Virus protection method based on host security and computer equipment

Abstract

The embodiment of the invention discloses a virus protection method based on host security and computer equipment. A specific embodiment of the method comprises the steps of distributing a model training task corresponding to training task information to a first node; in response to the monitored task modification operation for the first node, generating operation risk description information for the task modification operation; in response to the received training sample information and training sample verification information sent by the second node, performing training sample tamper-proof verification on the training sample information according to the training sample verification information; and according to the operation risk description information and / or the sample risk description information, executing protection security for a model training task corresponding to the training task information. According to the embodiment, the neural network model in the training stage is effectively protected, so that the training quality is ensured, and waste of computing resources is avoided.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a virus protection method and computer equipment based on host security. Background Art

[0002] A neural network model is a machine learning model that imitates the processing and learning mechanism of the human nervous system, especially the working method of neurons. It can analyze and process data to achieve tasks such as prediction, classification, and recognition. At present, with the rise of models such as GPT (Generative Pre-trained Transformer), neural network models with large parameters have become the mainstream research trend. At present, supervised model training is still widely used as one of the important training methods for neural network models.

[0003] However, since neural network models have a characteristic of extremely large parameter numbers, they need to rely on a large amount of computer resources for model training during the model training phase. During the training phase, when malicious sample tampering or malicious operations occur, it will at least affect the model convergence speed, and at worst affect the quality of the trained model, and also cause a large amount of computer resources to be wasted. Summary of the invention

[0004] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present application propose a virus protection method and computer device based on host security to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present application provide a virus protection method based on host security, the method comprising: creating a model training task for the target neural network model according to a model description file corresponding to the target neural network model, and obtaining a training task information set, wherein the target neural network model is a neural network model to be trained, and the model description file comprises: a model structure description file and a model training parameter description file, and the training task information in the training task information set comprises: task description information, node address, training mode and training sample address; for each training task information in the training task information set, performing the following processing steps: according to the training task information, distributing the model training task corresponding to the training task information to a first node, wherein the first node is a distributed node for executing the model training task corresponding to the training task information; in response to monitoring the The task modification operation of the first node generates operation risk description information for the above task modification operation, wherein the above operation risk description information includes: operation type, operation risk confidence, operation abnormality confidence, operation origin credibility, virus confidence, wherein the virus confidence characterizes the confidence that the above task modification operation is a host virus; in response to respectively receiving the training sample information and the training sample verification information sent by the second node, according to the above training sample verification information, performing the training sample anti-tampering verification on the above training sample information to generate sample risk description information, wherein the above second node is a distributed node corresponding to the training sample address included in the above training task information, and the above training sample information includes: training sample and sample label, and the training sample is an image type training sample; according to the above operation risk description information and / or the above sample risk description information, perform protection security for the model training task corresponding to the above training task information.

[0007] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0008] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0009] The above-mentioned embodiments of the present application have the following beneficial effects: through the virus protection method based on host security of some embodiments of the present application, effective protection for the model training stage is achieved, avoiding the problem that the model is contaminated, thereby affecting the quality of the model obtained by training, and the problem that computing resources are wasted. Specifically, the reason for the above-mentioned problems is that due to the characteristics of the neural network model with a large number of parameters, a large number of computer resources need to be relied on for model training during the model training stage. During the training stage, when malicious sample tampering and malicious operations occur, the model convergence speed will be affected at the least, and the quality of the model obtained by training will be affected at the worst, and a large amount of computer resources will be wasted. Based on this, the virus protection method based on host security of some embodiments of the present application, first, according to the model description file corresponding to the target neural network model, a model training task for the above-mentioned target neural network model is created to obtain a training task information set, wherein the above-mentioned target neural network model is a neural network model to be trained, and the above-mentioned model description file includes: a model structure description file and a model training parameter description file, and the training task information in the above-mentioned training task information set includes: task description information, node address, training mode and training sample address. For a neural network model with a large number of parameters, it is difficult to match the corresponding training requirements by using a single-machine training method. Therefore, a distributed method is usually used for model training. Therefore, through task decomposition, the entire model training task can be effectively decomposed into training tasks processed by nodes at different distribution times, thereby improving the training efficiency. Secondly, for each training task information in the above-mentioned training task information set, the following processing steps are performed: the first step is to distribute the model training task corresponding to the above-mentioned training task information to the first node according to the above-mentioned training task information, wherein the above-mentioned first node is a distributed node for executing the model training task corresponding to the above-mentioned training task information. The second step is to generate operation risk description information for the above-mentioned task modification operation in response to monitoring the task modification operation for the above-mentioned first node, wherein the above-mentioned operation risk description information includes: operation type, operation risk confidence, operation abnormality confidence, operation origin credibility, virus confidence, wherein the virus confidence characterizes the confidence that the above-mentioned task modification operation is a host virus. In order to improve the training speed, it is often necessary to adjust the task adaptively according to the current training state. During this period, there may be invasive malicious task modifications or non-invasive malicious task modifications initiated internally. Therefore, by generating corresponding operation risk description information for each task modification operation generated, the risk of the task modification operation is evaluated.In the third step, in response to receiving the training sample information and the training sample verification information sent by the second node respectively, the training sample information is subjected to the training sample anti-tampering check according to the training sample verification information to generate the sample risk description information, wherein the second node is the distributed node corresponding to the training sample address included in the training task information, and the training sample information includes: training samples and sample labels, and the training samples are image type training samples. In practice, for supervised training methods, training samples and sample labels are crucial to the training accuracy of the model. However, in the training process, the training accuracy of the model is easily damaged by sample contamination, and even non-convergence occurs. Therefore, it is necessary to perform corresponding verification on whether the training sample has been tampered with to obtain the corresponding sample risk description information. Finally, the protection security of the model training task corresponding to the training task information is performed according to the operational risk description information and / or the sample risk description information. In this way, the neural network model in the training stage is effectively protected, thereby ensuring the training quality and avoiding the waste of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0011] Figure 1 is a flow chart of some embodiments of the host security-based virus protection method according to the present application; Figure 2 It is a schematic diagram of the model structure diagram; Figure 3 is a schematic diagram of a distribution process of distributing the model training task corresponding to the above training task information to the first node; Figure 4 It is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0012] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0013] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0014] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0015] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0016] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0017] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0018] refer to Figure 1 , shows a process 100 of some embodiments of the virus protection method based on host security according to the present application. The virus protection method based on host security includes the following steps: Step 101, based on the model description file corresponding to the target neural network model, create a model training task for the target neural network model and obtain a training task information set.

