Feature extraction model training method and device, storage medium and electronic equipment

By adopting circular dynamic model training strategies and generating adversarial network sample amplification technology in scripting language vulnerability detection, the problems of limited coverage and low efficiency of vulnerability detection in the existing technology are solved, and more effective semantic feature extraction and vulnerability detection effects are achieved.

CN119513607AActive Publication Date: 2025-02-25GUANGZHOU ZHONO ELECTRONICS TECH CO LTD
View PDF 4 Cites 0 Cited by

Patent Information

Application Number
CN202411650546.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2024-11-18
Publication Date
2025-02-25
Estimated Expiration
2044-11-18

AI Technical Summary

Technical Problem

When using scripting languages ​​to detect vulnerabilities, the detection coverage is limited and the efficiency is not high. Especially due to the dynamic changes and complexity of scripting languages, it makes it difficult to extract effective semantic features during model training.

Method used

Through a feature extraction model training method, a circular dynamic model training strategy is used to divide the model training process into different stages, and different optimization strategies are adopted at each stage, including the first learning strategy and the second learning strategy, using the generative adversarial network for sample amplification, and the parameters of the generative adversarial network are updated through the quasi-Newtonian method.

Benefits of technology

Effectively extracting semantic features from scripting languages ​​improves the coverage and efficiency of vulnerability detection, reduces the risk of overfitting, and allows the model to adapt to changes in training data more flexibly.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN119513607A_ABST
    Figure CN119513607A_ABST
Patent Text Reader

Abstract

The invention provides a feature extraction model training method and device, a storage medium and electronic equipment. In the method, the electronic equipment obtains a sample script set; training a current to-be-trained model through a first learning strategy to extract features from the sample script set until the current to-be-trained model reaches preset performance; training the current to-be-trained model through a second learning strategy to extract features from the sample script set; and iterating the above steps until the current to-be-trained model meets the iteration stop condition of the feature extraction model. Thus, the training process of the model is divided into different stages, and different optimization strategies are adopted in each training stage, so that the model can more flexibly adapt to the change of training data to reduce the risk of overfitting, thereby effectively jumping out of a local optimal solution, and improving the accuracy of the model training. And the trained feature extraction model can extract effective semantic features from the script.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The present application relates to the field of neural networks, and more specifically, to a feature extraction model training method, device, storage medium and electronic device. Background Art

[0002] Scripting languages ​​are popular for their convenience and efficiency. They greatly simplify the programming process, allowing developers to quickly implement various functions with less code. At the same time, scripting languages ​​usually have excellent automation and text processing capabilities. However, current scripting languages ​​are still insufficient in vulnerability detection, mainly manifested in limited detection coverage and low efficiency.

[0003] Take TCL (Tool Command Language) script as an example. This script is widely used in digital back-end processing, such as layout, routing, timing analysis, etc. Its security and correctness directly affect the quality and reliability of the entire chip design. With the increase in the complexity of integrated circuit design and the shortening of design cycles, traditional manual inspection methods can no longer meet the needs of rapid development. Therefore, a script vulnerability prediction method based on a neural network model is proposed in the relevant technology.

[0004] However, in practice, it is found that scripting language, as a weakly typed computer language, provides certain grammatical constraints, but it actually has a higher degree of freedom compared to strongly typed computer languages. Therefore, the dynamic changes and complexity of the scripts make it difficult to extract effective semantic features during model training, thus affecting the trained model's ability to identify vulnerabilities in the scripts. Therefore, it is urgent to provide a model training method for scripting languages ​​so that the model can learn effective semantic features from scripting languages. Summary of the invention

[0005] In order to overcome at least one of the deficiencies in the prior art, the present application provides a feature extraction model training method, device, storage medium and electronic device, specifically including:

[0006] In a first aspect, the present application provides a feature extraction model training method, the method comprising:

[0007] Get the sample script set;

[0008] Training the current model to be trained by the first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance;

[0009] Training the current model to be trained by a second learning strategy to extract features from the sample script set;

[0010] The above steps are iterated until the current model to be trained meets the iteration stop condition for serving as the feature extraction model.

[0011] In combination with the optional implementation manner of the first aspect, the step of training the current model to be trained by using the first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance includes:

[0012] Processing the sample script set according to the current model to be trained to obtain a first feature extraction loss, and updating the current model to be trained at a first learning rate;

[0013] Generate new weights for the current model to be trained based on the existing weights of the current model to be trained;

[0014] The above steps are iterated until the current model to be trained reaches the preset performance.

[0015] In combination with an optional implementation manner of the first aspect, the first learning rate includes a preset basic learning rate and a target acceleration coefficient, and the first feature extraction loss obtained by processing the sample script set according to the current model to be trained, and updating the current model to be trained at the first learning rate, includes:

[0016] The first feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a descent speed and curvature of a corresponding loss function;

[0017] According to the descent speed and curvature, the target acceleration coefficient is obtained;

[0018] Update the current model to be trained according to the basic learning rate and the target acceleration factor.

