Unknown threat detection method, device and computer equipment based on decoupled representation learning

Abstract

The present application relates to the field of log detection technology, and discloses an unknown threat detection method, device and computer equipment based on decoupled representation learning. By learning different attack features, different types of attack samples are generated, which can enrich the diversity of attack data distribution, improve the model's ability to cope with various complex attack scenarios, and alleviate the problem of biased attacks. By introducing multi-instance learning methods and decoupled representation learning, the characteristics of attack data are deeply learned from multiple angles, the model's dependence on known attack features is reduced, and the model's generalization ability in detecting unknown attacks is improved, thereby improving data diversity and coverage; through the multi-instance learning method, effective features are mined and the influence of redundant features is reduced, thereby enhancing the detection accuracy of the model, so that it can still accurately identify attack behaviors when facing highly complex new energy power system log data.

Description

Technical Field

[0001] The present application relates to the field of log detection technology, and in particular to an unknown threat detection method, apparatus and computer equipment based on decoupled representation learning. Background Art

[0002] The new power system is a new era power system that takes ensuring energy and power security as its basic premise, meeting the power demand for high-quality economic and social development as its primary goal, building a high-proportion new energy supply and consumption system as its main task, with multi-directional coordination and flexible interaction among sources, networks, loads and storage as its strong support, with a strong, intelligent and flexible power grid as its hub platform, and technological innovation as well as institutional and mechanism innovation as its basic guarantee.

[0003] With the widespread application of emerging digital technologies such as 5G, artificial intelligence, big data, and blockchain, in addition to the risks of traditional network attacks, new technologies themselves also face the risks of terminal intrusion, user impersonation, and data tampering. The "collective" destruction of remote loads on the Internet by third-party entities represented by load aggregators may cause major network security incidents, affect the security of the power grid and electricity safety, and undermine the stability of the power grid. Therefore, the increasingly severe network security situation requires the security protection strategy of the new power system to shift from traditional passive defense to active protection. Facing unknown network security risks, it is necessary to actively perceive and quickly and effectively identify and discover attack behaviors, enhance defense and deterrence capabilities, and provide active and effective all-round systematic protection. The operating entities of the source, network, and load links of the new power system need to establish intelligent perception means for network security events, predict, prejudge, warn, and pre-control network security events, and realize active perception of network security risks.

[0004] In order to cope with these complex and ever-changing network threats, the new power system needs to further improve the existing security defense architecture and build a flexible and adaptive security protection system to deal with unknown attack behaviors. Traditional passive defense strategies mainly rely on known threat intelligence libraries and rule matching, but they often seem powerless when facing unknown threats. The difficulty in identifying unknown threats is mainly due to the unknown and complexity of attack behaviors. In the field of network security, attackers constantly update and improve their attack methods and techniques to evade detection and defense. These unknown attacks may have two sources. On the one hand, they evolve from existing attack methods and compile and combine existing attack methods; on the other hand, they are new attacks based on new 0day vulnerabilities (zero-day vulnerabilities), new malicious tools, etc. These unknown attacks may use new vulnerability exploits, complex malware, or advanced social engineering methods, making it difficult for security defense measures to identify and prevent them. Summary of the invention

[0005] The present application provides an unknown threat detection method based on decoupled representation learning, aiming to solve the technical problem in the prior art that it is difficult to identify and detect unknown attacks on new power systems with new energy as the main body.

[0006] The present application provides an unknown threat detection method based on decoupled representation learning, including:

[0007] Acquire attack sample data, wherein the attack sample data includes known attack samples and normal data;

[0008] Based on the principle of data enhancement, pseudo attack samples are generated according to known attack samples;

[0009] Vectorize the known attack samples, normal data, and pseudo-attack samples respectively to obtain known attack feature vectors, normal feature vectors, and pseudo-attack vectors;

[0010] Obtain the attack vector in the knowledge graph, and generate a potential residual attack vector based on the attack vector and the normal feature vector;

[0011] The known attack feature vector is input into the known attack learning head through the convolutional neural network for learning to obtain the known attack score;

[0012] The pseudo attack vector is input into the pseudo attack learning head through the convolutional neural network for learning to obtain the pseudo attack score;

[0013] The latent residual attack vector is input into the latent residual learning head through the convolutional neural network for learning to obtain the latent residual score;

[0014] The normal feature vector is input into the normal learning head through the convolutional neural network for learning to obtain the normal score;

[0015] Obtain vector samples, and input the vector samples into the known attack learning head, pseudo attack learning head, potential residual learning head and normal learning head through the convolutional neural network respectively, and sum the generated known attack scores, pseudo attack scores and potential residual scores, subtract the normal scores, and obtain the abnormal scores;

[0016] Determine the attack category of the vector sample based on the anomaly score.