[0019] In some embodiments, the executor of the host security-based virus protection method (e.g., a computer device) can create a model training task for the target neural network model according to the model description file corresponding to the target neural network model, and obtain a training task information set.

[0020] The target neural network model is a neural network model to be trained. In practice, the target neural network model is trained using a supervised model training method. The model description file includes: a model structure description file and a model training parameter description file.

[0021] The model structure description file is a file used to describe the model structure of the target neural network model. In practice, the model structure description file may include: the type of layer, the number of layers, the connection order of the layers, the parameters of the layers, and the input and output sizes of the layers. For example, the types of layers may include: convolutional layer, fully connected layer, input layer, output layer, flattening layer, etc. The parameters of the layers may include: the input size of the layer, the output size of the layer, the convolution kernel size, the step size, the activation function, the padding method, etc.

[0022] The model training parameter description information is used to describe the training parameters of the target neural network model during the model training phase. For example, the model training parameter description information may include: learning rate, batch size, number of iterations, regularization parameter, loss function, and optimizer. Among them, the learning rate is a parameter used to describe the step size for each weight update. In practice, a smaller learning rate may increase the model training time, and a larger learning rate may cause oscillation, which may lead to the failure of the model to converge. The batch size refers to the number of training samples used in each gradient update process. In practice, a large batch can use more training samples in a single gradient update process, but it will take up more memory. The number of iterations refers to the number of times the data set corresponding to the entire training sample is completely traversed. In practice, when the number of iterations is set to a large number, it may cause overfitting of the model, and when the number of iterations is set to a small number, it may cause underfitting of the model. The regularization parameter is used to prevent overfitting and to improve the generalization ability of the model to a certain extent. For example, L1 regularization coefficient, L2 regularization coefficient. The loss function measures the difference between the predicted value and the actual value. For example, the loss function may include: mean square error loss function, root mean square error loss function, mean absolute error loss function, etc. The optimizer characterizes the method of minimizing the loss function. For example, the optimizer may include: gradient descent optimizer, Adam optimizer, etc.

[0023] The training task information is a task description of the model training task. Among them, the training task information in the training task information set includes: task description information, node address, training mode and training sample address. The task description information is a task description of the model training task assigned to a single distributed node. The node address represents the communication address of the distributed node of the model training task corresponding to the task description information to be processed. The training mode represents the distributed node of the model training task corresponding to the task description information to be processed, and the distributed training mode of the model training task corresponding to the task description information to be processed. In practice, the training mode may include: data parallel mode, model parallel mode, etc. Among them, the data parallel mode refers to multiple distributed nodes performing model training in parallel and independently. The model parallel mode refers to splitting the model into multiple parts, and multiple distributed nodes performing model training in parallel. The training sample address refers to the storage address of the training samples required for the model training task corresponding to the training task information.

[0024] In practice, when the model structure is complex and the model parameters are numerous, it is impossible to use a single machine to achieve efficient training for the target neural network model. Therefore, it is often necessary to use a distributed approach to decompose the model training task corresponding to the target neural network model into multiple distributed node sub-training tasks to be executed through multiple computers or virtual computer nodes (distributed nodes), so as to improve the model training efficiency of the target neural network model through various optimization methods such as parallel training. In practice, the above-mentioned execution subject can use the TensorFlow framework, PyTorch framework, PaddlePaddle framework, etc., according to the model description file corresponding to the target neural network model, create a model training task for the above-mentioned target neural network model, and obtain a training task information set.