[0019] In combination with the optional implementation manner of the first aspect, the step of training the current model to be trained by using the second learning strategy to extract features from the sample script set includes:

[0020] A second feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a gradient of a corresponding loss function;

[0021] Generating fine-tuning parameters of the current model to be trained according to the gradient; and updating the current model to be trained by using the fine-tuning parameters;

[0022] Prune the weights of the current model to be trained;

[0023] The current model to be trained is updated at a second learning rate according to a third feature extraction loss obtained by processing the sample script set according to the current model to be trained.

[0024] In combination with the optional implementation manner of the first aspect, the gradient includes a weight gradient and a bias gradient, the fine-tuning parameter includes a weight fine-tuning parameter and a bias fine-tuning parameter, and generating the fine-tuning parameter of the current model to be trained according to the gradient includes:

[0025] Obtaining a first cosine value of the product of the weight gradient and a preset amplitude parameter;

[0026] Determine the product of the first cosine value and a preset frequency parameter as the weight fine-tuning parameter;

[0027] Obtaining a second cosine value of the product of the bias gradient and a preset amplitude parameter;

[0028] The product of the second cosine value and a preset frequency parameter is determined as the offset fine-tuning parameter.

[0029] In combination with the optional implementation manner of the first aspect, the learning rate of the first learning strategy is greater than the learning rate of the second learning strategy.

[0030] In combination with the optional implementation manner of the first aspect, the sample script set includes extended samples generated by the sample augmentation model, and the method further includes:

[0031] Get the original script set;

[0032] Obtaining a current gradient of a corresponding loss function according to a model loss obtained by processing the original script set in a current generative adversarial network;

[0033] According to the current gradient and the historical gradient during the previous iteration, the current generative adversarial network is updated by the quasi-Newton method;

[0034] Iterate the above steps until the current generative adversarial network meets the iteration stop condition as a sample augmentation model.

[0035] In combination with the optional implementation manner of the first aspect, updating the current generative adversarial network by the quasi-Newton method according to the current gradient and the historical gradient during the previous iteration includes:

[0036] Obtain an approximate Hessian matrix of the quasi-Newton method according to the historical gradient calculation;

[0037] The current gradient is adjusted by the approximate Hessian matrix, and the current generative adversarial network is updated according to the adjusted current gradient.

[0038] In a second aspect, the present application also provides a feature extraction model training device, the device comprising:

[0039] A sample acquisition module is used to acquire a sample script set;

[0040] A model training module, used for training the current model to be trained to extract features from the sample script set by using a first learning strategy until the current model to be trained reaches a preset performance;

[0041] Training the current model to be trained by a second learning strategy to extract features from the sample script set;

[0042] The above steps are iterated until the current model to be trained meets the iteration stop condition for serving as the feature extraction model.

[0043] In conjunction with the optional implementation manner of the second aspect, the model training module is further specifically used for:

[0044] Processing the sample script set according to the current model to be trained to obtain a first feature extraction loss, and updating the current model to be trained at a first learning rate;

[0045] Generate new weights for the current model to be trained based on the existing weights of the current model to be trained;

[0046] The above steps are iterated until the current model to be trained reaches the preset performance.

[0047] In conjunction with the optional implementation manner of the second aspect, the first learning rate includes a preset basic learning rate and a target acceleration coefficient, and the model training module is further specifically used for:

[0048] The first feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a descent speed and curvature of a corresponding loss function;

[0049] According to the descent speed and curvature, the target acceleration coefficient is obtained;

[0050] Update the current model to be trained according to the basic learning rate and the target acceleration factor.

[0051] In conjunction with the optional implementation manner of the second aspect, the model training module is further specifically used for:

[0052] A second feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a gradient of a corresponding loss function;

[0053] Generating fine-tuning parameters of the current model to be trained according to the gradient; and updating the current model to be trained by using the fine-tuning parameters;

[0054] Prune the weights of the current model to be trained;

[0055] The current model to be trained is updated at a second learning rate according to a third feature extraction loss obtained by processing the sample script set according to the current model to be trained.

[0056] In conjunction with the optional implementation manner of the second aspect, the gradient includes a weight gradient and a bias gradient, the fine-tuning parameter includes a weight fine-tuning parameter and a bias fine-tuning parameter, and the model training module is further specifically used for:

[0057] Obtaining a first cosine value of the product of the weight gradient and a preset amplitude parameter;

[0058] Determine the product of the first cosine value and a preset frequency parameter as the weight fine-tuning parameter;

[0059] Obtaining a second cosine value of the product of the bias gradient and a preset amplitude parameter;

[0060] The product of the second cosine value and a preset frequency parameter is determined as the offset fine-tuning parameter.

[0061] In combination with the optional implementation manner of the second aspect, the learning rate of the first learning strategy is greater than the learning rate of the second learning strategy.

