Cryptographic equipment state monitoring method and device, electronic equipment and storage medium

Abstract

The invention provides a password equipment state monitoring method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining original data outputted by password equipment, and determining a target state of the password equipment according to the original data and a target state monitoring model, the target state comprises a normal state, an abnormal state, a high-load state or an unknown state, if the target state is not the unknown state, an alarm instruction and a monitoring report are generated, the alarm instruction is used for instructing a user to handle the abnormal state and the high-load state, and if the target state is the unknown state, the monitoring report is generated. And if not, updating the target state monitoring model and carrying out monitoring processing according to the updated model. According to the method, the target state of the cryptographic equipment is analyzed according to the obtained original data and the target state monitoring model, so that the output result is comprehensive and accurate, omission is avoided, and the safety and the operation and maintenance efficiency of an information system are improved.

Description

Technical Field

[0001] The present application relates to the technical field of status monitoring, and in particular to a method, apparatus, electronic device and storage medium for monitoring the status of a cryptographic device. Background Art

[0002] In the context of the current digital age, cryptographic devices, as a key element of information security, are essential to maintaining the confidentiality, integrity and availability of data transmission. Cryptographic devices can support a series of security operations from convention infrastructure, digital certificates and key management.

[0003] Traditional monitoring methods involve hardware log review, regular on-site inspections, and network traffic statistics to monitor the device status of cryptographic devices and analyze network traffic. However, these methods have problems such as lag, one-sided monitoring, and difficulty in discovering potential threats. Summary of the invention

[0004] The purpose of this application is to provide a cryptographic device status monitoring method, device, electronic device and storage medium to address the deficiencies in the above-mentioned prior art, so as to solve the problems of lag, one-sided monitoring and difficulty in discovering potential threats in the prior art.

[0005] To achieve the above objectives, the technical solutions adopted in this application are as follows: In a first aspect, the present application provides a method for monitoring the status of a cryptographic device, the method comprising: Obtain the original data output by the cryptographic device; Determine the target state of the cryptographic device according to the raw data and a pre-trained target state monitoring model, wherein the target state includes: a normal state, an abnormal state, a high-load state, or an unknown state; If the target state is not the unknown state, an alarm instruction and a monitoring report are generated, wherein the alarm instruction is used to instruct the user to handle abnormal states and high-load states; If the target state is the unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model.

[0006] Optionally, updating the target state monitoring model and performing monitoring processing according to the updated model includes: Adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment; Retraining the model after parameter adjustment to obtain the updated model; The current data output by the cryptographic device is acquired in real time, and the current state of the cryptographic device is determined according to the current data and the updated model.

[0007] Optionally, adjusting the model parameters of the target state monitoring model to obtain a parameter-adjusted model includes: The convolution kernel sliding window parameters and optimizer parameters in the target state monitoring model are adjusted to obtain a model after parameter adjustment.

[0008] Optionally, determining the target state of the cryptographic device according to the original data and a pre-trained target state monitoring model includes: Generate three-dimensional tensor data according to the original data, wherein the three-dimensional tensor data includes: a plurality of window data obtained according to a preset sliding window length, a spatial feature vector corresponding to each window data, and a protocol feature vector corresponding to each window data; The three-dimensional tensor data is input into the target state monitoring model, and the target state monitoring model sequentially performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device.

[0009] Optionally, generating three-dimensional tensor data according to the original data includes: Dividing the original data according to the preset sliding window length to obtain the multiple window data; Normalizing the protocol features in each of the window data to obtain a protocol feature vector corresponding to each of the window data, wherein the protocol features include a data protocol type, a flag bit, and a data packet length; Generate a spatial feature vector corresponding to each window data according to the spatial feature of each window data, wherein the spatial feature includes an Internet Protocol address and a port number; Three-dimensional tensor data is generated according to the sliding window length, the spatial feature vector corresponding to each window data, and the protocol feature vector corresponding to each window data.

[0010] Optionally, the target state monitoring model includes an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer connected in sequence; The step of inputting the three-dimensional tensor data into the target state monitoring model, wherein the target state monitoring model sequentially performs feature extraction, feature fusion, and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device, includes: Inputting the three-dimensional tensor data into the input layer, and transmitting the three-dimensional tensor data to the convolution layer through the input layer; Extracting a plurality of initial features of the three-dimensional tensor data based on a plurality of convolution kernels in the convolution layer, and performing a nonlinear transformation on the plurality of initial features using an activation function to obtain a plurality of first features; Downsampling each of the first features in the pooling layer to obtain a plurality of second features; Performing feature fusion and classification on each of the second features in the fully connected layer to obtain classification features; The target state of the cryptographic device is outputted through the output layer according to the classification features.

[0011] Optionally, the training process of the target state monitoring model includes: Obtaining training data and data labels corresponding to the training data, preprocessing the training data, and dividing the preprocessed training data into a training set, a validation set, and a test set in chronological order; Initialize the initial state monitoring model; Inputting the training sets into the initial state monitoring model respectively, iteratively correcting the initial state monitoring model according to the first training result output by the initial state monitoring model and the data label, to obtain an intermediate state monitoring model; The validation sets are respectively input into the intermediate state monitoring model, and the intermediate state monitoring model is iteratively corrected according to a second training result output by the intermediate state monitoring model to obtain a target state monitoring model, wherein the second training result includes accuracy, precision and recall.

[0012] Optionally, initializing an initial state monitoring model includes: Initializing model parameters of the initial state monitoring model based on a random initialization strategy; According to the configuration information of the user, the loss function of the initial state monitoring model is determined to be a cross entropy loss function, and the optimizer is determined to be a gradient descent optimization algorithm.

[0013] Optionally, iteratively correcting the initial state monitoring model according to the training result output by the initial state monitoring model and the data label includes: Determine loss information of the initial state monitoring model based on the training result output by the initial state monitoring model, the data label and the cross entropy loss function; According to the loss information, the initial state monitoring model is iteratively corrected based on the gradient descent optimization algorithm.

[0014] In a second aspect, the present application provides a cryptographic device status monitoring device, the device comprising: An acquisition module, used to acquire the original data output by the cryptographic device; A determination module, configured to determine a target state of the cryptographic device according to the original data and a pre-trained target state monitoring model, wherein the target state includes: a normal state, an abnormal state, a high-load state, or an unknown state; A generating module, configured to generate an alarm instruction and a monitoring report if the target state is not the unknown state, wherein the alarm instruction is used to instruct a user to handle an abnormal state and a high load state; An updating module is used to update the target state monitoring model and perform monitoring processing according to the updated model if the target state is the unknown state.

