Network security monitoring method and system based on computing power, and electronic equipment

Abstract

The invention relates to the technical field of network security monitoring, in particular to a network security monitoring method and system based on computing power and electronic equipment. The method comprises the following steps: acquiring names of software currently in a running state in target equipment, a system log of the target equipment, a network average uplink speed of the target equipment, a network average downlink speed of the target equipment, a data downloading amount of the target equipment and a data uploading amount of the target equipment according to a preset time interval; the network security abnormity intelligent identification model of the target equipment is trained, whether the network security of the target equipment is abnormal or not is judged, intelligent, effective and timely network security monitoring is carried out on the network security of the target equipment before a certain unknown virus is found, and corresponding measures are taken in time, so that the network security of the target equipment is effectively monitored. The problem that effective and timely network security monitoring is difficult to carry out before a certain unknown virus is found in the prior art is solved, and the reliability and the intelligent degree of network security monitoring are improved to a great extent.

Description

Technical Field

[0001] The present invention relates to the technical field of network security monitoring, and in particular to a network security monitoring method and system based on computing power, and electronic equipment. Background Art

[0002] Computer communication is a new technology that integrates computer technology, modern communication technology, network technology, information technology and other technologies. Computer communication network is a new communication method formed by the combination of computer technology and communication technology. It mainly meets the needs of data transmission. It connects multiple computer terminals with independent functions in different geographical locations and attached hardware devices (routers, switches) with communication links, and is equipped with corresponding network software to realize the communication system formed by resource sharing during the communication process.

[0003] However, in the process of computer network communication, since modern computer communication must be closely integrated with computer networks and communication technology is used in an open network environment, communication security will have many uncertain factors due to the complexity of the outside world. At the same time, various network attacks may affect information and communication resources, cause network signal interruption, and even some malicious attacks. Once the computer communication network system is breached, it will cause the transparency of communication information and no confidentiality, resulting in the leakage of key data, which will cause immeasurable losses. To this end, effective measures must be taken to ensure the computer communication network system. Only by ensuring the security of the computer communication network system can people better conduct network communication and more effectively transmit information safely. Then, due to the continuous evolution of virus software in the existing technology, better concealment, more types, and more diverse data theft methods, it is difficult to conduct effective and timely network security monitoring through conventional monitoring methods, such as virus library comparison. Often, only when a certain virus exists in the virus library can it be easily targeted for monitoring. Before the virus is discovered, it must have been attacked or even suffered losses. That is, it is difficult for the existing technology to conduct effective and timely network security monitoring before discovering an unknown virus, and take corresponding measures in time.

[0004] Therefore, the prior art needs to be further developed. Summary of the invention

[0005] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and provide a network security monitoring method and system, and electronic equipment based on computing power to solve the problems existing in the prior art.

[0006] To achieve the above technical objectives, according to a first aspect of the present invention, the present invention provides a network security monitoring method based on computing power, comprising: S100, obtaining the name of each software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and recording the obtained data as a network coupling state data set of the target device; collecting a first preset number of network coupling state data sets of the target devices, and dividing the collected network coupling state data sets of the target devices into a training data set and a verification data set according to a first preset ratio; S200, using the collected training data set of the target device to train the network coupling state data set of the target device, using the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimize the model parameters, and complete the network security anomaly intelligent recognition model training of the target device; S300. When the model training is completed, the network coupling status data set of the target device is obtained again, and the obtained network coupling status data set of the target device is input into the network security anomaly intelligent recognition model of the target device, so as to determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

[0007] Specifically, the system log includes: The startup and shutdown time of each software, the average network upload speed of each software, the average network download speed of each software, the data download volume of each software, the data upload volume of each software, and the file names accessed by each software.

[0008] Specifically, the method further includes: According to the startup time and shutdown time of each software, the running time of each software is calculated. According to the file names accessed by each software, the number of files accessed by each software is calculated. The startup time and shutdown time of each software and the number of files accessed by each software are recorded in the network coupling status data set of the target device.