[0062] In conjunction with the optional implementation manner of the second aspect, the sample script set includes extended samples generated by the sample amplification model, and the method sample acquisition module is further used to:

[0063] Get the original script set;

[0064] The model training module is further used to obtain the current gradient of the corresponding loss function according to the model loss obtained by processing the original script set in the current generative adversarial network;

[0065] According to the current gradient and the historical gradient during the previous iteration, the current generative adversarial network is updated by the quasi-Newton method;

[0066] Iterate the above steps until the current generative adversarial network meets the iteration stop condition as a sample augmentation model.

[0067] In conjunction with the optional implementation manner of the second aspect, the model training module is further specifically used for:

[0068] Obtain an approximate Hessian matrix of the quasi-Newton method according to the historical gradient calculation;

[0069] The current gradient is adjusted by the approximate Hessian matrix, and the current generative adversarial network is updated according to the adjusted current gradient.

[0070] In a third aspect, the present application also provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the feature extraction model training method is implemented.

[0071] In a fourth aspect, the present application also provides an electronic device, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the feature extraction model training method is implemented.

[0072] Compared with the prior art, this application has the following beneficial effects:

[0073] The present application provides a feature extraction model training method, device, storage medium and electronic device. In the method, the electronic device obtains a sample script set; trains the current model to be trained through a first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance; trains the current model to be trained through a second learning strategy to extract features from the sample script set; iterates the above steps until the current model to be trained meets the iteration stop condition as a feature extraction model. In this way, the training process of the model is divided into different stages, and different optimization strategies are adopted in each training stage, so that the model can adapt to changes in training data more flexibly to reduce the risk of overfitting, so that it can effectively jump out of the local optimal solution, so that the trained feature extraction model can extract effective semantic features from the script. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0075] Figure 1 One of the flow charts of the feature extraction model training method provided in the embodiment of the present application;

[0076] Figure 2 The second flowchart of the feature extraction model training method provided in the embodiment of the present application;

[0077] Figure 3 A training flow chart of a sample expansion model provided in an embodiment of the present application;

[0078] Figure 4 A schematic diagram of the structure of a generative adversarial network provided in an embodiment of the present application;

[0079] Figure 5 A schematic diagram of the structure of a feature extraction model training device provided in an embodiment of the present application;

[0080] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0082] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0083] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0084] In the description of the present application, it should be noted that the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. In addition, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0085] Based on the above statement, as introduced in the background technology, the dynamic changes and complexity of the script make it difficult to extract effective semantic features during the model training process, thereby affecting the trained model's ability to identify vulnerabilities in the script. Therefore, it is urgent to provide a model training method for the script language so that the model can learn effective semantic features from the script language.

[0086] Based on the discovery of the above technical problems, the inventors have proposed the following technical solutions to solve or improve the above problems through creative work. It should be noted that the defects in the solutions in the above prior art are the results obtained by the inventors after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed in the embodiments of the present application for the above problems below should all be the contributions made by the inventors to the present application in the process of invention and creation, and should not be understood as technical contents known to those skilled in the art.

[0087] In view of this, the present embodiment provides a feature extraction model training method. In the method, an electronic device obtains a sample script set; trains the current model to be trained through a first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance; trains the current model to be trained through a second learning strategy to extract features from the sample script set, wherein the learning rate of the first learning strategy is greater than the learning rate of the second learning strategy; iterates the above steps until the current model to be trained meets the iteration stop condition as a feature extraction model. In this way, the training process of the model is divided into different stages, and different optimization strategies are adopted in each training stage, so that the model can adapt to changes in training data more flexibly to reduce the risk of overfitting, thereby effectively jumping out of the local optimal solution, so that the trained feature extraction model can extract effective semantic features from the script.

[0088] It is worth noting that the electronic device implementing the above-mentioned feature extraction model training method may be, but is not limited to, a mobile terminal, a tablet computer, a laptop computer, a desktop computer, and a server, etc. The server may be a single server or a server group. The server group may be centralized or distributed (for example, the server may be a distributed system). In some embodiments, the server may be local or remote relative to the user terminal. In some embodiments, the server may be implemented on a cloud platform; as an example only, the cloud platform may include a private cloud, a public cloud, a hybrid cloud, a community cloud (Community Cloud), a distributed cloud, an inter-cloud (Inter-Cloud), a multi-cloud (Multi-Cloud), etc., or any combination thereof. In some embodiments, the server may be implemented on an electronic device having one or more components.

[0089] To make the solution provided by this embodiment clearer, the following uses a server as an electronic device for implementing the feature extraction model training method, and combines Figure 1 Each step of the method is described in detail. However, it should be understood that the operations of the flowchart may not be implemented in order, and steps without logical contextual relationships may be reversed in order or implemented simultaneously. In addition, those skilled in the art may add one or more other operations to the flowchart, or remove one or more operations from the flowchart under the guidance of the content of this application. Figure 1 As shown, the method includes:

[0090] S1A, Get a sample script set.

[0091] The sample script set includes multiple script codes recorded in text form. These script codes can be any one of scripting languages ​​such as TCL, Python, JavaScript, PHP, etc. It can be understood that the method provided in this embodiment is applicable to multiple scripting languages, not limited to TCL scripts.

