Safety management method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a security management method and device, electronic equipment and a storage medium, the method is applied to the electronic equipment, and the method comprises the following steps: receiving security log data sent by a plurality of clients which are respectively deployed in different operation environments; identifying an attack behavior according to the security log data, and obtaining an attack source address corresponding to the attack behavior; extracting attack feature data in security log data corresponding to the attack behavior; analyzing the attack feature data through a trained security response model to obtain a response disposal scheme; and the response processing scheme and the attack source address are respectively sent to the plurality of clients, so that each client executes the response processing scheme when receiving the access behavior initiated by the attack source address, the plurality of clients can process the attack behavior initiated by the same attack source address in time, and the security of the access behavior initiated by the same attack source address is improved. And the overall safety protection capability is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security management method, device, electronic device and storage medium. Background Art

[0002] With the rapid development and application of information technology, network security threats are becoming increasingly severe. Enterprises and organizations are facing various complex network attacks, such as distributed denial of service (DDos) attacks, SQL (Structured Query Language) injections, cross-site scripting (XSS) attacks, etc. These attacks may not only cause system paralysis, but also leak sensitive information, causing huge economic losses and reputation damage. Therefore, strengthening network security protection has become an urgent need for enterprises and organizations.

[0003] In the related technology, emergency response to network attacks still relies on manual handling after the platform alarm. This method has high time cost, low efficiency, and it is difficult to achieve an all-weather response, and the security protection effect is poor. Summary of the invention

[0004] The embodiments of the present application disclose a security management method, device, electronic device and storage medium, which can enable multiple clients to promptly process attack behaviors initiated by the same attack source address, thereby improving the overall security protection capability.

[0005] In a first aspect, an embodiment of the present application discloses a security management method, which is applied to an electronic device. The method includes:

[0006] Receiving security log data sent by multiple clients, wherein the multiple clients are respectively deployed in different operating environments;

[0007] Identify attack behaviors according to the security log data, and obtain attack source addresses corresponding to the attack behaviors;

[0008] Extracting attack feature data from security log data corresponding to the attack behavior;

[0009] Analyze the attack feature data through the trained security response model to obtain a response and disposal plan;

[0010] The response handling scheme and the attack source address are sent to the multiple clients respectively, so that each of the clients executes the response handling scheme when receiving the access behavior initiated by the attack source address.

[0011] As an optional implementation, in the first aspect of the embodiment of the present application, the security response model includes multiple decision trees; the security response model completed through training analyzes the attack feature data to obtain a response disposal plan, including:

[0012] Analyzing the attack feature data through each decision tree to obtain a response action output by each decision tree;

[0013] According to the preset learning rate, the response actions output by each decision tree are integrated to obtain a response disposal plan.

[0014] As an optional implementation, in the first aspect of the embodiment of the present application, the security response model is obtained by training according to an attack sample set, the attack sample set includes a plurality of attack feature samples, each of the attack feature samples includes an attack sample feature vector, and a sample response action corresponding to the attack sample feature vector;

[0015] Before the trained security response model analyzes the attack feature data to obtain a response solution, the method further includes:

[0016] Generate multiple decision trees included in the security response model to be trained through the attack sample set;

[0017] If the number of generated decision trees reaches the target number, or the tree depth of any of the generated decision trees reaches the target depth, it is determined that the training of the security response model is completed.

[0018] As an optional implementation, in the first aspect of the embodiment of the present application, the attack sample feature vector includes sample feature values ​​corresponding to a plurality of attack features, and the plurality of decision trees included in the security response model to be trained generated by the attack sample set include:

[0019] Determine, according to a plurality of attack feature samples included in a current node of the first decision tree, a plurality of candidate splitting points corresponding to each of the attack features;

[0020] Determine, according to a plurality of attack feature samples included in the current node, a splitting gain corresponding to each of the candidate splitting points;

[0021] The candidate splitting point with the largest splitting gain is used as the target splitting point of the current node, and multiple attack feature samples contained in the current node are classified according to the target splitting point to obtain multiple attack feature samples corresponding to the left child node of the current node and multiple attack feature samples corresponding to the right child node of the current node;

[0022] The left child node or the right child node is used as a new current node, and the step of determining the candidate splitting points corresponding to the multiple attack features respectively according to the multiple attack feature samples corresponding to the current node is re-executed until the tree depth of the first decision tree reaches a depth threshold, or the number of attack feature samples corresponding to the left child node or the right child node is less than a number threshold, then it is determined that the generation of the first decision tree is completed.

[0023] As an optional implementation manner, in the first aspect of the embodiment of the present application, determining the splitting gain corresponding to each of the candidate splitting points according to the multiple attack sample feature vectors included in the current node includes:

[0024] Calculating a first objective function value according to a plurality of attack feature samples corresponding to the current node;

[0025] Classifying a plurality of attack feature samples corresponding to the current node according to a first candidate splitting point to obtain a first attack sample feature set and a second attack sample feature set, wherein the first candidate splitting point is any of the candidate splitting points;

[0026] Calculating a second objective function value corresponding to the first attack sample feature set according to each attack feature sample included in the first attack sample feature set;

[0027] Calculating a third objective function value corresponding to the second attack sample feature set according to each attack feature sample included in the second attack sample feature set;

[0028] A splitting gain of the first candidate splitting point is determined according to the first objective function value, the second objective function value, and the third objective function value.

[0029] As an optional implementation, in the first aspect of the embodiment of the present application, the decision tree includes a plurality of leaf nodes, each of the leaf nodes includes one or more attack feature samples, and after determining that the first decision tree is generated, the method further includes:

[0030] Calculate the fourth objective function value corresponding to each leaf node in the first decision tree according to each attack feature sample contained in each leaf node;

[0031] The weight corresponding to each leaf node is determined according to the fourth objective function value corresponding to each leaf node.

[0032] As an optional implementation, in the first aspect of the embodiment of the present application, after determining that the security response model training is completed, the method further includes:

[0033] By analyzing the first attack test sample contained in the test set through each decision tree included in the trained security response model, a predicted response action of each decision tree to the first attack test sample is obtained; the test set includes multiple attack test samples, each of the attack test samples includes an attack feature test vector, and a target response action corresponding to the attack feature test vector, and the first attack test sample is any of the attack test samples;

[0034] The predicted response actions corresponding to the first attack test sample output by each decision tree are integrated to obtain a predicted response disposal plan corresponding to the first attack test sample;

[0035] Calculating an error corresponding to the first attack test sample according to the predicted response disposal scheme and the target response action included in the first attack test sample;

[0036] Calculating the overall error of the test set according to the errors respectively corresponding to the multiple attack test samples;

[0037] If the overall error is greater than a preset error threshold, the safety response model continues to be trained.

[0038] A second aspect of an embodiment of the present application discloses a security management device, which is applied to an electronic device, and the device includes:

[0039] A receiving module, used to receive security log data sent by multiple clients, wherein the multiple clients are respectively deployed in different operating environments;

[0040] An acquisition module, used to identify attack behaviors according to the security log data, and obtain an attack source address corresponding to the attack behaviors;

[0041] An extraction module, used to extract attack feature data from the security log data corresponding to the attack behavior;

[0042] An analysis module is used to analyze the attack feature data through a trained security response model to obtain a response disposal plan;

[0043] The sending module is used to send the response processing scheme and the attack source address to the multiple clients respectively, so that each of the clients executes the response processing scheme when receiving the access behavior initiated by the attack source address.

[0044] A third aspect of the present application discloses an electronic device, including:

[0045] A memory storing executable program code;

[0046] a processor coupled to the memory;

[0047] The processor calls the executable program code stored in the memory to execute the method described in any one of the above embodiments.

