Communication threat detection method, device, equipment, medium and product

Abstract

The invention discloses a communication threat detection method, device and equipment, a medium and a product, which are applied to the technical field of communication, and the method comprises the following steps: receiving global feature data; obtaining a plurality of target probabilities based on the global feature data and a plurality of target detection algorithms; based on the global feature data and the gating network, multiple weights corresponding to multiple target detection algorithms are obtained, and each target detection algorithm in the multiple target detection algorithms corresponds to one weight in the multiple weights; and determining a communication threat level based on the plurality of target probabilities and the plurality of weights. The communication threat level is realized through a plurality of target detection algorithms, the method is not only suitable for all scenes, but also can improve the detection efficiency and effect.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a communication threat detection method, device, equipment, medium and product. Background Art

[0002] With the development of technology, equipment systems are facing increasingly complex and diverse threats, including but not limited to signal interference, network attacks, track anomalies, communication interruptions, etc. Especially in harsh environments and complex human interference, the security and stability of equipment systems face huge challenges.

[0003] At present, threat detection mainly adopts statistical and rule-based methods. Specifically, based on statistical analysis or preset rules, key indicators such as the system's trajectory parameters and communication signals are monitored, and threats are judged based on deviation thresholds.

[0004] However, the above method cannot be applied to all scenarios, resulting in poor detection effect. Summary of the invention

[0005] The main purpose of the present invention is to provide a communication threat detection method, device, equipment, medium and product to solve the problem that the existing detection methods cannot be applied to all scenarios, resulting in poor detection effect.

[0006] In order to achieve the above object, in a first aspect, the present invention provides a communication threat detection method, comprising: receiving global feature data; Based on global feature data and multiple target detection algorithms, multiple target probabilities are obtained; Based on the global feature data and the gating network, a plurality of weights corresponding to the plurality of target detection algorithms are obtained, wherein each target detection algorithm in the plurality of target detection algorithms corresponds to one of the plurality of weights; Based on multiple target probabilities and multiple weights, a communication threat level is determined.

[0007] In one embodiment, the multiple target detection algorithms include an abnormal behavior detection algorithm, a signal interference detection algorithm, and a communication threat detection algorithm.

[0008] In one embodiment, based on global feature data and multiple target detection algorithms, multiple target probabilities are obtained, including: Acquire behavior feature data, signal feature data, and communication feature data from the global feature data; Input the behavior feature data into the abnormal behavior detection algorithm and output the abnormal behavior probability; Input the signal feature data into the signal interference detection algorithm and output the signal interference threat probability; The communication feature data is input into the communication threat detection algorithm and the communication threat probability is output.

[0009] In one embodiment, the abnormal behavior detection algorithm is a decision tree algorithm; Input the behavior feature data into the abnormal behavior detection algorithm and output the abnormal behavior probability, including: Input the behavior feature data into the decision tree algorithm to obtain the prediction results of each path in the decision tree algorithm; The prediction results of each path in the decision tree algorithm are integrated through the voting mechanism to obtain the probability of abnormal behavior.

[0010] In one embodiment, the signal interference detection algorithm is a convolutional neural network model; The signal feature data is input into the signal interference detection algorithm, and the signal interference threat probability is output, including: The signal feature data is input into the convolution layer of the convolutional neural network model, and the local feature data in the signal feature data is extracted through the convolution layer; The local feature data is reduced in dimension through the pooling layer in the convolutional neural network model, and the feature vector is output; The feature vector is transformed through the fully connected layer in the convolutional neural network model to output the signal interference threat probability.

[0011] In one embodiment, the communication threat detection algorithm is a long short-term memory network model; The communication feature data is input into the communication threat detection algorithm, and the communication threat probability is output, including: The gating mechanism of the long short-term memory network model is used to obtain the hidden state of the communication feature data; Input the hidden state into the fully connected layer of the long short-term memory network model for classification to obtain the feature category; The Softmax function is used to transform the feature categories to obtain the communication threat probability.

