Security event handling deep neural network construction method and system

Abstract

The invention discloses a security event handling deep neural network construction method and system, and relates to the technical field of data models, and the method comprises the steps: calling local user login data; classifying the user login data to form a data set of a program application programming interface; selecting a data set, and extracting user features in the data set; forming a to-be-trained user login information judgment model based on the user features; calling local user login data as a sample to be input into the to-be-trained user login information judgment model; extracting user features in a data set from the samples which are judged to be wrong; and receiving user login information. By classifying user login data, a plurality of datasets about program application programming interfaces are formed. As the network architecture program application programming interfaces of the power grid equipment are relatively complicated, the classification of each network architecture program application programming interface is beneficial to improving the effect of preventing network attacks.

Description

Technical Field

[0001] The present invention relates to the field of data model technology, and specifically to a method and system for constructing a deep neural network for handling security incidents. Background Art

[0002] The causes, manifestations and results of network security incidents can be divided into multiple types, such as malicious programs, network attacks, information destruction, content security, and facility failures. In recent years, with the rapid development of cyberspace and the digital economy, various types of network security incidents have occurred frequently, and have shown characteristics such as scale, organization, and specialization. In the field of power grid equipment, network security incidents dominated by network attacks have shown an explosive growth trend. The reason is that the user composition of power grid equipment is relatively complex, and the network architecture program application programming interface of power grid equipment is relatively complex, which is susceptible to flooding attacks in DDOS (Distributed Denial of Service) attacks. To this end, it is necessary to propose a method and system for constructing a deep neural network for security incident handling in view of the defects that the network architecture program application programming interface of traditional power grid equipment is relatively complex and prone to flooding attacks. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the network architecture program application programming interface for the traumatic power grid equipment is relatively complex and easily subject to flood attacks.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for constructing a deep neural network for handling security incidents, which comprises the following steps:

[0006] Call local user login data; classify the user login data to form a data set of the program application programming interface; select a data set and extract user features in the data set; form a user login information judgment model to be trained based on the user features; call local user login data as sample input to the user login information judgment model to be trained; extract user features in the data set for samples with misjudgment; receive user login information.

[0007] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the calling of local user login data includes selecting a database of a program application programming interface.

[0008] The user login data of the call database.

[0009] Blacklist of calls to the database.

[0010] The process of selecting a database of a program application programming interface is returned until all databases of program application programming interfaces are selected.

[0011] All blacklists and all user login data are used as training samples.

[0012] The extracting of user features from the data set includes calling a program application programming interface corresponding to the data set.

[0013] Select a user login data.

[0014] Determine the address resolution protocol of the program's application programming interface.

[0015] Use the Address Resolution Protocol to resolve the IP address in the user login data.

[0016] Return to the step of selecting a user login data until all user login data are selected.

[0017] The extracting of user features from the data set also includes selecting an IP address.

[0018] Determine the IP address's login frequency and average length of time logged in.

[0019] Return to the step of selecting an IP address until all IP addresses are selected.

[0020] A two-dimensional matrix is ​​established in which the vertical rows represent the login frequency and the horizontal rows represent the average length of the login time.

[0021] Mark each IP address in a two-dimensional matrix to generate a two-dimensional feature matrix.

[0022] After extracting the user features in the data set, the selected data set is returned until all data sets are selected.

[0023] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the user login information judgment model to be trained based on user characteristics includes selecting an IP address.

[0024] Determines the length of all login intervals for an IP address.

[0025] Return to the step of selecting an IP address until all IP addresses are selected.

[0026] The frequency of the length of the login time interval corresponding to each IP address is counted to generate statistical results.

[0027] The statistical results are annotated on a two-dimensional feature matrix.

[0028] The characteristic equation of the two-dimensional feature matrix is ​​extracted to generate the relationship between the login frequency and the mean length of the login time of the IP address.

[0029] A judgment function is generated based on the relationship between the login frequency of the IP address and the average length of the login time.

[0030] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the calling of local user login data as a sample input of a user login information judgment model to be trained includes receiving a local user login data.

[0031] Parse the IP address and recent login time in local user login data.