[0048] A fourth aspect of an embodiment of the present application discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor executes the method described in any one of the above embodiments.

[0049] Compared with the related art, the embodiments of the present application include at least the following beneficial effects:

[0050] The security management method, device, electronic device and storage medium disclosed in the embodiments of the present application receive security log data sent by multiple clients, and the multiple clients are respectively deployed in different operating environments; identify attack behavior based on the security log data, and obtain the attack source address corresponding to the attack behavior; extract attack feature data in the security log data corresponding to the attack behavior; analyze the attack feature data through a trained security response model to obtain a response disposal plan; and send the response disposal plan and the attack source address to multiple clients respectively, so that each client executes the response disposal plan when receiving the access behavior initiated by the attack source address. In an embodiment of the present application, the electronic device can receive security log data from multiple clients, identify attack behaviors in the security log data, and obtain the attack source address corresponding to the attack behavior, so that the attack source address of the attack behavior against any client can be obtained from the security log data; the attack feature data in the security log data corresponding to the attack behavior is extracted, and the attack feature data is analyzed by a trained security response model to obtain a response disposal plan, and the response disposal plan and the attack source address corresponding to the attack behavior are sent to the multiple clients, so that even if the client has not been attacked by the attack source address before, the corresponding response disposal plan can be obtained, so that each client can execute the response disposal plan when receiving the access behavior initiated by the attack source address, so that multiple clients can promptly process the attack behavior initiated by the same attack source address, thereby improving the overall security protection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1It is a schematic diagram of an application scenario of a security management method disclosed in an embodiment of the present application;

[0053] Figure 2 It is a flowchart of a security management method disclosed in an embodiment of the present application;

[0054] Figure 3 It is a flowchart of analyzing attack feature data through a trained security response model disclosed in an embodiment of the present application to obtain a response disposal solution process;

[0055] Figure 4 It is a schematic diagram of a process of training a security response model through an attack sample set disclosed in an embodiment of the present application;

[0056] Figure 5 It is a flowchart diagram of a process of generating multiple decision trees included in a security response model to be trained through an attack sample set disclosed in an embodiment of the present application;

[0057] Figure 6 It is a flowchart diagram of a process for determining a splitting gain corresponding to each candidate splitting point according to multiple attack feature samples included in the current node disclosed in an embodiment of the present application;

[0058] Figure 7 It is a schematic diagram of a process for determining the weights corresponding to each leaf node in the first decision tree disclosed in an embodiment of the present application;

[0059] Figure 8 It is a flowchart of testing a trained security response model through a test set disclosed in an embodiment of the present application;

[0060] Fig. 9 It is a structural schematic diagram of a security management device disclosed in an embodiment of the present application;

[0061] Fig.10 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0063] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0064] See also Figure 1 , Figure 1 Schematic diagram of an application scenario of a security management method disclosed in an embodiment of the present application. Figure 1 As shown, the application scenario diagram of the security management method may include an electronic device 110 and multiple clients 120, which is not specifically limited in the embodiment of the present application.

[0065] The electronic device 110 establishes communication connections with the multiple clients 120. The communication connection mode may include but is not limited to a cellular network connection, a Wi-Fi connection, etc., which is not specifically limited in the embodiment of the present application.

[0066] Among them, the electronic device 110 may be deployed with an enterprise core network / data center to receive security log data from multiple clients 120. Optionally, the electronic device 110 may include but is not limited to one or more of a physical server, a server set, etc., which is not specifically limited in the embodiment of the present application. Exemplarily, the electronic device may run log receiving and processing software in the enterprise's data center to achieve reception and processing of security log data.

[0067] Multiple clients 120 can be deployed in different operating environments. For example, multiple clients 120 can be installed on end-user devices (such as employees' work computers), servers, or directly embedded in network devices (such as firewalls, routers, etc.), respectively collect security log data, and send their respective security log data to the electronic device 110.

[0068] In some embodiments, the electronic device 110 may issue a zero-trust policy to multiple clients 120, so that the security log data corresponding to the multiple clients 120 can be securely sent to the electronic device 110 through the zero-trust tunnel. The zero-trust policy can be used to establish a zero-trust tunnel between the electronic device 110 and the multiple clients 120. The zero-trust tunnel refers to a secure communication path that can be used to ensure that the security log data is always protected and verified during the transmission between the electronic device 110 and the multiple clients 120.

[0069] In some embodiments, the electronic device 110 may issue a dynamic configuration policy to multiple clients 120, and the dynamic configuration policy may be used to define configuration information related to the security log data uploaded by the client 120 to the electronic device 110, thereby realizing transmission control of the security log data sent by multiple clients 120. Optionally, the dynamic configuration policy may include the type of log transmitted, the size and number of logs sent and received, and the upper limit of the log storage capacity, etc., which are not specifically limited in the embodiments of the present application. Among them, the size of the log sent and received refers to the size of the space occupied by each log record, usually in bytes; the number of logs refers to the number of log entries generated within a certain period of time; the upper limit of the log storage capacity refers to the maximum storage space specified by the log file or log data.

[0070] In some embodiments, the electronic device 110 may send an operation instruction to any client 120, which may be used to control the client 120 to respond to an attack behavior initiated by any attack source address, thereby realizing remote management and emergency response of the client 120; the client executes the operation instruction to respond to the attack behavior from the attack source address, such as blocking traffic access from a suspicious IP (Internet Protocol) address.

[0071] In an embodiment of the present application, an electronic device 110 receives security log data sent by multiple clients 120, which are respectively deployed in different operating environments; identifies attack behavior based on the security log data, and obtains an attack source address corresponding to the attack behavior; extracts attack feature data in the security log data corresponding to the attack behavior; analyzes the attack feature data through a trained security response model to obtain a response disposal plan; sends the response disposal plan and the attack source address to multiple clients 120, respectively, so that each client 120 executes the response disposal plan when receiving an access behavior initiated by the attack source address, which enables multiple clients to promptly handle attack behaviors initiated by the same attack source address, thereby improving the overall security protection capability.

[0072] Please read further Figure 2 , Figure 2 1 is a flow chart of a security management method disclosed in an embodiment of the present application, and the security management method can be applied to the above-mentioned electronic device 110. Figure 2 As shown, the security management method may include the following steps:

[0073] Step 210: receiving security log data sent by a plurality of clients, where the plurality of clients are respectively deployed in different operating environments.

[0074] The client can capture security events in the system, network or application, and convert the information of the security event into security log data according to the preset log format.

[0075] Among them, security events may refer to any activity event that may threaten or actually damage the system, network or data. Exemplary types of security events may include unauthorized access, malware infection, denial of service attack, data leakage, etc. Among them, denial of service attack refers to exhausting the resources of the target system (such as bandwidth, processor time or memory) through various means, causing the system to respond slowly or even stop working completely, so that legitimate users cannot access the service.

[0076] Security log data may refer to the record data of security events that occurred in the system, network or application. For example, the security log data may include timestamp, event type, source IP (Internet Protocol) address, target IP (Internet Protocol) address and device information, etc. Among them, the timestamp may refer to the specific time when the security event occurred; the event type may refer to the type of security event, such as login attempt, file access, system error, etc.; the source IP (Internet Protocol) address may refer to the source IP (Internet Protocol) address that initiated the security event, the target IP (Internet Protocol) address may refer to the target IP (Internet Protocol) address that initiated the security event, and the device information may refer to the information corresponding to the device where the security event occurred, such as the device ID (Identifier), operating system version, etc.

