Information transmission attack event intelligent prediction model training optimization method

Abstract

The invention discloses an information transmission attack event intelligent prediction model training optimization method, which comprises the steps of a data preparation stage, a feature engineering stage, a model selection and construction stage, a model training stage and a model evaluation and optimization stage, and is characterized in that data are collected from multiple channels, noise is cleaned and removed, missing values and abnormal values are processed, and accurate labeling is carried out; then key features are extracted, redundant irrelevant features are removed through selection, standardized transformation is carried out, a proper model is selected based on data features, an integrated learning combination model is adopted, then a training set, a verification set and a test set are divided, a proper optimizer is selected, parameters are adjusted to be over, training is carried out through the training set, and over-fitting is prevented through the verification set; and finally, using index evaluation of accuracy and recall rate, and adjusting hyper-parameters and continuous optimization of the model structure through cross validation. According to the method, data collection, data imbalance processing and data noise interference processing are adopted, data diversity is improved, and interference of data noise is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to an optimization method for training an intelligent prediction model for information transmission attack events. Background Art

[0002] In the field of information transmission, with the rapid development of network technology, the complexity and diversity of information transmission attack events are increasing, posing a serious threat to information security. It is necessary to use intelligent prediction model training optimization methods for information transmission attack events to improve the security of information transmission.

[0003] The data sources of the existing intelligent prediction model training optimization methods for information transmission attack events are relatively single, and it is difficult to comprehensively cover various attack scenarios. In addition, due to privacy and security restrictions, it is impossible to effectively integrate multi-source data when integrating data across institutions. It is difficult to collect minority samples of attack events, resulting in a prominent data imbalance problem. At the same time, the effect of dealing with data imbalance and noise interference is poor. For data imbalance, only simple oversampling or undersampling technology is used, which cannot fundamentally solve the problem of weak model prediction ability for minority attack events. When dealing with data noise, the means are single and it is impossible to deeply mine and process noise data, which affects the stability and accuracy of model training. Summary of the invention

[0004] The purpose of the present invention is to provide an intelligent prediction model training optimization method for information transmission attack events in order to solve the technical problems that the existing information transmission attack event intelligent prediction model training optimization method has a relatively single data source and is not effective in processing data imbalance and noise interference.

[0005] The technical solution adopted by the present invention is as follows: The information transmission attack event intelligent prediction model training optimization method includes the following steps: S1. Data preparation stage, including data collection, data imbalance processing and data noise interference processing, mainly collecting data from multiple channels such as network logs, firewall records, and intrusion detection system alarms, actively obtaining supplementary data, cleaning and removing noise, processing missing values ​​and outliers, and accurately labeling them; S2, feature engineering stage, extract key features, remove redundant and irrelevant features through selection, and then perform standardization transformation; S3, model selection and construction phase, select the appropriate model based on data characteristics, and use ensemble learning to combine models; S4, model training phase, divide the model into training set, validation set and test set, select the appropriate optimizer and adjust the hyperparameters, use the training set for training and use the validation set to prevent overfitting; S5: In the model evaluation and optimization phase, we use the accuracy and recall rate indicators for evaluation, select the best model through cross-validation, and adjust the hyperparameters and model structure based on the results for continuous optimization.

[0006] Among them, the data collection includes expanding data sources and overcoming data acquisition limitations. The expanded data sources need to monitor traffic from key nodes in the internal network, collect system and application logs, obtain data externally with the help of security information sharing platforms and industry cooperation, and build a simulated network environment to execute attacks to generate data. Overcoming data acquisition limitations is achieved through federated learning, combining local pre-processing and encryption of data by all parties, and aggregating encryption parameters on the central server to achieve collaborative training, or using homomorphic encryption technology to encrypt data for model training and decrypt the results, thereby achieving effective data utilization while protecting data privacy.