[0017] In one embodiment, the step of generating a pseudo attack sample based on a known attack sample based on the data enhancement principle includes:

[0018] Obtain known attack samples and map them to the attack phases in the ATT&CK framework, where the attack phases include reconnaissance and identification phase, initial access phase, execution phase, privilege escalation phase, lateral movement phase, collection phase, and command and control phase;

[0019] Based on the principle of data enhancement, the known attack samples in each attack stage are deformed and replaced to obtain pseudo attack samples.

[0020] In one embodiment, the step of obtaining an attack vector in the knowledge graph and generating a potential residual attack vector based on the attack vector and a normal feature vector includes:

[0021] Extract malicious data based on malicious sequences in the knowledge graph;

[0022] Select attack vectors representing attack characteristics based on malicious data;

[0023] Based on the WGAN-GP model, the attack vector is fused into the normal feature vector to obtain the first false vector;

[0024] The BiLSTM model is used as a discriminator to distinguish false vectors and normal feature vectors to determine the fusion effect of the WGAN-GP model;

[0025] Iteratively training the WGAN-GP model and the BiLSTM model alternately, and adjusting the parameters of the WGAN-GP model to an optimal state;

[0026] A second false vector is generated based on the BiLSTM model in the optimal state, and the second false vector is used as a potential residual attack vector.

[0027] In one embodiment, the step of inputting the known attack feature vector into the known attack learning head through the convolution neural network for learning to obtain the known attack score includes:

[0028] The known attack score is input into the known attack learning head through the convolutional neural network for learning, where the function expression of the known attack learning head is:

[0029]

[0030] Among them, g s (M X1 θ s ) represents the output value of the known attack learning head, d i represents the i-th known attack feature vector, M X1 represents the known attack feature vector numbered x1, D represents the set of known attack feature vectors, θ s Represents the parameters of the known attack learning head, Indicates M X1 The set of K vectors with the largest anomaly scores among all known attack feature vectors;

[0031] The known attack score is calculated based on the output value of the known attack learning head, where the calculation formula is:

[0032] l s (X1,y X1 )=l(g s (M X1 θ s ),y X1 );

[0033] Among them, l s (X1,y X1) represents the known attack score corresponding to the loss function of the known attack learning head numbered x1, where x1 represents the known attack feature vector input through the convolutional neural network, and y X1 Represents the number corresponding to the known attack feature vector input through the convolutional neural network. If X is a known attack, then y X is 1, if X is a normal sample, then y X is 0.

[0034] In one embodiment, in the step of inputting the pseudo attack vector into the pseudo attack learning head through the convolution neural network for learning to obtain the pseudo attack score, the function expression of the pseudo attack learning head is:

[0035] l P (X2,y X2 )=l(g p (M X2 θ p ),y X2 );

[0036] Among them, l P (X2,y X2) represents the pseudo-attack score corresponding to the pseudo-attack learning head loss function numbered x2, X2 represents the set of pseudo-attack vectors, y X2 Indicates the number corresponding to the pseudo attack vector input through the convolutional neural network, g p (M X2 θ p ) represents the output of the pseudo-attack learning head, M X2 represents the pseudo attack feature vector numbered x2, θ p represents the parameters of the pseudo-attack learning head. If X2 is a pseudo-attack, then y X2 is 1, if X2 is a normal sample, then y X 2 is 0.

[0037] In one embodiment, in the step of inputting the potential residual attack vector into the potential residual learning head through the convolutional neural network for learning to obtain the potential residual score, the function expression of the potential residual learning head is:

[0038] l r (X3,y X3 )=l(g r (M rθX3 θ r ),y X3 );

[0039] Among them, M rθX3 =M r θM X 3;

[0040] Among them, l r (X3,y X3) represents the potential residual score corresponding to the loss function of the latent residual learning head numbered x3, X3 represents the set of latent residual vectors, y X3 Represents the number corresponding to the potential residual vector input through the convolutional neural network, M rθX3 represents the reference feature, θ r represents the latent residual learning head; M r represents the characteristics of the residual vector, θ represents element-by-element subtraction, and M X 3 represents the pseudo-attack feature vector numbered x3; if x3 is a known attack or pseudo-attack, then y X2 is 1, if X3 is a normal sample, then y X 3 is 0.

[0041] In one embodiment, in the step of inputting the normal feature vector into the normal learning head through the convolution neural network for learning to obtain the normal score, the function expression of the normal learning head is:

[0042]

[0043] Among them, l n (X4,y X4) represents the normal score corresponding to the loss function of the potential normal learning head numbered x4, X4 represents the set of normal feature vectors, y X4 Indicates the number corresponding to the normal feature vector input through the convolutional neural network, d i represents the jth normal eigenvector, θ n represents the parameters of the normal learning head, and h′×w′ represents the dimension of the normal feature vector.