[0077] Multiple clients establish communication connections with the electronic device, and the electronic device can receive security log data sent by the multiple clients based on the communication connections.

[0078] It should be noted that multiple clients are deployed in different operating environments, which may be a network environment, a computing platform, a cloud environment, a virtualized environment, etc., and the present application embodiment does not specifically limit this.

[0079] Step 220, identifying attack behavior according to the security log data, and obtaining the attack source address corresponding to the attack behavior.

[0080] In some embodiments, the electronic device may pre-store attack keywords and match security log data with the attack keywords. If the attack keywords exist in the security log data, the attack behavior may be determined based on the attack keywords, and the attack source address corresponding to the attack behavior may be obtained.

[0081] In some embodiments, the electronic device can extract event features corresponding to security events based on security log data and pre-set some rules. If the above event features meet these rules, it is considered to be an attack behavior.

[0082] Step 230: extract attack feature data from the security log data corresponding to the attack behavior.

[0083] After the electronic device identifies an attack behavior based on the security log data, it can extract attack feature data from the security log data corresponding to the attack behavior.

[0084] In some embodiments, the attack feature data may include attack source device features and attack target device features. Attack source device features refer to relevant features of the device that initiates the attack behavior. For example, the attack source device features may include one or more of the attack source IP, attack protocol, attack time, device fingerprint, and file sample.

[0085] The attack source IP (Internet Protocol) may refer to the IP (Internet Protocol) address of the computer device that initiates the attack; the attack protocol may refer to the protocol used by the attacker when conducting a network attack, for example, it may be a TCP (Transmission Control Protocol) / IP (Internet Protocol) protocol attack, HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure) protocol attack, or DNS (Domain Name System) protocol attack, etc.; the attack time may refer to the specific time period when the attack occurs; the device fingerprint may refer to the identifier of the attack device, which is used to uniquely identify and track the attack device; the file sample may refer to a specific file used for analysis and research, for example, it may be a malware sample, a suspicious file, a vulnerability exploit sample, etc. Among them, the malware sample may be a virus, a Trojan horse, a ransomware, a backdoor, etc., the suspicious file may refer to a file that behaves abnormally but has not yet been determined to be malicious, and the vulnerability exploit sample may refer to a file containing a specific vulnerability exploit code.

[0086] The characteristics of the target device may refer to the relevant characteristics of the device under attack. For example, the characteristics of the target device may include but are not limited to the operating status of the device under attack, and / or the specific resource information of the device under attack. For example, the operating status of the device may include the device status such as the CPU (Central Processing Unit) utilization and memory usage of the device under attack; the specific resource information of the device under attack may include one or more of the intrusion vulnerability type, sample callback address and port, crontab task, profit address, etc.

[0087] Among them, the vulnerability type exploited by the attacker may refer to the vulnerability in the device under attack that is exploited by the attacker when conducting a network attack, such as buffer overflow, SQL (Structured Query Language) injection, cross-site scripting, etc.; the sample callback address may refer to the IP (Internet Protocol) address or domain name through which the malware that initiates the attack communicates with the remote control server, and the sample callback port may refer to the port through which the malware that initiates the attack communicates with the remote control server; the crontab task may refer to a task that is executed regularly in the device under attack; the profit address may refer to the address used by the device that initiates the attack to receive illegal gains in a security incident.

[0088] The attack feature data corresponding to the attack behavior may include multiple attack features. In some embodiments, the electronic device may establish a mapping set corresponding to each attack feature contained in the attack feature data, and convert each attack feature into a numerical value. It should be noted that the attack feature may include a numerical attack feature and a non-numerical attack feature. Numerical attack features can be directly converted. For example, the electronic device can directly convert a character-type attack source IP (Internet Protocol) into an integer-type attack source IP (Internet Protocol); for non-numerical attack features, the electronic device can establish a mapping table corresponding to the attack feature, and the mapping table may include numerical values ​​corresponding to one or more attack features. Exemplarily, for the TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) attack protocol, the numerical value corresponding to the TCP (Transmission Control Protocol) protocol may be 1, and the numerical value corresponding to the UDP (User Datagram Protocol) protocol may be 2.

[0089] In some embodiments, the electronic device may clean the received security log data before extracting the attack signature data to filter out noise data and meaningless data. Exemplarily, the electronic device may process missing values ​​in the security log data, such as deleting missing values ​​or filling missing values ​​with specific values ​​(such as mean, median, mode, etc.). It should be noted that in other embodiments, the electronic device may also perform other data cleaning, such as outlier processing, duplicate data processing, inconsistent data processing, etc.

[0090] Step 240: Analyze the attack feature data through the trained security response model to obtain a response solution.

[0091] Among them, the security response model can be used to analyze the attack feature data to obtain a response and disposal plan for the attack behavior. Optionally, the security response model can be an XGBoost model, a LightGBM model, a CatBoost model, etc., which is not specifically limited in the embodiments of the present application.

[0092] In some embodiments, the security response model may include a convolution layer, a pooling layer, a fully connected layer, etc. The electronic device may analyze the attack feature data through the convolution layer, the pooling layer, and the fully connected layer included in the trained security response model to obtain a response disposal plan.

[0093] The response disposal plan may refer to a specific method of responding to the attack behavior initiated by the above-mentioned attack source address.

[0094] Optionally, the response and disposal plan may include, but is not limited to, blocking the attack source IP, isolating the affected system, repairing vulnerabilities, cleaning malware, strengthening access control, strengthening border defense, etc., and the embodiments of the present application do not specifically limit this. Among them, isolating the affected system may refer to isolating the client that is attacked from the system, such as disconnecting the network connection; repairing vulnerabilities may refer to the client repairing the vulnerability used by the attack source address to attack; cleaning malware may refer to removing the malware that initiates the attack from the client; strengthening access control refers to strengthening the control of the attack source address on the client's access behavior, such as limiting the permissions of the access behavior initiated by the attack source address; strengthening border defense may refer to strengthening the boundary between the client's network and the external network to ensure that only legitimate traffic can enter the client's network.

[0095] In some embodiments, the electronic device analyzes the attack feature data through the trained security response model to obtain the probability value of each response solution, which can represent the probability that the attack feature data corresponds to the response solution. The electronic device can determine the response solution with the largest probability value as the response solution corresponding to the attack feature data.

[0096] In some embodiments, the electronic device analyzes the attack feature data through the trained security response model to obtain scores of various response solutions. The electronic device may determine the response solution with the highest score as the response solution corresponding to the attack feature data.

[0097] Step 250, sending the response handling plan and the attack source address to multiple clients respectively, so that each client executes the response handling plan when receiving the access behavior initiated by the attack source address.

[0098] The above-mentioned multiple clients include clients that have been attacked by the attack source address and clients that have not been attacked by the attack source address. For the client that has been attacked by the attack source address, the client can execute the response disposal plan to respond to the attack initiated by the attack source address; for the client that has not been attacked by the attack source address, the client can store the response disposal plan and the attack source address in correspondence, so that when the client receives the access behavior initiated by the attack source address, it can execute the response disposal plan to respond to the attack initiated by the attack source address.

[0099] In an embodiment of the present application, an electronic device receives security log data sent by multiple clients, and the multiple clients are respectively deployed in different operating environments; identifies attack behavior based on the security log data, and obtains an attack source address corresponding to the attack behavior; extracts attack feature data in the security log data corresponding to the attack behavior; analyzes the attack feature data through a trained security response model to obtain a response disposal plan; and sends the response disposal plan and the attack source address to multiple clients respectively, so that each client executes the response disposal plan when receiving an access behavior initiated by the attack source address, which enables multiple clients to promptly process attack behaviors initiated by the same attack source address, thereby improving the overall security protection capability.