[0007] Among them, the data imbalance processing includes targeted data collection, data annotation optimization and preliminary data balancing processing. The targeted data collection focuses on determining minority samples, and increases the collection of minority samples by cooperating with professional teams and adjusting collection strategies. The data annotation optimization relies on forming a professional annotation team, adopting multi-person annotation, cross-validation and expert judgment to ensure accurate and consistent annotations. The preliminary data balancing processing uses random oversampling in real time to moderately increase the proportion of minority samples, and at the same time performs under-sampling screening on majority samples based on cluster analysis to reduce the number and retain feature distribution.

[0008] Among them, the data noise interference processing includes data source control, data format inspection and cleaning, noise identification and processing based on statistical methods, and noise detection based on machine learning. It starts with data source control, selects high-quality data sources and reliable collection tools, and then performs data format inspection and cleaning, verifies data format and removes invalid data. Subsequently, based on statistical methods, the mean and standard deviation of numerical data are calculated to set thresholds, and data distribution is analyzed to identify and process noise. Finally, machine learning is used to learn normal data patterns and divide data clusters through anomaly detection algorithms and cluster analysis to identify and process noise data.

[0009] Among them, the noise identification and processing based on statistical methods, for numerical data, usually uses the mean plus or minus 3 times the standard deviation as the threshold range. Data points outside this range are preliminarily identified as noise, and then the histogram and box plot of the data are drawn to visually observe the data distribution. For the identified noise data, if the amount of noise data is small, it can be deleted directly. If the amount of data is large and cannot be easily discarded, for numerical noise, the mean or median can be used as a substitute, and then corrected by linear interpolation method.

[0010] Among them, the anomaly detection algorithm in noise detection based on machine learning is an isolation forest anomaly detection algorithm, which takes the collected data features as input, and the algorithm randomly selects a feature and a value within the feature range, and constructs multiple binary trees by recursively dividing the data space. Normal data points are usually isolated in the deeper layers of the tree, while noise data points are isolated in the shallower layers of the tree. The anomaly score is calculated according to the depth of the data point in the tree, and the high score is noise. The clustering analysis algorithm is K-Means clustering, which divides the data into K clusters, assuming that normal data will be concentrated in larger and dense clusters, while noise data often forms isolated small clusters or exists as outliers.

[0011] Among them, the feature engineering stage will extract features related to information transmission attacks from the original data, and then use correlation analysis and chi-square test methods to select features that have a significant impact on model prediction, remove redundant and irrelevant features, reduce data dimensions, and finally standardize and normalize the features to make them have a unified scale, thereby improving model training efficiency and stability.

[0012] Among them, the model selection and construction stage selects a suitable model based on data characteristics and problem requirements, adjusts the structural parameters of the selected model, and finally adopts an integrated learning method to combine the advantages of multiple models to enhance the model's robustness and generalization ability.

[0013] Among them, in the model training stage, the processed data is divided into training set, validation set and test set in a ratio of 7:2:1 or 8:1:1, which are used for model training, parameter adjustment and performance evaluation respectively. Then, stochastic gradient descent and its variant optimizers are selected to optimize the model parameter update method by adjusting the learning rate and batch size hyperparameters. Finally, the model is trained with the training set data. During the training process, the model performance is monitored with the help of the validation set to prevent overfitting. If overfitting occurs, the model structure or hyperparameters are adjusted.

[0014] Among them, the model evaluation and optimization stage uses multiple indicators such as accuracy, recall rate, F1 value, and area under the ROC curve to evaluate model performance, comprehensively considers the performance of the model in unbalanced data and noisy environments, and uses the K-fold cross-validation method to divide the data set into training and validation subsets for multiple times, train and evaluate the model, select the model with stable and optimal performance, reduce the deviation caused by data division, and then adjust the model hyperparameters, improve the model structure or re-perform feature engineering based on the evaluation results to continuously optimize the model performance until business needs are met.