[0025] It should be noted that the above-mentioned computing device can be hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or it can be implemented as a single server or a single terminal device. When the computing device is embodied as software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, for example, or it can be implemented as a single software or software module. No specific limitation is made here. In practice, the above-mentioned computing execution subject can be a distributed framework for model training of the target neural network model.

[0026] In some optional implementations of some embodiments, the execution subject creates a model training task for the target neural network model according to the model description file corresponding to the target neural network model, and obtains a training task information set, including: The first step is to determine the model structure of the target neural network model according to the model structure description file included in the model description file to generate a model structure diagram.

[0027] The model structure diagram is a diagram structure used to describe the model structure of the target neural network model. The diagram nodes in the model structure tree correspond to the layers included in the target neural network model.

[0028] As an example, in practice, the file formats of different model structure description files may be different. Therefore, the model structure diagram is obtained through unified conversion to achieve a unified description of the model structure of the model corresponding to the file format model structure description file. Figure 2 A schematic diagram of the model structure diagram shown in FIG. Figure 2 The model structure diagram shown includes: input layer, convolution layer A, convolution layer B, convolution layer C, concatenation layer and fully connected layer. Taking Python code as an example, the code corresponding to the model structure description file can be (its Figure 2 The model structure diagram shown corresponds to): # Define the input layer input_layer=Input(shape=(64, 64, 3)) # Define three parallel convolutional layers A, B, and C conv_layer_A=Conv2D(filters=32,kernel_size=(3,3),padding='same',activation='relu')(input_layer) conv_layer_B=Conv2D(filters=64,kernel_size=(5,5),padding='same',activation='relu')(input_layer) conv_layer_C=Conv2D(filters=128,kernel_size=(7,7),padding='same',activation='relu')(input_layer) # Define the stitching layer concatenated = Concatenate(axis=-1)([conv_layer_A, conv_layer_B,conv_layer_C]) flattened = Flatten()(concatenated) # Define fully connected layer dense_layer = Dense(128, activation='relu')(flattened) output_layer = Dense(10, activation='softmax')(dense_layer) # Build the model model = Model(inputs=input_layer, outputs=output_layer) In the second step, according to the above model structure diagram, the above target neural network model is deconstructed to generate a set of sub-models.

[0029] In practice, each graph node in the model structure diagram can be a sub-model, thereby obtaining a sub-model set. In addition, in order to improve the efficiency of using distributed nodes, multiple connected graph nodes can also be used as a sub-model.

[0030] Step 3: For each sub-model in the above sub-model set, perform the following model training task creation steps: The first sub-step is to allocate distributed nodes matching the above sub-model according to the model parameter quantity and operator type corresponding to the above sub-model, so as to obtain the node address included in the training task information corresponding to the above sub-model.

[0031] In practice, since the model structure of the sub-model is known and the size of the feature map corresponding to the sub-model is known, the model parameter quantity corresponding to the sub-model can be quantified according to the sub-model combined with the size of the feature map processed by the sub-model. Operator types may include: linear operators (matrix multiplication, convolution, transposed convolution), normalization operators, pooling operators, etc. Therefore, the above-mentioned execution subject can combine the model parameter quantity and operator type corresponding to the sub-model to quantify the computing power requirements corresponding to the sub-model, so as to allocate distributed nodes matching the sub-model. After the allocation is completed, the node address included in the training task information corresponding to the above-mentioned sub-model can be obtained.

[0032] The second sub-step is, in response to the allocation being completed, generating a model training task for the above sub-model, and obtaining the task description information included in the training task information corresponding to the above sub-model.

[0033] In practice, a sub-model can be understood as a neural network model to be trained with a smaller model size. Therefore, the above-mentioned execution entity can use the TensorFlow framework, PyTorch framework, PaddlePaddle framework, etc. to create a model training task for the sub-model and obtain the task description information included in the training task information corresponding to the above sub-model.

[0034] The third sub-step is to predict the training time complexity based on the model parameter quantity and operator type corresponding to the above sub-model.

[0035] In practice, since the number of model parameters and the operator type are known, the above execution entity can predict the training time complexity corresponding to the sub-model based on historical training tasks.

[0036] The fourth sub-step is to determine the training mode included in the training task information corresponding to the above sub-model based on the above training time complexity and the above sub-model.

[0037] In practice, under the premise of knowing the training time complexity corresponding to the sub-model and the model structure corresponding to the sub-model, the above-mentioned execution subject can match the training mode that best matches the sub-model as the training mode included in the training task information corresponding to the sub-model.

[0038] The fifth sub-step is to determine the storage address of the training samples used for model training of the above-mentioned sub-model, as the training sample address included in the training task information corresponding to the above-mentioned sub-model.

