Network attack detection model optimization method and device, equipment and storage medium

Abstract

The invention relates to the technical field of network security, and particularly provides a network attack detection model optimization method and device, equipment and a storage medium, and the method comprises the steps: obtaining industry original data; preprocessing the original data to obtain original attack link data; performing binary tree structured processing on the original attack link data to obtain an original attack link knowledge tree; calculating the attack success probability of each original attack link in the original attack link knowledge tree through a Bass algorithm; judging whether the attack success probability of each original attack link is greater than a probability threshold; if yes, matching the original attack link with a target attack link in the target attack link knowledge tree to update the target attack link knowledge tree; and obtaining a linear knowledge body based on the updated target attack link knowledge tree. According to the method provided by the invention, the network attack behavior can be quickly and accurately found, and the accuracy of network attack detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and specifically provides an optimization method, device, equipment and storage medium for a network attack detection model. Background Art

[0002] With the continuous development and progress of informatization, the means of network attacks have become more and more intense, and they are characterized by being more numerous, faster, more variable, and more invisible. Various types of advanced persistent threats have also emerged in an endless stream. Effectively identifying and grasping the full picture of complex network attacks has always been an urgent desire and strategic need of the industry. Traditionally, security analysts usually use heuristic methods to improve their attack detection models based on a small set of network attack data, that is, using a heuristic method based on the naive Bayesian classification algorithm to analyze a limited number of characteristic values, that is, attack steps, and use the Bayesian formula to calculate the probability of attack success or failure based on the attack steps, and then determine whether the corresponding attack link belongs to the attacker's attack step.

[0003] However, at this stage, many industries, especially security departments, do not have enough attack step link data, so the optimization of attack models can only be based on limited attack step links. Heuristic analysis based on limited network attack data will result in the heuristic method being unable to obtain higher attack success or failure judgment accuracy, and may even result in the accuracy of the attack success or failure judgment results being too low. Moreover, the existing network attack detection model has weak early warning capabilities for unknown attack step links, and can usually only apply heuristic methods for a certain known attack, but cannot use different heuristic methods for different types of known attacks.

[0004] In addition, because of the use of the prior hypothesis method, that is, the prior naive Bayesian assumption, in the actual attack detection process, there is a high redundancy between the feature sets; therefore, the heuristic method may form an incorrect detection result for a certain unknown classification, that is, for small-scale data, under the premise of limited prior knowledge, it is impossible to generalize and form an accurate attack model based on the limited attack step data; in addition, in large-scale data, that is, when there are many unknown data in the attack step link, since the heuristic method needs to frequently call the learning optimization attack model, the heuristic method requires a large amount of calculation and has a high time complexity. Summary of the invention

[0005] The present invention provides a method, device, equipment and storage medium for optimizing a network attack detection model, so as to solve the defects of the prior art that network attack detection is time-consuming and has low accuracy, and to improve the speed and accuracy of network attack detection.

[0006] In a first aspect, the present invention provides a method for optimizing a network attack detection model, comprising:

[0007] Obtaining original data of an industry;

[0008] Preprocessing the original data to obtain original attack link data;

[0009] The original attack link data is processed into a binary tree structure to obtain an original attack link knowledge tree;

[0010] Calculate the probability of successful attack of each original attack link in the original attack link knowledge tree by using the YeBas algorithm;

[0011] Determine whether the probability of success of the attack of each of the original attack links is greater than a probability threshold;

[0012] If yes, matching is performed based on the original attack link and the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree;

[0013] A linear knowledge body is obtained based on the updated target attack link knowledge tree.

[0014] In some implementations, preprocessing the original data to obtain original attack link data includes:

[0015] The original data is desensitized, and the desensitized original data is graded, layered and modularized according to the ATT&CK framework to obtain the original attack link data.

[0016] In some implementations, the processing of the original attack link data into a binary tree structure to obtain an original attack link knowledge tree includes:

[0017] Obtaining an original attack link graph from the original attack link data;

[0018] Acquire each of the original attack links from the attack link graph;

[0019] Each of the original attack links is stored in a binary tree to obtain the original attack link knowledge tree.