[0015] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: In the present invention, the collaboration of data collection, data imbalance processing and data noise interference processing is adopted. In terms of data collection, data is collected through multiple channels such as network logs, firewall records, and intrusion detection system alarms to improve data diversity. In terms of data imbalance processing, a variety of oversampling, undersampling technologies and annotation optimization are combined to comprehensively improve data distribution. In terms of data noise interference processing, the source is controlled, and multi-level detection and processing with statistical and machine learning algorithms are used to more deeply explore and eliminate noise, thereby improving model stability and accuracy. These advantages improve data quality and effectively solve the technical problem that the data source in the method is relatively single and the effect in processing data imbalance and noise interference is poor. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of the method steps of the present invention; Figure 2 It is a flow chart of the steps in the data preparation stage of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0018] Reference Figure 1-Figure 2The training and optimization method of the intelligent prediction model for information transmission attack events includes the steps of data preparation stage, feature engineering stage, model selection and construction stage, model training stage, model evaluation and optimization stage. The data preparation stage includes data collection, data imbalance processing and data noise interference processing. It mainly collects data from multiple channels such as network logs, firewall records, and intrusion detection system alarms, actively obtains supplementary data, and cleans and removes noise, processes missing values ​​and outliers, and accurately labels them. Then, key features are extracted, redundant and irrelevant features are removed through selection, and then standardized transformation is performed. Based on the characteristics of the data, a suitable model is selected, and an integrated learning combination model is adopted. Then, the training set, validation set and test set are divided, a suitable optimizer is selected and hyperparameters are adjusted, and the training set is used for training and the validation set is used to prevent overfitting. Finally, we use the accuracy and recall rate related indicators for evaluation, select the best through cross-validation, adjust the hyperparameters and model structure according to the results for continuous optimization, and set up the collaboration between data collection, data imbalance processing and data noise interference processing. In data collection, we use multi-source integration, active collection and privacy protection technology to break through traditional limitations and obtain more comprehensive and diverse data. When dealing with data imbalance, we coordinate multiple links from collection to labeling, and use a variety of sampling technologies to effectively improve category distribution and enhance the representativeness of minority samples. In the face of data noise interference, we control it from the source, combine statistical and machine learning methods, detect and process noise at multiple levels to ensure high data quality. These advantages improve data quality in all aspects and lay a solid foundation for building a more accurate, stable and efficient intelligent prediction model.

[0019] Reference Figure 2As shown in the figure, data collection includes expanding data sources and overcoming data acquisition limitations. To expand data sources, it is necessary to monitor traffic from key nodes in the internal network, collect system and application logs, install network traffic analysis tools at key nodes related to network core switches and routers, and then set fixed time intervals, such as collecting network traffic data every 5 minutes, collect log data in real time, store the collected data in the local database, and classify and store them according to data type and time. Externally, data is obtained through security information sharing platforms and industry cooperation. Cooperation is negotiated with well-known network security data providers and industry security organizations, and data sharing agreements are signed. External data is obtained in accordance with the methods specified in the agreement, and external data is integrated with internally collected data to unify the data format. A simulated network environment is built using virtualization technology to simulate the enterprise network architecture, and network attack simulation tools are used to record network traffic and system response data during the attack and save them to a dedicated simulation data repository. To overcome data acquisition limitations, federated learning is used to combine local pre-processing and encryption data of all parties, and the central server aggregates encryption parameters to achieve collaborative training, or homomorphic encryption technology is used to encrypt data. After encryption, it is used for model training, and the result is decrypted, so as to achieve effective data utilization under the premise of protecting data privacy. Federated learning includes the establishment of a network of participants, data preprocessing and encryption, model training and parameter interaction, and the establishment of a federated learning network by uniting multiple organizations with relevant data. Each party builds a data preprocessing module and a model training node locally. Each participant cleans and annotates the local data, and then encrypts the data using an encryption algorithm. The central server coordinates the training of all parties. Each party trains the model on the local encrypted data and sends the encrypted model parameters to the central server. After the central server aggregates the parameters, it returns the updated parameters to each party, and each party uses it to update the local model. This process is repeated until the model converges. Homomorphic encryption technology includes data encryption, model training and result decryption. The data owner uses a homomorphic encryption algorithm to encrypt the data so that the encrypted data can be used for specific operations without decryption. The encrypted data is transmitted to the model training party, and the training party executes the model training algorithm on the encrypted data. Due to the characteristics of homomorphic encryption, the calculation result after decryption is consistent with the calculation result on the plaintext data. After the model training is completed, the data owner decrypts the model output result to obtain the final training or prediction result.