[0032] Based on the IP address and recent login time, determine whether the IP address is logging in for the first time.

[0033] If the IP address is logging in for the first time, the database access volume at the login time is called.

[0034] Determine whether the database access volume exceeds the risk threshold.

[0035] If the database access volume exceeds the risk threshold, it is determined that the IP address is not the IP address of a normal user.

[0036] If the database access volume does not exceed the risk threshold, it is further determined whether the login time interval of the IP address matches the judgment function.

[0037] If the login time interval of the IP address does not match the judgment function, it is determined that the IP address is not the IP address of a normal user.

[0038] If the login time interval of the IP address matches the judgment function, the IP address is the IP address of a normal user.

[0039] The calling of local user login data as sample input to the user login information judgment model to be trained also includes statistically analyzing the judgment results and generating the judgment accuracy rate in the statistical results.

[0040] Determine whether the accuracy rate in the statistical results is greater than or equal to the target threshold.

[0041] If the judgment accuracy rate in the statistical results is greater than or equal to the target threshold, the user login information judgment model is output.

[0042] If the judgment accuracy rate in the statistical results is less than the target threshold, the user login data with incorrect judgment will be marked.

[0043] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the statistical judgment results, generating the judgment accuracy in the statistical results, include counting the number of IP addresses that are not normal users' IP addresses.

[0044] Choose an IP address that is not a normal user.

[0045] Use the blacklist in the database to determine whether the IP address matches the blacklist in the database.

[0046] If the IP address matches the blacklist in the database, the process returns to selecting an IP address that is not a normal user until all IP addresses that are not normal users are selected.

[0047] If the IP address does not match the blacklist in the database, the number of items in the misjudgment statistics list will be increased by one.

[0048] Return to the step of selecting an IP address that is not a normal user until all IP addresses that are not normal users are selected.

[0049] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the statistical judgment results generate the judgment accuracy rate in the statistical results, and also include counting the number of IP addresses that are normal users.

[0050] Select an IP address that is a normal user.

[0051] Use the blacklist in the database to determine whether the IP address matches the blacklist in the database.

[0052] If the IP address does not match the blacklist in the database, the process returns to selecting an IP address of a normal user until all IP addresses of normal users are selected.

[0053] If the IP address matches the blacklist in the database, the number of items in the misjudgment statistics list is increased by one.

[0054] Return to the step of selecting an IP address of a normal user until all IP addresses of normal users are selected.

[0055] Based on the number of items in the misjudgment statistical list, the correct judgment rate is generated.

[0056] The user features in the data set are extracted for the samples with incorrect judgment, and the user login information judgment model is adjusted.

[0057] The local user login data is returned as a sample input to the user login information judgment model to be trained, until the judgment accuracy of the user login information judgment model reaches a target threshold.

[0058] As a preferred solution of the method for constructing a deep neural network for handling security incidents described in the present invention, the receiving of user login information includes calling a user login information judgment model to determine whether the user is a normal user.

[0059] If the user is a normal user, the user's device is connected to the program application programming interface.

[0060] If the user is not a normal user, access to the user's device is denied.

[0061] Another object of the present invention is to provide a deep neural network construction system for security incident handling, which can extract user login features, build a deep neural network model based on user behavior features, and judge in real time whether the user login information is normal, thereby solving the problems of low judgment efficiency, insufficient accuracy, inability to optimize the model in time, and delayed response to potential risks in the existing security incident handling system.

[0062] In order to solve the above technical problems, the present invention provides the following technical solutions: a deep neural network construction system for security incident handling, including a server and a storage device.

[0063] The service area is responsible for running the user login information judgment model, including analyzing the user login information and judging whether it is a normal user operation.

[0064] The service area is also responsible for calling the database, obtaining user login data, blacklist data, receiving user login information and calling the model in real time for judgment, and quickly responding whether the user is a normal user. Based on the judgment result, the server controls whether the user device is connected to the system.

[0065] The storage is connected to the server for communication, and is used to store user login data and blacklist data for training a user login information judgment model, and to store judgment results and statistical results of user login information.

[0066] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method for constructing a deep neural network for handling security incidents as described above are implemented.