[0012] In one embodiment, based on global feature data and a gating network, multiple weights corresponding to multiple target detection algorithms are obtained, including: The global feature data is linearly transformed through the fully connected layer of the gating network to obtain the scores of each target detection algorithm in multiple target detection algorithms; The scores of each target detection algorithm in the multiple target detection algorithms are processed by the Softmax function to obtain the weight of each target detection algorithm in the multiple target detection algorithms; The weights of the target detection algorithms in the multiple target detection algorithms are aggregated to obtain multiple weights corresponding to the multiple target detection algorithms.

[0013] In one embodiment, determining a communication threat level based on multiple target probabilities and multiple weights includes: Perform weighted fusion on multiple target probabilities and multiple weights to calculate the communication threat value; The communication threat value is mapped to a preset level interval to obtain a communication threat level corresponding to the communication threat value.

[0014] In a second aspect, an embodiment of the present invention provides a communication threat detection device, including: A data receiving module, used for receiving global feature data; A probability acquisition module is used to obtain multiple target probabilities based on global feature data and multiple target detection algorithms; A weight acquisition module, used for acquiring a plurality of weights corresponding to a plurality of target detection algorithms based on the global feature data and the gating network, wherein each target detection algorithm in the plurality of target detection algorithms corresponds to a weight in the plurality of weights; The level determination module is used to determine the communication threat level based on multiple target probabilities and multiple weights.

[0015] In a third aspect, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above methods when executing the computer program.

[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0017] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0018] The embodiments of the present invention provide a communication threat detection method, device, equipment, medium and product, including: first receiving global feature data, then obtaining multiple target probabilities based on the global feature data and multiple target detection algorithms, and then obtaining multiple weights corresponding to the multiple target detection algorithms based on the global feature data and the gated network, wherein each target detection algorithm in the multiple target detection algorithms corresponds to one of the multiple weights, and finally determining the communication threat level based on the multiple target probabilities and the multiple weights. The present invention implements the communication threat level through multiple target detection algorithms, which is not only applicable to all scenarios, but also can improve the detection efficiency and effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention, so that other features, purposes and advantages of the present invention become more obvious. The accompanying drawings of the exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings: Figure 1 It is a flow chart of a communication threat detection method provided by an embodiment of the present invention; Figure 2 It is a flowchart of another communication threat detection method provided by an embodiment of the present invention; Figure 3 It is a structural schematic diagram of a communication threat detection device provided by an embodiment of the present invention; Figure 4 It is a schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.

[0022] In the embodiments of the present invention, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0023] It should be understood that in various embodiments of the present invention, the size of each process number does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0024] It should be understood that in the present invention, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0025] It should be understood that in the present invention, "plurality" refers to two or more than two. "And / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "Contains A, B and C", "Contains A, B, C" means that A, B, and C are all included, "Contains A, B or C" means that one of A, B, and C is included, and "Contains A, B and / or C" means that any one, any two, or any three of A, B, and C are included.

[0026] It should be understood that in the present invention, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A and B can be determined based on A. Determining B based on A does not mean determining B based only on A, but B can also be determined based on A and / or other information. A and B match when the similarity between A and B is greater than or equal to a preset threshold.

[0027] Depending on the context, "if" as used herein may be interpreted as "when" or "when" or "in response to determining" or "in response to detecting."

[0028] The data involved in the present invention may be data authorized by the tester or fully authorized by all parties. The collection, dissemination, and use of the data shall comply with the requirements of relevant laws, regulations, and standards of relevant countries and regions. The implementation modes / embodiments of the present invention may be combined with each other.

[0029] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0030] In order to facilitate the understanding of the present invention, the following terms are first explained: RF: Random Forest is an ensemble learning algorithm based on decision trees. It constructs multiple decision trees and outputs the final result by voting or averaging. It has high robustness and generalization ability and is widely used in classification and regression tasks.

[0031] CNN: Convolutional Neural Network is a deep learning model that is particularly suitable for processing two-dimensional data with local features (such as images and signals). It extracts features through convolutional layers, reduces dimensions through pooling layers, and finally completes classification or regression tasks through fully connected layers.