[0015] Optionally, the update module is specifically used to: Adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment; Retraining the model after parameter adjustment to obtain the updated model; The current data output by the cryptographic device is acquired in real time, and the current state of the cryptographic device is determined according to the current data and the updated model.

[0016] Optionally, the update module is specifically used to: The convolution kernel sliding window parameters and optimizer parameters in the target state monitoring model are adjusted to obtain a model after parameter adjustment.

[0017] Optionally, the determining module is specifically used to: Generate three-dimensional tensor data according to the original data, wherein the three-dimensional tensor data includes: a plurality of window data obtained according to a preset sliding window length, a spatial feature vector corresponding to each window data, and a protocol feature vector corresponding to each window data; The three-dimensional tensor data is input into the target state monitoring model, and the target state monitoring model sequentially performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device.

[0018] Optionally, the determining module is specifically used to: Dividing the original data according to the preset sliding window length to obtain the multiple window data; Normalizing the protocol features in each of the window data to obtain a protocol feature vector corresponding to each of the window data, wherein the protocol features include a data protocol type, a flag bit, and a data packet length; Generate a spatial feature vector corresponding to each window data according to the spatial feature of each window data, wherein the spatial feature includes an Internet Protocol address and a port number; Three-dimensional tensor data is generated according to the sliding window length, the spatial feature vector corresponding to each window data, and the protocol feature vector corresponding to each window data.

[0019] Optionally, the target state monitoring model includes an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer connected in sequence; Optionally, the determining module is specifically used to: Inputting the three-dimensional tensor data into the input layer, and transmitting the three-dimensional tensor data to the convolution layer through the input layer; Extracting a plurality of initial features of the three-dimensional tensor data based on a plurality of convolution kernels in the convolution layer, and performing a nonlinear transformation on the plurality of initial features using an activation function to obtain a plurality of first features; Downsampling each of the first features in the pooling layer to obtain a plurality of second features; Performing feature fusion and classification on each of the second features in the fully connected layer to obtain classification features; The target state of the cryptographic device is outputted through the output layer according to the classification features.

[0020] Optionally, the determining module is further used for: Obtaining training data and data labels corresponding to the training data, preprocessing the training data, and dividing the preprocessed training data into a training set, a validation set, and a test set in chronological order; Initialize the initial state monitoring model; Inputting the training sets into the initial state monitoring model respectively, iteratively correcting the initial state monitoring model according to the first training result output by the initial state monitoring model and the data label, to obtain an intermediate state monitoring model; The validation sets are respectively input into the intermediate state monitoring model, and the intermediate state monitoring model is iteratively corrected according to a second training result output by the intermediate state monitoring model to obtain a target state monitoring model, wherein the second training result includes accuracy, precision and recall.

[0021] Optionally, the determining module is further used for: Initializing model parameters of the initial state monitoring model based on a random initialization strategy; According to the configuration information of the user, the loss function of the initial state monitoring model is determined to be a cross entropy loss function, and the optimizer is determined to be a gradient descent optimization algorithm.

[0022] Optionally, the determining module is further used for: Determine loss information of the initial state monitoring model based on the training result output by the initial state monitoring model, the data label and the cross entropy loss function; According to the loss information, the initial state monitoring model is iteratively corrected based on the gradient descent optimization algorithm.

[0023] In a third aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the above-mentioned cryptographic device status monitoring method.

[0024] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned cryptographic device status monitoring method are executed.

[0025] The beneficial effects of the present application are: by obtaining the raw data output by the cryptographic device, and then determining the target state of the cryptographic device according to the target state monitoring model pre-trained according to the original data set. Since multiple monitoring dimensions can be set in the target state monitoring model to extract features from the raw data, the target state monitoring module can generate accurate device states based on comprehensive data. And since the raw data is obtained in real time and the data is analyzed, the changes in the device state can be monitored in a timely manner. If it is determined that the target state is not an unknown state, an alarm instruction and a monitoring report are generated, so as to respond to the target state in a timely manner. If the target state is an unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model. By setting an unknown state in the output result of the target state monitoring model, inaccurate output results caused by limitations or errors in the model parameter settings are avoided. This method analyzes the state of the cryptographic device according to the target state monitoring model of the acquired original data set, avoids consuming a lot of human resources and time, and the output result is accurate and no omissions occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 It is a flowchart of a method for monitoring the status of a cryptographic device provided in an embodiment of the present application; Figure 2 It is a flowchart of a processing method under an unknown state provided by an embodiment of the present application; Figure 3 It is a schematic flow chart of a method for generating three-dimensional tensor data provided in an embodiment of the present application; Figure 4It is a flowchart of a data arrangement method provided in an embodiment of the present application; Figure 5 It is a flowchart of a method for outputting a target state of a cryptographic device provided in an embodiment of the present application; Figure 6 It is a schematic diagram of a training process of a target state monitoring model provided in an embodiment of the present application; Figure 7 It is a flowchart of another method for monitoring the status of a cryptographic device provided in an embodiment of the present application; Figure 8 It is a structural diagram of a cryptographic device status monitoring device provided in an embodiment of the present application; Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0029] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0030] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0031] Among the traditional monitoring methods, the first method is to regularly collect and analyze the hardware logs of the cryptographic device during the encryption process, so that the operation and maintenance personnel can obtain the operating status, abnormal information and fault alarm information of the cryptographic device. However, the real-time performance of the hardware log in this method depends on the frequency of log recording and the transmission efficiency. If the frequency of log recording is low or the transmission efficiency is low, the changes in the device status may not be reflected in time. Secondly, the level of detail and readability of the log content vary, and professional skills and experience are required to interpret it, which will increase labor costs. Finally, some cryptographic devices may limit the access rights or access details of hardware logs for security reasons.

[0032] The second method is to manually conduct regular inspections of cryptographic devices. Specifically, physical inspections, software updates, and configuration verifications are performed on cryptographic devices on a regular basis. Although this method can intuitively detect physical damage or configuration errors in cryptographic devices, it also has significant defects: First, the manual inspection cycle is long, and the status of the cryptographic device and its changes cannot be determined in real time. Second, the inspection cost is high, requiring a lot of human resources and time costs. Third, the inspection results are affected by the inspectors' skill level and subjective judgment, and there may be omissions or misjudgments.