[0044] The present application also provides an unknown threat detection device based on decoupled representation learning, comprising:

[0045] A first acquisition module, used to acquire attack sample data, wherein the attack sample data includes known attack samples and normal data;

[0046] A generation module is used to generate pseudo attack samples based on known attack samples based on the data enhancement principle;

[0047] A vectorization module is used to vectorize known attack samples, normal data, and pseudo-attack samples to obtain known attack feature vectors, normal feature vectors, and pseudo-attack vectors;

[0048] The second acquisition module is used to obtain the attack vector in the knowledge graph and generate a potential residual attack vector based on the attack vector and the normal feature vector;

[0049] A known attack module, which is used to input the known attack feature vector into the known attack learning head through a convolutional neural network for learning to obtain a known attack score;

[0050] A pseudo-attack module, which is used to input the pseudo-attack vector into the pseudo-attack learning head through a convolutional neural network for learning to obtain a pseudo-attack score;

[0051] The latent residual module is used to input the latent residual attack vector into the latent residual learning head through the convolutional neural network for learning to obtain the latent residual score;

[0052] The normal module is used to input the normal feature vector into the normal learning head through the convolutional neural network for learning to obtain a normal score;

[0053] A training module is used to obtain vector samples, and input the vector samples into the known attack learning head, pseudo attack learning head, potential residual learning head and normal learning head through the convolutional neural network respectively, and sum the generated known attack scores, pseudo attack scores and potential residual scores, subtract the normal scores, and obtain the abnormal scores;

[0054] The determination module is used to determine the attack category of the vector sample according to the anomaly score.

[0055] The present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0056] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0057] The beneficial effects of the present application are as follows: by learning different attack features and combining data enhancement technology and generative adversarial network (GAN) methods, different types of attack samples are generated, and the attack samples include known attack samples, normal data, pseudo-attack samples and potential residual attacks, so as to enrich the diversity of attack data distribution, enhance the model's ability to cope with various complex attack scenarios, and alleviate the problem of biased attacks. By introducing multi-instance learning methods and decoupled representation learning, the characteristics of attack data are deeply learned from multiple angles, the model's dependence on known attack features is reduced, and the model's generalization ability in detecting unknown attacks is improved, thereby improving data diversity and coverage; through multi-instance learning methods, effective features are mined and the influence of redundant features is reduced, thereby enhancing the detection accuracy of the model, so that it can still accurately identify attack behaviors when facing highly complex new energy power system log data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 The figure is a schematic diagram of a method flow of an embodiment of the present application.

[0059] Figure 2 This is a schematic diagram of the method structure of an embodiment of the present application.

[0060] Figure 3 Schematic diagram of a feature learning process according to an embodiment of the present application.

[0061] Figure 4 Schematic diagram of the device structure of an embodiment of the present application.

[0062] Figure 5 A schematic diagram of the internal structure of a computer device according to an embodiment of the present application.

[0063] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] like Figure 1-5 As shown, the present application provides an unknown threat detection method based on decoupled representation learning, including:

[0066] S1. Acquire attack sample data, where the attack sample data includes known attack samples and normal data;

[0067] S2, based on the principle of data enhancement, generate pseudo attack samples according to known attack samples;

[0068] S3, respectively vectorize the known attack samples, normal data, and pseudo-attack samples to obtain a known attack feature vector, a normal feature vector, and a pseudo-attack vector;

[0069] S4, obtaining the attack vector in the knowledge graph, and generating a potential residual attack vector based on the attack vector and the normal feature vector;

[0070] S5, inputting the known attack feature vector into the known attack learning head through the convolution neural network for learning, and obtaining the known attack score;

[0071] S6, inputting the pseudo attack vector into the pseudo attack learning head through the convolution neural network for learning to obtain a pseudo attack score;

[0072] S7, inputting the potential residual attack vector into the potential residual learning head through the convolutional neural network for learning to obtain a potential residual score;

[0073] S8, inputting the normal feature vector into the normal learning head through the convolution neural network for learning to obtain a normal score;

[0074] S9, obtaining vector samples, and respectively inputting the vector samples into the known attack learning head, the pseudo attack learning head, the potential residual learning head, and the normal learning head through the convolution neural network, and summing the generated known attack scores, pseudo attack scores, and potential residual scores, and subtracting the normal scores to obtain the abnormal scores;

[0075] S10. Determine the attack category of the vector sample according to the anomaly score.