[0039] In practice, the above-mentioned execution entity can dynamically allocate training samples for model training of the above-mentioned sub-model, and use the node address (storage address) of the distributed node that stores the training samples for model training of the above-mentioned sub-model as the training sample address included in the training task information corresponding to the above-mentioned sub-model.

[0040] As an example, the model training task corresponding to the sub-model is executed on distributed node A, and the training samples used for model training of the above sub-model are stored in distributed node B. Therefore, the training sample address can be the node address of distributed node B.

[0041] Step 102: for each training task information in the training task information set, perform the following processing steps: Step 1021: Distribute the model training task corresponding to the training task information to the first node according to the training task information.

[0042] In some embodiments, the execution subject may distribute the model training task corresponding to the training task information to the first node according to the training task information. The first node is a distributed node for executing the model training task corresponding to the training task information. In practice, the execution subject may distribute the training task information to the first node in the form of broadcasting.

[0043] As an example, see Figure 3 The schematic diagram of the distribution process of distributing the model training task corresponding to the above training task information to the first node is shown, wherein distributed node A can be elected as the scheduling node, and distributed node A can publish the training task information B in the broadcast channel in the form of broadcasting. Since the training task information B is the first node that has a corresponding relationship with distributed node B, when distributed node B receives the training task information B, it indicates that the distribution is successful. However, there is no corresponding relationship between other distributed nodes, such as distributed node C, distributed node D, ..., distributed node Z and the training task information B, so distributed node C, distributed node D, ..., distributed node Z will ignore the training task information B broadcast by distributed node A.

[0044] In some optional implementations of some embodiments, distributing the model training task corresponding to the training task information to the first node according to the training task information includes: The first step is to generate a first temporary key.

[0045] In practice, the first temporary key may be a key provided by a scheduling node (e.g. Figure 3 The temporary key created by the distributed node A) shown in FIG.

[0046] The second step is to obtain the identity key, signature key, and second temporary key corresponding to the first node from the key server.

[0047] Among them, the signature key corresponding to the above-mentioned first node is updated regularly. The key server is a server for storing the identity key, signature key and second temporary key corresponding to each distributed node. The identity key represents the node identity for the first node. The signature key represents the node signature for the first node. The second temporary key is a temporary key temporarily generated for the first node. Among them, the identity key, signature key and second temporary key all include a private key and a public key.

[0048] The third step is to determine the initial key based on the private key included in the first temporary key, the public key included in the identity key, the public key of the signature key, and the public key of the second temporary key.

[0049] The key length of the initial key is 32 bytes. Initial key = KDF (DH (private key included in the first temporary key, public key included in the identity key) | DH (private key included in the first temporary key, public key of the signature key) | DH (private key included in the first temporary key, public key of the second temporary key)). DH() represents the ECDHE elliptic curve function. “|” represents concatenation. KDF() represents the key derivation function.

[0050] The fourth step is to send a start message to the first node.

[0051] The start message may include a public key included in the identity key of the scheduling node (execution subject) and a public key included in the first temporary key.

[0052] The fifth step is to encrypt the training task information according to the initial key in response to receiving the verification message for the start message sent by the first node to obtain the encrypted training task information.

[0053] In practice, during the model training process, tampering with the training task information is one of the most direct ways to affect the execution of the model training task. When the tampering is initiated from the outside, it can be identified and intercepted by interception technologies such as firewalls. However, when the tampering is initiated from the inside, it is difficult to intercept by technologies such as firewalls. Therefore, on this basis, this application assumes that the distributed nodes are not trustworthy. When the distributed nodes communicate with each other, especially when transmitting information and data related to model training, the above encryption method is used for encryption to ensure the security of the information transmission process.

[0054] The sixth step is to send the encrypted training task information to the first node to distribute the model training task corresponding to the training task information to the first node.

[0055] In practice, since the above encryption method is essentially asymmetric encryption, after receiving the encrypted training task information, the first node can decrypt the encrypted training task information by combining the corresponding public key and private key.

[0056] Step 1022: In response to monitoring a task modification operation for the first node, generating operation risk description information for the task modification operation.

[0057] In some embodiments, the execution subject may generate operational risk description information for the task modification operation in response to monitoring the task modification operation for the first node. In practice, the task modification operation may be a modification operation initiated from outside the distributed system or from inside the distributed system. The operational risk description information includes: operation type, operational risk confidence, operational abnormality confidence, operation origin credibility, and virus confidence, wherein the virus confidence characterizes the confidence that the task modification operation is a host virus. The operation type characterizes the specific operation type of the task modification operation. The operational risk confidence characterizes the risk of executing the task modification operation. The operational abnormality confidence characterizes the behavioral abnormality of the task modification operation. The operation origin credibility characterizes the credibility of the node that initiates the task modification operation.

[0058] In some optional implementations of some embodiments, the execution subject generates, in response to monitoring a task modification operation on the first node, operation risk description information for the task modification operation, including: In the first step, the operation feature extraction model is used to extract the operation features of the above task modification operations to generate operation features.