[0020] In some implementations, storing each of the original attack links in a binary tree to obtain the original attack link knowledge tree includes:

[0021] Each node in the original attack link is stored in a corresponding non-leaf node in the binary tree, and different operations after each node in the original attack link are stored in the binary tree to obtain the original attack link knowledge tree.

[0022] In some implementations, matching the original attack link with a target attack link in a target attack link knowledge tree to update the target attack link knowledge tree includes:

[0023] Compare the original attack link with the target attack link in the target attack link knowledge tree one by one, and determine whether the original attack link is consistent with the target attack link in the target attack link knowledge tree;

[0024] If yes, marking the target attack link;

[0025] If not, the original attack link is stored in the target attack link knowledge tree to update the target attack link knowledge tree.

[0026] In some implementations, storing the original attack link in the target attack link knowledge tree to update the target attack link knowledge tree includes:

[0027] After the successfully matched original target attack link is layered according to the ATT&CK framework, the original attack link is stored in the branch node of the target attack link knowledge tree to update the target attack link knowledge tree.

[0028] In some implementations, obtaining a linear knowledge body based on the updated target attack link knowledge tree includes:

[0029] The updated target attack link knowledge tree is disassembled, and each branch of the target attack link knowledge tree is the linear knowledge body.

[0030] In a second aspect, the present invention further provides an optimization device for a network attack detection model, comprising:

[0031] An acquisition module is used to acquire raw data of an industry;

[0032] A preprocessing module, used for preprocessing the original data to obtain original attack link data;

[0033] A processing module, used for performing binary tree structure processing on the original attack link data to obtain an original attack link knowledge tree;

[0034] A calculation module, used for calculating the probability of success of attack of each original attack link in the original attack link knowledge tree by using a YeBais algorithm;

[0035] A judgment module, used to judge whether the probability of success of the attack of each of the original attack links is greater than a probability threshold; if so, matching the original attack link with the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree;

[0036] The disassembly module obtains a linear knowledge body based on the updated target attack link knowledge tree.

[0037] In a third aspect, the present invention further provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the method for optimizing the network attack detection model described in any one of the above items is implemented.

[0038] In a fourth aspect, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the optimization method of the network attack detection model described in any one of the above items is implemented.

[0039] The optimization method of the network attack detection model provided by the present invention obtains original attack link data and an original attack link knowledge tree after processing the original data, adopts the leaf-bayes algorithm to calculate the probability of each original attack link in the original attack link knowledge tree, and after judging the probability value, when the probability is greater than the probability threshold, compares the original attack link knowledge tree with the target attack link knowledge tree to obtain the corresponding target attack link, and when the probability is less than the probability threshold, stores the original attack link in the original attack link knowledge tree into the target attack link knowledge tree to achieve the updating purpose, and obtains a linear knowledge body after the updating. It can be found that the attack link knowledge model is based on the original attack link knowledge tree with a binary tree structure, and is calculated by the leaf-bayes algorithm to obtain a linear knowledge body. On the basis of the current industry's attack knowledge accumulation, a more accurate and universal network attack detection model can be obtained, thereby providing an effective basis for the universal detection model and improving the accuracy of network attack detection.

[0040] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flow chart of the optimization method of the network attack detection model provided by the present invention;

[0043] Figure 2It is a structural schematic diagram of an optimization device for a network attack detection model provided by the invention;

[0044] Figure 3 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Combine the following Figures 1 to 3 The embodiments shown describe the technical solution of the present invention:

[0047] The embodiment of the present invention provides a method for optimizing a network attack detection model, such as Figure 1 As shown, the optimization method of the network attack detection model includes:

[0048] Step S110: Obtain original data of an industry.