[0100] In some embodiments, the security response model may include multiple decision trees, such as Figure 3 As shown, the step analyzes the attack feature data through the trained security response model to obtain a response disposal plan, which may include the following steps:

[0101] Step 310: Analyze the attack feature data through each decision tree to obtain the response action output by each decision tree.

[0102] The decision tree may be used to classify attack feature data and output response actions corresponding to the attack feature data.

[0103] In some embodiments, each decision tree may include multiple internal nodes and multiple leaf nodes. The electronic device may judge the division conditions of the attack feature data through the internal nodes of each decision tree, and divide the attack feature data into different child nodes according to the judgment result of the division conditions. Thereafter, the division condition judgment and attack feature data division of each child node are recursively repeated until the leaf node to which the attack feature data belongs is obtained. Each leaf node can be used to represent a response action, so the response action corresponding to the attack feature data output by each decision tree can be obtained.

[0104] In some embodiments, each leaf node includes a weight corresponding to each response action. According to the leaf nodes to which the attack feature data is divided, the weight of each response action corresponding to the attack feature data output by each decision tree can be obtained, and then the response action corresponding to the attack feature data output by each decision tree can be obtained.

[0105] Step 320: According to a preset learning rate, the response actions output by each decision tree are integrated to obtain a response disposal plan.

[0106] The preset learning rate can be used to coordinate the contribution of the response actions output by each decision tree to the response disposal plan.

[0107] In some embodiments, the above-mentioned response action can be a weight vector, and the elements of the weight vector can represent the weight values ​​corresponding to each response action. The electronic device can fuse the weight vectors output by each decision tree according to a preset learning rate to obtain a response disposal plan. Further, the electronic device can weight the weight vectors output by each decision tree according to a preset learning rate to obtain a cumulative weight vector, and then use a probability conversion function to convert the cumulative weight vector into probability values ​​corresponding to each response action, and according to the probability values ​​corresponding to each response action, determine the response action with the largest probability value as the response disposal plan.

[0108] In some embodiments, the above response actions may be numerical values. It should be noted that different response actions may be mapped to different numerical values, for example, blocking the attack source address may be 1, and strengthening access control to the attack source address may be 2. The electronic device may perform weighted averaging of the numerical values ​​corresponding to the response actions output by each decision tree according to a preset learning rate, and use the response action mapped to the numerical value obtained after the weighted averaging as the response disposal scheme.

[0109] In the embodiment of the present application, the electronic device can analyze the attack feature data through each decision tree to obtain the response action output by each decision tree; then, the response action output by each decision tree can be integrated according to the preset learning rate to obtain the response disposal plan. By integrating multiple decision trees, the overfitting risk of a single decision tree can be reduced, and the robustness and generalization ability of the security response model can be improved.

[0110] In some embodiments, Figure 4 As shown, before the step of analyzing the attack feature data through the trained security response model to obtain a response disposal plan, the following steps may also be included:

[0111] Step 410: Generate multiple decision trees included in the security response model to be trained through the attack sample set.

[0112] The electronic device can generate multiple decision trees included in the security response model to be trained by gradually classifying the attack sample set.

[0113] The security response model may be trained based on an attack sample set, where the attack sample set may include multiple attack feature samples, each of which may include an attack sample feature vector and a sample response action corresponding to the attack sample feature vector.

[0114] Exemplarily, the attack sample set can be expressed as D = {(x1, y1), (x2, y2), ..., (x N ,y N )}, where y i It can represent the sample response action corresponding to the i-th attack feature sample, N can represent the total number of attack feature samples, x i ={x i1 ,x i2 ,...,x iT}, i = 1, 2, ..., N can represent the attack sample feature vector corresponding to the i-th attack feature sample, T can represent the total number of features in the attack sample feature vector, x ij It can represent the feature value of the j-th attack feature of the i-th attack feature sample.

[0115] It should be noted that each decision tree initially contains only one node, namely the root node, which includes the above attack sample set. The electronic device may first determine the best candidate split point of the root node, and split the root node according to the best candidate split point, that is, classify the attack sample set contained in the root node into multiple attack sample subsets, and obtain a child node containing the attack sample subset.

[0116] In the process of generating the decision tree, for each node to be split, the electronic device can first determine the best candidate splitting point of the node, and classify the multiple attack feature samples contained in the node into the left child node and the right child node obtained by splitting the node according to the best candidate splitting point, and then use the left child node and the right child node as new nodes to be split, and re-execute the above steps until the tree depth of the decision tree reaches the depth threshold, or the number of attack feature samples corresponding to the left child node and the right child node is less than the number threshold, then it can be determined that the decision tree generation is completed.

[0117] Step 420: If the number of generated decision trees reaches the target number, or the tree depth of any generated decision tree reaches the target depth, it is determined that the security response model training is completed.

[0118] The electronic device may check the number of generated decision trees and the tree depth of the generated decision trees after each decision tree is generated. If the number of generated decision trees reaches the target number, or the tree depth of any generated decision tree reaches the target depth, it is determined that the security response model training is completed.

[0119] In the embodiment of the present application, the electronic device can generate multiple decision trees contained in the security response model to be trained through the attack sample set; if the number of decision trees generated reaches the target number, or the tree depth of any decision tree generated reaches the target depth, it is determined that the security response model training is completed. By limiting the number and depth of decision trees, the model complexity is effectively controlled, overfitting is prevented, and the prediction accuracy and robustness of the security response model are improved.

[0120] In some embodiments, the attack sample feature vector includes sample feature values ​​corresponding to a plurality of attack features. Figure 5 As shown, the step of generating multiple decision trees included in the security response model to be trained through the attack sample set may include the following steps:

[0121] Step 510: Determine multiple candidate splitting points corresponding to each attack feature according to multiple attack feature samples included in the current node of the first decision tree.

[0122] Among them, the first decision tree may refer to any decision tree to be generated, and the first decision tree may include one or more nodes; the current node may refer to the node currently split in the first decision tree; the candidate split point may refer to the sample feature value for classifying multiple attack feature samples.

[0123] In some embodiments, the electronic device may use a preset quantile to determine the candidate splitting point. Exemplarily, for each attack feature, the electronic device may select the 1 / 3 and 2 / 3 quantiles of the sample feature values ​​corresponding to the attack feature in the multiple attack feature samples contained in the current node as candidate splitting points. Among them, the 1 / 3 quantile represents the 33rd percentile after the sample feature values ​​are sorted, that is, the value in the top 33% position after the sample feature values ​​are sorted from small to large; the 2 / 3 quantile represents the 66th percentile after the sample feature values ​​are sorted, that is, the value in the top 66% position after the sample feature values ​​are sorted from small to large. The 1 / 3 quantile and the 2 / 3 quantile can evenly divide the data into three parts, which helps to find a more balanced splitting point, and compared with using all possible splitting points, selecting the 1 / 3 and 2 / 3 quantiles can reduce the number of candidate splitting points and improve computational efficiency.

[0124] In some embodiments, the electronic device may use an approximate algorithm to determine the candidate splitting point. Exemplarily, the electronic device may use a histogram method to determine the candidate splitting point. For any attack feature, the electronic device may pre-set the number of buckets, divide the sample feature values ​​of the attack feature into multiple buckets according to the number of buckets, and classify the multiple attack feature samples contained in the current node into different buckets according to the sample feature values ​​corresponding to the attack feature in each attack feature sample, and use the boundary value of the bucket as the candidate splitting point.