[0059] In practice, first, the instructions corresponding to the task modification operation can be converted into a two-dimensional grayscale image. Then, with the two-dimensional grayscale image as input, a convolutional neural network model with 7 convolutional layers is used as an operation feature extraction model to extract the operation features of the above task modification operation to generate operation features. Specifically, when the instructions corresponding to the task modification operation are converted into a two-dimensional grayscale image, the instructions corresponding to the task modification operation can be converted into a binary string, which is cut into a substring with a length of 8 bits, wherein the substring with a length of 8 bits corresponds to 1 pixel, so that the instructions corresponding to the task modification operation can be converted into a two-dimensional grayscale image. Among them, considering that the lengths of the instructions corresponding to the task modification operation are often different, resulting in inconsistent sizes of the obtained two-dimensional grayscale images, which cannot be directly input into the convolutional neural network model, the operation feature extraction model also includes: 3 parallel downsampling layers for different grayscale image scales in the convolutional neural network model with 7 convolutional layers. The input size of each downsampling layer is preset. When the size of the two-dimensional grayscale image is consistent with the input size of the downsampling layer, it can be directly input. When it is inconsistent, the input size of the downsampling layer closest to the size of the two-dimensional grayscale image is determined as a constraint, and the two-dimensional grayscale image is padded with 0 to ensure that the two-dimensional grayscale image after 0 padding can be input into the downsampling layer. Among them, the output sizes of the three downsampling layers are consistent with the input size of the convolutional neural network model with 7 convolutional layers.

[0060] The second step is to determine the operation type included in the above operation risk information based on the operation type classifier and the above operation characteristics.

[0061] Among them, the operation type classifier is a multi-classifier, which is used to output the operation types included in the operation risk information.

[0062] The third step is to determine the operational risk confidence included in the operational risk information based on the operational risk confidence predictor and the operational characteristics.

[0063] In practice, the operational risk confidence predictor may be a single classifier, and the confidence corresponding to its classification result may be the operational risk confidence.

[0064] The fourth step is to determine the operation origin, operation initiation time, operation initiation period, and operation initiation frequency of the above task modification operation.

[0065] In practice, the origin of the task modification operation can be located by reverse tracing, and the operation initiation time, operation initiation period, and operation initiation frequency corresponding to the task modification operation can be obtained according to the operation log.

[0066] The fifth step is to determine the confidence level of the operation abnormality included in the operation risk information based on the operation characteristics, the operation origin, the operation initiation time, the operation initiation period and the operation initiation frequency.

[0067] In practice, the above-mentioned operation origin, the above-mentioned operation initiation time, the above-mentioned operation initiation period and the above-mentioned operation initiation frequency are static features, and the above-mentioned execution subject can feature encode the above-mentioned operation origin, the above-mentioned operation initiation time, the above-mentioned operation initiation period and the above-mentioned operation initiation frequency by feature encoding. Then, the encoded features and the operation features are concatenated as the input of the operation anomaly classifier to obtain the operation anomaly confidence. Among them, the operation anomaly classifier can also be a binary classifier (the classification results include operation anomaly and normal operation), and the confidence of the corresponding classification result can be the operation anomaly confidence.

[0068] In practice, the operation feature extraction model, operation type classifier, risk confidence predictor and operation anomaly classifier can be taken as a whole and trained in a supervised manner.

[0069] Step 6: Determine whether the source of the above operation is in the list of trusted operation sources.

[0070] The trusted operation source list is a list used to maintain the trusted operation source identity. The above-mentioned execution subject can regularly perform trust verification on the distributed nodes, and store the node addresses of the operation sources (distributed nodes) that meet the trust verification into the trusted operation source list.

[0071] In a seventh step, in response to determining that the operation initiator is not in the list of trusted operation sources, determine whether there is a historical operation profile corresponding to the operation initiator.

[0072] In practice, the historical operation profile can be a behavioral profile constructed based on the historical operation behavior of the operation origin.

[0073] In the eighth step, in response to the existence of a historical operation portrait corresponding to the operation origin, determine the credibility of the operation origin included in the operation risk information according to the historical operation portrait, the operation characteristics, the operation origin, the operation initiation time, the operation initiation time period and the operation initiation frequency.

[0074] Among them, the credibility of the operation origin can be combined with a pre-built decision tree model, with the above-mentioned historical operation portrait, the above-mentioned operation characteristics, the above-mentioned operation origin, the above-mentioned operation initiation time, the above-mentioned operation initiation time period and the above-mentioned operation initiation frequency as input to obtain the credibility of the operation origin.

[0075] In the ninth step, in response to the absence of a historical operation profile corresponding to the operation origin, the credibility of the operation origin included in the operation risk information is determined according to the operation characteristics, the operation origin, the operation initiation time, the operation initiation period and the operation initiation frequency.

[0076] In practice, the above-mentioned execution entity can still combine the above-mentioned decision tree model to obtain the credibility of the origin of the operation.