[0049] Among them, the original data can be divided into multiple types according to the field / industry, including: attack link graph: a directed graph that represents a group of attack methods used by attackers as nodes, and the transfer between attack methods as edge logic; link data: a series of data formats extracted from the attack link graph, including but not limited to the identity of the attacker, the attack method used, the address of the target accessed after the attack, the success / failure of the attack, and the harm caused by the attack method used; attack link data: data obtained by reorganizing the link data according to the attack link graph.

[0050] Exemplarily, the original data in a certain industry can be obtained and stored with the industry name. In actual application, the industry data can be selected as needed, and no specific limitation is made here.

[0051] Step S120: pre-process the original data to obtain original attack link data.

[0052] Among them, the attack link data can be a directed graph that links attack means with targets, including attack type, attack payload, attack stage, defense weakness, mitigation weakness, usage payload, etc.

[0053] It should be noted that the original data includes all original attack information, and the original attack information needs to be extracted from the original data to obtain original attack link data, and the original attack link data is the target data for calculation.

[0054] Furthermore, the above step S120 may also specifically include: desensitizing the original data, and grading, layering and modularizing the desensitized original data according to the ATT&CK framework to obtain the original attack link data.

[0055] In this embodiment, the ATT&CK framework is an attack detection and protection framework, wherein the specific framework content of the ATT&CK framework can be selected as needed to obtain corresponding attack link information. In practical applications, the selection of the ATT&CK framework can refer to the existing ATT&CK framework, and can also refer to its derivative framework, etc. When the original data is hierarchically layered and modularly processed based on the ATT&CK framework, the original data can be hierarchically layered and modularly processed with the original attack link as the basic unit. For example, the attack links extracted from the original data are A1, A2, A3, and A4, then A1 can be classified as a first-level attack, A2 and A3 can be classified as second-level attacks, A4 can be classified as a third-level attack, and so on.

[0056] Step S130: Perform binary tree structure processing on the original attack link data to obtain an original attack link knowledge tree.

[0057] Among them, the original attack link knowledge tree may include: node: represents the attack method / step in the original data, which serves as the leaf node of the attack link knowledge tree; event: the event is used to associate the node with the leaf node, and the event is uniformly managed through the event id. When this logic exists in the attack link data, it can be used as a node in the attack link knowledge tree.

[0058] In an exemplary embodiment, processing the original attack link data into a binary tree structure may include obtaining an attack link graph in the original data, extracting attack link data such as event id, attack method, attacker, visitor address, damage caused by the attack method, and attack success / failure from the attack link graph; storing the extracted attack link data in a binary tree, using the event id as an index, and storing them in the binary tree of step 1 respectively; and splitting industry data according to industry division, and associating them with the event id as an index. Combined with the binary tree structure, data processing capabilities and performance can be improved.

[0059] It should be noted that after the original attack link data is hierarchically layered and modularized according to the ATT&CK framework, an attack link graph can be obtained based on the original attack link data. The attack link graph is a binary tree structure, wherein each node in the attack link graph corresponds to an attack scheme in the original attack link. After the attack link graph is obtained, each original attack link in the attack link graph can be marked, for example, marked as A, B, C, D, etc.

[0060] Furthermore, the above step S130 may also specifically include: obtaining an original attack link graph in the original attack link data; obtaining each original attack link from the original attack link graph; and storing each original attack link in a binary tree to obtain an original attack link knowledge tree.

[0061] In this embodiment, the attack link diagram can be obtained by means of a network attack defense diagram. The network attack defense diagram can be a layer structure, a branch structure, or a binary tree structure. The branch structure can appear in the form of a network defense knowledge node, or a binary tree network defense knowledge structure, wherein the node is different network information. The branch structure includes multiple levels of nodes, and each level of node stores different types of network information. The branch structure connects the basic model of network defense knowledge through the connection between the nodes at each level. The basic model of network defense knowledge includes the mapping relationship between basic features, basic attack methods, basic defense rules, and corresponding security products. From the above basic features, basic attack methods, basic defense rules, and corresponding security product combinations, the corresponding attack link can be obtained. For example, in the branch structure, there are a first-level node, a second-level node, and a third-level node. By combining the data of the first-level node and the second-level node in the branch structure, the corresponding basic model can be obtained as A. By combining the data of the second-level node and the third-level node in the branch structure, the corresponding basic model can be obtained as B. Then both A and B can be stored in the binary tree.