[0067] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for constructing a deep neural network for handling security incidents as described above.

[0068] Beneficial effects of the present invention: by classifying user login data, multiple data sets about program application programming interfaces are formed. Since the network architecture program application programming interface of power grid equipment is relatively complicated, classifying each type of network architecture program application programming interface is beneficial to improving the effect of preventing network attacks. Using the user characteristics of each data set, a user login information judgment model to be trained is formed. Using local user login data as a sample, the user login information judgment model to be trained is trained to obtain a user login information judgment model. When the user login information judgment model receives the user login information, it can determine whether the user is a normal user. This solves the defect that the network architecture program application programming interface of traditional power grid equipment is relatively complicated and prone to flooding attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0070] Figure 1 An overall flow chart of a method for constructing a deep neural network for handling security incidents provided in the first embodiment of the present invention.

[0071] Figure 2 An overall framework diagram of a security incident handling deep neural network construction system provided for the second embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0073] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a method for constructing a deep neural network for handling security incidents, characterized in that:

[0074] S1: Call local user login data.

[0075] Calling local user login data includes selecting a database of a program application programming interface.

[0076] The user login data of the call database.

[0077] Blacklist of calls to the database.

[0078] Return to select a database of a program API until all databases of program APIs are selected.

[0079] All blacklists and all user login data are used as training samples.

[0080] Extracting user features from a data set includes calling a program application programming interface corresponding to the data set.

[0081] Select a user login data.

[0082] Determine the address resolution protocol of the program's application programming interface.

[0083] Use the Address Resolution Protocol to resolve the IP address in the user login data.

[0084] Return to select a user login data until all user login data are selected.

[0085] Extracting user features from the dataset also includes selecting an IP address.

[0086] Determine the IP address's login frequency and average length of time logged in.

[0087] Return to select an IP address until all IP addresses are selected.

[0088] A two-dimensional matrix is ​​established in which the vertical rows represent the login frequency and the horizontal rows represent the average length of the login time.

[0089] Mark each IP address in a two-dimensional matrix to generate a two-dimensional feature matrix.

[0090] Specifically, during the flood attack process, the flood attack device often has short-term, high-frequency login operations, or only performs a single login operation. The information characteristics of these flood attack devices can often distinguish flood attack devices from ordinary devices.

[0091] More specifically, a two-dimensional matrix with vertical rows representing login frequency and horizontal rows representing the average length of login time, such as:

[0092] The frequencies are 1, 2, 3, 4, etc. The average lengths of login time are 0.01 seconds, 0.02 seconds, 1 second, 2 seconds, etc.

[0093] When three devices with different IP addresses all fall at the intersection of the matrix with a frequency of 1 and an average login time of 0.01 seconds, the value filled in at the intersection of the matrix is ​​3.

[0094] By obtaining a characteristic equation for the matrix of the login frequency and the average login time length of the devices in the blacklist, a relationship between the login frequency and the average login time length of the devices in the blacklist can be determined.

[0095] After extracting the user features in the dataset, return to select the dataset until all datasets are selected.

[0096] Specifically, application programming interfaces that require user login include information systems, fee settlement systems, equipment management systems, etc. Many systems that require user login may use the same information verification system or independent information verification systems, and different information verification systems may have loopholes in verifying information.

[0097] S2: Classify the user login data to form a data set for the program application programming interface.

[0098] Specifically, each program application programming interface is classified to form an independent judgment mechanism for each program application programming interface, which is conducive to reducing the probability of the occurrence of identified vulnerabilities and improving the success rate of flood attack screening.

[0099] S3: Select a data set and extract user features from the data set.

[0100] Specifically, flood attacks often use attacked terminals to execute attack programs. Since many terminals of local devices often have a high level of security protection and are not easily attacked by the network, the login information features of many terminals of local devices, that is, users in the data set, can be used to identify the devices that carry out flood attacks.

[0101] S4: Form a user login information judgment model to be trained based on user characteristics.

[0102] Forming a user login information judgment model to be trained based on user characteristics includes selecting an IP address.

[0103] Determines the length of all login intervals for an IP address.

[0104] Return to select an IP address until all IP addresses are selected.