[0077] In the tenth step, the above operation features are compared with the host virus features in the host virus feature library to generate virus similarity as the virus confidence included in the above operation risk description information.

[0078] In practice, the above-mentioned execution entity can use similarity calculation to determine the virus similarity as the virus confidence included in the above-mentioned operation risk description information.

[0079] The operational risk of task modification operations can be quantified from multiple angles, including operation type, operation risk confidence, operation anomaly confidence, operation origin credibility, and virus confidence.

[0080] Step 1023, in response to receiving the training sample information and the training sample verification information sent by the second node respectively, performing a training sample tamper-proof check on the training sample information according to the training sample verification information to generate sample risk description information.

[0081] In some embodiments, the execution subject may, in response to receiving the training sample information and the training sample verification information respectively sent by the second node, perform a training sample anti-tampering check on the training sample information according to the training sample verification information to generate sample risk description information. The second node is a distributed node corresponding to the training sample address included in the training task information. The training sample information includes: training samples and sample labels, and the training samples are image type training samples.

[0082] In some optional implementations of some embodiments, the execution subject, in response to receiving the training sample information and the training sample verification information sent by the second node respectively, performs a training sample tamper-proof verification on the training sample information according to the training sample verification information to generate sample risk description information, including: The first step is to decrypt the above training sample verification information to obtain decrypted training sample verification information.

[0083] Among them, the above-mentioned decrypted training sample verification information includes: key point features of training samples, trusted sample labels, feature extraction parameters and check codes, and the check codes are tamper-proof check codes for the key point features of training samples, the above-mentioned trusted sample labels and the above-mentioned feature extraction parameters. In practice, the encryption and decryption method of transmitting information and data between the first node and the second node can refer to the content in step 1021. The key point features of training samples are pre-collected key point features for training samples. The trusted sample label can be a trusted sample label. The feature extraction parameters are extraction parameters of sample features in the training samples for tamper-proof verification. The check code can be a check code for the key point features of training samples, trusted sample labels, and feature extraction parameters. Specifically, the check code can be a CRC (Cyclic Redundancy Check) cyclic check code.

[0084] In the second step, based on the verification code, anti-tampering verification is performed on the key point features of the training samples, the trusted sample labels and the feature extraction parameters.

[0085] In practice, the execution entity may perform tamper-proof verification on the key point features of the training samples, the trusted sample labels and the feature extraction parameters according to the verification code by means of CRC verification.

[0086] In the third step, in response to passing the verification information tamper-proof verification, the following verification steps are performed: The first sub-step is to extract at least M local key point features from the key point features of the training samples.

[0087] Wherein, 32≤M≤64. The M local key point features are M local features that are not connected in the key point features of the training samples.

[0088] The second sub-step is to extract features from the training samples included in the training sample information according to the feature extraction parameters to generate features of the training samples to be verified.

[0089] In practice, since the training samples are image type training samples, the feature extraction parameters can be pre-constructed parameters related to the convolution kernel for image features. The key point features of the training samples are also extracted according to the feature extraction parameters.

[0090] The third sub-step is to perform feature comparison on the corresponding points of the above-mentioned training sample features to be verified according to the above-mentioned M local key point features, so as to generate a first comparison result.

[0091] Among them, the first comparison result represents whether the M local key point features are consistent with the corresponding points of the training sample features to be verified.

[0092] The fourth sub-step is to determine the label consistency between the above-mentioned credible sample label and the sample label included in the above-mentioned training sample information to generate a second comparison result.

[0093] The second comparison result indicates whether the credible sample label is consistent with the sample label included in the training sample information.

[0094] The fifth sub-step is to generate the sample risk description information according to the first comparison result and the second comparison result.

[0095] Step 1024, performing security protection for the model training task corresponding to the training task information according to the operation risk description information and / or the sample risk description information.

[0096] In some embodiments, the above-mentioned execution entity can perform protection security for the model training task corresponding to the training task information based on the operation risk description information and / or the sample risk description information.

[0097] In some optional implementations of some embodiments, the execution subject performs security protection for the model training task corresponding to the training task information according to the operation risk description information and / or the sample risk description information, including: In the first step, in response to the above-mentioned operation risk description information indicating that the above-mentioned task modification operation has an operation risk, the following first protection step is performed: In the first sub-step, based on the above-mentioned operation risk description information and the operation protection decision tree, the operation protection for the above-mentioned task modification operation is determined.

[0098] Among them, the operation protection decision tree is a pre-built decision tree used to make operation protection type decisions in combination with risk description information.

[0099] The second sub-step is to initiate a task risk warning for the model training task corresponding to the above training task information.

[0100] In practice, the above-mentioned execution entity can initiate a task risk warning to the object that initiates the model training task for the target neural network model.

[0101] In the second step, in response to the sample risk description information indicating that the training sample has sample risk, the training sample information is frozen, and the following second protection step is performed: The first sub-step is to initiate node locking for the second node.