[0020] Reference Figure 2As shown, data imbalance processing includes targeted data collection, data annotation optimization and preliminary data balancing processing. Targeted data collection focuses on determining minority samples. There is relatively little data on specific types of advanced persistent threat attacks. For such minority classes, we actively expand the collection method and cooperate with security teams focusing on this field to obtain relevant data accumulated in actual monitoring. By cooperating with professional teams and adjusting collection strategies, we increase the collection efforts for categories with small amounts of data, obtain different variants of the same type of attack data, enrich the diversity of minority samples, and increase the collection of minority samples. Data annotation optimization relies on the establishment of a professional annotation team, whose members include network security experts and personnel familiar with the data annotation process. They accurately annotate the collected data and clearly distinguish between normal and attack events. In particular, for complex or ambiguous data samples, experts make judgments based on network security knowledge and experience. Multi-person annotation, cross-validation and expert judgment are used, and different annotation personnel Label the same batch of data and then compare the labeling results. For samples with disagreements, determine the final labeling through team discussion or consulting authoritative experts to improve the accuracy and consistency of the labeling and provide a reliable basis for subsequent processing. For preliminary data balancing, random oversampling is used in real time to moderately increase the proportion of minority class samples. At the same time, under-sampling screening is performed on majority class samples based on cluster analysis to reduce the number and retain the characteristic distribution. During the data collection process, for minority class samples, a simple oversampling method can be applied in real time. After a certain number of minority class samples are collected, some samples are randomly copied to increase their proportion in the current collected data, and attention is paid to controlling the degree of oversampling to avoid over-copying leading to overfitting of the model. For majority class samples, preliminary under-sampling screening can be performed to divide the majority class samples into multiple clusters, select some representative samples from each cluster to retain, and delete the remaining samples, to reduce the number of majority class samples to a certain extent, while trying to retain their characteristic distribution.

[0021] Reference Figure 2As shown in the figure, data noise interference processing includes data source control, data format check and cleaning, noise identification and processing based on statistical methods, and noise detection based on machine learning. From the data source control, select high-quality data sources and reliable collection tools, then check and clean the data format, verify the data format and remove invalid data, then calculate the mean and standard deviation of numerical data based on statistical methods, set thresholds, analyze data distribution and identify noise, and finally use machine learning to learn normal data patterns and divide data clusters through anomaly detection algorithms and cluster analysis to identify and process noise data. When collecting data, use high-quality data sources and reliable collection tools to reduce noise introduction. For the collected data, preliminarily check the data format, use simple statistical methods to set a reasonable range for numerical data, remove outliers that exceed the range, further reduce data noise interference, prevent noise data from misleading model training, and make the model learn wrong patterns, reducing prediction accuracy and generalization ability.

[0022] Reference Figure 2 As shown in the figure, noise identification and processing based on statistical methods, for numerical data, usually the mean plus or minus 3 times the standard deviation is used as the threshold range, and data points beyond this range are preliminarily identified as noise. The mean of network traffic data is set to 100KB and the standard deviation is 10KB, then the data points with traffic values ​​less than 70KB or greater than 130KB are noise data, and then the histogram and box plot of the data are drawn to visually observe the data distribution. In the data distribution of network connection time, most of the connection time is concentrated in 1-10 minutes, but some data points show a connection time of 1000 minutes. After analysis, if it does not conform to normal business logic, it is determined to be noise. For the identified noise data, if the amount of noise data is small, it can be deleted directly. If the amount of data is large and cannot be easily discarded, for numerical noise, the mean and median can be used as substitutes, and then corrected by linear interpolation method, and the abnormal traffic value is replaced by the mean of other normal network traffic data in the same time period.