[0076] As described in the above steps S1-S10, the present application is aimed at the unknown attack detection problem faced by the new power system with new energy as the main body under the background of high proportion of power electronic equipment access and supply and demand volatility, and proposes an unknown attack detection method based on decoupled representation learning, LogDEL (Log Decoupling Express learning), which can improve the detection capability and adaptability of the new power system to unknown attacks. By learning different attack features and combining data enhancement technology and generative adversarial network (GAN) methods, different types of attack samples are generated. The attack samples include known attack samples, normal data, pseudo-attack samples and potential residual attacks. This can enrich the diversity of attack data distribution, improve the model's ability to cope with various complex attack scenarios, and alleviate the problem of biased attacks. By introducing multi-instance learning methods and decoupled representation learning, the characteristics of attack data are deeply learned from multiple angles, reducing the model's dependence on known attack features and improving the model's generalization ability in detecting unknown attacks, thereby improving data diversity and coverage; through multi-instance learning methods, effective features are mined and the impact of redundant features is reduced, thereby enhancing the detection accuracy of the model, so that it can still accurately identify attack behaviors when facing highly complex new energy power system log data.

[0077] In one embodiment, the step S2 of generating a pseudo attack sample based on a known attack sample based on the data enhancement principle includes:

[0078] S21. Obtain known attack samples and map them to the attack stages in the ATT&CK framework, where the attack stages include reconnaissance and identification stage, initial access stage, execution stage, privilege escalation stage, lateral movement stage, collection stage, and command and control stage.

[0079] S22. Based on the data enhancement principle, the known attack samples in each attack stage are deformed and replaced to obtain pseudo attack samples.

[0080] As described in the above steps S21 and S22, since unknown attacks in the real world are becoming more and more hidden, there are only slight differences from normal samples. Unknown attacks include two categories: the first category, which is derived from the attack means of known attacks; the second category, which is very different from the known attacks in form, but has deep universal attack features. This embodiment generates pseudo-attacks (i.e., unknown attacks that are derived from the attack means of known attacks) through a data enhancement method, aiming to cross-integrate the features of known attack samples and generate unknown attack samples. Specifically, this application is based on MITRE ATT&CK (MITRE Adversarial Tactics Techniques and Common Knowledge, Intruder Tactics, Techniques and Common Knowledge Base), which is a comprehensive knowledge base of tactics, techniques and procedures (TTPs) used by adversaries in network attacks. This framework covers various attack methods used by attackers from the initial system intrusion to achieving their goals. MITRE ATT&CK divides the attack matrix into enterprise matrix, mobile matrix and ICS (International Control System) matrix according to the different platforms used, and divides the technology into more than ten tactics. However, the division of these tactics lacks a certain order, and it is impossible to defend in time when the technology of a certain stage is discovered, and it is difficult to use it for APT attacks that occur in reality. Therefore, it is necessary to divide the technology in MITRE ATT&CK and assign it to each stage of the attack so that defensive measures can be taken at the corresponding stage. By analyzing known attack samples and mapping the known attack samples with the attack stages in the MITRE ATT&CK framework, known attacks can be replaced and generated in the same attack stage. This process uses the mutual replacement of the same attack stage to obtain pseudo-attack samples. Specifically, when an attacker implements a specific technology at a certain stage, the technology is deformed through data enhancement methods based on known attack strategies and procedures, thereby forming a pseudo-attack. The pseudo-attack samples generated in this way can reflect the changes in attack behavior in different environments and improve the ability of the monitoring system to respond to unknown attacks.

[0081] In one embodiment, the step of obtaining an attack vector in the knowledge graph and generating a potential residual attack vector based on the attack vector and a normal feature vector includes:

[0082] S41, extracting malicious data according to malicious sequences in the knowledge graph;

[0083] S42, selecting an attack vector representing attack characteristics according to the malicious data;

[0084] S43, based on the WGAN-GP model, the attack vector is integrated into the normal feature vector to obtain a first false vector;

[0085] S44, using the BiLSTM model as a discriminator to discriminate false vectors and normal feature vectors to determine the fusion effect of the WGAN-GP model;

[0086] S45, alternately iteratively training the WGAN-GP model and the BiLSTM model, and adjusting the parameters of the WGAN-GP model to an optimal state;

[0087] S46. Generate a second false vector based on the BiLSTM model in the optimal state, and use the second false vector as a potential residual attack vector.