[0033] The third method is to evaluate the operating status of cryptographic devices by counting and analyzing the network traffic output by cryptographic devices. This method usually only focuses on macro indicators such as the total amount, direction and speed of network traffic to infer the load and abnormal conditions of cryptographic devices. However, this method can only monitor the status of devices in a limited monitoring dimension, and it is difficult to accurately capture detailed information in the encrypted communication process, such as protocol anomalies, encryption policy violations and other potential security threats.

[0034] Based on this, the present application proposes a cryptographic device status monitoring method, which determines the target state of the cryptographic device according to the target state monitoring model pre-trained by the acquired original data set. Since multiple monitoring dimensions can be set in the target state monitoring model to extract features from the original data, the output device state is more accurate and comprehensive. When the target state is an unknown state, the target state monitoring model is updated and monitoring is performed according to the updated model, thereby avoiding inaccurate output results due to limitations or errors in the model parameter settings. This method analyzes the status of the cryptographic device according to the target state monitoring model of the acquired original data set, thereby avoiding a large amount of human resources and time, and the output results are accurate without omissions, thereby improving the security and operation and maintenance efficiency of the information system.

[0035] Next, refer to Figure 1 The specific steps of the cryptographic device status monitoring method are introduced. Figure 1The flowchart of a cryptographic device status monitoring method provided in an embodiment of the present application is shown in FIG. Optionally, the cryptographic device status monitoring method can be applied to an electronic device with computing capabilities.

[0036] S101. Obtain original data output by a cryptographic device.

[0037] The cryptographic device may be a hardware device or tool for encrypting and decrypting information. The cryptographic device may be an electronic device with computing capabilities, used to generate, store and process encryption keys and execute encryption algorithms. For example, the cryptographic device may be a virtual private network (VPN) server and an encryption gateway.

[0038] Optionally, a network packet capture tool may be used to obtain the original data output by the cryptographic device, wherein the network packet capture tool may be Wireshark.

[0039] Optionally, the original data includes the timestamp of the Transmission Control Protocol / Internet Protocol (TCP / IP) data packet, the source Internet Protocol (IP) address, the destination IP address, the source port, the destination port, the protocol type and the data length, etc. Exemplarily, the format of the original data may be as shown in Table 1 below: Table 1

[0040] Among them, Info includes information such as protocol and port information, flag bit, window size, data packet payload length, etc. For example, the protocol and port information is 443->53871 in Table 1 above, the flag bit is [ACK]Seq=1Ack=1 in Table 1 above, the window size is Win=1188 in Table 1 above, and the data packet payload length is Len=0 in Table 1 above. It is worth noting that since Ack=1 is an acknowledgment packet, the data packet payload length is 0, that is, there is no actual application layer data.

[0041] In the encryption process, the data to be encrypted is first input into the cryptographic device, and the cryptographic device encrypts the data to be encrypted according to the key information and generates the original data. The original data is the encrypted data.

[0042] As an optional implementation, the raw data may be acquired at a preset acquisition interval. The preset acquisition interval is relatively short. For example, the preset acquisition interval may be 5 seconds.

[0043] S102. Determine the target state of the cryptographic device according to the original data and a pre-trained target state monitoring model, where the target state includes: normal state, abnormal state, high load state or unknown state.

[0044] Before the raw data is input into a pre-trained target state monitoring model, the raw data may be pre-processed to generate three-dimensional tensor data based on the raw data.

[0045] Optionally, the target state monitoring model can be a 3D Convolutional Neural Network (3D CNNs), which can process 3D tensor data with time or deep learning. 3D CNNs can simultaneously capture the temporal evolution of raw data and the correlation between different features.

[0046] Optionally, in the target state of the cryptographic device, the normal state means that the cryptographic device can accurately complete the encryption of the data to be encrypted. The abnormal state means that the cryptographic device cannot accurately complete the encryption of the data to be encrypted. The cause of the abnormal state may be that the performance of the cryptographic device is degraded or it suffers from a function, etc. The high-load state may be that the cryptographic device cannot encrypt the data to be encrypted in time. The cause of the high-load state may be that there is too much data to be encrypted, or the encryption algorithm of the cryptographic device is not streamlined enough, resulting in huge consumption of computing resources. The unknown state may be that the current state of the cryptographic device cannot be determined. The cause of the unknown state may be the limitation or error of the model parameter setting of the target state monitoring module.

[0047] It is worth noting that the target state may not be a single state, but may be a combination of a normal state, an abnormal state, and a high-load state. For example, the target state may be a normal state and a high-load state, or an abnormal state and a high-load state.

[0048] S103. If the target state is not an unknown state, an alarm instruction and a monitoring report are generated. The alarm instruction is used to instruct the user to handle abnormal states and high-load states.

[0049] Among them, if the target state is not an unknown state, it means that the model parameters in the current target state monitoring model are suitable for the current data environment and do not need to be updated.

[0050] Optionally, if the target state is an abnormal state or a high-load state, an alarm instruction is generated to trigger an alarm mechanism to remind the staff of the current state of the cryptographic device. If the target state is an abnormal state, the cryptographic device is adjusted and corrected, including abnormal traffic isolation and dynamic adjustment of security policies. If the target state is a high-load state, the staff can control the inflow of data to be encrypted and optimize the encryption algorithm.

[0051] When the target state is not an unknown state, the monitoring report generated can be generated in the form of a visual report. The visual report can be in the form of a chart or a dashboard. The visual report can intuitively display the state change trend of the cryptographic device.

[0052] As an optional implementation, a monitoring report may be generated according to a preset time period, and the working status of the cryptographic device within the preset time period may be counted according to the monitoring report to generate a statistical report. For example, the preset time period is 1 hour, and the preset acquisition interval is 5 seconds. Then, the current status of the cryptographic device is obtained every 5 seconds, and the target status of 720 groups of cryptographic devices can be obtained within 1 hour. The target status of 720 groups of cryptographic devices is counted to generate a statistical report to analyze the historical trends and security events within 1 hour.

[0053] S104: If the target state is an unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model.

[0054] Specifically, when the target state is an unknown state, the model parameters of the target state monitoring model are updated, and then monitoring processing is performed based on the updated model and the original data acquired in real time to output an accurate target state of the cryptographic device.

[0055] Among them, the model parameters can be convolution kernel sliding window parameters and optimizer, etc.