[0092] In addition, it should be noted that the model to be trained is a neural network. Exemplarily, the neural network can adopt a 2-layer hidden layer structure, the first hidden layer includes 100 neurons, the second hidden layer includes 50 neurons, and the activation function is the ReL_RU activation function. Like a conventional neural network, before training it through a sample script set, it needs to go through a series of initialization operations. That is, the server needs to initialize the weights w of the model to be trained. r and bias b r Initialize and set the initial learning rate In an optional implementation, the initial weights and biases may be set as follows:

[0093]

[0094] In the formula, ~ means that it obeys a specific distribution, that is, The mean is 0 and the variance is The normal distribution. is the variance of the initial distribution. In this embodiment The value of is 0.01.

[0095] Continue to see Figure 1 , the feature extraction model training method also includes:

[0096] S2A, training the current model to be trained by the first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance.

[0097] It should be noted that, considering that the dynamic changes and complexity of the script make it difficult to extract effective semantic features during the model training process, the inventor was inspired by the periodic metabolic process of biological cells, that is, to optimize the response and adaptability of the organism through different mechanisms at different stages. Therefore, by simulating the various stages in the cell cycle, this embodiment proposes a circular dynamic model training method for optimizing the parameters of the model to be trained. It can be understood that this embodiment divides the training process of the model to be trained into multiple stages, and each stage adopts different strategies to adjust the weights and biases of the neural network, so that the model to be trained can adapt to changes in training data more flexibly.

[0098] Similar to the periodic metabolic process of biological cells, this embodiment divides the training process of the model to be trained into "growth period, synthesis period, evaluation period, pre-mitosis period, mitosis period, and dormancy period". Among them, the first learning strategy corresponds to the three stages of "growth period, synthesis period, and evaluation period". The following is a detailed description of the three stages, that is, Figure 2 As shown, Figure 1 Step S2A in the embodiment specifically includes:

[0099] S2A-1, updating the current model to be trained at a first learning rate according to a first feature extraction loss obtained by processing the sample script set by the current model to be trained.

[0100] In this embodiment, the first learning rate corresponds to the "growth period", during which the weight adjustment amount needs to be increased to quickly adapt to the characteristics of the training data. Therefore, in addition to the preset basic learning rate, the first learning rate also includes a target acceleration coefficient. Based on the basic learning rate and the target acceleration coefficient, the server can obtain the first feature extraction loss obtained by processing the sample script set according to the current model to be trained, and obtain the descent speed and curvature of the corresponding loss function; obtain the target acceleration coefficient according to the descent speed and curvature; and update the current model to be trained according to the basic learning rate and the target acceleration coefficient.

[0101] Exemplarily, the updating method of the first learning rate can be expressed as:

[0102]

[0103] Where η r represents the basic learning rate, γ r Indicates the target acceleration factor, L R Represents the loss function of the model to be trained, for example, using cross entropy loss; represents the gradient of the loss function with respect to the weight parameter, represents the gradient of the loss function with respect to the bias parameter, represents the weight parameter after the tth iteration, represents the weight parameter after the t+1th iteration, represents the bias parameter after the tth iteration, represents the bias parameter after the t+1th iteration, Mathematical symbol representing partial derivative operation.

[0104] For the target acceleration factor γ in the above expression r, this embodiment is set by the descent speed and curvature of the loss function to avoid over-adjustment. In addition, a preset maximum acceleration coefficient is provided to limit the maximum value of the acceleration coefficient. Therefore, the server obtains the candidate acceleration coefficient of the basic learning rate according to the descent speed and curvature; then, the smallest one is selected from the candidate acceleration coefficient and the preset maximum acceleration coefficient as the target acceleration coefficient of the basic learning rate.

[0105] For this, the calculation expression of the target acceleration coefficient is as follows:

[0106]

[0107] In the formula, It indicates the preset maximum acceleration factor, and min() indicates the minimum value function.

[0108] In this way, during the growth period of the model to be trained, a target acceleration factor is introduced based on the basic learning rate to improve the convergence rate of the model.

[0109] S2A-2, generating new weights for the current model to be trained based on the existing weights of the current model to be trained.

[0110] In this embodiment, generating new weights for the current model to be trained corresponds to the "synthesis phase", that is, synthesizing multiple weight parameters into new parameters through specific operations, thereby improving the generalization ability of the network. In this embodiment, the function that uses multiple weight parameters to synthesize new parameters is called the synthesis function S(w r ), the expression is:

[0111]

[0112] In the formula, represents the i-th weight parameter, represents the importance coefficient of the ith weight parameter, and nr represents the number of weight parameters. Among them, the importance coefficient of the ith weight parameter is related to the gradient size of the weight parameter in the "growth period", and the expression for the importance coefficient of the ith weight parameter is:

[0113]

[0114] In the formula, σ wr Represents the attenuation speed parameter, and its calculation expression is:

[0115]

[0116] Thus, a new weight is generated for the current model to be trained through the above embodiment. After the above growth period and synthesis period, the model to be trained enters the "evaluation period", so step S2A also includes:

[0117] S2A-3, determine whether the current model to be trained reaches the preset performance. If so, continue to execute step S3A. Otherwise, return to execute step S2A-1 to continue to quickly adjust the parameters of the model to be trained.