[0105] The frequency of the length of the login time interval corresponding to each IP address is counted to generate statistical results.

[0106] The statistical results are annotated on a two-dimensional feature matrix.

[0107] The characteristic equation of the two-dimensional feature matrix is ​​extracted to generate the relationship between the login frequency and the mean length of the login time of the IP address.

[0108] A judgment function is generated based on the relationship between the login frequency of the IP address and the average length of the login time.

[0109] Calling local user login data as a sample input to a user login information judgment model to be trained includes receiving a local user login data.

[0110] Parse the IP address and recent login time in local user login data.

[0111] Based on the IP address and recent login time, determine whether the IP address is logging in for the first time.

[0112] If the IP address is logging in for the first time, the database access volume at the login time is called.

[0113] Determine whether the database access volume exceeds the risk threshold.

[0114] If the database access volume exceeds the risk threshold, it is determined that the IP address is not the IP address of a normal user.

[0115] If the database access volume does not exceed the risk threshold, it is further determined whether the login time interval of the IP address matches the judgment function.

[0116] Specifically, the judgment function may be a blacklist judgment function.

[0117] It can also be a judgment function for all user login data.

[0118] Simply, the selected IP address can be an IP address in the blacklist or an IP address of the user's login data.

[0119] If the login time interval of the IP address does not match the judgment function, it is determined that the IP address is not the IP address of a normal user.

[0120] If the login time interval of the IP address matches the judgment function, the IP address is the IP address of a normal user.

[0121] Specifically, when the IP address is the first login IP address, it is difficult for the system database to determine whether the IP address is a network attack. In this case, the database access volume can be used to preliminarily determine whether the system is under a flood attack. Generally, after the flood attack device encounters a system denial of login, the flood attack operator will replace the flood attack device, and the user will log in and repeat the operation multiple times, and the operation time interval is at least ten seconds or even dozens of seconds, which can effectively avoid flood attacks.

[0122] Calling local user login data as sample input to the user login information judgment model to be trained also includes statistically judging results and generating a judgment accuracy rate in the statistical results.

[0123] Determine whether the accuracy rate in the statistical results is greater than or equal to the target threshold.

[0124] If the judgment accuracy rate in the statistical results is greater than or equal to the target threshold, the user login information judgment model is output.

[0125] If the judgment accuracy rate in the statistical results is less than the target threshold, the user login data with incorrect judgment will be marked.

[0126] The statistical judgment results are generated to determine the accuracy of the judgment, including counting the number of IP addresses that are not normal users.

[0127] Choose an IP address that is not a normal user.

[0128] Use the blacklist in the database to determine whether the IP address matches the blacklist in the database.

[0129] If the IP address matches the blacklist in the database, it returns and selects an IP address that is not a normal user until all IP addresses that are not normal users are selected.

[0130] If the IP address does not match the blacklist in the database, the number of items in the misjudgment statistics list will be increased by one.

[0131] Return to select an IP address that is not a normal user until all IP addresses that are not normal users are selected.

[0132] Counting the judgment results, generating the judgment accuracy rate in the statistical results, and also including counting the number of IP addresses that are normal users.

[0133] Select an IP address that is a normal user.

[0134] Use the blacklist in the database to determine whether the IP address matches the blacklist in the database.

[0135] If the IP address does not match the blacklist in the database, it returns to select an IP address of a normal user until all IP addresses of normal users are selected.

[0136] If the IP address matches the blacklist in the database, the number of items in the misjudgment statistics list is increased by one.

[0137] Return and select an IP address for a normal user until all IP addresses for normal users are selected.

[0138] Based on the number of items in the misjudgment statistical list, the correct judgment rate is generated.

[0139] Specifically, when the judgment accuracy rate in the statistical results is less than the target threshold, it means that the success rate of the user login information judgment model is low. At this time, marking the user login data with incorrect judgments and using the two-dimensional feature matrix to fine-tune the user login information judgment model can improve the judgment accuracy rate of the user login information judgment model.

[0140] Specifically, when a judgment result is obtained, four possible results may appear:

[0141] The device that flooded the attack was identified correctly.

[0142] The device that is the target of the flood attack is judged as an error.