[0056] In this embodiment, the target state of the cryptographic device is determined by obtaining the raw data output by the cryptographic device and then using the target state monitoring model pre-trained according to the raw data set. Since multiple monitoring dimensions can be set in the target state monitoring model to extract features from the raw data, the target state monitoring module can generate accurate device states based on comprehensive data. And since the raw data is obtained in real time and analyzed, changes in the device state can be monitored in a timely manner. If it is determined that the target state is not an unknown state, an alarm instruction and a monitoring report are generated, so as to respond to the target state in a timely manner. If the target state is an unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model. By setting an unknown state in the output result of the target state monitoring model, inaccurate output results caused by limitations or errors in model parameter settings are avoided. This method analyzes the state of the cryptographic device according to the target state monitoring model of the acquired raw data set, avoids consuming a lot of human resources and time, and the output result is accurate without omissions.

[0057] Further, refer to Figure 2 The steps of updating the target state monitoring model in the above step S104 and performing monitoring processing according to the updated model are introduced. Figure 2It is a flowchart of a processing method in an unknown state provided in an embodiment of the present application.

[0058] S201, adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment.

[0059] As an optional implementation, a model parameter library may be preset, and when the model parameters of the target state monitoring model need to be adjusted, the model parameters in the model parameter library are called to adjust the model parameters of the target state monitoring model.

[0060] As another optional implementation, the model parameters of the target state monitoring model may be manually adjusted to obtain adjusted parameters.

[0061] S202: Retrain the model after parameter adjustment to obtain an updated model.

[0062] Optionally, since the model parameters of the target state monitoring model are adjusted, the model parameters do not match the target state monitoring model, and the model needs to be fine-tuned to obtain an updated model. The updated model can output an accurate current state according to the current data based on the adjusted model parameters.

[0063] S203: Acquire the current data output by the cryptographic device in real time, and determine the current state of the cryptographic device according to the current data and the updated model.

[0064] As an optional implementation, it may take some time to update the target state monitoring model. Therefore, in order to ensure the timeliness of the output state of the cryptographic device, the current data output by the cryptographic device is directly used for analysis to obtain the current state of the cryptographic device.

[0065] As another optional implementation, in addition to outputting the current state of the cryptographic device based on the current data acquired in real time, the data during the training of the updated model can also be input into the updated model to obtain the state results of the cryptographic device within the complete time period.

[0066] In this embodiment, by adjusting the model parameters of the target state monitoring model when the target state is an unknown state, and retraining the model after the parameter adjustment, the current state of the cryptographic device is determined according to the current data and the retrained updated model, thereby ensuring that the output state of the cryptographic device is accurate, and avoiding the situation where the actual cryptographic device is in an abnormal state or a high-load state, but the output is in a normal state.

[0067] The specific steps of adjusting the model parameters of the target state monitoring model in the above step S201 to obtain the model after parameter adjustment are as follows: Optionally, the convolution kernel sliding window parameters and optimizer parameters in the target state monitoring model are adjusted to obtain a model after parameter adjustment.

[0068] Specifically, the convolution kernel sliding window parameters in the target state monitoring module can be adjusted, for example, the convolution kernel sliding window parameters are set to 3×1×5, 5×1×7, etc. The larger the convolution kernel sliding window parameters are, the more extensive the features captured are.

[0069] The optimizer parameter can be a learning rate, which can be adjusted to 0.0001, 0.001, or 0.01, etc. A lower learning rate can make the training process more stable, but the convergence speed is slower, and a higher learning rate can make the training converge faster, but may cause instability.

[0070] As an optional implementation, the parameter-adjusted model can also be obtained by increasing or decreasing the number of neurons and replacing the optimizer. Specifically, the number of neurons in the fully connected layer can be adjusted according to the performance on the validation set. Increasing the number of neurons can improve the expressiveness of the model, but may lead to overfitting; reducing the number of neurons can simplify the model and reduce the risk of overfitting. You can also choose the Adam optimizer, stochastic gradient descent optimizer, RMSprop optimizer, AdaGrad optimizer and Nadam optimizer. Among them, the Adam optimizer can set the initial learning rate to 0.001 and the decay rate to 0.9 and 0.999, the stochastic gradient descent optimizer can set an adjustable learning rate and momentum value, the RMSprop optimizer can set an adjustable learning rate and decay rate, the AdaGrad optimizer is suitable for sparse data, and the Nadam optimizer is suitable for high-precision monitoring tasks.

[0071] Next, the specific steps of determining the target state of the cryptographic device according to the original data and the pre-trained target state monitoring model in the above step S102 are introduced: Optionally, three-dimensional tensor data is generated based on the original data, and the three-dimensional tensor data includes: multiple window data obtained according to a preset sliding window length, a spatial feature vector corresponding to each window data, and a protocol feature vector corresponding to each window data.

[0072] As an optional implementation, the protocol characteristics and spatial characteristics of each window data are determined based on the original data and the preset sliding window length, and then three-dimensional tensor data is generated based on the preset sliding window length, the protocol characteristics of each window data and the spatial characteristics of each window data.

[0073] Among them, the preset sliding window length can be, for example, 1 minute, and the window data is all data within 1 minute. The spatial features may include the source IP address, the destination IP address, etc., and the dimension of the spatial features is determined according to the dimension of the content it contains. Exemplarily, the source IP address and the destination IP address are both 16 bits, and the spatial features are 32 bits. The protocol features may include the protocol type and the data packet length, etc., and the dimension of the protocol features is determined according to the dimension of the content it contains. Exemplarily, the protocol type is 4 bits and the data packet length is 16 bits, and the protocol feature is 20 bits.

[0074] Optionally, the three-dimensional tensor data is input into a target state monitoring model, which sequentially performs feature extraction, feature fusion, and feature classification on the three-dimensional tensor data and outputs the target state of the cryptographic device.

[0075] Specifically, the number of three-dimensional tensor data received by the target state monitoring model is the same as the number of target states of the output cryptographic device.

[0076] In this embodiment, three-dimensional tensor data is generated based on the original data, and the three-dimensional tensor data is input into the target state monitoring model. The target state monitoring model sequentially performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device, thereby realizing real-time state monitoring and avoiding the use of a large amount of manpower and time resources.

[0077] Next, refer to Figure 3 The steps of generating three-dimensional tensor data based on the original data in the above steps are introduced. Figure 3 It is a flowchart of a method for generating three-dimensional tensor data provided in an embodiment of the present application.