[0009] Specifically, the method uses the collected training data set of the target device to train the network coupling state data set of the target device, uses the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimizes the model parameters, and completes the network security anomaly intelligent recognition model training of the target device, including: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the network coupling state data set of the next target device according to the network coupling state data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, and the direction in which the parameter gradient of the network security anomaly intelligent recognition model of the target device decreases fastest is determined; the network security anomaly intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, and the parameters of the network security anomaly intelligent recognition model of the target device are optimized.

[0010] Specifically, the preset network layer also includes a ResNet network layer, and the ResNet network layer is used to classify and predict the output results according to the collected network coupling status data set of the target device, and the classification results include network security anomalies of the target device and network security normal of the target device.

[0011] Specifically, the ResNet network layer is used to classify and predict the output results according to the collected network coupling status data set of the target device, including: When constructing Backbone, the Resnet network layer and network coupling status data set encoding are added. The encoding method of the network coupling status data set encoding is to encode the collected network coupling status data set in the order of collection. Resnet starts layer-by-layer training after the training data set is input. The training extracts the features in the network coupling status data set of the target device, and assists Transformer in predicting whether the network security of the target device is abnormal. The extracted features are used with the help of the network coupling status data set encoding to obtain the encoding information of each network coupling status data set, which is used by relevant managers to locate abnormal network coupling status data sets when the network security of the target device is abnormal.

[0012] Specifically, the determining whether the network security of the target device is abnormal, and outputting an alarm signal regarding the network security abnormality of the target device according to the determination result, includes: If it is determined that the network security of the target device is abnormal, an alarm signal about the network security abnormality of the target device is output, and coded information of the abnormal network coupling state data set is output, and the network connection permission of the target device is deprived; If it is determined that the network security of the target device is normal, a prompt signal indicating that the network security of the target device is normal is output.

[0013] Specifically, the output includes an alarm signal of network security anomaly of the target device and coded information of abnormal network coupling state data set, and also includes: Record the timestamp of the collection of the network coupling status data set of each target device, the user's login history data and the user's logout history data, and output the timestamp, user's login history data and user's logout history data corresponding to the network coupling status data set while outputting the encoding information of the abnormal network coupling status data set.

[0014] According to a second aspect of the present invention, there is provided a network security monitoring system based on computing power, comprising: An acquisition module is used to acquire the names of various software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and record the acquired data as the network coupling state data set of the target device; to collect the network coupling state data sets of a first preset number of target devices; and to acquire the network coupling state data sets of the target device again after the model training is completed; A control module is used to divide the collected network coupling status data set of the target device into a training data set and a verification data set according to a first preset ratio; to use the collected training data set of the target device to train the network coupling status data set of the target device, and to use the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimize the model parameters, and complete the training of the network security anomaly intelligent recognition model of the target device; and to input the network coupling status data set of the target device acquired again into the network security anomaly intelligent recognition model of the target device after the model training is completed, so as to determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

[0015] According to a third aspect of the present invention, there is provided an electronic device, comprising: a memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the above-mentioned computing power-based network security monitoring method is implemented.

[0016] Beneficial effects: The present invention obtains the names of various software currently in operation in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and then trains a network security anomaly intelligent recognition model for the target device, and then determines whether the network security of the target device is abnormal. This realizes intelligent, effective, and timely network security monitoring of the network security of the target device before a certain unknown virus is discovered, and takes corresponding measures in a timely manner, solving the problem in the prior art that it is difficult to perform effective and timely network security monitoring before a certain unknown virus is discovered, and greatly improves the reliability and intelligence of network security monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of a network security monitoring method based on computing power provided in a specific embodiment of the present invention; Figure 2 is a schematic diagram of the system composition of a network security monitoring system based on computing power provided in a specific embodiment of the present invention; Figure 3 It is a structural diagram of a network security anomaly intelligent identification model provided in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings of the present invention. Based on the embodiments in this application, other similar embodiments obtained by ordinary technicians in this field without making creative work should all fall within the scope of protection of this application. In addition, the directional words mentioned in the following embodiments, such as "up", "down", "left", "right", etc., are only reference to the directions of the accompanying drawings. Therefore, the directional words used are used to illustrate rather than limit the invention.