[0118] It can be understood that after entering the evaluation period of the model to be trained, it is necessary to evaluate whether the performance of the current model to be trained reaches the preset performance after rapid convergence, and to decide whether to enter the next "early split period" based on this. In this regard, this embodiment provides a performance evaluation function P(w r ,b r ), used to determine whether to enter the next cycle, the performance evaluation function P(w r ,b r ) is expressed as:

[0119]

[0120] In the formula, θ r represents the performance threshold, which is 0.5. That is, after the features extracted by the current training model are input into the vulnerability identification model, its recognition accuracy is lower than 0.5. L(w r ,b r ) is 1, it will enter the growth phase again, otherwise, it will enter the next prophase. Figure 1 , after step S2, the method further comprises:

[0121] S3A, trains the current model to be trained through the second learning strategy to extract features from the sample script set.

[0122] In this embodiment, it is necessary to enable the model to be trained to quickly adapt to the training data in the first stage, and to make minor adjustments to the parameters of the model in the second stage. Therefore, as an optional implementation, the learning rate of the first learning strategy can be greater than the learning rate of the second learning strategy. In this way, the model to be trained can quickly adapt to the training data to improve the training efficiency.

[0123] As described in the above embodiment for the periodic metabolic process of biological cells, the second learning strategy of this embodiment corresponds to the above three stages of "pre-mitotic phase, mitotic phase, and dormant phase". The following is a detailed description of the three stages. Figure 2 As shown, Figure 1 Step S3A in the embodiment specifically includes:

[0124] S3A-1, obtaining the gradient of the corresponding loss function according to the second feature extraction loss obtained by processing the sample script set according to the current model to be trained.

[0125] S3A-2, generating fine-tuning parameters of the current model to be trained according to the gradient; and updating the current model to be trained through the fine-tuning parameters.

[0126] In this embodiment, updating the current model to be trained by fine-tuning parameters corresponds to the "prophase" in which the cells are simulated to prepare for division. Therefore, only slight adjustments need to be made to the current model to be trained. Therefore, as an optional implementation of S3A-2, the server can obtain the first cosine value of the product between the weight gradient and the preset amplitude parameter; determine the product between the first cosine value and the preset frequency parameter as the weight fine-tuning parameter; obtain the second cosine value of the product between the bias gradient and the preset amplitude parameter; and determine the product between the second cosine value and the preset frequency parameter as the bias fine-tuning parameter.

[0127] Exemplarily, the calculation expressions of weight fine-tuning parameters and bias fine-tuning parameters can be expressed as:

[0128]

[0129] In the formula, Δw r represents the weight fine-tuning parameter, Δb r represents the bias fine-tuning parameter, represents the weight gradient, represents the bias gradient, β r represents the preset amplitude parameter, ξ r represents a preset frequency parameter. As an optional implementation, ξ r The value can be 5, β r The possible value is 3.14.

[0130] For the above ξ r With β r , can also be calculated by:

[0131]

[0132] In the formula, ρ r It represents the scaling factor of the perturbation amplitude, and its value can be 0.95.

[0133] After the above-mentioned “early split stage”, the model to be trained enters the “split stage”, so step S3A also includes:

[0134] S3A-3, prune the weights of the current model to be trained.

[0135] At this stage, the structure of the training model needs to be greatly adjusted. Therefore, the weight pruning method is adopted to optimize the training model. It should be noted that in the training process of the neural network model, weight pruning is a common optimization method, that is, by removing unimportant weights in the network, the complexity of the model is reduced, thereby reducing the computing cost and storage requirements. In this embodiment, the weight parameters whose gradients are greater than the preset gradient threshold are retained. Therefore, the weight pruning function R(w r ) is as follows:

[0136]

[0137] In the formula, λ r Indicates the gradient threshold. In this implementation, the gradient threshold can be set to 0.01, that is, weights with gradients greater than 0.01 are retained.

[0138] After the above-mentioned "splitting period", the model to be trained enters the "dormant period", so step S3A also includes:

[0139] S3A-4, updating the current model to be trained at a second learning rate according to the third feature extraction loss obtained by processing the sample script set by the current model to be trained.

[0140] In this embodiment, the dormant period means that the weight of the model to be trained gradually tends to be stable, which means that the learning rate of the model needs to be reduced. Therefore, the second learning rate in the dormant period is much smaller than the first learning rate in the growth period. In order to determine a more appropriate learning rate, the server can determine the second learning rate according to the current number of iterations, where the second learning rate is inversely correlated with the current number of iterations. The corresponding expression is as follows:

[0141]

[0142] Where η r represents the second learning rate, δ r represents the attenuation coefficient, which can be set to 0.95, k r Indicates the current iteration number.