[0125] Step 520: Determine the splitting gain corresponding to each candidate splitting point according to the multiple attack feature samples included in the current node.

[0126] The electronic device may determine the splitting gain corresponding to each candidate splitting point according to the attack sample feature vectors and sample response actions respectively corresponding to the multiple attack feature samples included in the current node.

[0127] In some embodiments, Figure 6 As shown, the step of determining the splitting gain corresponding to each candidate splitting point according to multiple attack feature samples contained in the current node may include the following steps:

[0128] Step 610: Calculate a first objective function value according to a plurality of attack feature samples corresponding to the current node.

[0129] In some embodiments, the electronic device may pre-construct an objective function corresponding to the security response model to be trained, and the objective function may be composed of the sum of the loss function values ​​of each attack feature sample in the attack sample set and the sum of the complexity of each decision tree in the security response model to be trained, wherein the loss function value of the attack feature sample may be calculated by the sample response action corresponding to the attack feature sample and the predicted response action of the decision tree to the attack feature sample. Exemplarily, the objective function may refer to the following formula (1):

[0130]

[0131] Where N represents the number of attack feature samples in the attack sample set, y i It can represent the sample response action corresponding to the i-th attack feature sample, It can represent the predicted response action corresponding to the i-th attack feature sample, It can represent the sum of the loss function values ​​corresponding to N attack feature samples, K can represent the total number of decision trees in the security response model to be trained, and f k It can represent the kth decision tree in the security response model to be trained, Ω(f k ) represents the complexity of the kth decision tree in the safety response model to be trained, It can represent the sum of the complexities of K decision trees in the security response model to be trained.

[0132] In some embodiments, the complexity of the first decision tree can be calculated by the weight of the leaf nodes of the decision tree and the number of leaf nodes. Specifically, the complexity of the first decision tree can be calculated by the number of leaf nodes of the decision tree and the sum of the squares of the weights of each leaf node. Exemplarily, the complexity calculation formula of the first decision tree can refer to the following formula (2):

[0133]

[0134] Wherein, f may represent the first decision tree, Ω(f) may represent the complexity of the first decision tree, T may represent the number of leaf nodes of the first decision tree, and w j It can represent the weight of the jth leaf node in the first decision tree, γ can represent the leaf node penalty coefficient, which can be used to control the number of leaf nodes, and λ can represent the second normal form L2 regularization coefficient, which can be used to control the size of the leaf node weight. It can represent the sum of the weights of each leaf node in the first decision tree.

[0135] In some embodiments, the electronic device may simplify the objective function of the safety response model to be trained.

[0136] As an optional implementation, the electronic device may use Taylor series to approximate the objective function, and the simplified objective function expression may refer to the following formula (3):

[0137]

[0138] Among them, y i It can represent the sample response action corresponding to the i-th attack feature sample; It can represent the predicted response action obtained by analyzing the i-th attack feature sample by the k-1-th decision tree; It can represent the loss function value corresponding to the k-1th decision tree, g i Denotes the loss function for predicting the response action The first-order derivative of can represent the deviation between the predicted response action obtained by the k-th decision tree analyzing the i-th attack feature sample and the sample response action corresponding to the i-th attack feature sample; f k (x i ) can represent the predicted response action obtained by the k-th decision tree predicting the i-th attack sample feature vector; h i Denotes the loss function for predicting the response action The second derivative of Ω(f k ) can represent the complexity corresponding to the kth decision tree.

[0139] After the electronic device simplifies the objective function, the electronic device may calculate the first objective function value according to the attack sample feature vectors and sample response actions respectively corresponding to the plurality of attack feature samples corresponding to the current node.

[0140] In some embodiments, the first objective function value may be calculated by first-order derivatives corresponding to each attack feature sample and second-order derivatives corresponding to each attack feature sample.

[0141] As an optional implementation, the first objective function value may be calculated by the sum of first-order derivatives corresponding to multiple attack feature samples included in the current node and the sum of second-order derivatives corresponding to multiple attack feature samples included in the current node.

[0142] Exemplarily, the calculation expression of the sum of the first-order derivatives corresponding to the multiple attack feature samples contained in the current node can refer to the following formula (4):

[0143]

[0144] Among them, m represents the number of attack feature samples contained in the current node, g i Represents the first-order derivative corresponding to the i-th attack feature sample in the current node.

[0145] For example, g i The calculation expression of can be referred to as follows (5):

[0146]

[0147] Among them, y i It can represent the sample response action corresponding to the i-th attack feature sample, It can represent the predicted response action corresponding to the i-th attack feature sample, It can represent the first-order partial derivative of the loss function.

[0148] Exemplarily, the calculation expression of the sum of the second-order derivatives corresponding to the multiple attack feature samples contained in the current node can refer to the following formula (6):

[0149]

[0150] Among them, m represents the number of attack feature samples contained in the current node, h i Represents the second-order derivative corresponding to the i-th attack feature sample in the current node.

[0151] For example, h i The calculation expression of can be referred to as follows (7):

[0152]

[0153] Among them, y i It can represent the sample response action corresponding to the i-th attack feature sample, It can represent the predicted response action corresponding to the i-th attack feature sample, It can represent the second-order partial derivative of the loss function.

[0154] Step 620 , classifying multiple attack feature samples corresponding to the current node according to the first candidate splitting point to obtain a first attack feature sample set and a second attack feature sample set, wherein the first candidate splitting point is any candidate splitting point.

[0155] The first candidate split point may represent a sample feature value corresponding to any attack feature.

[0156] The electronic device may classify the multiple attack feature samples included in the current node into a first attack feature sample set and a second attack feature sample set according to the attack feature and sample feature value corresponding to the first candidate splitting point and the sample feature value corresponding to the attack feature in the multiple attack feature samples included in the current node. Specifically, the electronic device may classify the attack feature samples whose sample feature value corresponding to the attack feature is less than or equal to the first candidate splitting point as the first attack feature sample set, and classify the attack feature samples whose sample feature value corresponding to the attack feature is greater than the first candidate splitting point as the second attack feature sample set.

[0157] Step 630: Calculate a second objective function value corresponding to the first attack feature sample set according to each attack feature sample included in the first attack feature sample set.

[0158] The second objective function value may be calculated by the sum of the first-order derivatives corresponding to the first attack feature sample set and the sum of the second-order derivatives corresponding to the first attack feature sample set.

[0159] Exemplarily, the calculation expression of the sum of the first-order derivatives corresponding to the attack feature samples included in the first attack feature sample set can refer to the following formula (8):

[0160]

[0161] Wherein, p may represent the number of attack feature samples included in the first attack feature sample set; g i It can represent the first-order derivative of the i-th attack feature sample in the first attack feature sample set;

[0162] Exemplarily, the calculation expression of the sum of the second-order derivatives corresponding to the attack feature samples included in the first attack feature sample set can refer to the following formula (9):

[0163]

[0164] Where p represents the number of attack feature samples contained in the first attack feature sample set, h i Represents the second-order derivative corresponding to the i-th attack feature sample in the first attack feature sample set.

[0165] Step 640: Calculate a third objective function value corresponding to the second attack feature sample set according to each attack feature sample included in the second attack feature sample set.

[0166] The third objective function value may be calculated by the sum of the first-order derivatives corresponding to the second attack feature sample set and the sum of the second-order derivatives corresponding to the second attack feature sample set.

[0167] Exemplarily, the calculation expression of the sum of the first-order derivatives corresponding to the attack feature samples included in the second attack feature sample set can refer to the following formula (10):

[0168]

[0169] Where q represents the number of attack feature samples contained in the second attack feature sample set, g i Represents the first-order derivative corresponding to the i-th attack feature sample in the second attack feature sample set.