[0032] LSTM: Long Short-Term Memory is an improved recurrent neural network (RNN). By introducing gate mechanisms (such as input gate, forget gate, and output gate), it can effectively capture long-term dependencies in sequence data and is widely used in tasks such as time series prediction and natural language processing.

[0033] The gate network is a mechanism for dynamically selecting and activating model subcomponents. It generates weights or selection priorities for the algorithm model by analyzing input features, ensuring efficient use of model resources and adaptability of the decision-making process.

[0034] Next, the solution of the present invention will be described through specific embodiments in conjunction with the accompanying drawings.

[0035] See also Figure 1 , Figure 1 A flow chart of a communication threat detection method provided by an embodiment of the present invention. The method comprises the following steps: Step S101: receiving global feature data.

[0036] Global characteristic data includes behavior characteristic data, signal characteristic data and communication characteristic data.

[0037] Step S102: Based on the global feature data and multiple target detection algorithms, multiple target probabilities are obtained.

[0038] like Figure 2 As shown, multiple target detection algorithms include abnormal behavior detection algorithm, signal interference detection algorithm and communication threat detection algorithm.

[0039] To obtain multiple target probabilities based on global feature data and multiple target detection algorithms, it is necessary to first obtain the behavior feature data, signal feature data and communication feature data in the global feature data, and then input the behavior feature data into the abnormal behavior detection algorithm respectively to output the abnormal behavior probability, input the signal feature data into the signal interference detection algorithm to output the signal interference threat probability, and input the communication feature data into the communication threat detection algorithm to output the communication threat probability.

[0040] When the abnormal behavior detection algorithm is a decision tree algorithm, input the behavior feature data into the abnormal behavior detection algorithm to output the abnormal behavior probability, including: input the behavior feature data into the decision tree algorithm to obtain the prediction results of each path in the decision tree algorithm; fuse the prediction results of each path in the decision tree algorithm through a voting mechanism to obtain the abnormal behavior probability.

[0041] Specifically, the input of the abnormal behavior detection algorithm is behavior feature data, which can be represented by a set of feature vector datasets and is mainly used to characterize the multi-dimensional state parameters collected during operation.

[0042] The input is a set of feature vector datasets including a feature set and a label set. Specifically: Feature set:

[0043] Among them, is the nth sample, is the d features of the sample, representing different dimensions of the running state, such as resource consumption rate, execution delay, behavior trajectory deviation degree, etc.

[0044] Label set:

[0045] Among them, indicates that the ith sample is an abnormal behavior, indicates normal behavior.

[0046] The output is the abnormal behavior probability .

[0047] The abnormal behavior detection algorithm process is as follows: Step1: Training data sampling: Randomly sample m sub-datasets from the input feature set X and label set Y in a replacement way:

[0048] Among them, and are the kth sub-dataset, and the sampling size is b% (b ≤ 100) of the original dataset size.

[0049] Step2: For each sub-dataset , randomly select features ( <<d) to construct a decision tree. The construction steps of each decision tree are: Select the best splitting feature and splitting point from the feature subset of the sample to minimize the classification impurity of the sub-nodes after splitting:

[0050] Among them, left and right represent two child nodes bounded by the split point τ, and G(·) is the calculation function of impurity (Gini index or entropy).

[0051] Repeat the above steps until the stopping condition is reached (such as the maximum depth or the number of node samples is less than the threshold), train and generate m decision trees to form the final random forest model.

[0052] Step 3: In the detection phase, enter new data points , use the random forest model to predict whether it is abnormal behavior: Single decision tree prediction: Each decision tree will The path classification is performed through the tree structure to obtain the prediction result:

[0053] Forest voting fusion: The prediction results of all decision trees are fused through a voting mechanism to obtain the final prediction and output the probability of abnormal behavior:

[0054] The modular design of random forest makes the abnormal behavior detection algorithm have high accuracy and robustness, and can efficiently process multi-dimensional features to adapt to the detection needs in complex threat scenarios.