[0019] The present invention will be further described below in conjunction with the accompanying drawings and preferred embodiments.

[0020] See also Figure 1 The present invention provides a network security monitoring method based on computing power, comprising: S100. Obtain the name of each software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and record the obtained data as a network coupling state data set of the target device; collect the network coupling state data sets of a first preset number of target devices, and divide the collected network coupling state data sets of the target devices into a training data set and a verification data set according to a first preset ratio.

[0021] Specifically, the system log includes: The startup and shutdown time of each software, the average network upload speed of each software, the average network download speed of each software, the data download volume of each software, the data upload volume of each software, and the file names accessed by each software.

[0022] Specifically, the method further includes: According to the startup time and shutdown time of each software, the running time of each software is calculated. According to the file names accessed by each software, the number of files accessed by each software is calculated. The startup time and shutdown time of each software and the number of files accessed by each software are recorded in the network coupling status data set of the target device.

[0023] It is understandable that each data in the network coupling state data set of the target device is data generated by the target device within a preset time interval, including the user's login history data and the user's logout history data. The user's login history data and logout history data include the user name, login time and logout time of the user who logged in and logged out of the target device within the preset time interval.

[0024] It should be noted that the step before step S100 includes: A preset time interval, a first preset number, a first preset ratio, a first preset round, and a second preset round are preset in the control module.

[0025] It can be understood that the preset time interval, the first preset number, the first preset ratio, the first preset round, and the second preset round can be specifically set according to the actual needs of the user of the present invention. The present invention does not limit the specific values ​​of the above parameters, and there is no regularity in setting the specific values ​​of the above parameters, as long as it is applicable to the computing power-based network security monitoring method proposed in the present invention.

[0026] Preferably, the present invention sets the preset time interval to 5 seconds, the present invention sets the first preset number to 1000, the present invention sets the first preset ratio to 8:2, the present invention sets the first preset round to 30,000 times, and the present invention sets the second preset round to 300. The above settings can further improve the performance of the model and the efficiency of model training, and greatly improve the accuracy and reliability of the network security anomaly intelligent identification model of the target device of the present invention.

[0027] It is understandable that before the network security anomaly intelligent recognition model of the target device is officially put into use, the present invention obtains 1000 network coupling status data sets of the target device during normal operation, and the relevant management personnel confirm that the network coupling status data sets of the target device are normal, that is, the network coupling status data sets of 1000 target devices are used to train the network security anomaly intelligent recognition model of the target device. After the training of the network security anomaly intelligent recognition model of the target device is completed, the network coupling status data set of the target device is obtained again, and the obtained network coupling status data set of the target device is input into the network security anomaly intelligent recognition model of the target device, and then it is determined whether the network security of the target device is abnormal, and an alarm signal about the network security anomaly of the target device is output according to the determination result. If it is necessary to monitor multiple or multiple target devices, the network security anomaly intelligent recognition model of each target device can be trained according to the method proposed by the present invention, which further improves the intelligence and usability of the present invention and greatly expands the application scenario of the present invention.

[0028] It should be noted here that, for example, in the same target device of the same company, if the target device has not been subjected to a network attack, under the condition that the running time of each software is known, there is a certain coupling relationship and dynamic balance relationship between the name of each software currently running in the target device and the system log of the target device, the average network upstream speed of the target device, the average network downstream speed of the target device, the data download volume of the target device, and the data upload volume of the target device obtained at preset time intervals. There will not be sudden large fluctuations in, for example, the average network upstream speed of the target device, the average network downstream speed of the target device, the data download volume, the data upload volume, and the number of file access times within a certain time interval. Once this occurs, it proves that at this time, the coupling relationship and the dynamic balance relationship are broken, proving that at this time, the target device may cause a network security attack, that is, the network security anomaly of the target device. Based on this, the present invention designs and trains an intelligent recognition model for network security anomalies of target devices.