[0170] Exemplarily, the calculation expression of the sum of the second-order derivatives corresponding to the attack feature samples included in the second attack feature sample set can refer to the following formula (11):

[0171]

[0172] Where q represents the number of attack feature samples contained in the second attack feature sample set, and h i Represents the second-order derivative corresponding to the i-th attack feature sample in the second attack feature sample set.

[0173] Step 650: Determine a splitting gain of a first candidate splitting point according to the first objective function value, the second objective function value, and the third objective function value.

[0174] The electronic device may determine a splitting gain of the first candidate splitting point according to the first objective function value, the second objective function value, and the third objective function value.

[0175] Specifically, the electronic device may calculate the splitting gain of the first candidate splitting point based on the sum of the first-order derivatives corresponding to multiple attack feature samples contained in the current node and the sum of the second-order derivatives corresponding to the multiple attack feature samples contained in the current node, the sum of the first-order derivatives corresponding to the attack feature samples contained in the first attack feature sample set and the sum of the second-order derivatives corresponding to the attack feature samples contained in the first attack feature sample set, the sum of the first-order derivatives corresponding to the attack feature samples contained in the second attack feature sample set and the sum of the second-order derivatives corresponding to the attack feature samples contained in the second attack feature sample set.

[0176] Exemplarily, the calculation expression of the splitting gain of the first candidate splitting point can refer to the following formula (12):

[0177]

[0178] Among them, G L It can represent the sum of the first-order derivatives corresponding to the attack feature samples included in the first attack feature sample set; H L G may represent the sum of the second-order derivatives corresponding to the attack feature samples included in the first attack feature sample set; R It can represent the sum of the first-order derivatives corresponding to the attack feature samples included in the second attack feature sample set; H R It can represent the sum of the second-order derivatives corresponding to the attack feature samples included in the first attack feature sample set; G can represent the sum of the first-order derivatives corresponding to multiple attack feature samples included in the current node; H can represent the sum of the second-order derivatives corresponding to multiple attack feature samples included in the current node; γ can represent the leaf node penalty coefficient in the first decision tree, which can be used to control the number of leaf nodes in the first decision tree to prevent overfitting; λ can represent the L2 regularization coefficient, which can be used to control the number of leaf nodes in the first decision tree to prevent overfitting.

[0179] In the embodiment of the present application, the electronic device can calculate the first objective function value according to the multiple attack feature samples corresponding to the current node; can classify the multiple attack feature samples corresponding to the current node according to the first candidate splitting point to obtain the first attack feature sample set and the second attack feature sample set, and the first candidate splitting point is any candidate splitting point; can calculate the second objective function value corresponding to the first attack feature sample set according to each attack feature sample included in the first attack feature sample set; can calculate the third objective function value corresponding to the second attack feature sample set according to each attack feature sample included in the second attack feature sample set; according to the first objective function value, the second objective function value and the third objective function value, the splitting gain of the first candidate splitting point can be determined. By determining the splitting gain of the first candidate splitting point, the candidate splitting point with the largest splitting gain can be determined from multiple candidate splitting points, minimizing the difference between the predicted value and the true value of the model, thereby improving the accuracy of the model prediction.

[0180] Step 530, taking the candidate splitting point with the largest splitting gain as the target splitting point of the current node, and classifying the multiple attack feature samples contained in the current node according to the target splitting point, to obtain the multiple attack feature samples corresponding to the left child node of the current node, and the multiple attack feature samples corresponding to the right child node of the current node.

[0181] Among them, the sample feature values ​​corresponding to the multiple attack feature samples corresponding to the left child node of the current node are greater than or equal to the target splitting point, and the sample feature values ​​corresponding to the multiple attack feature samples corresponding to the right child node of the current node are less than the target splitting point.

[0182] Step 540: Determine whether the tree depth of the first decision tree reaches a depth threshold.

[0183] After using the target splitting point to classify multiple attack feature samples contained in the current node, the electronic device can obtain the tree depth of the first decision tree and obtain a pre-stored depth threshold to determine whether the tree depth of the first decision tree reaches the depth threshold. If the tree depth of the first decision tree reaches the depth threshold, step 570 can be directly executed to determine that the generation of the first decision tree is completed.

[0184] Step 550: determine whether the number of attack feature samples corresponding to the left child node or the right child node is less than a quantity threshold.

[0185] In the case of determining that the tree depth of the first decision tree does not reach the depth threshold, the electronic device may obtain a pre-stored quantity threshold, and further determine whether the number of attack feature samples corresponding to the left child node of the current node is less than the quantity threshold. If the number of attack feature samples corresponding to the left child node is less than the quantity threshold, the electronic device may execute step 570 to determine that the first decision tree is generated; if the number of attack feature samples corresponding to the left child node is greater than the quantity threshold, the electronic device may determine whether the number of attack feature samples corresponding to the right child node is less than the quantity threshold. If the number of attack feature samples corresponding to the right child node is less than the quantity threshold, the electronic device may execute step 570 to determine that the first decision tree is generated; if the number of attack feature samples corresponding to the right child node is greater than the quantity threshold, the electronic device may continue to execute step 560. It should be noted that the judgment order of the left child node and the right child node may be swapped as needed.

[0186] Step 560: Take the left child node or the right child node whose number of attack feature samples is not less than the number threshold as the new current node.

[0187] When the electronic device determines that the tree depth of the first decision tree does not reach the depth threshold and the numbers of attack feature samples corresponding to the left child node and the right child node of the current node are both greater than the number threshold, the electronic device may use the left child node or the right child node whose number of attack feature samples is not less than the number threshold as the new current node and re-execute steps 520 to 550.

[0188] Step 570: Determine whether the generation of the first decision tree is complete.

[0189] The electronic device may determine that the generation of the first decision tree is complete when the tree depth of the first decision tree reaches a depth threshold, or when the number of attack feature samples corresponding to the left child node or the right child node is less than a number threshold.

[0190] In the embodiment of the present application, the electronic device can determine multiple candidate splitting points corresponding to each attack feature according to multiple attack feature samples contained in the current node of the first decision tree; can determine the splitting gain corresponding to each candidate splitting point according to the multiple attack feature samples contained in the current node; can use the candidate splitting point with the largest splitting gain as the target splitting point of the current node, and classify the multiple attack feature samples contained in the current node according to the target splitting point to obtain multiple attack feature samples corresponding to the left child node of the current node and multiple attack feature samples corresponding to the right child node of the current node; use the left child node or the right child node as the new current node, and re-execute the step of determining the candidate splitting points corresponding to multiple attack features according to the multiple attack feature samples corresponding to the current node, until the tree depth of the first decision tree reaches the depth threshold, or the number of attack feature samples corresponding to the left child node and the right child node is less than the number threshold, then it can be determined that the first decision tree is generated. By determining the best candidate splitting point of the node in the decision tree, and using the best candidate splitting point to classify the attack feature samples contained in the node, it can ensure that the loss of the generated decision tree is minimized, and the accuracy of the generated decision tree in predicting the attack feature samples can be improved.

[0191] In some embodiments, Figure 7 As shown, the decision tree includes multiple leaf nodes, each leaf node includes one or more attack feature samples. After the step of determining that the first decision tree is generated, the following steps may also be included:

[0192] Step 710: Calculate the fourth objective function value corresponding to each leaf node according to each attack feature sample contained in each leaf node in the first decision tree.

[0193] The fourth objective function value corresponding to each leaf node may be calculated by the sum of the first-order derivatives corresponding to the multiple attack feature samples included in the leaf node and the sum of the second-order derivatives corresponding to the multiple attack feature samples included in the leaf node.