[0143] The user's device is determined to be correct.

[0144] The user's device was identified as faulty.

[0145] In order to determine the two situations that the device of the flood attack is judged to be wrong and the user's device is judged to be wrong, both situations are situations where the user login information judgment model makes a wrong judgment.

[0146] For samples with incorrect judgment, user features in the data set are extracted and the user login information judgment model is adjusted.

[0147] Return and call the local user login data as sample input to the user login information judgment model to be trained until the judgment accuracy of the user login information judgment model reaches the target threshold.

[0148] S5: Call the local user login data as sample input to the user login information judgment model to be trained.

[0149] Specifically, since the power grid equipment needs to handle a large number of electricity bill payment logins from electricity user terminals, it is necessary to add a blacklist of electricity user terminals and all user login data as training samples to improve the fault tolerance of the samples.

[0150] The terminals of the power user are used as devices for flood attacks, which is a common means of flood attacks. Many terminals of local devices often have a high security protection level and are generally not used as devices for flood attacks. However, the security protection level of the terminals of the power user is low, which makes them easy to become devices for flood attacks. The blacklist can be used to extract the information characteristics of the devices for flood attacks, thereby improving the ability to resist flood attacks.

[0151] S6: Extract user features from the dataset for samples with misjudgment.

[0152] S7: Receive user login information.

[0153] Receiving user login information includes calling a user login information judgment model to judge whether the user is a normal user.

[0154] If the user is a normal user, the user's device is connected to the program application programming interface.

[0155] If the user is not a normal user, access to the user's device is denied.

[0156] Example 2, reference Figure 2 , as an embodiment of the present invention, provides a system for constructing a deep neural network for handling security incidents, characterized in that it includes a server 100 and a storage 200.

[0157] The service area 100 is responsible for running the user login information judgment model, including the analysis of the user login information and judging whether it is a normal user operation;

[0158] Service area 100 is also responsible for calling the database, obtaining user login data and blacklist data, receiving user login information and calling the model in real time for judgment, and quickly responding to whether the user is a normal user. Based on the judgment result, the server controls whether the user device is connected to the system.

[0159] The storage 200 is connected to the server for communication, and is used to store user login data and blacklist data for training the user login information judgment model, and to store the judgment results and statistical results of the user login information.

[0160] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0161] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0162] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0163] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0164] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for constructing a deep neural network for handling security incidents, characterized in that: include: Call local user login data; Classify user login data to form a data set for the program application programming interface; Select a data set and extract user features from the data set; Based on the user characteristics, a user login information judgment model to be trained is formed; Call local user login data as sample input to the user login information judgment model to be trained; Extract user features from the data set for samples with misjudgment; Receive user login information.

2. A method for constructing a deep neural network for handling security incidents as claimed in claim 1, characterized in that: The calling of local user login data includes selecting a database of a program application programming interface; Call the user login data of the database; Blacklist of calling database; Returning to the step of selecting a database of a program application programming interface until all databases of program application programming interfaces are selected; Use all blacklists and all user login data as training samples; The user features in the extracted data set are Including, calling the program application programming interface corresponding to the data set; Select a user login data; Determine the address resolution protocol of the program application programming interface; Use the Address Resolution Protocol to resolve the IP address in the user login data; Return to the step of selecting a user login data until all user login data are selected; The extracting user features from the data set also includes selecting an IP address; Determine the login frequency and average length of login time of the IP address; Return to the step of selecting an IP address until all IP addresses have been selected; Create a two-dimensional matrix with vertical rows representing login frequency and horizontal rows representing the average length of login time; Mark each IP address in a two-dimensional matrix to generate a two-dimensional feature matrix; After extracting the user features in the data set, the selected data set is returned until all data sets are selected.

3. A method for constructing a deep neural network for handling security incidents as claimed in claim 2, characterized in that: The forming of the user login information judgment model to be trained based on the user characteristics includes selecting an IP address; Determine the length of all login intervals for an IP address; Return to the step of selecting an IP address until all IP addresses have been selected; Count the frequency of the length of the login time interval corresponding to each IP address and generate statistical results; Mark the statistical results on the two-dimensional feature matrix; Extract the characteristic equation of the two-dimensional feature matrix and generate the relationship between the login frequency and the mean length of the login time of the IP address; A judgment function is generated based on the relationship between the login frequency of the IP address and the average length of the login time.