[0143] In this way, after the training model is trained first fast and then slowly through the first learning strategy and the second learning strategy, it is necessary to further determine whether it can be used as a feature extraction model. Therefore, if Figure 1 As shown, after step S3, the feature extraction model training method further includes:

[0144] S4A, determining whether the current model to be trained satisfies the iteration stop condition as a feature extraction model, if not, returning to step S2 to execute, otherwise, executing step S5.

[0145] S5A, uses the current model to be trained as a feature extraction model.

[0146] In this way, after at least one round of iteration, the model to be trained is trained into a feature extraction model. Since different strategies are used to adjust the weights and biases at each stage, the trained feature extraction model can more flexibly adapt to scripts with various forms.

[0147] In addition, it was found in practice that the collection, acquisition, annotation and preprocessing of training data are time-consuming and labor-intensive, especially scripts with logical vulnerabilities are difficult to obtain in large quantities. Insufficient training samples can easily lead to poor generalization ability of the model and affect the accuracy of the model. Therefore, the sample script set of the above-mentioned training feature extraction model includes extended samples generated by the sample augmentation model. Therefore, this embodiment also provides a method for training the sample augmentation model. Figure 3 As shown, the method includes:

[0148] S1B, Get the original script set.

[0149] The original script set refers to the actual script data set collected, that is, these script data are usually obtained through actual use in real application scenarios or collection of specific tasks, and are authentic and representative. Therefore, the original script set is the basis for building high-quality training data. This embodiment uses these original script sets as samples to train the generative adversarial network to obtain a sample augmentation model that can generate high-quality extended samples.

[0150] like Figure 4 As shown in Figure 1, the generative adversarial network consists of two parts: the generator (G) and the discriminator (D). Taking the TCL script as an example, the working principle is as follows: the generator uses the input data (for example, random noise) to generate TCL script code data that approximates the real thing, and the discriminator is responsible for distinguishing whether the input data comes from the real original script set or the data generated by the generator.

[0151] Based on the above implementation, the original script is introduced in the generative adversarial network. Figure 3 , the method further comprises:

[0152] S2B, according to the model loss obtained by processing the original script set in the current generative adversarial network, obtains the current gradient of the corresponding loss function.

[0153] S3B, updates the current generative adversarial network through the quasi-Newton method based on the current gradient and the historical gradient during the previous iteration.

[0154] It should be noted that in the training process of the generative adversarial network, the model loss is an indicator used to evaluate the performance of the generator (G) and the discriminator (D). Specifically, the model loss reflects the difference between the script data generated by the current generator and the real script data, as well as the accuracy of the discriminator in distinguishing between real data and generated data. By calculating the model loss, the current gradient of the loss function can be obtained, and then the parameters of the generator and the discriminator can be adjusted to gradually optimize their performance. However, it was found in practice that the parameter update method of the traditional generative adversarial network has the problems of poor training stability and slow convergence speed. In this regard, the present embodiment updates the parameters of the generative adversarial network through the improved quasi-Newton method. The improved quasi-Newton method can more effectively adjust the network weights, speed up the convergence speed, and improve the quality of the generated data. That is, step S3B includes:

[0155] S3B-1, the approximate Hessian matrix of the quasi-Newton method is calculated based on the historical gradient.

[0156] S3B-2, adjusts the current gradient by approximating the Hessian matrix, and updates the current generative adversarial network according to the adjusted current gradient.

[0157] S4B, determine whether the current generative adversarial network meets the iteration stop condition as a sample augmentation model. If yes, execute S5B, otherwise, execute step S2B.

[0158] S5B, using the current generative adversarial network as a sample augmentation model.

[0159] For example, the following uses the TCL script as an example to explain the training method of the generative adversarial network in detail:

[0160] First, the server initializes the network parameters of the generator and the discriminator. For example, it can be initialized by a small random number. The random initialization method can be expressed as:

[0161] θ g ←rand(-0.1,0.1)

[0162] θ d ←rand(-0.1,0.1)

[0163] In the formula, θ g represents the parameters of the generator, θ d Represents the parameters of the discriminator.

[0164] Then, a batch is randomly selected from the existing TCL original script set for discriminator training. The selected data is represented as:

[0165] D batch ={d1,d2,…,dm}

[0166] The generator receives random noise as input and generates a batch of TCL fake scripts through forward propagation, which can be expressed as:

[0167] G batch =g(z;θ g )

[0168] In the formula, G batch represents a batch of TCL forged scripts, and z represents the generated random noise.

[0169] Next, the discriminator receives both fake data and real data from the generator. The training goal is to maximize the classification accuracy of the discriminator for real data and generated data, expressed as:

[0170]

[0171]

[0172] Where, L d represents the loss function of the discriminator, d(d i θ d ) represents the output function of the discriminator, λ d Represents the learning rate, which can be set to 0.01.

[0173] The output function of the discriminator d(x; θ d ) is calculated as:

[0174]

[0175] In the formula, f(x;θ d ) represents the original output of the discriminator for the input x, that is, the linear output of the last layer of the discriminator.