[0194] Step 720, determining the weight corresponding to each leaf node according to the fourth objective function value corresponding to each leaf node.

[0195] The electronic device may determine the weight corresponding to each leaf node according to the fourth objective function value corresponding to each leaf node.

[0196] Exemplarily, the calculation expression of the weight corresponding to the leaf node can be referred to as the following formula (13).

[0197]

[0198] Among them, I j represents the index set of all attack feature samples belonging to leaf node j, represents the sum of the first-order derivatives corresponding to all attack feature samples in leaf node j, represents the sum of the second-order derivatives corresponding to all attack feature samples in leaf node j, λ represents the regularization parameter, and w j Represents the weight corresponding to leaf node j.

[0199] In the embodiment of the present application, the electronic device can calculate the fourth objective function value corresponding to each leaf node according to each attack feature sample contained in each leaf node in the first decision tree; and the weight corresponding to each leaf node can be determined according to the fourth objective function value corresponding to each leaf node. By calculating an objective function value for each leaf node and adjusting the weight of each leaf node based on this, it can help improve the model's recognition ability for specific response actions.

[0200] In some embodiments, Figure 8 As shown, after the step of determining that the security response model training is completed, the following steps may also be included:

[0201] Step 810, analyzing the first attack test sample included in the test set through each decision tree included in the trained security response model, and obtaining the predicted response action of each decision tree to the first attack test sample; the test set includes multiple attack test samples, each attack test sample includes an attack feature test vector, and a target response action corresponding to the attack feature test vector, and the first attack test sample is any attack test sample.

[0202] Step 820: The predicted response actions corresponding to the first attack test sample output by each decision tree are integrated to obtain a predicted response disposal plan corresponding to the first attack test sample.

[0203] Step 830 , calculating the error corresponding to the first attack test sample according to the predicted response disposal scheme and the target response action included in the first attack test sample.

[0204] Step 840, calculating the overall error of the test set according to the errors corresponding to the multiple attack test samples.

[0205] The above-mentioned overall error may include accuracy, precision, recall, F1 score, logarithmic loss, etc., which is not specifically limited in the embodiments of the present application.

[0206] For example, the overall error may be a logarithmic error. The calculation expression of the logarithmic error may refer to the following formula (14):

[0207]

[0208] Where N represents the number of attack test samples in the test set; K represents the number of response actions; y ikIt can represent the label of the i-th attack test sample belonging to the k-th response action, y ik =1 means that the i-th attack test sample belongs to the k-th response action, y ik = 0 means that the i-th attack test sample does not belong to the k-th response action; ik It can represent the probability that the ith attack test sample is predicted to be the kth response action. The probability that the ith attack test sample is predicted to be the kth response action can be calculated by the weight vector of each response action contained in the ith attack test sample and the probability conversion function.

[0209] Step 850, determining whether the overall error is greater than a preset error threshold.

[0210] The electronic device can obtain a pre-stored preset error threshold and determine whether the above-mentioned overall error is greater than the preset error threshold. When the above-mentioned overall error is greater than the preset error threshold, execute step 860 to continue training the security response model; when the above-mentioned overall error is less than the preset error threshold, execute step 870 to end the training of the security response model.

[0211] Step 860, continue training the security response model.

[0212] Step 870, ending the training of the security response model.

[0213] In the embodiment of the present application, the electronic device can analyze the first attack test sample contained in the test set through each decision tree contained in the trained security response model, and obtain the predicted response action of each decision tree to the first attack test sample; the test set includes multiple attack test samples, each attack test sample includes an attack feature test vector, and a target response action corresponding to the attack feature test vector, and the first attack test sample is any attack test sample; the predicted response action corresponding to the first attack test sample output by each decision tree is integrated to obtain the predicted response disposal scheme corresponding to the first attack test sample; according to the predicted response disposal scheme and the target response action contained in the first attack test sample, the error corresponding to the first attack test sample is calculated; according to the errors corresponding to the multiple attack test samples, the overall error of the test set is calculated; if the overall error is greater than the preset error threshold, the attack detection model continues to be trained. By calculating the error between the predicted response action and the target response action of each test sample, the performance of the security response model on the unreceived security log data can be accurately evaluated, and then through iterative training, the generalization ability and prediction accuracy of the security response model can be continuously improved.

[0214] See also Fig. 9 , Fig. 9 Schematic diagram of a security management device disclosed in an embodiment of the present application. Fig. 9 As shown, the security management device 900 may include a receiving module 910 , an acquiring module 920 , an extracting module 930 , an analyzing module 940 and a sending module 950 .

[0215] The receiving module 910 is used to receive security log data sent by multiple clients, where the multiple clients are deployed in different operating environments.

[0216] The acquisition module 920 is used to identify attack behaviors according to security log data and obtain attack source addresses corresponding to the attack behaviors.

[0217] The extraction module 930 is used to extract attack feature data from the security log data corresponding to the attack behavior.

[0218] The analysis module 940 is used to analyze the attack feature data through the trained security response model to obtain a response disposal plan.

[0219] The sending module 950 is used to send the response disposal plan and the attack source address to multiple clients respectively, so that each of the clients executes the response disposal plan when receiving the access behavior initiated by the attack source address.

[0220] In some embodiments, the security response model includes multiple decision trees; the analysis module 940 is also used to analyze the attack feature data through each decision tree to obtain the response action output by each decision tree; according to the preset learning rate, the response actions output by each decision tree are integrated to obtain a response disposal plan.

[0221] In some embodiments, the security response model is trained based on an attack sample set, the attack sample set includes multiple attack feature samples, each attack feature sample includes an attack sample feature vector, and a sample response action corresponding to the attack sample feature vector; the security management device 900 also includes a generation module and a determination module.

[0222] The generation module is used to generate multiple decision trees included in the security response model to be trained through the attack sample set.

[0223] The determination module is used to determine that the training of the security response model is completed if the number of generated decision trees reaches the target number, or the tree depth of any generated decision tree reaches the target depth.

[0224] In some embodiments, the attack sample feature vector includes sample feature values ​​corresponding to multiple attack features respectively, and the generation module is also used to determine multiple candidate splitting points corresponding to each attack feature according to the multiple attack feature samples contained in the current node of the first decision tree; determine the splitting gain corresponding to each candidate splitting point according to the multiple attack feature samples contained in the current node; use the candidate splitting point with the largest splitting gain as the target splitting point of the current node, and classify the multiple attack feature samples contained in the current node according to the target splitting point to obtain multiple attack feature samples corresponding to the left child node of the current node and multiple attack feature samples corresponding to the right child node of the current node; use the left child node or the right child node as the new current node, and re-execute the step of determining the candidate splitting points corresponding to the multiple attack features respectively according to the multiple attack feature samples corresponding to the current node, until the tree depth of the first decision tree reaches the depth threshold, or the number of attack feature samples corresponding to the left child node and the right child node is less than the number threshold, then it is determined that the generation of the first decision tree is completed.

[0225] In some embodiments, the generation module is also used to calculate a first objective function value based on multiple attack feature samples corresponding to the current node; classify the multiple attack feature samples corresponding to the current node according to the first candidate splitting point to obtain a first attack sample feature set and a second attack sample feature set, and the first candidate splitting point is any candidate splitting point; calculate the second objective function value corresponding to the first attack sample feature set according to each attack feature sample included in the first attack sample feature set; calculate the third objective function value corresponding to the second attack sample feature set according to each attack feature sample included in the second attack sample feature set; determine the splitting gain of the first candidate splitting point according to the first objective function value, the second objective function value and the third objective function value.