[0023] Reference Figure 2As shown in the figure, the anomaly detection algorithm in noise detection based on machine learning is the isolation forest anomaly detection algorithm. The collected data features are used as input. The algorithm randomly selects a feature and a value within the feature range. By recursively dividing the data space, multiple binary trees are constructed. Normal data points are usually isolated in the deeper layers of the tree, while noise data points are isolated in the shallower layers of the tree. The anomaly score is calculated according to the depth of the data point in the tree. The one with a high score is noise. For the login behavior data in the network log, when a login record is quickly isolated in the isolation forest and its anomaly score is high, it will be judged as noise or abnormal login behavior. The clustering analysis algorithm is K-Means clustering, which divides the data into K clusters. It is assumed that normal data will be gathered in larger and dense clusters, while noise data often forms isolated small clusters or exists as outliers. After K-Means clustering of the network connection data, when it is found that the connection features in a small cluster are significantly different from those of other large clusters and do not conform to the common network connection mode, the small cluster data is judged as noise.

[0024] Reference Figure 1 As shown in the figure, the feature engineering stage extracts features related to information transmission attacks from the original data. In the network traffic data, the features such as traffic size, traffic rate, connection duration, entropy value of source port and destination port are extracted. For system log data, the features such as operation type, operation time interval, and user or process ID involved are extracted. For application data, the request response time, request frequency, format characteristics of transmission data, etc. are extracted. Then, the features that have a significant impact on model prediction are selected by correlation analysis and chi-square test. The correlation coefficient between each feature and the attack event label is calculated by correlation analysis, and the features with low correlation are removed. The chi-square test is used to evaluate the importance of features for classification, and features with high chi-square values ​​are selected. Redundant and irrelevant features are removed to reduce the data dimension. Finally, the features are standardized and normalized to have a unified scale, which improves the efficiency and stability of model training. The numerical features are standardized and the feature values ​​are converted into standard normal distribution data with a mean of 0 and a standard deviation of 1. For bounded data, the normalization method is used to map the feature values ​​to the interval [0,1].

[0025] Reference Figure 1As shown in the figure, in the model selection and construction stage, a suitable model is selected according to the data characteristics and problem requirements. The models include random forest model, support vector machine model and recurrent neural network model. The structural parameters of the selected model are adjusted. When using the recurrent neural network model, the number of network layers, the number of neurons and the connection method are adjusted. Through experiments and verification, the optimal number of hidden layers and the number of neurons in each layer are determined to balance the complexity and performance of the model. For the decision tree model, the tree depth, splitting criterion and other parameters are adjusted to avoid overfitting caused by too deep decision trees. At the same time, regularization technology is used to add regularization terms to the loss function to constrain model parameters and prevent model overfitting. Finally, an integrated learning method is used to combine the advantages of multiple models to combine multiple different models or different variants of the same model to enhance the robustness and generalization ability of the model. Robustness is the ability of the model to maintain stable and good performance in the face of interference factors such as data noise, outliers, adversarial attacks or changes in data distribution. Generalization ability refers to the ability of the model to accurately predict or classify data that has never been seen.

[0026] Reference Figure 1 As shown in the figure, during the model training phase, the processed data is divided into training set, validation set and test set in a ratio of 7:2:1 or 8:1:1. The training set is used to learn and optimize the model parameters. The validation set is used to evaluate the model performance, adjust the hyperparameters and prevent overfitting during the training process. The test set is used to finally evaluate the generalization ability of the model on unseen data. Then, stochastic gradient descent and its variant optimizers are selected. Stochastic gradient descent is a commonly used optimizer. It updates the parameters by calculating the gradient using a small batch of data in each iteration. Variant optimizers include Adagrad, Adadelta, Adam and other optimizers. The learning rate of each parameter can be dynamically adjusted during the training process. By adjusting the learning rate and batch size hyperparameters, the model parameter update method is optimized, and finally the training set data is used to train the model. During the training process, the model performance is monitored with the help of the validation set to prevent overfitting. If overfitting occurs, the model structure or hyperparameters are adjusted. The selected optimizer is used to calculate the gradient of the loss function to the model parameters through the back propagation algorithm, and the model parameters are updated according to the gradient. This process is continuously iterated to gradually reduce the loss function and continuously improve the model performance. In each iteration, the performance indicators on the validation set are monitored. When the performance of the validation set no longer improves after several iterations, or even decreases, it means that the model is overfitting. At this time, stop training or adjust the model structure and hyperparameters.