[0078] S301. Divide original data according to a preset sliding window length to obtain multiple window data.

[0079] The window data includes part of the original data divided according to the sliding window length.

[0080] S302: Normalize the protocol features in each window data to obtain a protocol feature vector corresponding to each window data, where the protocol features include a data protocol type, a flag bit, and a data packet length.

[0081] Specifically, the data in the protocol features of each window data that are not in binary form are normalized. For example, the data packet length in the protocol features is processed. Specifically, the protocol features corresponding to each window data are determined based on the maximum data packet length in the original data received historically and the data packet length in the protocol features in each window data. Specifically, the data packet length in the protocol features in each window data is divided by the maximum data packet length, so that the data packet length is normalized to a feature between 0 and 1.

[0082] Optionally, the flag bit may be a synchronization sequence number (SYN) and an acknowledgement (ACK) flag in the TCP protocol.

[0083] S303: Generate a spatial feature vector corresponding to each window data according to the spatial feature of each window data, where the spatial feature includes an Internet Protocol address and a port number.

[0084] Specifically, the spatial features of each window data are encoded into a vector of fixed length. The spatial features include IP address, port number, etc., where the IP address includes the source IP address and the target IP address. A hash function can be used to map the IP address to an integer form, and the integer IP address and port number are combined to generate a spatial feature vector.

[0085] S304: Generate three-dimensional tensor data according to the sliding window length, the spatial feature vector corresponding to each window data, and the protocol feature vector corresponding to each window data.

[0086] Optionally, based on a Sorting Algorithms (SA) algorithm, three-dimensional tensor data is constructed according to the sliding window length, the spatial feature vector, and the protocol feature vector, wherein the SA algorithm is used to arrange a group of data elements in a preset order.

[0087] In this embodiment, the SA algorithm is used to arrange the spatial feature vectors and the protocol feature vectors in the order of timestamps, ensuring that the original time order is retained when extracting features from the three-dimensional tensor data. Specifically, Figure 4 FIG. 1 is a flow chart of a data arrangement method provided in an embodiment of the present application. Figure 4As shown, the spatial feature vector and the protocol feature vector are saved as data to be sorted in the format of Packet Capture (pcap), the data to be sorted in the pcap format are parsed, and the timestamps of the data packets in each data to be sorted are extracted. The data packets in the data to be sorted include timestamps, source IP addresses, destination IP addresses, protocol types, and data packet lengths. Each data packet and the corresponding timestamp are stored in a database, and the data packets in the data to be sorted are sorted using a quick sorting algorithm according to the timestamp order of the data packets to generate sorted data, and three-dimensional tensor data is constructed based on the sliding window length and the sorted data to achieve data formatting. Based on this, the sliding window length is set as a dimension, represented as T, and the spatial feature vector and the protocol feature vector are concatenated and sorted through the SA algorithm as a dimension, represented as P, and the obtained three-dimensional tensor data can be T×1×P. Among them, 1 in T×1×P represents the feature vector under a single channel.

[0088] In this embodiment, multiple window data are obtained, and then the protocol feature vector and space feature vector corresponding to each window data are determined according to the protocol features and space features of each window data, thereby ensuring the timeliness and comprehensiveness of the cryptographic device status analysis.

[0089] As an optional implementation, the above steps S301-S304 are data preprocessing steps. This step can not only be used to initialize the original data when the cryptographic device is state-monitored, but also can be used to initialize the training data used to train the target state monitoring model. After the training data is initialized, the training data can also be divided into a training set, a validation set, and a test set in chronological order.

[0090] Optionally, the target state monitoring model includes an input layer, a convolution layer, a pooling layer, a fully connected layer and an output layer connected in sequence, and performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data in sequence.

[0091] Optionally, the input layer is the first layer of the target state monitoring model, which is used to receive three-dimensional tensor data. The convolution layer is used to extract local features in the input data. The convolution layer extracts data features by sliding convolution kernels. The pooling layer is used to reduce the spatial dimension of the data and reduce the amount of calculation. The fully connected layer is used for feature fusion and classification, and the output layer outputs the target state of the cryptographic device.

[0092] Next, refer to Figure 5 The specific steps of inputting the three-dimensional tensor data into the target state monitoring model in the above steps, and the target state monitoring model sequentially extracting features, fusion and classification of the three-dimensional tensor data, and outputting the target state of the cryptographic device are introduced. Figure 5It is a flowchart of a method for outputting a target state of a cryptographic device provided in an embodiment of the present application.

[0093] S501, input the three-dimensional tensor data into the input layer, and transmit it to the convolution layer through the input layer.

[0094] For example, if the sliding window length is 10, the spatial feature length is 32 bits, and the protocol feature length is 20 bits, then the three-dimensional tensor data is 10×1×52.

[0095] S502. Extract multiple initial features of the three-dimensional tensor data based on multiple convolution kernels in the convolution layer, and perform nonlinear transformation on the multiple initial features using an activation function to obtain multiple first features.

[0096] Among them, multiple initial features of the three-dimensional tensor data are extracted according to the preset convolution kernel sliding window parameters. Among them, the convolution kernel sliding window parameters can be, for example, 3×1×5. The convolution kernel represents sliding 3 sliding windows in the time dimension, convolving the entire IP address encoding in the spatial dimension, and sliding 5 features in the protocol feature dimension. Among them, the sliding step size and the padding value can be preset, for example, the sliding step size can be set to 1, and the padding value can be set to 0.

[0097] Optionally, the activation function is used to introduce nonlinear factors so that the target state monitoring model can learn and process complex patterns and data. The activation functions in the model parameter library can include Sigmoid function, ReLU (Rectified Linear Unit) function and hyperbolic tangent (tanh) function.

[0098] As an optional implementation, the activation function ReLU (Rectified Linear Unit) can be used to perform nonlinear transformation on the spatiotemporal features in the initial features. Its expression is f(x) = max(0, x), that is, when the input x is greater than 0, the output is x, and when the input x is less than or equal to 0, the output is 0. The use of the activation function ReLU can make the target state monitoring model use more complex and abstract feature representation.

[0099] S503: Downsample each first feature in a pooling layer to obtain multiple second features.

[0100] Specifically, a maximum pooling layer is set after each convolution layer, the pooling window size can be 2×1×2, and the pooling layer is used to downsample the first feature, thereby reducing the size and calculation amount of the first feature.