[0062] Furthermore, storing each original attack link in a binary tree to obtain an original attack link knowledge tree may include: storing each node in the original attack link in a non-leaf node in the binary tree, and storing different operations after each node in the original attack link in the binary tree to obtain the original attack link knowledge tree. Similarly, the data of each level of nodes in the branch structure can be stored in different layers of nodes in the binary tree, and different operations after the nodes corresponding to each level of nodes are stored in the binary tree to obtain the original attack link knowledge tree.

[0063] Step S140: Calculate the probability of successful attack of each original attack link in the original attack link knowledge tree by using the YeBais algorithm.

[0064] In this embodiment, the original attack link knowledge tree specifically refers to the expression of the attack link graph obtained after processing the original attack link data according to the ATT&CK framework. It should be noted that when processing the original attack link data, according to experience, it may appear that the attack link graph does not completely conform to all attack links in the current industry. For example, after the original data is hierarchically, layered and modularly processed according to the ATT&CK framework, taking T1 as an example, at this time, the attack link graph obtained according to T1 may not involve all the original attack links, that is, T1 does not conform to all attack links in the current industry. At this time, it is necessary to use the Yebaes classification algorithm to calculate each original attack link in the original attack link knowledge tree to calculate the probability of successful attack of each original attack link.

[0065] Furthermore, the probability of successful attack of each original attack link in the original attack link knowledge tree is calculated by the Ye Beis algorithm as follows: the maximum attack value in the original attack link knowledge tree is calculated by the Ye Beis algorithm, and then the probability of successful attack of each original attack link is determined by marking the maximum attack value.

[0066] Step S150, determine whether the probability of success of each original attack link is greater than the probability threshold; if so, execute step S160; if not, execute step S170.

[0067] Exemplarily, the probability threshold may be 0.5, 0.6, 0.7, or 0.8. This embodiment does not specifically limit the range of the probability threshold, and the probability threshold may be determined according to actual application scenarios.

[0068] Step S160: If yes, matching is performed based on the original attack link and the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree.

[0069] Furthermore, the above step S160 can also specifically include: comparing the original attack link with the target attack link in the target attack link knowledge tree one by one, and determining whether the original attack link is consistent with the target attack link in the target attack link knowledge tree; if so, marking the target attack link; if not, storing the original attack link in the target attack link knowledge tree to update the target attack link knowledge tree.

[0070] In this embodiment, the Yebaes algorithm is used to calculate the maximum attack value in the original attack link knowledge tree, and the nodes in the original attack link knowledge tree are marked according to the maximum attack value to determine the target attack link in the original attack link knowledge tree, wherein the target attack link is the attack link that is successfully attacked in the original attack link knowledge tree, and the target attack link in the target attack link knowledge tree is the same as the target attack link in the original attack link knowledge tree.

[0071] Specifically, the maximum attack value in the original attack link knowledge tree is stored as the attack link in the current industry, and each original attack link in the original attack link knowledge tree is transferred from a branch and stored in the target attack link knowledge tree, so that the target attack link knowledge tree contains all attack links in the current industry.

[0072] Step S170: Acquire a linear knowledge body based on the updated target attack link knowledge tree.

[0073] In this embodiment, after matching, the target attack link knowledge tree can be disassembled, that is, the target attack link knowledge tree is hierarchically layered and modularized according to the ATT&CK framework to obtain a linear knowledge body. It can be found that the linear knowledge body is based on the target attack link knowledge tree, and the attack link knowledge tree is linearly simplified through hierarchical layering and modular processing, that is, the attack link knowledge tree is split so that all nodes in the attack link knowledge tree are hierarchical layer nodes of a linear structure.