[0055] In the case where the signal interference detection algorithm is a convolutional neural network model, the signal feature data is input into the signal interference detection algorithm, and the signal interference threat probability is output, including: inputting the signal feature data into the convolution layer of the convolutional neural network model, and extracting local feature data in the signal feature data through the convolution layer; reducing the dimension of the local feature data through the pooling layer in the convolutional neural network model, and outputting a feature vector; converting the feature vector through the fully connected layer in the convolutional neural network model, and outputting the signal interference threat probability.

[0056] Specifically, The input is signal feature data, represented by a three-dimensional tensor: Two-dimensional signal data: Time domain signal waveform data: The change of signal x over time is represented by a vector of fixed length:

[0057] Frequency domain feature map (spectrogram): The time domain signal is converted into frequency domain features through short-time Fourier transform (STFT) or fast Fourier transform (FFT):

[0058] S is a two-dimensional matrix that represents the energy distribution of frequency f and time t.

[0059] The final input is represented as a three-dimensional tensor:

[0060] Among them: H is the time length or frequency dimension of the signal, W is the feature dimension or time slice, C is the number of channels, grayscale signal C=1, color signal C=3.

[0061] Output: Signal interference threat probability

[0062] The signal interference detection algorithm process is as follows: Step 1: Convolution operation: The convolution layer extracts local feature data of the signal through filters:

[0063] in, is the value of the input signal at position (i+p-1,j+q-1) and channel c, Represents the weight of the kth convolution kernel, which is , represents the bias of the kth convolution kernel, σ represents the ReLU activation function, Represents the convolution output feature map.

[0064] Step 2: Pooling operation: The pooling layer reduces the size of the feature map by reducing the dimension of the local feature data, thereby enhancing the translation invariance of the feature. This application uses the maximum pooling (Max Pooling) as follows:

[0065] Where: R is the pooling window (2 x 2), is the pooled output feature map.

[0066] Step 3: Fully connected layer: The feature map output by the pooling layer is flattened into a vector, i.e., a feature vector, and input into the fully connected layer:

[0067] in, represents the j-th value of the flattened eigenvector, represents the weight matrix of the fully connected layer, represents the bias of the fully connected layer, Represents the k-th classification score of the output.

[0068] Step 4: Classification output: Finally, the Softmax function is used to convert the output of the fully connected layer into classification probability, and the output signal interference threat probability is:

[0069] Where c represents the category, c∈{0,1} (0: no interference, 1: interference), K represents the number of categories, represents the k-th classification score of the output, Represents the c-th classification score of the output.

[0070] The convolutional layer of the CNN model extracts the local pattern of the signal, the pooling layer reduces the dimension to retain important features, and the fully connected layer implements classification. This design can efficiently process the frequency domain or time domain features of the signal, has the advantages of strong robustness and high detection accuracy, and is very suitable for signal interference detection.

[0071] When the communication threat detection algorithm is a long short-term memory network model, the communication feature data is input into the communication threat detection algorithm, and the communication threat probability is output, including: using the gating mechanism of the long short-term memory network model to obtain the hidden state of the communication feature data; inputting the hidden state into the fully connected layer of the long short-term memory network model for classification to obtain the feature category; and using the Softmax function to convert the feature category to obtain the communication threat probability.

[0072] Specifically, the input is communication feature data, which can be represented by time series signal data, that is, continuous monitoring data of the communication system:

[0073] Where T represents the length of the time series (number of sampling points), Represents the feature vector at time t, with dimension d. Features may include signal strength, signal-to-noise ratio (SNR), bit error rate (BER), frequency offset, etc.

[0074] The output is the communication threat probability

[0075] The communication threat detection algorithm process is as follows: The core of LSTM is its gating mechanism, including input gate, forget gate and output gate, to solve the gradient disappearance or explosion problem of traditional RNN.

[0076] Step 1: Forget Gate: Controls whether the current unit retains the state of the previous time step:

[0077] in, represents the output vector of the forget gate, Represents the weight matrix of the forget gate, with a size of , represents the bias vector of the forget gate, with a size of h, σ represents the Sigmoid activation function, and the output range is [0, 1], represents the input vector at the current time t, represents the hidden state at time t−1.