[0176] Finally, the generator is trained by improving the ability of the data generated by the generator to deceive the discriminator. The parameter update of the generator depends on the evaluation result of the discriminator on the generated data. The loss function of the generator training is expressed as:

[0177]

[0178]

[0179] Based on the above-mentioned introduction to the conventional training method of the generator and the discriminator, this embodiment adopts the improved quasi-Newton method to update the weight parameters of the generator and the discriminator. Specifically, in each round of iteration, the approximate Hessian matrix of the current gradient is calculated using the gradient information of the previous round, so as to adjust the learning rate and the update direction. The parameter update method is expressed as:

[0180]

[0181]

[0182]

[0183]

[0184] In the formula, H g , H d Represent the approximate Hessian matrices of the generator and discriminator parameters, η g , η d Indicates the corresponding learning rate. In this embodiment, the Hessian matrix approximation is implemented using the BFGS update rule, and the expression is:

[0185]

[0186]

[0187] In the formula, δ k represents the difference of parameter update, y k Represents the difference in gradient updates.

[0188] The above steps are iterated until the preset stop iteration condition is met, so as to train the above generator into a script generator that meets the requirements, and the TCL expansion script generated by the script generator can achieve the effect of deceiving the discriminator. In this embodiment, the preset stop iteration condition is to reach the preset maximum number of iterations, and the maximum number of iterations can be set to 1000 times.

[0189] Based on the same inventive concept as the feature extraction model training method provided in this embodiment, this embodiment also provides a feature extraction model training device, which includes at least one software function module that can be stored in a memory or fixed in an electronic device in the form of software. The processor in the electronic device is used to execute the executable module stored in the memory. For example, the software function module and computer program included in the device. Please refer to Figure 5 , functionally speaking, the device may include:

[0190] A sample acquisition module 11 is used to acquire a sample script set;

[0191] The model training module 12 is used to train the current model to be trained by a first learning strategy to extract features from a sample script set until the current model to be trained reaches a preset performance; train the current model to be trained by a second learning strategy to extract features from a sample script set; and iterate the above steps until the current model to be trained meets the iteration stop condition as a feature extraction model.

[0192] In this embodiment, the sample acquisition module 11 is used to implement Figure 1 In step S1A, the model training module 12 is used to implement Figure 1 Therefore, for the detailed description of each of the above modules, please refer to the specific implementation of the corresponding step. In addition, it should be noted that since the feature extraction model training method has the same inventive concept as the above-mentioned feature extraction model training method, the feature extraction model training device can also implement other steps or sub-steps of the method through the above-mentioned modules, which will not be repeated in this embodiment.

[0193] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0194] It should also be understood that if the above implementation is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application.

[0195] Therefore, this embodiment also provides a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by the processor, the feature extraction model training method provided in this embodiment is implemented. Among them, the storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, etc., which can store program codes.

[0196] This embodiment provides an electronic device for implementing a feature extraction model training method. Figure 6 As shown, the electronic device includes a processor 22 and a memory 21. In addition, the memory 21 stores a computer program, and the processor implements the feature extraction model training method provided in this embodiment by reading and executing the computer program corresponding to the above implementation in the memory 21.

[0197] Continue to see Figure 6The electronic device further includes a communication unit 23. The memory 21, the processor 22 and the communication unit 23 are electrically connected to each other directly or indirectly through a system bus 24 to achieve data transmission or interaction.

[0198] The memory 21 may be an information recording device based on any electronic, magnetic, optical or other physical principle, used to record execution instructions, data, etc. In some embodiments, the memory 21 may be, but is not limited to, a volatile memory, a non-volatile memory, a storage drive, etc.

[0199] In some embodiments, the volatile memory may be a random access memory (RAM); in some embodiments, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), a flash memory, etc.; in some embodiments, the storage drive may be a disk drive, a solid-state drive, any type of storage disk (such as a CD, a DVD, etc.), or a similar storage medium, or a combination thereof, etc.

[0200] The communication unit 23 is used to send and receive data through a network. In some embodiments, the network may include a wired network, a wireless network, a fiber optic network, a telecommunication network, an intranet, the Internet, a local area network (LAN), a wide area network (WAN), a wireless local area network (WLAN), a metropolitan area network (MAN), a wide area network (WAN), a public switched telephone network (PSTN), a Bluetooth network, a ZigBee network, or a near field communication (NFC) network, or any combination thereof. In some embodiments, the network may include one or more network access points. For example, the network may include a wired or wireless network access point, such as a base station and / or a network switching node, through which one or more components of the service request processing system may be connected to the network to exchange data and / or information.

[0201] The processor 22 may be an integrated circuit chip having a signal processing capability, and the processor may include one or more processing cores (e.g., a single-core processor or a multi-core processor). By way of example only, the processor may include a central processing unit (CPU), an application specific integrated circuit (ASIC), an application specific instruction set processor (ASIP), a graphics processing unit (GPU), a physical processing unit (PPU), a digital signal processor (DSP), a field programmable gate array (FPGA), a programmable logic device (PLD), a controller, a microcontroller unit, a reduced instruction set computer (RISC), or a microprocessor, or any combination thereof.