[0074] Furthermore, the above step S170 may also specifically include: disassembling the updated target attack link knowledge tree, each branch of the target attack link knowledge tree being the linear knowledge body. It should be noted that during the splitting, a node may be split into multiple nodes, which is not specifically limited in this embodiment.

[0075] In this embodiment, after processing the original data, the original attack link data and the original attack link knowledge tree are obtained, and the Ye Bei Si algorithm is used to calculate the probability of each original attack link in the original attack link knowledge tree. After judging the probability value, when the probability is greater than the probability threshold, the original attack link knowledge tree and the target attack link knowledge tree are compared to obtain the corresponding target attack link. When the probability is less than the probability threshold, the original attack link in the original attack link knowledge tree is stored in the target attack link knowledge tree to achieve the update purpose. After the update, a linear knowledge body is obtained. It can be found that the attack link knowledge model is based on the original attack link knowledge tree with a binary tree structure. The Ye Bei Si algorithm is used for calculation to obtain a linear knowledge body. On the basis of the current industry's attack knowledge accumulation, a more accurate and universal network attack detection model can be obtained, which can provide an effective basis for the universal detection model and improve the accuracy of network attack detection.

[0076] The embodiment of the present invention also provides an optimization device for a network attack detection model, see Figure 2 The optimization device of the network attack detection model includes: an acquisition module 201, a preprocessing module 202, a processing module 203, a calculation module 204, a judgment module 205 and a disassembly module 206.

[0077] in:

[0078] The acquisition module 201 is used to acquire original data of an industry.

[0079] The preprocessing module 202 is used to preprocess the original data to obtain original attack link data.

[0080] The processing module 203 is used to perform binary tree structure processing on the original attack link data to obtain an original attack link knowledge tree.

[0081] The calculation module 204 is used to calculate the probability of successful attack of each original attack link in the original attack link knowledge tree by using the Leaf-Bass algorithm.

[0082] The judgment module 205 is used to judge whether the probability of success of each original attack link is greater than a probability threshold; if so, the target attack link in the target attack link knowledge tree is matched based on the original attack link to update the target attack link knowledge tree.

[0083] The disassembly module 206 obtains a linear knowledge body based on the updated target attack link knowledge tree.

[0084] Those skilled in the art should understand that the division of the various modules in the embodiment is only a division of logical functions, and can be fully or partially integrated into one or more actual carriers in actual application, and these modules can be implemented entirely in the form of software called by the processing unit, or entirely in the form of hardware, or in the form of a combination of software and hardware. It should be noted that each module in the optimization device of the network attack detection model in this embodiment corresponds one-to-one to each step in the optimization method of the network attack detection model in the above-mentioned embodiment. Therefore, the specific implementation method of this embodiment can refer to the implementation method of the above-mentioned network attack detection model optimization method, which will not be repeated here.

[0085] An embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, a method for optimizing a network attack detection model is implemented.

[0086] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned method for optimizing the network attack detection model is implemented.

[0087] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 complete mutual communication through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the optimization method of the network attack detection model, the method comprising: obtaining original data of an industry; preprocessing the original data to obtain original attack link data; performing binary tree structure processing on the original attack link data to obtain an original attack link knowledge tree; calculating the probability of successful attack of each original attack link in the original attack link knowledge tree by the leaf Bayes algorithm; judging whether the probability of successful attack of each original attack link is greater than the probability threshold; if so, matching the original attack link with the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree; obtaining a linear knowledge body based on the updated target attack link knowledge tree.