[0088] As described in the above steps S41-S46, since the second type of unknown attack and the known have common abnormal features, but they are very different in form, and there is only a small difference from the normal sample. Based on this, the present application generates concealed attack data in accordance with the real environment by using the WGAN-GP (Wasserstein GAN with Gradient Penalty) generative adversarial network model. First, the attack features are extracted from the known attack sequence. These attack features represent the main properties of the attack and are used as a reference for the concealed attack in the subsequent generation process. Secondly, the normal sequence features are generated using the generative model of the WGAN-GP structure. These normal sequence features reflect the normal behavior in the real environment. Then, the attack features are fused to the normal sequence features to obtain false samples. These fused samples are very similar to normal samples in form, but contain hidden attack features. Then, BiLSTM is used as a discriminator to discriminate the generated false samples and normal samples to enhance the ability of the generator to generate concealed samples. Finally, by alternately iteratively training the generative model and the discriminative model, the parameters of WGAN-GP are updated to the optimal state to minimize the error, and the trained WGAN-GP is used to generate potential residual attack vectors. Specifically, first, malicious sequences in the knowledge graph are extracted to obtain malicious data, and attack vectors representing attack features are selected from them. Secondly, the normal feature vectors generated by the generative model of the WGAN-GP structure are used to fuse (concatenate) the attack vectors and the normal feature vectors, and the BiLSTM model is used as a discriminator to discriminate the generation effect of the generator. Finally, WGAN-GP and the discriminative model are alternately iteratively trained, and the parameters of WGAN-GP are updated to the optimal state.

[0089] In one embodiment, the step S5 of inputting the known attack feature vector into the known attack learning head through the convolution neural network for learning to obtain the known attack score includes:

[0090] S51, inputting the known attack score into the known attack learning head through the convolution neural network for learning, wherein the function expression of the known attack learning head is:

[0091]

[0092] Among them, g s (M X1 θ s ) represents the output value of the known attack learning head, d i represents the i-th known attack feature vector, M X1 represents the known attack feature vector numbered x1, D represents the set of known attack feature vectors, θ s Represents the parameters of the known attack learning head, Indicates M X1 The set of K vectors with the largest anomaly scores among all known attack feature vectors;

[0093] S52. Calculate the known attack score according to the output value of the known attack learning head, where the calculation formula is:

[0094] l s (X1,y X1 )=l(g s (M X1 θ s ),y X1 );

[0095] Among them, l s (X1,y X1) represents the known attack score corresponding to the loss function of the known attack learning head numbered x1, where x1 represents the known attack feature vector input through the convolutional neural network, and y X1 Represents the number corresponding to the known attack feature vector input through the convolutional neural network. If X is a known attack, then y X is 1, if X is a normal sample, then y X is 0.

[0096] As described in the above steps S51 and S52, unknown attacks can be detected through known attacks. Since unknown attacks in the prior art are becoming more and more hidden, they share most common features with normal log sequences, with only some minor differences. Block-by-block anomaly learning can learn the anomaly score of each small sequence block. Based on this, this embodiment uses a method based on top-K multiple instance learning (MIL, Multiple Instance Learning) (such as Figure 3 ) to effectively learn attack representations. Specifically, Figure 2 As shown, the leftmost side shows multiple features M of the input sequence X X1, that is, the input sequence X is a known attack feature vector, and the operation-by-operation vector is generated based on the input sequence X through the convolutional neural network (CNN). The operation-by-operation vector can be expressed as Where D represents the collection of known attack feature vectors, d i represents the i-th known attack feature vector, h and w are the dimensions of the feature vector (the actual representation of the feature), and then the head g is learned through the known attack s Map these representations to learn the attack score of the input sequence. Since only the selective representation contains the attack features, top-K multi-instance learning is used for optimization. The input sequence is scored according to the K most abnormal features to obtain a known attack score. In addition, this embodiment uses a loss function called deviation loss to implement the loss function in all learning heads, which can have more stable and effective performance than other loss functions (such as cross entropy loss or focal loss). In addition, as Figure 2 In the above, the input sequence X can also be a pseudo-attack feature vector, a potential residual feature vector and a normal feature vector, all of which are generated by a convolutional neural network (CNN) to generate an operation-by-operation vector, and finally output a score L respectively through a known attack learning head, a pseudo-attack learning head, a potential residual learning head and a normal learning head.

[0097] In one embodiment, in the step S6 of inputting the pseudo attack vector into the pseudo attack learning head through the convolution neural network for learning to obtain the pseudo attack score, the function expression of the pseudo attack learning head is:

[0098] l P (X2,y X2 )=l(g p (M X2 θ p ),y X2 );

[0099] Among them, l P (X2,y X2) represents the pseudo-attack score corresponding to the pseudo-attack learning head loss function numbered x2, X2 represents the set of pseudo-attack vectors, y X2 Indicates the number corresponding to the pseudo attack vector input through the convolutional neural network, g p (M X2 θ p ) represents the output of the pseudo-attack learning head, M X2 represents the pseudo attack feature vector numbered x2, θ p represents the parameters of the pseudo-attack learning head. If X2 is a pseudo-attack, then y X2 is 1, if X2 is a normal sample, then y X 2 is 0.