[0202] Understandably, Figure 6The structure shown is for illustration only. The electronic device may also have Figure 6 More or fewer components than shown, or with Figure 6 Different configurations are shown. Figure 6 The components shown may be implemented in hardware, software or a combination thereof.

[0203] It should be understood that the apparatus and method disclosed in the above-mentioned embodiments can also be implemented in other ways. The apparatus embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the apparatus, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0204] The above are only various implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A feature extraction model training method, characterized in that: The method comprises: Get the sample script set; Training the current model to be trained by the first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance; Training the current model to be trained by a second learning strategy to extract features from the sample script set; The above steps are iterated until the current model to be trained meets the iteration stop condition for serving as the feature extraction model.

2. The feature extraction model training method according to claim 1, characterized in that: The step of training the current model to be trained by using the first learning strategy to extract features from the sample script set until the current model to be trained reaches a preset performance includes: Processing the sample script set according to the current model to be trained to obtain a first feature extraction loss, and updating the current model to be trained at a first learning rate; Generate new weights for the current model to be trained based on the existing weights of the current model to be trained; The above steps are iterated until the current model to be trained reaches the preset performance.

3. The feature extraction model training method according to claim 2, characterized in that: The first learning rate includes a preset basic learning rate and a target acceleration coefficient, and the first feature extraction loss obtained by processing the sample script set according to the current model to be trained, and updating the current model to be trained at the first learning rate, includes: The first feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a descent speed and curvature of a corresponding loss function; According to the descent speed and curvature, the target acceleration coefficient is obtained; Update the current model to be trained according to the basic learning rate and the target acceleration factor.

4. The feature extraction model training method according to claim 1, characterized in that: The step of training the current model to be trained by using the second learning strategy to extract features from the sample script set includes: A second feature extraction loss obtained by processing the sample script set according to the current model to be trained is used to obtain a gradient of a corresponding loss function; Generating fine-tuning parameters of the current model to be trained according to the gradient; and updating the current model to be trained by using the fine-tuning parameters; Prune the weights of the current model to be trained; The current model to be trained is updated at a second learning rate according to a third feature extraction loss obtained by processing the sample script set according to the current model to be trained.

5. The feature extraction model training method according to claim 4, characterized in that: The gradient includes a weight gradient and a bias gradient, the fine-tuning parameter includes a weight fine-tuning parameter and a bias fine-tuning parameter, and the fine-tuning parameter of the current model to be trained is generated according to the gradient, including: Obtaining a first cosine value of the product of the weight gradient and a preset amplitude parameter; Determine the product of the first cosine value and a preset frequency parameter as the weight fine-tuning parameter; Obtaining a second cosine value of the product of the bias gradient and a preset amplitude parameter; The product of the second cosine value and a preset frequency parameter is determined as the offset fine-tuning parameter.

6. The feature extraction model training method according to claim 1, characterized in that: A learning rate of the first learning strategy is greater than a learning rate of the second learning strategy.

7. The feature extraction model training method according to claim 1, characterized in that: The sample script set includes extended samples generated by a sample augmentation model, and the method further includes: Get the original script set; Obtaining a current gradient of a corresponding loss function according to a model loss obtained by processing the original script set in a current generative adversarial network; According to the current gradient and the historical gradient during the previous iteration, the current generative adversarial network is updated by the quasi-Newton method; Iterate the above steps until the current generative adversarial network meets the iteration stop condition as a sample augmentation model.

8. The feature extraction model training method according to claim 7, characterized in that: The method updates the current generative adversarial network by using the quasi-Newton method according to the current gradient and the historical gradient during the previous iteration, including: Obtain an approximate Hessian matrix of the quasi-Newton method according to the historical gradient calculation; The current gradient is adjusted by the approximate Hessian matrix, and the current generative adversarial network is updated according to the adjusted current gradient.

9. A feature extraction model training device, characterized in that: The device comprises: A sample acquisition module is used to acquire a sample script set; A model training module, used for training the current model to be trained to extract features from the sample script set by using a first learning strategy until the current model to be trained reaches a preset performance; Training the current model to be trained by a second learning strategy to extract features from the sample script set, wherein a learning rate of the first learning strategy is greater than a learning rate of the second learning strategy; The above steps are iterated until the current model to be trained meets the iteration stop condition for serving as the feature extraction model.

10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, it implements the feature extraction model training method described in any one of claims 1-8.

11. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory stores a computer program, and when the computer program is executed by the processor, the feature extraction model training method described in any one of claims 1-8 is implemented.

Citation Information

Patent Citations

  • Webshell detection method and webshell detection device

    CN112052451A

  • Model training method and device, storage medium and electronic equipment

    CN115618221A

  • Intelligent visual monitoring and maintenance system construction method, device and system

    CN118521295A

  • Agricultural feature vector extraction model training method and device, equipment and storage medium

    CN118820774A