[0088] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0089] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the optimization method of the network attack detection model provided by the above-mentioned methods, and the method includes: obtaining original data of an industry; preprocessing the original data to obtain original attack link data; binary tree structuring the original attack link data to obtain an original attack link knowledge tree; calculating the probability of successful attack of each original attack link in the original attack link knowledge tree through the Leaf Bayes algorithm; judging whether the probability of successful attack of each original attack link is greater than a probability threshold; if so, matching the original attack link with the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree; and obtaining a linear knowledge body based on the updated target attack link knowledge tree.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an optimization method for executing a network attack detection model provided by the above-mentioned methods, the method comprising: obtaining original data of an industry; preprocessing the original data to obtain original attack link data; performing binary tree structured processing on the original attack link data to obtain an original attack link knowledge tree; calculating the probability of successful attack of each original attack link in the original attack link knowledge tree through a leaf-bayes algorithm; determining whether the probability of successful attack of each original attack link is greater than a probability threshold; if so, matching the original attack link with a target attack link in a target attack link knowledge tree to update the target attack link knowledge tree; and obtaining a linear knowledge body based on the updated target attack link knowledge tree.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution can essentially or contribute to the prior art in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments. Internet of Things

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for optimizing a network attack detection model, characterized in that: include: Obtaining original data of an industry; Preprocessing the original data to obtain original attack link data; The original attack link data is processed into a binary tree structure to obtain an original attack link knowledge tree; Calculate the probability of successful attack of each original attack link in the original attack link knowledge tree by using the YeBas algorithm; Determine whether the probability of success of the attack of each of the original attack links is greater than a probability threshold; If yes, matching is performed based on the original attack link and the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree; A linear knowledge body is obtained based on the updated target attack link knowledge tree.

2. The optimization method of the network attack detection model according to claim 1, characterized in that: The preprocessing of the original data to obtain original attack link data includes: The original data is desensitized, and the desensitized original data is graded, layered and modularized according to the ATT&CK framework to obtain the original attack link data.

3. The optimization method of the network attack detection model according to claim 1, characterized in that: The processing of the original attack link data into a binary tree structure to obtain an original attack link knowledge tree includes: Obtaining an original attack link graph from the original attack link data; Acquire each of the original attack links from the original attack link graph; Each of the original attack links is stored in a binary tree to obtain the original attack link knowledge tree.

4. The optimization method of the network attack detection model according to claim 3 is characterized in that: The storing each of the original attack links into a binary tree to obtain the original attack link knowledge tree comprises: Each node in the original attack link is stored in a corresponding non-leaf node in the binary tree, and different operations after each node in the original attack link are stored in the binary tree to obtain the original attack link knowledge tree.

5. The optimization method of the network attack detection model according to claim 1, characterized in that: The matching of the original attack link with the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree includes: Compare the original attack link with the target attack link in the target attack link knowledge tree one by one, and determine whether the original attack link is consistent with the target attack link in the target attack link knowledge tree; If yes, marking the target attack link; If not, the original attack link is stored in the target attack link knowledge tree to update the target attack link knowledge tree.

6. The optimization method of the network attack detection model according to claim 5, characterized in that: The storing the original attack link into the target attack link knowledge tree to update the target attack link knowledge tree includes: After the successfully matched original target attack link is layered according to the ATT&CK framework, the original attack link is stored in the branch node of the target attack link knowledge tree to update the target attack link knowledge tree.

7. The optimization method of the network attack detection model according to claim 1, characterized in that: Acquiring a linear knowledge body based on the updated target attack link knowledge tree includes: The updated target attack link knowledge tree is disassembled, and each branch of the target attack link knowledge tree is the linear knowledge body.

8. An optimization device based on a network attack detection model, characterized in that: include: An acquisition module is used to acquire raw data of an industry; A preprocessing module, used for preprocessing the original data to obtain original attack link data; A processing module, used for performing binary tree structure processing on the original attack link data to obtain an original attack link knowledge tree; A calculation module, used for calculating the probability of success of attack of each original attack link in the original attack link knowledge tree by using a YeBais algorithm; A judgment module, used to judge whether the probability of success of the attack of each original attack link is greater than a probability threshold; If yes, matching is performed based on the original attack link and the target attack link in the target attack link knowledge tree to update the target attack link knowledge tree; The disassembly module obtains a linear knowledge body based on the updated target attack link knowledge tree.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the method for optimizing the network attack detection model as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for optimizing the network attack detection model according to any one of claims 1 to 7 is implemented.

Images