[0226] In some embodiments, the decision tree includes multiple leaf nodes, each leaf node includes one or more attack feature samples, and the security management device 900 also includes a function value calculation module and a weight calculation module.

[0227] A function value calculation module, used to calculate a fourth objective function value corresponding to each leaf node according to each attack feature sample contained in each leaf node in the first decision tree;

[0228] The weight calculation module is used to determine the weight corresponding to each leaf node according to the fourth objective function value corresponding to each leaf node.

[0229] In an embodiment of the present application, an electronic device can receive security log data from multiple clients, identify attack behaviors in the security log data, and obtain the attack source address corresponding to the attack behavior, so that the attack source address of the attack behavior against any client can be obtained from the security log data; the attack feature data in the security log data corresponding to the attack behavior is extracted, and the attack feature data is analyzed by a trained security response model to obtain a response disposal plan, and the response disposal plan and the attack source address corresponding to the attack behavior are sent to the multiple clients, so that each client that has not received the attack behavior initiated by the attack source address can execute the response disposal plan when it receives the access behavior initiated by the attack source address, so that multiple clients can respond to and dispose of the attack behavior initiated by the same attack source address in a timely manner, thereby improving the overall security protection capability.

[0230] See also Fig.10 , Fig.10 Schematic diagram of the structure of an electronic device disclosed in the embodiment of the present application. Fig.10 As shown, the electronic device 1000 may include:

[0231] A memory 1010 storing executable program codes;

[0232] a processor 1020 coupled to the memory 1010;

[0233] The processor 1020 calls the executable program code stored in the memory 1010 to execute any one of the polishing endpoint detection methods disclosed in the embodiments of the present application.

[0234] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by the processor, the processor implements any one of the polishing endpoint detection methods disclosed in the embodiment of the present application.

[0235] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. Those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required for the present application.

[0236] In the various embodiments of the present application, it should be understood that the size of the serial numbers of the above-mentioned processes does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0237] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0238] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0239] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-accessible memory. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several requests for a computer device (which can be a personal computer, a server or a network device, etc., specifically a processor in a computer device) to perform some or all of the steps of the above-mentioned methods of various embodiments of the present application.

[0240] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0241] The above is a detailed introduction to a polishing endpoint detection method, device, electronic device and storage medium disclosed in the embodiment of the present application. The principle and implementation method of the present application are described in detail using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those of ordinary skill in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. A safety management method, characterized in that: Applied to electronic equipment, the method comprises: Receiving security log data sent by multiple clients, wherein the multiple clients are respectively deployed in different operating environments; Identify attack behaviors according to the security log data, and obtain attack source addresses corresponding to the attack behaviors; Extracting attack feature data from security log data corresponding to the attack behavior; Analyze the attack feature data through the trained security response model to obtain a response and disposal plan; The response handling scheme and the attack source address are sent to the multiple clients respectively, so that each of the clients executes the response handling scheme when receiving the access behavior initiated by the attack source address.

2. The method according to claim 1, characterized in that The security response model includes a plurality of decision trees; the security response model completed through training analyzes the attack feature data to obtain a response disposal plan, including: Analyzing the attack feature data through each decision tree to obtain a response action output by each decision tree; According to the preset learning rate, the response actions output by each decision tree are integrated to obtain a response disposal plan.

3. The method according to claim 1, characterized in that The security response model is trained according to an attack sample set, wherein the attack sample set includes a plurality of attack feature samples, each of which includes an attack sample feature vector and a sample response action corresponding to the attack sample feature vector; Before the trained security response model analyzes the attack feature data to obtain a response solution, the method further includes: Generate multiple decision trees included in the security response model to be trained through the attack sample set; If the number of generated decision trees reaches the target number, or the tree depth of any of the generated decision trees reaches the target depth, it is determined that the training of the security response model is completed.

4. The method according to claim 3, characterized in that The attack sample feature vector includes sample feature values ​​corresponding to a plurality of attack features respectively. The plurality of decision trees included in the security response model to be trained are generated by using the attack sample set, including: Determine, according to a plurality of attack feature samples included in a current node of the first decision tree, a plurality of candidate splitting points corresponding to each of the attack features; Determine, according to a plurality of attack feature samples included in the current node, a splitting gain corresponding to each of the candidate splitting points; The candidate splitting point with the largest splitting gain is used as the target splitting point of the current node, and multiple attack feature samples contained in the current node are classified according to the target splitting point to obtain multiple attack feature samples corresponding to the left child node of the current node and multiple attack feature samples corresponding to the right child node of the current node; The left child node or the right child node is used as a new current node, and the step of determining the candidate splitting points corresponding to the multiple attack features respectively according to the multiple attack feature samples corresponding to the current node is re-executed until the tree depth of the first decision tree reaches a depth threshold, or the number of attack feature samples corresponding to the left child node or the right child node is less than a number threshold, then it is determined that the generation of the first decision tree is completed.

5. The method according to claim 4, characterized in that The determining, according to the multiple attack feature samples included in the current node, the splitting gain corresponding to each of the candidate splitting points includes: Calculating a first objective function value according to a plurality of attack feature samples corresponding to the current node; Classifying a plurality of attack feature samples corresponding to the current node according to a first candidate splitting point to obtain a first attack sample feature set and a second attack sample feature set, wherein the first candidate splitting point is any of the candidate splitting points; Calculating a second objective function value corresponding to the first attack sample feature set according to each attack feature sample included in the first attack sample feature set; Calculating a third objective function value corresponding to the second attack sample feature set according to each attack feature sample included in the second attack sample feature set; A splitting gain of the first candidate splitting point is determined according to the first objective function value, the second objective function value, and the third objective function value.

6. The method according to claim 4, characterized in that The decision tree includes a plurality of leaf nodes, each of which includes one or more attack feature samples. After determining that the first decision tree is generated, the method further includes: Calculate the fourth objective function value corresponding to each leaf node in the first decision tree according to each attack feature sample contained in each leaf node; The weight corresponding to each leaf node is determined according to the fourth objective function value corresponding to each leaf node.

7. The method according to any one of claims 3 to 6, characterized in that: After determining that the security response model training is completed, the method further includes: By analyzing the first attack test sample contained in the test set through each decision tree included in the trained security response model, a predicted response action of each decision tree to the first attack test sample is obtained; the test set includes multiple attack test samples, each of the attack test samples includes an attack feature test vector, and a target response action corresponding to the attack feature test vector, and the first attack test sample is any of the attack test samples; The predicted response actions corresponding to the first attack test sample output by each decision tree are integrated to obtain a predicted response disposal plan corresponding to the first attack test sample; Calculating an error corresponding to the first attack test sample according to the predicted response disposal scheme and the target response action included in the first attack test sample; Calculating the overall error of the test set according to the errors respectively corresponding to the multiple attack test samples; If the overall error is greater than a preset error threshold, the safety response model continues to be trained.

8. A security management device, characterized in that: Applied to electronic equipment, the device comprises: A receiving module, used to receive security log data sent by multiple clients, wherein the multiple clients are respectively deployed in different operating environments; An acquisition module, used to identify attack behaviors according to the security log data, and obtain an attack source address corresponding to the attack behaviors; An extraction module, used to extract attack feature data from the security log data corresponding to the attack behavior; An analysis module is used to analyze the attack feature data through a trained security response model to obtain a response disposal plan; The sending module is used to send the response processing scheme and the attack source address to the multiple clients respectively, so that each of the clients executes the response processing scheme when receiving the access behavior initiated by the attack source address.

9. An electronic device, characterized in that: include: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 7.

Images