[0078] Step 2: Input Gate: Controls the impact of the current input on the cell state: Input gate weights:

[0079] in, represents the input vector at the current time t, represents the hidden state at time t−1, The weight matrix of the input gate, The bias vector of the input gate, represents the activation function, Represents the activation value of the input gate at the current time t, which is used to control the influence of the current input on the cell state.

[0080] Candidate memory status:

[0081] in, The weight matrix representing the candidate memory states, The bias vector representing the candidate memory state, represents the hyperbolic tangent activation function, Represents a candidate memory state, used to update the cell state.

[0082] Final memory status update:

[0083] in, represents the activation value of the forget gate, represents the cell state at time t−1, represents the cell state at the current moment, ⊙ represents element-by-element multiplication, Represents the activation value of the input gate at the current time t.

[0084] Step 3: Output Gate: Control the output of the current cell:

[0085] in, represents the weight matrix of the output gate, represents the bias vector of the output gate, represents the activation function, Represents the activation value of the output gate at the current time t, which is used to control the output range of the cell state to the hidden state.

[0086] The final hidden state:

[0087] in, represents the hyperbolic tangent activation function, which is used to map the cell state to the range [-1, 1], Indicates the cell state at the current moment, Represents the hidden state at the current moment, that is, the output value of the LSTM unit.

[0088] Step 4: Fully connected layer and classification: hidden state of the last time step T of LSTM As the feature representation of the entire sequence, it is input into the fully connected layer for classification:

[0089] in, represents the weight matrix of the fully connected layer, represents the bias of the fully connected layer, represents the activation function, represents the score of the kth category, represents the hidden state at time step T.

[0090] Step 5: Classification probability output: Use the Softmax function to convert the output of the fully connected layer into classification probability and output the communication threat probability:

[0091] Where: c∈{0,1} indicates whether there is a communication threat (0: no threat, 1: threat), K is the total number of categories, represents the k-th classification score of the output, Represents the c-th classification score of the output.

[0092] The communication threat detection algorithm based on the LSTM model can effectively capture long dependencies in time series and show good robustness in threat detection of communication signals. Through the gating mechanism, LSTM solves the problem that traditional RNN is difficult to learn long-term dependencies. It is suitable for processing dynamic and continuous communication signal features, especially showing unique advantages in detecting complex threat patterns.

[0093] Step S103: Based on the global feature data and the gating network, multiple weights corresponding to multiple target detection algorithms are obtained.

[0094] Each of the multiple target detection algorithms corresponds to one of the multiple weights.

[0095] In order to obtain multiple weights corresponding to multiple target detection algorithms based on global feature data and gating network, it is necessary to first perform linear transformation on the global feature data through the fully connected layer of the gating network to obtain the score of each target detection algorithm in the multiple target detection algorithms, and then process the score of each target detection algorithm in the multiple target detection algorithms through the Softmax function to obtain the weight of each target detection algorithm in the multiple target detection algorithms, and then summarize the weights of each target detection algorithm in the multiple target detection algorithms to obtain multiple weights corresponding to the multiple target detection algorithms.

[0096] Specifically, Input to the gating network: Global input features: summary features including signal, behavior, and communication data

[0097]

[0098] Algorithm-specific features (optional): Specific input features for each algorithm

[0099] Gated Network Reception or combined input [ , ] .

[0100] Network structure of the gated network: The gated network generates dynamic activation weights for each algorithm through a fully connected layer and a Softmax function.

[0101] Linear Transformation: Input After the fully connected layer:

[0102] in, represents the weight matrix of the gating network, k is the number of algorithms, represents the bias vector and Z represents the unnormalized algorithm activation score.

[0103] Activation weight generation (Softmax function):

[0104] in, Represents the activation weight of each algorithm, each weight Greater than or equal to 0, and satisfies .