[0029] S200, using the collected training data set of the target device to train the network coupling state data set of the target device, using the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimize the model parameters, and complete the network security anomaly intelligent recognition model training of the target device.

[0030] Specifically, the method uses the collected training data set of the target device to train the network coupling state data set of the target device, uses the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimizes the model parameters, and completes the network security anomaly intelligent recognition model training of the target device, including: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the network coupling state data set of the next target device according to the network coupling state data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, and the direction in which the parameter gradient of the network security anomaly intelligent recognition model of the target device decreases fastest is determined; the network security anomaly intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, and the parameters of the network security anomaly intelligent recognition model of the target device are optimized.

[0031] It can be understood that Transformer is a deep learning model based on the self-attention mechanism, which consists of a multi-head attention mechanism and a feedforward neural network. It can process sequence data and capture long-distance dependencies. The Transformer model does not contain traditional convolutional layers, but processes each element in the input sequence through an attention layer. The typical structure of Transformer includes an encoder and a decoder, wherein the encoder is composed of multiple identical layers stacked together, and the decoder adds a self-attention layer on the basis of the encoder to process sequence generation tasks. The present invention uses Transformer to supplement global context information, enhances the model's capabilities in feature extraction and global understanding, greatly improves the performance of the model, and greatly reduces the computational cost.

[0032] Specifically, the preset network layer also includes a ResNet network layer, and the ResNet network layer is used to classify and predict the output results according to the collected network coupling status data set of the target device, and the classification results include network security anomalies of the target device and network security normal of the target device.

[0033] It should be noted here that ResNet is a deep convolutional neural network, which solves the gradient vanishing problem in deep network training by introducing residual connections. The core component of ResNet is the residual block, which usually contains two or three convolutional layers and a jump connection, which allows the gradient to bypass these convolutional layers directly. The network structure of ResNet can be very deep. These networks extract the names of the software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device by stacking multiple residual blocks, and classify and predict the output results through global average pooling and fully connected layers. The classification results include network security anomalies of the target device and network security normality of the target device.

[0034] See also Figure 3 The present invention combines the ResNet network layer and the Transformer network layer. ResNet is good at extracting the names of the software currently running in the target device in the training data set and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the local features of the data upload volume of the target device, while Transformer can supplement the global context information. This combination can enhance the model's capabilities in feature extraction and global understanding, greatly improve the performance of the model, and greatly reduce the computational cost.

[0035] It can be understood that the ResNet network layer is used to classify and predict the output results through the network coupling state data set of the target device collected in the training data set and the verification data set. The specific steps are: (1) First, put the training data set into the Backbones network layer of the model. Backbone refers to a series of convolutional layers that constitute the skeleton of the neural network. The main function of these layers is to extract the features of the input data. The Backbone network is usually composed of multiple convolutional layers, pooling layers, and activation functions. It can extract meaningful feature representations from the original data. Backbones is composed of multiple Backbones, and the core network layer in Backbone is the Resnet network layer. After the data set is input into the model, the network coupling status data set of the target device will be input into Backbones for training; (2) When constructing Backbone, the Resnet network layer and the network coupling status data set encoding are added. The encoding method of the network coupling status data set encoding is to encode the collected network coupling status data set in the order of collection. After the training data set is input, Resnet starts layer-by-layer training to extract features from the network coupling status data set of the target device, and assists Transformer in predicting whether the network security of the target device is abnormal. The extracted features are used with the help of the network coupling status data set encoding to obtain the encoding information of each network coupling status data set, which is used by relevant management personnel to locate abnormal network coupling status data sets when the network security of the target device is abnormal.