[0101] S504: Perform feature fusion and classification on each second feature in the fully connected layer to obtain classification features.

[0102] The number of neurons in the fully connected layer can be set according to the number of states of the cryptographic device. In this application, the target state of the cryptographic device is 4, so the number of neurons in the fully connected layer is 4, that is, the dimension of the classification feature is 4.

[0103] S505. Output the target state of the cryptographic device according to the classification characteristics through the output layer.

[0104] As an optional implementation, a Softmax function can be used to output a state probability vector, and then the target state of the cryptographic device can be output based on the state probability vector. Specifically, the classification feature can be the score of each state corresponding to the current three-dimensional tensor data. The score is converted into a probability distribution so that the probability of each state in the target state is between (0, 1) and the sum of the probabilities of all states is 1. The Softmax function can be as shown in the following formula (1): (1) in, represents the state probability vector, whose length is 4, and z is a vector of length 4, i.e., the classification feature output by the fully connected layer. is the element in the vector z corresponding to the jth state category.

[0105] The state category where the maximum value in the state probability vector is located is taken as the target state of the cryptographic device.

[0106] In this embodiment, the three-dimensional tensor data features are extracted, fused and classified through the input layer, convolution layer, pooling layer, fully connected layer and output layer in sequence to obtain the target state of the cryptographic device, thereby analyzing the original data from more dimensions and avoiding one-sided monitoring.

[0107] As an optional implementation, Figure 6 Schematic diagram of the training process of a target state monitoring model provided in an embodiment of the present application. Figure 6 Introduce the training process of the target state monitoring model: S601, obtaining training data and data labels corresponding to the training data, preprocessing the training data, and dividing the preprocessed training data into a training set, a validation set, and a test set in chronological order.

[0108] The process of preprocessing the training data is the process of converting the training data into three-dimensional tensor data. The specific steps may refer to S301-S304.

[0109] Specifically, the training data can be divided into a training set, a validation set, and a test set in chronological order, with the training set accounting for 70%, the validation set accounting for 15%, and the test set accounting for 15%.

[0110] S602: Initialize the initial state monitoring model.

[0111] As an optional implementation, the initial state monitoring model can be initialized according to a random initialization strategy, a loss function, and an optimizer. The random initialization strategy can adjust the variance of the weights based on the linear relationship between the number of input and output neurons, thereby ensuring that the variance of the activation values ​​in forward and backward propagation is consistent.

[0112] S603 , input the training sets into the initial state monitoring model respectively, and iteratively correct the initial state monitoring model according to the first training results and data labels output by the initial state monitoring model to obtain an intermediate state monitoring model.

[0113] Specifically, the loss information is calculated based on the training results and data labels output by the initial state monitoring model, and the initial state monitoring model is iteratively corrected based on the loss information.

[0114] It is worth noting that during the iterative training process, each input randomly disrupts the order of the data in the training set, and performs forward propagation, loss calculation, backpropagation and parameter update in the input model in batches until the intermediate state monitoring model is output.

[0115] S604, input the verification set into the intermediate state monitoring model respectively, iteratively correct the intermediate state monitoring model according to the second training result output by the intermediate state monitoring model, and obtain the target state monitoring model, wherein the second training result includes accuracy, precision and recall.

[0116] Optionally, the validation set is used to evaluate the performance of the intermediate state monitoring model. After the second training result is output, it can be determined whether the model needs to be corrected based on the preset accuracy threshold, precision threshold, and recall threshold. If so, the model structure or hyperparameters can be adjusted until the target state monitoring model is obtained. Hyperparameters can be learning rate, number of convolution kernels, number of neurons in the fully connected layer, etc.

[0117] As an optional implementation, the test sets can be input into the target state monitoring model respectively, so as to evaluate the model performance according to the output results. Specifically, after the model training is completed, the generalization ability of the model is tested with the test set. The prediction effect of the target state monitoring model in practical applications can be understood through the test set.

[0118] In this embodiment, the training data is preprocessed to obtain a training set, a validation set, and a test set. The initial state monitoring model is iteratively corrected according to the training set to obtain an intermediate state monitoring model. The intermediate state monitoring model is then iteratively corrected according to the validation set to obtain a target state monitoring model, thereby obtaining a model that can output accurate state results for state monitoring of cryptographic devices.

[0119] The specific process of initializing the initial state monitoring model in the above step S602 is as follows: Optionally, model parameters of the initial state monitoring model are initialized based on a random initialization strategy.

[0120] Among them, the random initialization strategy can be the Xavier initialization strategy. This strategy adjusts the size of the weight according to the input and output dimensions of each layer in the initial state monitoring model, so that the data can remain stable during forward propagation and the gradient can also remain stable during backward propagation. The specific steps of the Xavier initialization strategy are: first, assuming that the number of input nodes in each layer is nin and the number of output nodes is nout, then the weight matrix of this layer is a (nout, nin) structure. Then, use a mean of 0 and a standard deviation of The weights are initialized using a normal distribution of , and the initialized weights are randomly drawn to fill the above weight matrix. The standard deviation is used to keep the gradient variance stable during forward and backward propagation.

[0121] In the initial state monitoring model, each layer except the input layer has a bias term, which allows the activation function of the node to be translated along the input axis, making the model more flexible and better fitting the data. The bias term is usually initialized to 0 or a small positive number.

[0122] Optionally, according to the user's configuration information, the loss function of the initial state monitoring model is determined to be a cross entropy loss function, and the optimizer is determined to be a gradient descent optimization algorithm. The loss function is used to measure the gap between the model prediction result and the actual result. During the model training process, the loss function is minimized by adjusting the model parameters, thereby achieving the effect of model adjustment.

[0123] Optionally, the user configuration information may include parameters of a cross entropy loss function and a gradient descent optimization algorithm.

[0124] Optionally, the cross entropy loss function can measure the difference between the model prediction result and the data label. The data label can be in one-hot encoding form, that is, each data label is a vector with a length equal to the number of categories. In this embodiment, the number of categories is 4, and only one element in the vector is 1, and the rest are 0.

[0125] The prediction probability distribution of the initial state monitoring model for the i-th sample data in the training set is p i =[p1,p2,p3,p4], the unique hot encoding of the data label is q i =[q1,q2,q3,q4]. For the entire training set, the cross entropy loss is the average of all sample losses.