4. A method for constructing a deep neural network for handling security incidents as claimed in claim 3, characterized in that: The calling of local user login data as a sample input to the user login information judgment model to be trained includes receiving a local user login data; Analyze the IP address and the recent login time in the local user login data; Based on the IP address and the recent login time, determine whether the IP address is the first login; If the IP address is logging in for the first time, the database access volume at the login time is called; Determine whether the database access volume exceeds the risk threshold; If the database access volume exceeds the risk threshold, it is determined that the IP address is not that of a normal user; If the database access volume does not exceed the risk threshold, it is further determined whether the login time interval of the IP address matches the judgment function; If the login time interval of the IP address does not match the judgment function, it is determined that the IP address is not the IP address of a normal user; If the login time interval of the IP address matches the judgment function, the IP address is the IP address of a normal user; The calling of local user login data as sample input to the user login information judgment model to be trained also includes counting the judgment results and generating the judgment accuracy rate in the statistical results; Determine whether the accuracy rate in the statistical results is greater than or equal to the target threshold; If the judgment accuracy rate in the statistical results is greater than or equal to the target threshold, the user login information judgment model is output; If the judgment accuracy rate in the statistical results is less than the target threshold, the user login data with incorrect judgment will be marked.

5. A method for constructing a deep neural network for handling security incidents as claimed in claim 4, characterized in that: The statistical judgment result, generating the judgment accuracy rate in the statistical result includes counting the number of IP addresses that are not normal users; Choose an IP address that is not a normal user; Use the blacklist in the database to determine whether the IP address matches the blacklist in the database; If the IP address matches the blacklist in the database, the step of selecting an IP address that is not a normal user is returned until all IP addresses that are not normal users are selected; If the IP address does not match the blacklist in the database, the number of items in the misjudgment statistics list is increased by one; Return to the step of selecting an IP address that is not a normal user until all IP addresses that are not normal users are selected.

6. A method for constructing a deep neural network for handling security incidents as claimed in claim 5, characterized in that: The statistical judgment results generate the judgment accuracy rate in the statistical results, and also include counting the number of IP addresses that are normal users; Select an IP address for a normal user; Use the blacklist in the database to determine whether the IP address matches the blacklist in the database; If the IP address does not match the blacklist in the database, the process returns to selecting an IP address of a normal user until all IP addresses of normal users are selected; If the IP address matches the blacklist in the database, the number of items in the misjudgment statistics list is increased by one; Return to the step of selecting an IP address of a normal user until all IP addresses of normal users are selected; Generate a correct judgment rate based on the number of items in the misjudgment statistical list; extracting user features from a data set for samples with misjudgment, and adjusting the user login information judgment model; The local user login data is returned as a sample input to the user login information judgment model to be trained, until the judgment accuracy of the user login information judgment model reaches a target threshold.

7. A method for constructing a deep neural network for handling security incidents according to claim 6, characterized in that: The receiving of user login information includes calling a user login information judgment model to judge whether the user is a normal user; If the user is a normal user, the user's device is connected to the program application programming interface; If the user is not a normal user, access to the user's device is denied.

8. A system using a method for constructing a deep neural network for handling security incidents as described in any one of claims 1 to 7, characterized in that: It includes a server (100) and a storage (200); The service area (100) is responsible for running a user login information judgment model, including analyzing the user login information and judging whether it is a normal user operation; The service area (100) is also responsible for calling the database, obtaining user login data and blacklist data, receiving the user's login information and calling the model in real time to make a judgment, and quickly responding whether the user is a normal user. Based on the judgment result, the server controls whether the user device is connected to the system; The storage device (200) is connected to the server for communication, and is used to store user login data and blacklist data for training a user login information judgment model, and to store judgment results and statistical results of user login information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a method for constructing a deep neural network for handling security incidents as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for constructing a deep neural network for handling security incidents as described in any one of claims 1 to 7 are implemented.

Images