[0036] Specifically, the method of using the collected training data set to train the network security anomaly intelligent recognition model of the target device, using the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimizing the model parameters, and completing the network security anomaly intelligent recognition model training of the target device also includes: After each training, the verification data set is input into the preset network layer of the previous training in batches for model parameter verification, and cyclic training is performed, with the total number of training rounds set to the first preset round; the loss value of the preset network layer is recorded, and it is determined whether the loss value meets the first preset condition, and whether to end the training and output the model parameters based on the judgment result.

[0037] Specifically, after each training, the verification data set is input into the preset network layer of the previous training in batches to verify the model parameters, and the cyclic training is performed, including the following methods: When the number of training times is not enough and the model needs to be optimized, the training can only be performed from the beginning. Therefore, the present invention develops a method for continuing the following training based on the previously trained model parameter file; (1) Provide custom parameters, which can be set according to user needs to continue training based on any training parameters; (2) Load the parameters of the custom model file; (3) Put the validation data set into the custom parameter network layer for validation, obtain the loss value and record the model parameters of the model corresponding to the minimum loss value during the training process; (4) Based on this set of model parameters, forward propagation training and back propagation are performed, and the optimizer optimizes the parameters to obtain a new set of data; (5) Put the verification data into the new data network layer for inference to obtain the loss value; (6) Perform cyclic training to obtain the best model and complete model optimization.

[0038] It is understandable that the training method adopted by the present invention is batch training, which means that each time the model parameters are updated, only a part of the samples in the validation data set is used, which is called a batch. The advantages of batch training are that it can reduce memory consumption, speed up training, increase randomness, and facilitate the generalization of the model.

[0039] It should be noted here that, in the present invention, batch_size=4, and the batch_size is the batch size. For example, when batch_size=4, it means that two network coupling state data sets are selected from the verification data set each time and put into the model for verification.

[0040] Specifically, the determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value satisfies the first preset condition, the training is terminated and the parameters of the network security anomaly intelligent recognition model of the current target device are output; if the loss value does not satisfy the first preset condition, the training is continued; The first preset condition is that after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

[0041] It can be understood that the present invention preferably sets the maximum round of cyclic training to 30,000 times, which can effectively ensure the accuracy of the model prediction of the present invention and record the loss value of the model training. The present invention sets the second preset round to 300, that is, when the loss value of the training no longer decreases within 300 rounds of training, the round with the smallest loss value in the 300 rounds of training is saved as the best verification round parameter to generate the best model file. The above setting makes the training rounds no longer rely on manual judgment, but uses the deep learning model for automatic training, which improves the accuracy of the model prediction, and automatically ends the training when the accuracy meets the requirements, which greatly saves the training time, and can also effectively prevent overfitting, which greatly improves the intelligence level of the present invention and the efficiency of model training.

[0042] Furthermore, the specific process of the network security anomaly intelligent recognition model for training the target device of the present invention is as follows: (1) Obtain the latent vector mean mu and logarithmic variance logvar of the target device in the forward propagation process of the network security anomaly intelligent recognition model; (2) Calculate a reasonable loss value representing the training effect: Calculate the divergence: k1=-0.5*(1+logvar-mu^2-(e^logvar)); Calculate the loss between the network coupling state data set and the predicted value in the validation data set: loss=L1+k1*k1_weight; Among them, loss is the loss value, k1 is the divergence, k1_weight is the proportion of k1, the value is 10, L1 is the absolute difference between the predicted value and the true value, and the calculation formula of L1 is as follows: ; Among them, A is the L1 loss in pytorch, which calculates the average or sum of the absolute differences between two tensors; the shape of A is N*C*H*W, which indicates that it is a four-dimensional tensor, N represents the number of samples (Batch Size), indicating that there are N data points, C represents the number of channels (Channels), H and W represent the height and width respectively, which are usually the two-dimensional spatial dimensions of the input features; P represents the padding value, which is a Boolean type, and the shape of P is c*h*w*1. The dimensions of P are the same as those of A in terms of channel, height, and width, but there is no sample number N, which means that P is a mask or padding information for a feature map of each sample, and the Boolean value of P may be used to mark whether the elements in A are filled (True) or valid (False).

