607, an input unit 608 and an external device 609, which are also connected to the bus 604.

[0286] Figure 7 A schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure. Figure 7As shown, a computer-readable storage medium 700 according to an embodiment of the present disclosure has computer-readable instructions 701 stored thereon. When the computer-readable instructions 701 are executed by a processor, the signal transmission method described in any of the foregoing embodiments of the present disclosure is implemented. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0287] The present disclosure further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the risk identification method described in any of the foregoing embodiments of the present disclosure.

[0288] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0289] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0290] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0291] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0292] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0293] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0294] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A risk identification method, characterized in that: The method comprises: Obtain network communication data; The network communication data is processed using the trained first model to obtain a risk identification result; wherein the first model is optimized based on the exploration of immune mechanism.

2. The method according to claim 1, characterized in that Before processing the network communication data using the trained first model, the method further includes: Training multiple sub-models of the second model respectively; the second model includes at least one of the following: a data expansion sub-model, a feature extraction sub-model, a feature dimension reduction sub-model, and a classifier sub-model; Wherein, the data expansion sub-model is used to perform data expansion on network communication data during the model training phase; Wherein, the feature extraction sub-model is used to extract features from input data; wherein, the feature extraction sub-model is obtained by training based on the exploration of immune mechanism; Wherein, the feature dimension reduction sub-model is used to perform feature dimension reduction on the input data; Wherein, the classifier sub-model is used to classify the input data; The trained feature extraction sub-model, the feature dimensionality reduction sub-model, and the classifier sub-model are combined to obtain the first model.

3. The method according to claim 1 or 2, characterized in that The training of the multiple sub-models of the second model respectively includes: The feature extraction sub-model is iteratively trained using the exploratory immune mechanism until the first condition is met: Using the neural network parameters, a set of characteristic parameters of the input data is obtained; The fitness of each element in the characteristic parameter set is calculated using a fitness mechanism; the fitness is related to the cross entropy error of each element; Using the K elements with the highest fitness and the current mutation rate parameter, update the elements of the feature parameter set; wherein K is an integer greater than 0; Update the mutation rate parameter.

4. The method according to claim 3, characterized in that The using of the fitness mechanism to calculate the fitness of each element in the characteristic parameter set includes: Obtaining the predicted label and the true label of each element in the feature parameter set to obtain a cross entropy error; Get the inverse of the cross entropy error of each element to get the fitness of each element.

5. The method according to claim 3, characterized in that The updating mutation rate parameter includes: Obtaining a fitness mean and a fitness variance of the characteristic parameter set; The updated mutation rate parameter is obtained by using the inverse of the current mutation rate parameter and the product of the fitness mean and the fitness variance.

6. The method according to any one of claims 1 to 5, characterized in that: The training of the multiple sub-models of the second model separately also includes at least one of the following: Use quantum state adversarial mechanism to train the data augmentation sub-model; The feature dimension reduction sub-model is trained using the expectation propagation mechanism; The classifier sub-model is trained using the extreme learning machine mechanism.

7. The method according to claim 6, characterized in that The training of the multiple sub-models of the second model respectively includes: The data expansion sub-model is iteratively trained using the quantum state adversarial mechanism until the second condition is met: Based on the current quantum bit parameters, network communication data is converted into quantum state data; Processing the quantum state data using a generator to obtain generated data; Use the discriminator to evaluate the generated data; Using the gradient descent principle, update the parameters of the generator and the discriminator; Update qubit parameters.

8. The method according to claim 7, characterized in that The converting network communication data into quantum state data based on the current quantum bit parameters includes: Perform parameter quantum gate operation on quantum state parameters to obtain quantum gate representation of quantum state parameters; The product of the quantum gate representation and the current quantum bit state is obtained to obtain the quantum state data.

9. The method according to claim 6, characterized in that The training of the multiple sub-models of the second model respectively includes: The feature dimensionality reduction sub-model is iteratively trained using the expectation propagation mechanism until the third condition is met: Using an encoder to process network communication data to obtain latent space data; Using latent space data, we get the posterior distribution; Using the posterior distribution and the prior distribution of network communication data, the network communication data after dimension reduction is evaluated; The annealing mechanism is used to update the parameters of the encoder and decoder.

10. The method according to claim 9, characterized in that The method of using the latent space data to obtain the posterior distribution includes: Using latent space data, obtain the mean and variance of latent space data; Using the mean and variance of the latent space data, we get the posterior distribution.

11. The method according to claim 6, characterized in that The training of the multiple sub-models of the second model respectively includes: The classifier sub-model is iteratively trained using the ELM mechanism until the fourth condition is met: Using a self-adjusting mechanism to evaluate the output data of the ELM mechanism; Update the relevant parameters of the ELM mechanism; The relevant parameters include at least: the number of hidden layers, the covariate matrix structure, weights, and biases.

12. The method according to claim 11, characterized in that The updating of the number of hidden layers comprises: The performance evaluation mechanism is used to obtain the performance index of the current ELM mechanism; The adjustment amount of the hidden layer is obtained by using the difference between the preset target performance index and the performance index of the current ELM mechanism; The updated number of hidden layers is obtained by using the sum of the current number of hidden layers and the adjustment amount.

13. The method according to claim 1, characterized in that The network communication data includes at least one of the following: source address, destination address, transmission protocol, source port number, destination port number, data packet size, timestamp, data load, flag information, and encryption status.

14. The method according to claim 1, wherein: The risk identification result includes at least one of the following: normal communication, malware propagation, information leakage, denial of service attack, and other risks.

15. A risk identification device, characterized in that: The device comprises: A data acquisition module, used for acquiring network communication data; The risk identification module is used to process the network communication data using the trained first model to obtain risk identification results; wherein the first model is optimized based on the exploration of immune mechanism.

16. A risk identification model, characterized in that: The risk identification model includes at least one of the following: The data augmentation sub-model is used to augment the network communication data during the model training phase; A feature extraction sub-model, used for extracting features from input data; wherein the feature extraction sub-model is optimized based on the exploration of immune mechanism; Feature dimension reduction sub-model, used to reduce the feature dimension of input data; The classifier sub-model is used to classify the input data.

17. The risk identification model according to claim 16, characterized in that: The risk identification model satisfies at least one of the following: The data expansion sub-model is trained by using a quantum state confrontation mechanism; The feature dimension reduction sub-model is trained by utilizing the expectation propagation mechanism; The classifier sub-model is trained by utilizing an extreme learning machine mechanism.

18. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 14.

19. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 14 is implemented.

20. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 14 is implemented.

Images