[0102] In practice, the above-mentioned execution subject may initiate node locking for the second node through the scheduling node to avoid communication and data transmission between the second node and other distributed nodes.

[0103] The second sub-step is to switch the training sample sending node for the model training task corresponding to the above training task information.

[0104] In practice, in order to ensure the stability of the training process, data is often backed up in multiple nodes. Therefore, when the second node is abnormal, it is possible to switch to the backup node corresponding to the second node as the training sample sending node for the model training task corresponding to the above training task information.

[0105] The node broadcast for the second node is not credible when broadcasting to other distributed nodes.

[0106] The third sub-step is to broadcast the node untrustworthiness of the second node to other distributed nodes.

[0107] In practice, untrusted node broadcasting is used to prevent other distributed nodes from actively initiating invalid communications and data exchanges with the second node.

[0108] The above-mentioned embodiments of the present application have the following beneficial effects: through the virus protection method based on host security of some embodiments of the present application, effective protection for the model training stage is achieved, avoiding the problem that the model is contaminated, thereby affecting the quality of the model obtained by training, and the problem that computing resources are wasted. Specifically, the reason for the above-mentioned problems is that due to the characteristics of the neural network model with a large number of parameters, a large number of computer resources need to be relied on for model training during the model training stage. During the training stage, when malicious sample tampering and malicious operations occur, the model convergence speed will be affected at the least, and the quality of the model obtained by training will be affected at the worst, and a large amount of computer resources will be wasted. Based on this, the virus protection method based on host security of some embodiments of the present application, first, according to the model description file corresponding to the target neural network model, a model training task for the above-mentioned target neural network model is created to obtain a training task information set, wherein the above-mentioned target neural network model is a neural network model to be trained, and the above-mentioned model description file includes: a model structure description file and a model training parameter description file, and the training task information in the above-mentioned training task information set includes: task description information, node address, training mode and training sample address. For a neural network model with a large number of parameters, it is difficult to match the corresponding training requirements by using a single-machine training method. Therefore, a distributed method is usually used for model training. Therefore, through task decomposition, the entire model training task can be effectively decomposed into training tasks processed by nodes at different distribution times, thereby improving the training efficiency. Secondly, for each training task information in the above-mentioned training task information set, the following processing steps are performed: the first step is to distribute the model training task corresponding to the above-mentioned training task information to the first node according to the above-mentioned training task information, wherein the above-mentioned first node is a distributed node for executing the model training task corresponding to the above-mentioned training task information. The second step is to generate operation risk description information for the above-mentioned task modification operation in response to monitoring the task modification operation for the above-mentioned first node, wherein the above-mentioned operation risk description information includes: operation type, operation risk confidence, operation abnormality confidence, operation origin credibility, virus confidence, wherein the virus confidence characterizes the confidence that the above-mentioned task modification operation is a host virus. In order to improve the training speed, it is often necessary to adjust the task adaptively according to the current training state. During this period, there may be invasive malicious task modifications or non-invasive malicious task modifications initiated internally. Therefore, by generating corresponding operation risk description information for each task modification operation generated, the risk of the task modification operation is evaluated.In the third step, in response to receiving the training sample information and the training sample verification information sent by the second node respectively, the training sample information is subjected to the training sample anti-tampering check according to the training sample verification information to generate the sample risk description information, wherein the second node is the distributed node corresponding to the training sample address included in the training task information, and the training sample information includes: training samples and sample labels, and the training samples are image type training samples. In practice, for supervised training methods, training samples and sample labels are crucial to the training accuracy of the model. However, in the training process, the training accuracy of the model is easily damaged by sample contamination, and even non-convergence occurs. Therefore, it is necessary to perform corresponding verification on whether the training sample has been tampered with to obtain the corresponding sample risk description information. Finally, the protection security of the model training task corresponding to the training task information is performed according to the operational risk description information and / or the sample risk description information. In this way, the neural network model in the training stage is effectively protected, thereby ensuring the training quality and avoiding the waste of computing resources.

[0109] The present application also provides a computer device 400. Figure 4 As shown, the computer device 400 includes: a bus 401, a processor 402, a memory 403 and a communication interface 404. The processor 402, the memory 403 and the communication interface 404 communicate with each other through the bus 401. The computer device 400 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 400.

[0110] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The bus 401 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 401 may include a path for transmitting information between various components of the computer device 400 (for example, the memory 403, the processor 402, and the communication interface 404).

[0111] The processor 402 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0112] The memory 403 may include a volatile memory, such as a random access memory (RAM). The memory 403 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0113] The memory 403 stores executable program codes, and the processor 402 executes the executable program codes to respectively implement the functions of the acquisition module, the sampling module, the determination module, and the mixing module, thereby implementing the above-mentioned virus protection method based on host security. That is, the memory 403 stores instructions for executing the above-mentioned virus protection method based on host security.