[0027] Reference Figure 1As shown in the figure, the model evaluation and optimization stage uses multiple indicators such as accuracy, recall, F1 value, and area under the ROC curve to evaluate model performance, comprehensively consider the performance of the model in unbalanced data and noisy environments, and use the K-fold cross-validation method to divide the data set into training and validation subsets for multiple times. The model is trained and evaluated, and the model with stable and optimal performance is selected to reduce the deviation caused by data division. Then, based on the evaluation results, the model hyperparameters are adjusted, the model structure is improved, or feature engineering is performed again to continuously optimize the model performance until business needs are met.

[0028] Specifically, the recall rate is used to evaluate the model's ability to identify attack events. The F1 value comprehensively considers the accuracy and recall rate to more comprehensively reflect the performance of the model on unbalanced data. The ROC curve is drawn and the AUC value is calculated to evaluate the classification performance of the model at different thresholds. The larger the AUC value, the stronger the classification ability of the model. For multi-classification problems, macro-average F1 value, micro-average F1 value and other indicators are used for measurement. The K-fold cross-validation method divides the data set into K subsets, and each time one of the subsets is selected as the validation set, and the remaining K-1 subsets are used as the training set. K training and validation are performed. After multiple training and validation, the performance indicators of each validation are calculated and the average is taken to obtain a more stable and Reliable model performance evaluation results reduce the deviation caused by data set division. When the model performs well on the training set but performs poorly on the validation set and test set, it means that the model is overfitting. It can be optimized by increasing the regularization strength, reducing the model complexity, and increasing the training data. When the model performs poorly on both the training set and the validation set, it means that the model is underfitting. Try to increase the model complexity, adjust the hyperparameters, and other methods to improve the model performance. In addition, by re-examining the feature engineering process, try to extract new features or further transform existing features to improve model performance. After optimization, the model is trained and evaluated again, and this process is repeated until the model performance reaches a satisfactory level.

[0029] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A training and optimization method for an intelligent prediction model of information transmission attack events, characterized in that: The following steps are involved: S1. Data preparation stage, including data collection, data imbalance processing and data noise interference processing, mainly collecting data from multiple channels such as network logs, firewall records, and intrusion detection system alarms, actively obtaining supplementary data, cleaning and removing noise, processing missing values ​​and outliers, and accurately labeling them; S2, feature engineering stage, extract key features, remove redundant and irrelevant features through selection, and then perform standardization transformation; S3, model selection and construction phase, select the appropriate model based on data characteristics, and use ensemble learning to combine models; S4, model training phase, divide the model into training set, validation set and test set, select the appropriate optimizer and adjust the hyperparameters, use the training set for training and use the validation set to prevent overfitting; S5: In the model evaluation and optimization phase, we use the accuracy and recall rate indicators for evaluation, select the best model through cross-validation, and adjust the hyperparameters and model structure based on the results for continuous optimization.

2. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: The data collection includes expanding data sources and overcoming data acquisition limitations. The expanded data sources are to monitor traffic from key nodes in the internal network, collect system and application logs, obtain data from the outside with the help of security information sharing platforms and industry cooperation, and build a simulated network environment to perform attacks to generate data. Overcoming data acquisition limitations is achieved through federated learning, combining local pre-processing and encryption of data by all parties, and aggregating encryption parameters on a central server to achieve collaborative training, or using homomorphic encryption technology to encrypt data for model training and decrypt the results, thereby achieving effective data utilization while protecting data privacy.

3. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: The data imbalance processing includes targeted data collection, data annotation optimization and preliminary data balancing processing. The targeted data collection focuses on determining minority samples, and increases the collection of minority samples by cooperating with professional teams and adjusting collection strategies. The data annotation optimization relies on forming a professional annotation team, adopting multi-person annotation, cross-validation and expert judgment to ensure accurate and consistent annotations. The preliminary data balancing processing uses random oversampling in real time to moderately increase the proportion of minority samples, and at the same time performs under-sampling screening on majority samples based on cluster analysis to reduce the number and retain feature distribution.

4. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: The data noise interference processing includes data source control, data format inspection and cleaning, noise identification and processing based on statistical methods, and noise detection based on machine learning. It starts with data source control, selects high-quality data sources and reliable collection tools, and then performs data format inspection and cleaning, verifies data format and removes invalid data. Subsequently, based on statistical methods, the mean and standard deviation of numerical data are calculated to set thresholds, and data distribution is analyzed to identify and process noise. Finally, machine learning is used to learn normal data patterns and divide data into clusters through anomaly detection algorithms and cluster analysis to identify and process noise data.

5. The information transmission attack event intelligent prediction model training optimization method according to claim 4 is characterized in that: The noise identification and processing based on statistical methods, for numerical data, uses the mean plus or minus 3 times the standard deviation as the threshold range. Data points outside this range are preliminarily identified as noise, and then histograms and box plots of the data are drawn to visually observe the data distribution. For the identified noise data, if the amount of noise data is small, it can be directly deleted. If the amount of data is large and cannot be easily discarded, for numerical noise, the mean or median can be used as a substitute, and then corrected by linear interpolation method.

6. The information transmission attack event intelligent prediction model training optimization method according to claim 4 is characterized in that: The anomaly detection algorithm in noise detection based on machine learning is an isolation forest anomaly detection algorithm, which takes the collected data features as input. The algorithm randomly selects a feature and a value within the feature range, and constructs multiple binary trees by recursively dividing the data space. Normal data points are usually isolated in the deeper layers of the tree, while noise data points are isolated in the shallower layers of the tree. The anomaly score is calculated according to the depth of the data point in the tree. The one with a high score is noise. The clustering analysis algorithm is K-Means clustering, which divides the data into K clusters. It is assumed that normal data will be clustered in larger and dense clusters, while noise data often forms isolated small clusters or exists as outliers.

7. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: The feature engineering stage extracts features related to information transmission attacks from the original data, and then uses correlation analysis and chi-square test methods to select features that have a significant impact on model prediction, remove redundant and irrelevant features, reduce data dimensions, and finally standardize and normalize the features to a unified scale, thereby improving model training efficiency and stability.

8. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: In the model selection and construction phase, a suitable model is selected based on data characteristics and problem requirements, structural parameters of the selected model are adjusted, and finally an integrated learning method is adopted to combine the advantages of multiple models to enhance the robustness and generalization ability of the model.

9. The information transmission attack event intelligent prediction model training optimization method according to claim 1 is characterized in that: In the model training stage, the processed data is divided into a training set, a validation set and a test set in a ratio of 7:2:1 or 8:1:1, which are used for model training, parameter adjustment and performance evaluation, respectively. Then, stochastic gradient descent and its variant optimizers are selected to optimize the model parameter update method by adjusting the learning rate and batch size hyperparameters. Finally, the model is trained with the training set data. During the training process, the model performance is monitored with the help of the validation set to prevent overfitting. If overfitting occurs, the model structure or hyperparameters are adjusted.

10. The information transmission attack event intelligent prediction model training optimization method according to claim 1, characterized in that: The model evaluation and optimization stage uses multiple indicators such as accuracy, recall, F1 value, and area under the ROC curve to evaluate model performance, comprehensively considers the performance of the model in unbalanced data and noisy environments, and uses the K-fold cross-validation method to divide the data set into training and validation subsets multiple times, train and evaluate the model, select the model with stable and optimal performance, and reduce the deviation caused by data division. Then, based on the evaluation results, adjust the model hyperparameters, improve the model structure, or re-perform feature engineering to continuously optimize the model performance until it meets business needs.

Images