[0105] Sparsification mechanism: If efficient calculation is required, the weights can be sparsely distributed through threshold or Top-k strategy after Softmax, activating only a small number of algorithms.

[0106]

[0107] Output: Algorithm weights or after sparse , user-guided algorithm activation.

[0108] The core function of the gating network is to dynamically generate algorithm weights and intelligently activate or combine the most relevant algorithm models according to input features, thereby achieving efficient resource allocation and more accurate predictions. Its innovations are: (1) Dynamic algorithm activation mechanism, which can adjust model calculations according to task requirements; (2) Sparsification strategy, which further improves computational efficiency by activating only the most relevant algorithms; (3) Enhanced interpretability, which clarifies the contribution of each algorithm through weight analysis; (4) Modular design, which decouples the gating network from the algorithm model and has flexibility and scalability. This design strikes a good balance between accuracy and efficiency.

[0109] Step S104: Determine the communication threat level based on multiple target probabilities and multiple weights.

[0110] In order to determine the communication threat level based on multiple target probabilities and multiple weights, it is necessary to first perform weighted fusion on the multiple target probabilities and multiple weights, calculate the communication threat value, and then map the communication threat value to a preset level range to obtain the communication threat level corresponding to the communication threat value.

[0111] Specifically, The outputs of each algorithm are combined and fused according to the algorithm weights to generate a communication threat value.

[0112] enter: Weights for Activation Algorithms

[0113] Output of each algorithm , where i∈{1,2,…,k} Weighted fusion output, calculate the communication threat value:

[0114] in, represents the output of the ith algorithm, Indicates the communication threat value.

[0115] The communication threat value is mapped to multiple level intervals, each interval represents a different threat level: Level 0 ( ): No Threat, Level 1 ( ): Low Threat, Level 2 ( ): Medium Threat, Level 3 ( ): High Threat, Level 4 ( ): Very high threat.

[0116]

[0117] The output results of each algorithm are dynamically integrated to achieve a comprehensive assessment and level determination of the threat. The output of each algorithm is weighted and summed using the algorithm weights generated by the gating network to obtain the communication threat value. , and maps it to threat levels (such as no threat, low threat, medium threat, high threat, and extremely high threat) according to preset thresholds. This not only integrates the detection results of multimodal features, but also outputs decisions in the form of fine-grained levels, providing rich interpretability and flexibility for threat management, while giving priority to high-level threats to ensure the rationality of resource allocation and decision-making efficiency.

[0118] The embodiment of the present invention provides a communication threat detection method, including: first receiving global feature data, then obtaining multiple target probabilities based on the global feature data and multiple target detection algorithms, and then obtaining multiple weights corresponding to the multiple target detection algorithms based on the global feature data and a gating network, wherein each target detection algorithm in the multiple target detection algorithms corresponds to one of the multiple weights, and finally determining the communication threat level based on the multiple target probabilities and the multiple weights. The present invention implements the communication threat level through multiple target detection algorithms, which is not only applicable to all scenarios, but also can improve the detection efficiency and effect.

[0119] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0120] The following is an embodiment of the device of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0121] Figure 3 A schematic diagram of the structure of a communication threat detection device provided by an embodiment of the present invention is shown. For the convenience of description, only the part related to the embodiment of the present invention is shown. A communication threat detection device includes the following: The data receiving module 301 is used to receive global feature data; A probability acquisition module 302 is used to acquire multiple target probabilities based on global feature data and multiple target detection algorithms; A weight acquisition module 303 is used to acquire a plurality of weights corresponding to a plurality of target detection algorithms based on the global feature data and the gating network, wherein each target detection algorithm in the plurality of target detection algorithms corresponds to a weight in the plurality of weights; The level determination module 304 is configured to determine a communication threat level based on multiple target probabilities and multiple weights.

[0122] In one embodiment, the multiple target detection algorithms include an abnormal behavior detection algorithm, a signal interference detection algorithm, and a communication threat detection algorithm.