[0043] (3) The loss value when using the validation data set to validate the current model network; (4) If the validation loss of this round is less than that of the previous round, the best model parameters are replaced with the training model of this round; (5) Put the rounds and loss values ​​into the dictionary one by one; (6) Compare the loss value of the current round with the loss values ​​of the 300 rounds before this round (parameters are provided and can be set according to actual needs, the default is 300), that is, traverse the loss values ​​from epoch-300 to epoch-1 (epoch is the training round, and comparison is performed when epoch is greater than 300). If the loss values ​​of the current round of epoch are all greater than the loss values ​​from (epoch-300) to (epoch-1), stop training.

[0044] (7) Save the best model parameters in the cyclic validation as a ckpt model file.

[0045] Specifically, the determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value meets the first preset condition, the training is terminated and the parameters of the network security anomaly intelligent recognition model of the current target device are output; if the loss value does not meet the first preset condition, the training continues.

[0046] Specifically, the first preset condition is: after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

[0047] S300. When the model training is completed, the network coupling status data set of the target device is obtained again, and the obtained network coupling status data set of the target device is input into the network security anomaly intelligent recognition model of the target device, so as to determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

[0048] Specifically, the determining whether the network security of the target device is abnormal, and outputting an alarm signal regarding the network security abnormality of the target device according to the determination result, includes: If it is determined that the network security of the target device is abnormal, an alarm signal about the network security abnormality of the target device is output, and coded information of the abnormal network coupling state data set is output, and the network connection permission of the target device is deprived; If it is determined that the network security of the target device is normal, a prompt signal indicating that the network security of the target device is normal is output.

[0049] Specifically, the output includes an alarm signal of network security anomaly of the target device and coded information of abnormal network coupling state data set, and also includes: The collected timestamps, user login history data and user logout history data of the network coupling state data set of each target device are recorded, and the timestamps, user login history data and user logout history data corresponding to the network coupling state data set are outputted while the coded information of the abnormal network coupling state data set is outputted. This further facilitates the relevant management personnel to locate the relevant data of the network abnormality, and further improves the intelligence and usability of the present invention.

[0050] It can be understood that the present invention obtains the names of various software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and then trains the target device's network security anomaly intelligent recognition model to determine whether the target device's network security is abnormal. This realizes intelligent, effective, and timely network security monitoring of the target device before a certain unknown virus is discovered, and corresponding measures are taken in a timely manner. This solves the problem in the prior art that it is difficult to conduct effective and timely network security monitoring before a certain unknown virus is discovered, and greatly improves the reliability and intelligence of network security monitoring.

[0051] See also Figure 2 The present invention provides another embodiment, which provides a network security monitoring system based on computing power, and the network security monitoring system based on computing power includes: The acquisition module 100 is used to acquire the name of each software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at a preset time interval, and record the acquired data as the network coupling state data set of the target device; to collect the network coupling state data set of a first preset number of target devices; and to acquire the network coupling state data set of the target device again after the model training is completed; The control module 200 is used to divide the collected network coupling status data set of the target device into a training data set and a verification data set according to a first preset ratio; to use the collected training data set of the target device to train the network coupling status data set of the target device, and to use the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimize the model parameters, and complete the training of the network security anomaly intelligent recognition model of the target device; and to input the network coupling status data set of the target device acquired again into the network security anomaly intelligent recognition model of the target device after the model training is completed, so as to determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

[0052] It should be noted here that the present invention obtains the names of various software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and then trains the target device's network security anomaly intelligent recognition model to determine whether the target device's network security is abnormal. This realizes intelligent, effective, and timely network security monitoring of the target device before a certain unknown virus is discovered, and takes corresponding measures in a timely manner. This solves the problem in the prior art that it is difficult to conduct effective and timely network security monitoring before a certain unknown virus is discovered, and greatly improves the reliability and intelligence of network security monitoring.