[0100] As described above, the output of the pseudo-attack learning head is consistent with the output expression of the known attack learning head, which will not be elaborated here. However, this embodiment uses a separate head to learn pseudo-attacks that are different from known attacks, so that their parameters are not shared and optimized independently.

[0101] In one embodiment, in the step S7 of inputting the potential residual attack vector into the potential residual learning head through the convolution neural network for learning to obtain the potential residual score, the function expression of the potential residual learning head is:

[0102] l r (X3,y X3 )=l(g r (M rθX3 θ r ),y X3 );

[0103] Among them, M rθX3 =M r θM X 3;

[0104] Among them, l r (X3,y X3) represents the potential residual score corresponding to the loss function of the latent residual learning head numbered x3, X3 represents the set of latent residual vectors, y X3 Represents the number corresponding to the potential residual vector input through the convolutional neural network, M rθX3 represents the reference feature, θ r represents the latent residual learning head; M r represents the characteristics of the residual vector, θ represents element-by-element subtraction, and M X 3 represents the pseudo-attack feature vector numbered x3; if x3 is a known attack or pseudo-attack, then y X2 is 1, if X3 is a normal sample, then y X 3 is 0.

[0105] As described above, since there are differences between the latent residual attack features and normal data, the present embodiment utilizes the differences between the attack features and the normal feature representations to learn such distinguishable composite features. Specifically, the present application proposes latent residual abnormal learning, which learns the abnormality score of the latent residual attack based on the comparison of the feature residuals of the latent residual vector with the features of some reference features (normal samples) in the learned feature space. In order to obtain the latent feature residuals, the present invention first uses a portion of the sequence features randomly extracted from the set of latent residual vectors as reference data, and calculates the average value of their features to obtain the reference features, i.e.

[0106] M rθX3 =M r θM X3;

[0107] where θ represents element-wise subtraction. These residual features are then used for anomaly classification:

[0108] l r (X3,y X3 )=l(g r (M rθX3 θ r ),y X3 );

[0109] Similarly, the output g of the latent residual learning head r Learn headers with known attacks s The output expression of is the same as that of . However, the difference is that the latent residual learning head uses different training inputs (i.e., residual features M) in a separate head. rθX3 ) with parameter θ r For training.

[0110] In one embodiment, in the step S8 of inputting the normal feature vector into the normal learning head through the convolution neural network for learning to obtain the normal score, the function expression of the normal learning head is:

[0111]

[0112] Among them, l n (X4,y X4) represents the normal score corresponding to the loss function of the potential normal learning head numbered x4, X4 represents the set of normal feature vectors, y X4 Indicates the number corresponding to the normal feature vector input through the convolutional neural network, d i represents the jth normal eigenvector, θ n represents the parameters of the normal learning head, and h′×w′ represents the dimension of the normal feature vector.

[0113] As mentioned above, since the known attack learning head g s , pseudo attack learning head g p , latent residual learning head g r Focusing on learning abnormal representations, the jointly learned features cannot model normal features well. To solve this problem, this embodiment adds a separate normal learning head g n , normal learning head n is a fully connected binary anomaly classifier that can distinguish normal samples from known attacks and pseudo attacks. Unlike attack features, which are usually fine-grained local features, normal features are holistic global features. Therefore, the normal learning head g n Unlike other heads, which use a top-K multi-instance learning based approach, it learns an overall normal score.

[0114] After all the above steps are completed, training and inference begin. During the training process, the feature mapping network f consists of all four heads g s , g p , g r and g n The four heads are independent of each other, so their parameters are not shared and optimized independently. During inference, given an input sequence, the anomaly learning head (g s , g p , g r ) and subtract the normal learning head g n The score is calculated to obtain its anomaly score. The category to which it belongs is determined based on the anomaly score. For example, when the anomaly score is less than 0.5, it is a normal feature, between 0.5-1.5, it is a known attack, between 1.5-2, it is a pseudo attack, and greater than 2, it is an attack with potential residual anomalies.