[0126] The formula of the cross entropy loss function is as follows (2): (2) Since q is a one-hot encoding, the above formula (2) can be simplified to the following formula (3): (3) where i is the index of the state category, P i is the probability that the model predicts that class.

[0127] Optionally, the gradient descent optimization algorithm adaptively adjusts the learning rate of each parameter by calculating the first-order moment estimate and the second-order moment estimate of the model gradient to minimize the cross entropy loss. The learning rate can be set to 0.001 and the decay rate can be set to 0.9 and 0.999.

[0128] Furthermore, based on the initialization of the model parameters, the setting of the loss function and the setting of the optimizer, the step of iteratively correcting the initial state monitoring model according to the training results and data labels output by the initial state monitoring model in the above step S603 includes: Optionally, based on the training results, data labels and cross entropy loss function output by the initial state monitoring model, loss information of the initial state monitoring model is determined.

[0129] Specifically, according to the training results and data labels output by the initial state monitoring model, the loss information is calculated based on the cross entropy loss function.

[0130] Optionally, the initial state monitoring model is iteratively corrected based on a gradient descent optimization algorithm according to the loss information.

[0131] The initial state monitoring model is iteratively modified based on the gradient optimization algorithm to minimize the loss information of the modified model.

[0132] It is worth noting that the above process of iteratively correcting the initial state monitoring model is also applicable to iteratively correcting the intermediate state monitoring model, so that the accuracy is within the preset accuracy threshold, the precision is within the precision threshold, and the recall is within the recall threshold, then the target state monitoring model is output.

[0133] As an optional implementation, Figure 7 FIG. 1 is a flow chart of another method for monitoring the status of a cryptographic device provided in an embodiment of the present application. Figure 7As shown. First, the initial state monitoring model is initialized, and then the initial state monitoring model is iteratively corrected based on the loss function and the optimizer to obtain the intermediate state monitoring model. The intermediate state monitoring model is iteratively corrected based on the training results of the intermediate state monitoring model to obtain the target state monitoring model. During the use of the model, the original data is obtained and initialized. The initialization process includes data partitioning, normalization processing and data formatting, etc., to generate three-dimensional tensor data, input the three-dimensional tensor data into the target state monitoring module, output the target state of the cryptographic device, and generate an alarm instruction and a monitoring report. When the target state is an unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model.

[0134] Based on the same inventive concept, a cryptographic device status monitoring device corresponding to the cryptographic device status monitoring method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned cryptographic device status monitoring method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0135] Reference Figure 8 As shown, it is a structural diagram of a cryptographic device status monitoring device provided in an embodiment of the present application, the device includes: an acquisition module 801, a determination module 802, a generation module 803 and an update module 804; wherein: The acquisition module 801 is used to acquire the original data output by the cryptographic device; A determination module 802 is used to determine the target state of the cryptographic device according to the original data and a pre-trained target state monitoring model, where the target state includes: a normal state, an abnormal state, a high-load state, or an unknown state; A generating module 803 is used to generate an alarm instruction and a monitoring report if the target state is not the unknown state, wherein the alarm instruction is used to instruct the user to handle the abnormal state and the high load state; The updating module 804 is used to update the target state monitoring model and perform monitoring processing according to the updated model if the target state is the unknown state.

[0136] Optionally, the updating module 804 is specifically used for: Adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment; Retraining the model after parameter adjustment to obtain the updated model; The current data output by the cryptographic device is acquired in real time, and the current state of the cryptographic device is determined according to the current data and the updated model.

[0137] Optionally, the updating module 804 is specifically used for: The convolution kernel sliding window parameters and optimizer parameters in the target state monitoring model are adjusted to obtain a model after parameter adjustment.

[0138] Optionally, the determining module 802 is specifically configured to: Generate three-dimensional tensor data according to the original data, wherein the three-dimensional tensor data includes: a plurality of window data obtained according to a preset sliding window length, a spatial feature vector corresponding to each window data, and a protocol feature vector corresponding to each window data; The three-dimensional tensor data is input into the target state monitoring model, and the target state monitoring model sequentially performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device.

[0139] Optionally, the determining module 802 is specifically configured to: Dividing the original data according to the preset sliding window length to obtain the multiple window data; Normalizing the protocol features in each of the window data to obtain a protocol feature vector corresponding to each of the window data, wherein the protocol features include a data protocol type, a flag bit, and a data packet length; Generate a spatial feature vector corresponding to each window data according to the spatial feature of each window data, wherein the spatial feature includes an Internet Protocol address and a port number; Three-dimensional tensor data is generated according to the sliding window length, the spatial feature vector corresponding to each window data, and the protocol feature vector corresponding to each window data.

[0140] Optionally, the target state monitoring model includes an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer connected in sequence; Optionally, the determining module 802 is specifically configured to: Inputting the three-dimensional tensor data into the input layer, and transmitting the three-dimensional tensor data to the convolution layer through the input layer; Extracting a plurality of initial features of the three-dimensional tensor data based on a plurality of convolution kernel sliding window parameters in the convolution layer, and performing a nonlinear transformation on the plurality of initial features using an activation function to obtain a plurality of first features; Downsampling each of the first features in the pooling layer to obtain a plurality of second features; Performing feature fusion and classification on each of the second features in the fully connected layer to obtain classification features; The target state of the cryptographic device is outputted through the output layer according to the classification features.

[0141] Optionally, the determining module 802 is further configured to: Obtaining training data and data labels corresponding to the training data, preprocessing the training data, and dividing the preprocessed training data into a training set, a validation set, and a test set in chronological order; Initialize the initial state monitoring model; Inputting the training sets into the initial state monitoring model respectively, iteratively correcting the initial state monitoring model according to the first training result output by the initial state monitoring model and the data label, to obtain an intermediate state monitoring model; The validation sets are respectively input into the intermediate state monitoring model, and the intermediate state monitoring model is iteratively corrected according to a second training result output by the intermediate state monitoring model to obtain a target state monitoring model, wherein the second training result includes accuracy, precision and recall.

[0142] Optionally, the determining module 802 is further configured to: Initializing model parameters of the initial state monitoring model based on a random initialization strategy; According to the configuration information of the user, the loss function of the initial state monitoring model is determined to be a cross entropy loss function, and the optimizer is determined to be a gradient descent optimization algorithm.