[0114] The communication interface 404 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 400 and other devices or a communication network.

[0115] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned host security-based virus protection method.

[0116] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned host security-based virus protection method.

[0117] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A virus protection method based on host security, comprising: According to the model description file corresponding to the target neural network model, a model training task for the target neural network model is created to obtain a training task information set, wherein the target neural network model is a neural network model to be trained, the model description file includes: a model structure description file and a model training parameter description file, and the training task information in the training task information set includes: task description information, node address, training mode and training sample address; For each training task information in the training task information set, the following processing steps are performed: Distribute the model training task corresponding to the training task information to a first node according to the training task information, wherein the first node is a distributed node for executing the model training task corresponding to the training task information; In response to monitoring a task modification operation for the first node, generating operation risk description information for the task modification operation, wherein the operation risk description information includes: operation type, operation risk confidence, operation abnormality confidence, operation origin credibility, and virus confidence, wherein the virus confidence represents the confidence that the task modification operation is a host virus; In response to receiving the training sample information and the training sample verification information sent by the second node respectively, performing a training sample tamper-proof check on the training sample information according to the training sample verification information to generate sample risk description information, wherein the second node is a distributed node corresponding to the training sample address included in the training task information, and the training sample information includes: a training sample and a sample label, and the training sample is an image type training sample; Perform security protection for the model training task corresponding to the training task information according to the operation risk description information and / or the sample risk description information.

2. The method according to claim 1, wherein: The step of creating a model training task for the target neural network model according to the model description file corresponding to the target neural network model, and obtaining a training task information set includes: Determining the model structure of the target neural network model according to the model structure description file included in the model description file to generate a model structure diagram; According to the model structure diagram, the target neural network model is deconstructed to generate a sub-model set; For each sub-model in the sub-model set, perform the following model training task creation steps: According to the model parameter quantity and operator type corresponding to the sub-model, a distributed node matching the sub-model is allocated to obtain a node address included in the training task information corresponding to the sub-model; In response to the allocation being completed, generating a model training task for the sub-model, and obtaining task description information included in the training task information corresponding to the sub-model; Predicting the training time complexity according to the model parameter quantity and operator type corresponding to the sub-model; Determine, according to the training time complexity and the sub-model, a training mode included in the training task information corresponding to the sub-model; Determine a storage address of a training sample used for model training of the sub-model as the training sample address included in the training task information corresponding to the sub-model.

3. The method according to claim 2, wherein: The step of distributing the model training task corresponding to the training task information to the first node according to the training task information includes: generating a first temporary key; Obtaining an identity key, a signature key, and a second temporary key corresponding to the first node from a key server, wherein the signature key corresponding to the first node is updated regularly; Determine an initial key according to the private key included in the first temporary key, the public key included in the identity key, the public key of the signature key, and the public key of the second temporary key, wherein the key length of the initial key is 32 bytes; Sending an initiation message to the first node; In response to receiving a verification message for the start message sent by the first node, encrypting the training task information according to the initial key to obtain encrypted training task information; The encrypted training task information is sent to the first node to distribute the model training task corresponding to the training task information to the first node.

4. The method according to claim 3, wherein: In response to receiving the training sample information and the training sample verification information sent by the second node respectively, performing a training sample tamper-proof check on the training sample information according to the training sample verification information to generate sample risk description information, including: Decrypting the training sample verification information to obtain decrypted training sample verification information, wherein the decrypted training sample verification information includes: key point features of the training sample, a trusted sample label, feature extraction parameters and a check code, wherein the check code is a tamper-proof check code for the key point features of the training sample, the trusted sample label and the feature extraction parameters; According to the verification code, anti-tampering verification is performed on the key point features of the training sample, the trusted sample label and the feature extraction parameter; In response to passing the verification information tamper-proof check, the following verification steps are performed: Extracting at least M local key point features from the key point features of the training samples; According to the feature extraction parameters, feature extraction is performed on the training samples included in the training sample information to generate features of the training samples to be verified; According to the M local key point features, feature comparison is performed on the points corresponding to the features of the training sample to be verified to generate a first comparison result; Determining label consistency between the credible sample label and the sample label included in the training sample information to generate a second comparison result; The sample risk description information is generated according to the first comparison result and the second comparison result.

5. The method according to claim 4, wherein: The performing of security protection for the model training task corresponding to the training task information according to the operation risk description information and / or the sample risk description information includes: In response to the operational risk description information indicating that the task modification operation has an operational risk, the following first protection step is performed: Determining the operation protection for the task modification operation according to the operation risk description information and the operation protection decision tree; Initiate a task risk warning for the model training task corresponding to the training task information; In response to the sample risk description information indicating that the training sample has sample risk, freezing the training sample information, and performing the following second protection step: Initiating node locking for the second node; Switching a training sample sending node for the model training task corresponding to the training task information; The node broadcast for the second node is not credible and is broadcast to other distribution nodes.

6. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 5 are implemented.

7. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images