[0123] In one embodiment, the probability acquisition module 302 is also used to acquire behavior feature data, signal feature data, and communication feature data in the global feature data; Input the behavior feature data into the abnormal behavior detection algorithm and output the abnormal behavior probability; Input the signal feature data into the signal interference detection algorithm and output the signal interference threat probability; The communication feature data is input into the communication threat detection algorithm and the communication threat probability is output.

[0124] In one embodiment, the abnormal behavior detection algorithm is a decision tree algorithm; The probability acquisition module 302 is also used to input the behavior feature data into the decision tree algorithm to obtain the prediction results of each path in the decision tree algorithm; The prediction results of each path in the decision tree algorithm are integrated through the voting mechanism to obtain the probability of abnormal behavior.

[0125] In one embodiment, the signal interference detection algorithm is a convolutional neural network model; The probability acquisition module 302 is also used to input the signal feature data into the convolution layer of the convolution neural network model, and extract local feature data from the signal feature data through the convolution layer; The local feature data is reduced in dimension through the pooling layer in the convolutional neural network model, and the feature vector is output; The feature vector is transformed through the fully connected layer in the convolutional neural network model to output the signal interference threat probability.

[0126] In one embodiment, the communication threat detection algorithm is a long short-term memory network model; The probability acquisition module 302 is also used to obtain the hidden state of the communication feature data by the gating mechanism of the long short-term memory network model; Input the hidden state into the fully connected layer of the long short-term memory network model for classification to obtain the feature category; The Softmax function is used to transform the feature categories to obtain the communication threat probability.

[0127] In one embodiment, the weight acquisition module 303 is further used to perform a linear transformation on the global feature data through a fully connected layer of the gated network to obtain a score of each target detection algorithm in the multiple target detection algorithms; The scores of each target detection algorithm in the multiple target detection algorithms are processed by the Softmax function to obtain the weight of each target detection algorithm in the multiple target detection algorithms; The weights of the target detection algorithms in the multiple target detection algorithms are aggregated to obtain multiple weights corresponding to the multiple target detection algorithms.

[0128] In one embodiment, the level determination module 304 is further used to perform weighted fusion on multiple target probabilities and multiple weights to calculate the communication threat value; The communication threat value is mapped to a preset level interval to obtain a communication threat level corresponding to the communication threat value.

[0129] The present invention Figure 4 A schematic diagram of a computer device is provided. Figure 4 As shown, the computer device 4 of this embodiment includes: a processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the processor 401. When the processor 401 executes the computer program 403, the steps in the above-mentioned various communication threat detection method embodiments are implemented, such as Figure 1 Alternatively, when the processor 401 executes the computer program 403, the functions of each module / unit in the above-mentioned communication threat detection device embodiments are implemented, for example Figure 3 Functionality of modules / units 301 to 304 is shown.

[0130] The present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the communication threat detection method provided by the various embodiments described above.

[0131] Among them, the readable storage medium can be a computer storage medium or a communication medium. Communication media include any medium that facilitates the transmission of computer programs from one place to another. Computer storage media can be any available medium that can be accessed by a general or special-purpose computer. For example, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application-specific integrated circuit (ASIC). In addition, the ASIC can be located in a user device. Of course, the processor and the readable storage medium can also exist in a communication device as discrete components. The readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0132] The present invention also provides a computer program product, which includes an execution instruction, which is stored in a readable storage medium. At least one processor of a device can read the execution instruction from the readable storage medium, and at least one processor executes the execution instruction so that the device implements the communication threat detection method provided by the various embodiments described above.

[0133] In the embodiments of the above-mentioned devices, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the present invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0134] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A communication threat detection method, characterized in that: include: receiving global feature data; Based on the global feature data and multiple target detection algorithms, obtaining multiple target probabilities; Based on the global feature data and the gating network, obtaining a plurality of weights corresponding to the plurality of target detection algorithms, wherein each target detection algorithm in the plurality of target detection algorithms corresponds to a weight in the plurality of weights; A communication threat level is determined based on the plurality of target probabilities and the plurality of weights.