[0143] Optionally, the determining module 802 is further configured to: Determine loss information of the initial state monitoring model based on the training result output by the initial state monitoring model, the data label and the cross entropy loss function; According to the loss information, the initial state monitoring model is iteratively corrected based on the gradient descent optimization algorithm.

[0144] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0145] The present application also provides an electronic device, such as Fig. 9 , which is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, includes: a processor 901, a memory 902 and a bus. The memory 902 stores machine-readable instructions executable by the processor 901 (for example, Figure 8 In the device, the execution instructions corresponding to the acquisition module 801, the determination module 802, the generation module 803 and the update module 804 are obtained, etc.), when the computer device is running, the processor 901 communicates with the memory 902 through a bus, and when the machine-readable instructions are executed by the processor 901, the processing of the above-mentioned cryptographic device status monitoring method is performed.

[0146] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned cryptographic device status monitoring method are executed.

[0147] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0148] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0149] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A method for monitoring the status of a cryptographic device, characterized in that: The method comprises: Obtain the original data output by the cryptographic device; Determine the target state of the cryptographic device according to the raw data and a pre-trained target state monitoring model, wherein the target state includes: a normal state, an abnormal state, a high-load state, or an unknown state; If the target state is not the unknown state, an alarm instruction and a monitoring report are generated, wherein the alarm instruction is used to instruct the user to handle abnormal states and high-load states; If the target state is the unknown state, the target state monitoring model is updated and monitoring processing is performed according to the updated model.

2. The method for monitoring the status of a cryptographic device according to claim 1, characterized in that: The updating of the target state monitoring model and performing monitoring processing according to the updated model includes: Adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment; Retraining the model after parameter adjustment to obtain the updated model; The current data output by the cryptographic device is acquired in real time, and the current state of the cryptographic device is determined according to the current data and the updated model.

3. The method for monitoring the status of a cryptographic device according to claim 2, characterized in that: The step of adjusting the model parameters of the target state monitoring model to obtain a model after parameter adjustment includes: The convolution kernel sliding window parameters and optimizer parameters in the target state monitoring model are adjusted to obtain a model after parameter adjustment.

4. The method for monitoring the status of a cryptographic device according to claim 1, characterized in that: Determining the target state of the cryptographic device according to the original data and a pre-trained target state monitoring model includes: Generate three-dimensional tensor data according to the original data, wherein the three-dimensional tensor data includes: a plurality of window data obtained according to a preset sliding window length, a spatial feature vector corresponding to each window data, and a protocol feature vector corresponding to each window data; The three-dimensional tensor data is input into the target state monitoring model, and the target state monitoring model sequentially performs feature extraction, feature fusion and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device.

5. The method for monitoring the status of a cryptographic device according to claim 4, characterized in that: Generating three-dimensional tensor data according to the original data includes: Dividing the original data according to the preset sliding window length to obtain the multiple window data; Normalizing the protocol features in each of the window data to obtain a protocol feature vector corresponding to each of the window data, wherein the protocol features include a data protocol type, a flag bit, and a data packet length; Generate a spatial feature vector corresponding to each window data according to the spatial feature of each window data, wherein the spatial feature includes an Internet Protocol address and a port number; Three-dimensional tensor data is generated according to the sliding window length, the spatial feature vector corresponding to each window data, and the protocol feature vector corresponding to each window data.

6. The method for monitoring the status of a cryptographic device according to claim 4, characterized in that: The target state monitoring model includes an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer connected in sequence; The step of inputting the three-dimensional tensor data into the target state monitoring model, wherein the target state monitoring model sequentially performs feature extraction, feature fusion, and feature classification on the three-dimensional tensor data, and outputs the target state of the cryptographic device, includes: Inputting the three-dimensional tensor data into the input layer, and transmitting the three-dimensional tensor data to the convolution layer through the input layer; Extracting a plurality of initial features of the three-dimensional tensor data based on a plurality of convolution kernel sliding window parameters in the convolution layer, and performing a nonlinear transformation on the plurality of initial features using an activation function to obtain a plurality of first features; Downsampling each of the first features in the pooling layer to obtain a plurality of second features; Performing feature fusion and classification on each of the second features in the fully connected layer to obtain classification features; The target state of the cryptographic device is outputted through the output layer according to the classification features.

7. The method for monitoring the status of a cryptographic device according to any one of claims 1 to 6, characterized in that: The training process of the target state monitoring model includes: Obtaining training data and data labels corresponding to the training data, preprocessing the training data, and dividing the preprocessed training data into a training set, a validation set, and a test set in chronological order; Initialize the initial state monitoring model; Inputting the training sets into the initial state monitoring model respectively, iteratively correcting the initial state monitoring model according to the first training result output by the initial state monitoring model and the data label, to obtain an intermediate state monitoring model; The validation sets are respectively input into the intermediate state monitoring model, and the intermediate state monitoring model is iteratively corrected according to a second training result output by the intermediate state monitoring model to obtain a target state monitoring model, wherein the second training result includes accuracy, precision and recall.

8. The method for monitoring the status of a cryptographic device according to claim 7, characterized in that: Initialize the initial state monitoring model, including: Initializing model parameters of the initial state monitoring model based on a random initialization strategy; According to the configuration information of the user, the loss function of the initial state monitoring model is determined to be a cross entropy loss function, and the optimizer is determined to be a gradient descent optimization algorithm.

9. The method for monitoring the status of a cryptographic device according to claim 8, characterized in that: The iterative correction of the initial state monitoring model according to the training result output by the initial state monitoring model and the data label includes: Determine loss information of the initial state monitoring model based on the training result output by the initial state monitoring model, the data label and the cross entropy loss function; According to the loss information, the initial state monitoring model is iteratively corrected based on the gradient descent optimization algorithm.

10. A cryptographic device status monitoring device, characterized in that: The device comprises: An acquisition module, used to acquire the original data output by the cryptographic device; A determination module, configured to determine a target state of the cryptographic device according to the original data and a pre-trained target state monitoring model, wherein the target state includes: a normal state, an abnormal state, a high-load state, or an unknown state; A generating module, configured to generate an alarm instruction and a monitoring report if the target state is not the unknown state, wherein the alarm instruction is used to instruct a user to handle an abnormal state and a high load state; An updating module is used to update the target state monitoring model and perform monitoring processing according to the updated model if the target state is the unknown state.

11. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-readable instructions to perform the steps of the cryptographic device status monitoring method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the cryptographic device status monitoring method as described in any one of claims 1 to 9 are executed.

Images