[0053] In a preferred embodiment, the present application further provides an electronic device, the electronic device comprising: A memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the computing power-based network security monitoring method is implemented. The computer device can be broadly a server, a terminal, or any other electronic device with necessary computing and / or processing capabilities. In one embodiment, the computer device may include a processor, a memory, a network interface, a communication interface, etc. connected via a system bus. The processor of the computer device can be used to provide necessary computing, processing and / or control capabilities. The memory of the computer device may include a non-volatile storage medium and an internal memory. An operating system, a computer program, etc. may be stored in or on the non-volatile storage medium. The internal memory may provide an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface and the communication interface of the computer device can be used to connect and communicate with external devices through a network. When the computer program is executed by the processor, the steps of the method of the present invention are performed.

[0054] The present invention may be implemented as a computer-readable storage medium having a computer program stored thereon, which causes the steps of the method of an embodiment of the present invention to be executed when executed by a processor. In one embodiment, the computer program is distributed on a plurality of computer devices or processors coupled to a network so that the computer program is stored, accessed and executed in a distributed manner by one or more computer devices or processors. A single method step / operation, or two or more method steps / operations, may be performed by a single computer device or processor or by two or more computer devices or processors. One or more method steps / operations may be performed by one or more computer devices or processors, and one or more other method steps / operations may be performed by one or more other computer devices or processors. One or more computer devices or processors may perform a single method step / operation, or perform two or more method steps / operations.

[0055] It will be appreciated by a person skilled in the art that the method steps of the present invention may be performed by instructing related hardware such as a computer device or a processor through a computer program, and the computer program may be stored in a non-temporary computer-readable storage medium, which causes the steps of the present invention to be performed when the computer program is executed. Depending on the circumstances, any reference to memory, storage, database, or other media herein may include non-volatile and / or volatile memory. Examples of non-volatile memory include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk, etc. Examples of volatile memory include random access memory (RAM), external cache memory, etc.

[0056] It can be understood that the present invention obtains the names of various software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and then trains the target device's network security anomaly intelligent recognition model to determine whether the target device's network security is abnormal. This realizes intelligent, effective, and timely network security monitoring of the target device before a certain unknown virus is discovered, and corresponding measures are taken in a timely manner. This solves the problem in the prior art that it is difficult to conduct effective and timely network security monitoring before a certain unknown virus is discovered, and greatly improves the reliability and intelligence of network security monitoring.

[0057] The various technical features described above can be combined arbitrarily. Although all possible combinations of these technical features are not described, any combination of these technical features should be considered to be covered by this specification as long as there is no contradiction in such combination.

[0058] The specific implementation of the present invention described above does not constitute a limitation on the protection scope of the present invention. Any other corresponding changes and modifications made based on the technical concept of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A network security monitoring method based on computing power, characterized in that: The method comprises: S100, obtaining the name of each software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and recording the obtained data as a network coupling state data set of the target device; collecting a first preset number of network coupling state data sets of the target devices, and dividing the collected network coupling state data sets of the target devices into a training data set and a verification data set according to a first preset ratio; S200, using the collected training data set of the target device to train the network coupling state data set of the target device, using the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimize the model parameters, and complete the network security anomaly intelligent recognition model training of the target device; S300. When the model training is completed, the network coupling status data set of the target device is obtained again, and the obtained network coupling status data set of the target device is input into the network security anomaly intelligent recognition model of the target device, so as to determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

2. The network security monitoring method based on computing power according to claim 1 is characterized in that: The system log includes: The startup and shutdown time of each software, the average network upload speed of each software, the average network download speed of each software, the data download volume of each software, the data upload volume of each software, and the file names accessed by each software.