2. The communication threat detection method according to claim 1, characterized in that: The multiple target detection algorithms include an abnormal behavior detection algorithm, a signal interference detection algorithm, and a communication threat detection algorithm.

3. The communication threat detection method according to claim 2, characterized in that: The obtaining of multiple target probabilities based on the global feature data and multiple target detection algorithms includes: Acquire behavior characteristic data, signal characteristic data and communication characteristic data in the global characteristic data; Inputting the behavior feature data into the abnormal behavior detection algorithm and outputting the abnormal behavior probability; Inputting the signal characteristic data into the signal interference detection algorithm and outputting the signal interference threat probability; The communication feature data is input into the communication threat detection algorithm, and a communication threat probability is output.

4. The communication threat detection method according to claim 3, characterized in that: The abnormal behavior detection algorithm is a decision tree algorithm; The step of inputting the behavior feature data into the abnormal behavior detection algorithm and outputting the abnormal behavior probability comprises: Inputting the behavior feature data into the decision tree algorithm to obtain prediction results of each path in the decision tree algorithm; The prediction results of each path in the decision tree algorithm are integrated through a voting mechanism to obtain the abnormal behavior probability.

5. The communication threat detection method according to claim 3, characterized in that: The signal interference detection algorithm is a convolutional neural network model; The step of inputting the signal characteristic data into the signal interference detection algorithm and outputting a signal interference threat probability comprises: Inputting the signal feature data into the convolutional layer of the convolutional neural network model, and extracting local feature data from the signal feature data through the convolutional layer; Performing dimension reduction on the local feature data through a pooling layer in the convolutional neural network model, and outputting a feature vector; The feature vector is transformed through a fully connected layer in the convolutional neural network model to output the signal interference threat probability.

6. The communication threat detection method according to claim 3, characterized in that: The communication threat detection algorithm is a long short-term memory network model; The step of inputting the communication feature data into the communication threat detection algorithm and outputting a communication threat probability comprises: Using the gating mechanism of the long short-term memory network model to obtain the hidden state of the communication feature data; Inputting the hidden state into the fully connected layer of the long short-term memory network model for classification to obtain a feature category; The feature category is converted using a Softmax function to obtain the communication threat probability.

7. The communication threat detection method according to claim 1, characterized in that: The obtaining, based on the global feature data and the gating network, a plurality of weights corresponding to the plurality of target detection algorithms comprises: Performing a linear transformation on the global feature data through a fully connected layer of the gating network to obtain a score of each target detection algorithm in the multiple target detection algorithms; Processing the scores of each target detection algorithm in the multiple target detection algorithms through a Softmax function to obtain a weight of each target detection algorithm in the multiple target detection algorithms; The weights of each target detection algorithm in the multiple target detection algorithms are aggregated to obtain multiple weights corresponding to the multiple target detection algorithms.

8. The communication threat detection method according to claim 1, characterized in that: The determining of the communication threat level based on the multiple target probabilities and the multiple weights includes: Performing weighted fusion on the multiple target probabilities and the multiple weights to calculate a communication threat value; The communication threat value is mapped to a preset level interval to obtain a communication threat level corresponding to the communication threat value.

9. A communication threat detection device, characterized in that: include: A data receiving module, used for receiving global feature data; A probability acquisition module, used to acquire multiple target probabilities based on the global feature data and multiple target detection algorithms; A weight acquisition module, configured to acquire a plurality of weights corresponding to the plurality of target detection algorithms based on the global feature data and the gating network, wherein each of the plurality of target detection algorithms corresponds to one of the plurality of weights; The level determination module is used to determine the communication threat level based on the multiple target probabilities and the multiple weights.

10. A computer device, characterized in that: comprising a memory, and one or more processors communicatively connected to the memory; The memory stores instructions that can be executed by the one or more processors, and the instructions are executed by the one or more processors to enable the one or more processors to implement the communication threat detection method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The invention comprises a program or an instruction, which, when executed on a computer, implements the communication threat detection method as claimed in any one of claims 1 to 8.

12. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the communication threat detection method according to any one of claims 1 to 8.

Images