[0115] The present application also provides an unknown threat detection device based on decoupled representation learning, comprising:

[0116] A first acquisition module 1 is used to acquire attack sample data, wherein the attack sample data includes known attack samples and normal data;

[0117] Generating module 2, used to generate pseudo attack samples according to known attack samples based on the data enhancement principle;

[0118] Vectorization module 3, used for vectorizing known attack samples, normal data, and pseudo-attack samples to obtain known attack feature vectors, normal feature vectors, and pseudo-attack vectors;

[0119] The second acquisition module 4 is used to acquire the attack vector in the knowledge graph and generate a potential residual attack vector based on the attack vector and the normal feature vector;

[0120] A known attack module 5, used for inputting the known attack feature vector into the known attack learning head through a convolutional neural network for learning to obtain a known attack score;

[0121] A pseudo attack module 6, used for inputting the pseudo attack vector into the pseudo attack learning head through a convolutional neural network for learning to obtain a pseudo attack score;

[0122] A latent residual module 7 is used to input the latent residual attack vector into the latent residual learning head through a convolutional neural network for learning to obtain a latent residual score;

[0123] A normal module 8, used for inputting the normal feature vector into the normal learning head through the convolution neural network for learning to obtain a normal score;

[0124] The training module 9 is used to obtain vector samples, and respectively input the vector samples into the known attack learning head, the pseudo attack learning head, the potential residual learning head and the normal learning head through the convolution neural network, and sum the generated known attack scores, pseudo attack scores and potential residual scores, and subtract the normal scores to obtain the abnormal scores;

[0125] The determination module 10 is used to determine the attack category of the vector sample according to the anomaly score.

[0126] It should be noted that each module and unit in the unknown threat detection device based on decoupled representation learning corresponds one-to-one to the steps in the unknown threat detection method based on decoupled representation learning.

[0127] like Figure 5 As shown, the present application also provides a computer device, which may be a server, and its internal structure may be as shown in Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all data required for the process of the unknown threat detection method based on decoupled representation learning. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the unknown threat detection method based on decoupled representation learning is implemented.

[0128] Those skilled in the art will understand that Figure 5 The structure shown in is merely a block diagram of a portion of the structure related to the present application solution and does not constitute a limitation on the computer device to which the present application solution is applied.

[0129] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, any one of the above-mentioned unknown threat detection methods based on decoupled representation learning is implemented.

[0130] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0131] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0132] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for detecting unknown threats based on decoupled representation learning, characterized in that: include: Acquire attack sample data, wherein the attack sample data includes known attack samples and normal data; Based on the principle of data enhancement, pseudo attack samples are generated according to known attack samples; Vectorize the known attack samples, normal data, and pseudo-attack samples respectively to obtain known attack feature vectors, normal feature vectors, and pseudo-attack vectors; Obtain the attack vector in the knowledge graph, and generate a potential residual attack vector based on the attack vector and the normal feature vector; The known attack feature vector is input into the known attack learning head through the convolutional neural network for learning to obtain the known attack score; The pseudo attack vector is input into the pseudo attack learning head through the convolutional neural network for learning to obtain the pseudo attack score; The latent residual attack vector is input into the latent residual learning head through the convolutional neural network for learning to obtain the latent residual score; The normal feature vector is input into the normal learning head through the convolutional neural network for learning to obtain the normal score; Obtain vector samples, and input the vector samples into the known attack learning head, pseudo attack learning head, potential residual learning head and normal learning head through the convolutional neural network respectively, and sum the generated known attack scores, pseudo attack scores and potential residual scores, subtract the normal scores, and obtain the abnormal scores; Determine the attack category of the vector sample based on the anomaly score.

2. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: The step of generating a pseudo attack sample based on a known attack sample based on the data enhancement principle includes: Obtain known attack samples and map them to the attack phases in the ATT&CK framework, where the attack phases include reconnaissance and identification phase, initial access phase, execution phase, privilege escalation phase, lateral movement phase, collection phase, and command and control phase; Based on the principle of data enhancement, the known attack samples in each attack stage are deformed and replaced to obtain pseudo attack samples.

3. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: The step of obtaining the attack vector in the knowledge graph and generating a potential residual attack vector based on the attack vector and the normal feature vector includes: Extract malicious data based on malicious sequences in the knowledge graph; Select attack vectors representing attack characteristics based on malicious data; Based on the WGAN-GP model, the attack vector is fused into the normal feature vector to obtain the first false vector; The BiLSTM model is used as a discriminator to distinguish false vectors and normal feature vectors to determine the fusion effect of the WGAN-GP model; Iteratively training the WGAN-GP model and the BiLSTM model alternately, and adjusting the parameters of the WGAN-GP model to an optimal state; A second false vector is generated based on the BiLSTM model in the optimal state, and the second false vector is used as a potential residual attack vector.

4. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: The step of inputting the known attack feature vector into the known attack learning head through the convolution neural network for learning to obtain the known attack score includes: The known attack score is input into the known attack learning head through the convolutional neural network for learning, where the function expression of the known attack learning head is: Among them, g s (M X1 θ s ) represents the output value of the known attack learning head, d i represents the i-th known attack feature vector, M X1 represents the known attack feature vector numbered x1, D represents the set of known attack feature vectors, θ s Represents the parameters of the known attack learning head, Indicates M X1 The set of K vectors with the largest anomaly scores among all known attack feature vectors; The known attack score is calculated based on the output value of the known attack learning head, where the calculation formula is: L s (X1,y X1 )=l(g s (M X1 ;θ s ),y X1 ); Among them, l s (X1,y X1) represents the known attack score corresponding to the loss function of the known attack learning head numbered x1, where x1 represents the known attack feature vector input through the convolutional neural network, and y X1 Represents the number corresponding to the known attack feature vector input through the convolutional neural network. If X is a known attack, then y X is 1, if X is a normal sample, then y X is 0.

5. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: In the step of inputting the pseudo attack vector into the pseudo attack learning head through the convolution neural network for learning to obtain the pseudo attack score, the function expression of the pseudo attack learning head is: l P (X2,y X2 )=l(g p (M X2 ;θ p ),y X2 ); Among them, l P (X2,y X2 ) represents the pseudo-attack score corresponding to the pseudo-attack learning head loss function numbered x2, X2 represents the set of pseudo-attack vectors, y X2 Indicates the number corresponding to the pseudo attack vector input through the convolutional neural network, g p (M X2 θ p ) represents the output of the pseudo-attack learning head, M X2 represents the pseudo attack feature vector numbered x2, θ p Represents the parameters of the pseudo-attack learning head. If X2 is a pseudo-attack, then y X2 is 1, if X2 is a normal sample, then y X 2 is 0.

6. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: In the step of inputting the potential residual attack vector into the potential residual learning head through the convolution neural network for learning to obtain the potential residual score, the function expression of the potential residual learning head is: l r (X3,y X3 )=l(g r (M rθX3 ;θ r ),y X3 ); Among them, M rθX3 =M r θM X 3; Among them, lr(X3,y X3 ) represents the potential residual score corresponding to the loss function of the latent residual learning head numbered x3, X3 represents the set of latent residual vectors, y X3 Represents the number corresponding to the potential residual vector input through the convolutional neural network, M rθX3 represents the reference feature, θ r represents the latent residual learning head; M r represents the characteristics of the residual vector, θ represents element-by-element subtraction, and M X 3 represents the pseudo-attack feature vector numbered x3; if x3 is a known attack or pseudo-attack, then y X2 is 1, if X3 is a normal sample, then y X 3 is 0.

7. The unknown threat detection method based on decoupled representation learning according to claim 1 is characterized in that: In the step of inputting the normal feature vector into the normal learning head through the convolution neural network for learning to obtain the normal score, the function expression of the normal learning head is: Among them, l n (X4,y X4 ) represents the normal score corresponding to the loss function of the potential normal learning head numbered x4, X4 represents the set of normal feature vectors, y X4 Indicates the number corresponding to the normal feature vector input through the convolutional neural network, d i represents the jth normal eigenvector, θ n represents the parameters of the normal learning head, and h′×w′ represents the dimension of the normal feature vector.

8. An unknown threat detection device based on decoupled representation learning, characterized in that: include: A first acquisition module, used to acquire attack sample data, wherein the attack sample data includes known attack samples and normal data; A generation module is used to generate pseudo attack samples based on known attack samples based on the data enhancement principle; A vectorization module is used to vectorize known attack samples, normal data, and pseudo-attack samples to obtain known attack feature vectors, normal feature vectors, and pseudo-attack vectors; The second acquisition module is used to obtain the attack vector in the knowledge graph and generate a potential residual attack vector based on the attack vector and the normal feature vector; A known attack module, which is used to input the known attack feature vector into the known attack learning head through a convolutional neural network for learning to obtain a known attack score; A pseudo-attack module, which is used to input the pseudo-attack vector into the pseudo-attack learning head through a convolutional neural network for learning to obtain a pseudo-attack score; The latent residual module is used to input the latent residual attack vector into the latent residual learning head through the convolutional neural network for learning to obtain the latent residual score; The normal module is used to input the normal feature vector into the normal learning head through the convolutional neural network for learning to obtain a normal score; A training module is used to obtain vector samples, and input the vector samples into the known attack learning head, pseudo attack learning head, potential residual learning head and normal learning head through the convolutional neural network respectively, and sum the generated known attack scores, pseudo attack scores and potential residual scores, subtract the normal scores, and obtain the abnormal scores; The determination module is used to determine the attack category of the vector sample according to the anomaly score.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images