3. The network security monitoring method based on computing power according to claim 2 is characterized in that: The method further comprises: According to the startup time and shutdown time of each software, the running time of each software is calculated. According to the file names accessed by each software, the number of files accessed by each software is calculated. The startup time and shutdown time of each software and the number of files accessed by each software are recorded in the network coupling status data set of the target device.

4. The network security monitoring method based on computing power according to claim 1 is characterized in that: The method uses the collected training data set of the target device to train the network coupling state data set of the target device, uses the verification data set to optimize the network security anomaly intelligent recognition model of the target device, optimizes the model parameters, and completes the network security anomaly intelligent recognition model training of the target device, including: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the network coupling state data set of the next target device according to the network coupling state data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, and the direction in which the parameter gradient of the network security anomaly intelligent recognition model of the target device decreases fastest is determined; the network security anomaly intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, and the parameters of the network security anomaly intelligent recognition model of the target device are optimized.

5. The network security monitoring method based on computing power according to claim 3 is characterized in that: The preset network layer also includes a ResNet network layer, which is used to classify and predict the output results according to the collected network coupling status data set of the target device, and the classification results include network security anomalies of the target device and network security normality of the target device.

6. The network security monitoring method based on computing power according to claim 5 is characterized in that: The ResNet network layer is used to classify and predict the output results according to the collected network coupling status data set of the target device, including: When constructing Backbone, the Resnet network layer and network coupling status data set encoding are added. The encoding method of the network coupling status data set encoding is to encode the collected network coupling status data set in the order of collection. Resnet starts layer-by-layer training after the training data set is input. The training extracts the features in the network coupling status data set of the target device, and assists Transformer in predicting whether the network security of the target device is abnormal. The extracted features are used with the help of the network coupling status data set encoding to obtain the encoding information of each network coupling status data set, which is used by relevant managers to locate abnormal network coupling status data sets when the network security of the target device is abnormal.

7. The network security monitoring method based on computing power according to claim 6 is characterized in that: The determining whether the network security of the target device is abnormal and outputting an alarm signal regarding the network security abnormality of the target device according to the determination result includes: If it is determined that the network security of the target device is abnormal, an alarm signal about the network security abnormality of the target device is output, and coded information of the abnormal network coupling state data set is output, and the network connection permission of the target device is deprived; If it is determined that the network security of the target device is normal, a prompt signal indicating that the network security of the target device is normal is output.

8. The network security monitoring method based on computing power according to claim 7 is characterized in that: The output includes an alarm signal of network security anomaly of the target device and coded information of abnormal network coupling state data set, and further includes: Record the timestamp of the collection of the network coupling status data set of each target device, the user's login history data and the user's logout history data, and output the timestamp, user's login history data and user's logout history data corresponding to the network coupling status data set while outputting the encoding information of the abnormal network coupling status data set.

9. A network security monitoring system based on computing power, characterized in that: include: an acquisition module, for acquiring the names of various software currently running in the target device and the system log of the target device, the average network uplink speed of the target device, the average network downlink speed of the target device, the data download volume of the target device, and the data upload volume of the target device at preset time intervals, and recording the acquired data as a network coupling state data set of the target device; and for collecting a first preset number of network coupling state data sets of the target devices; Used to obtain the network coupling status data set of the target device again after the model training is completed; A control module, configured to divide the collected network coupling state data set of the target device into a training data set and a verification data set according to a first preset ratio; It is used to train the network coupling status data set of the target device using the collected training data set of the target device, and to optimize the network security anomaly intelligent recognition model of the target device using the verification data set, optimize the model parameters, and complete the training of the network security anomaly intelligent recognition model of the target device; it is used to input the network coupling status data set of the target device acquired again into the network security anomaly intelligent recognition model of the target device after the model training is completed, and then determine whether the network security of the target device is abnormal, and output an alarm signal about the network security anomaly of the target device according to the determination result.

10. An electronic device, characterized in that: include: Memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the computing power-based network security monitoring method according to any one of claims 1 to 8 is implemented.

Images