Network security threat detection method based on artificial intelligence
Through the artificial intelligence-based network security threat detection method, using historical data to build sample sequences and labels, train LSTM models, identify and locate malicious payloads in APT attacks, solving the problem of difficulty in detecting and preventing APT attacks in a timely manner in the existing technology, and achieving efficient network security threat detection and prevention.
Patent Information
- Application Number
- CN202411734868.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-11
AI Technical Summary
The existing technology is difficult to detect and clear malicious payloads in APT attacks in a timely manner, making it difficult to detect and prevent network security threats.
Using artificial intelligence-based network security threat detection method, we use the target network to obtain historical data, build sample sequences and sample tags, train LSTM models, identify network security threat events, and locate the time period of malicious payload delivery through data reconstruction and model analysis.
Effectively identify and locate malicious payloads in APT attacks, improve the accuracy and efficiency of network security threat detection, and reduce potential threats.
Smart Images
Figure CN119603040A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology suitable for management, supervision or prediction purposes, and in particular to a network security threat detection method based on artificial intelligence. Background Art
[0002] In the field of network security, APT (Advanced Persistent Threat) is an advanced persistent threat. This is generally a cyber attack by hacker organizations with national backgrounds against hostile forces and national networks through long-term penetration and other methods. APT is a long-term process. The attacker will lurk in the target network for months or even years, waiting for the right time to launch an attack. The attacker will continue to infiltrate and attack the target, constantly looking for new vulnerabilities and opportunities.
[0003] When launching an attack in the form of APT, the attacker may deliver the malicious payload in a variety of ways. After the malicious payload is delivered, the attacker will exploit system vulnerabilities to launch the shellcode, thereby establishing an initial foothold in the target system. It can be seen that the success of APT attacks is based on the effective delivery of the malicious payload. If the malicious payload can be discovered and removed in a timely manner, it will be helpful to detect network security threats. Summary of the invention
[0004] The embodiments of the present application provide a network security threat detection method based on artificial intelligence to at least partially solve the above technical problems.
[0005] The present application embodiment adopts the following technical solutions:
[0006] In a first aspect, an embodiment of the present application provides a network security threat detection method based on artificial intelligence, the method comprising:
[0007] Acquire historical data collected during the historical operation of the target network; the historical data is used to characterize the state of the target network at different historical moments; the historical data includes historical traffic data, historical visitor attribute data, and historical encrypted communication attribute data;
[0008] A sample sequence and a sample label corresponding to the sample sequence are constructed based on the historical data; the sample sequence includes a number of sample nodes arranged in chronological order, and the sample nodes are used to characterize the state of the target network at the historical moment to which they belong, the operation status of network security repair, and whether a network security risk event is detected at the historical moment to which they belong; the sample label is used to characterize whether a network security threat event occurs at the historical moment to which the sample node closest to the current moment in the corresponding sample sequence belongs;
[0009] Using the sample sequence and the sample label to train the LSTM model to be trained to obtain a target model;
[0010] During the operation of the target network, data of the target network collected in a historical time period starting from the current time is used as data to be analyzed; the data to be analyzed includes a plurality of nodes to be analyzed arranged in time order;
[0011] Inputting the data to be analyzed into the target model to obtain analysis results;
[0012] If the analysis result indicates that the probability of a network security threat event occurring at the current moment is greater than a preset probability threshold, the data to be analyzed is reconstructed to obtain first data; the first data is obtained by deleting a specified number of adjacent nodes to be analyzed in the data to be analyzed;
[0013] Inputting the first data into the target model to obtain a first result;
[0014] If the first result indicates that the probability of a network security threat event occurring at the current moment is not greater than the probability threshold, the time period to which the deleted node to be analyzed belongs is used as the target time period;
[0015] Based on the data of the target network collected during the target time period, malicious payloads delivered to the target network are checked.
[0016] In an optional embodiment of this specification, the method further includes:
[0017] If after repeatedly constructing the first data and analyzing based on the target model, the probabilities indicated by the first results obtained are all greater than the probability threshold, malicious payloads delivered to the target network are checked based on data collected in the time period before the historical time period.
[0018] In an optional embodiment of this specification, the method further includes:
[0019] The historical time period is the time period from the last time a malicious payload check was performed on the target network to the current moment.
[0020] In an optional embodiment of this specification, the method further includes:
[0021] When the duration from the last malicious payload screening on the target network to the current moment is greater than a preset first duration threshold, the historical time period also includes a time period before the last malicious payload screening on the target network was performed.
[0022] In an optional embodiment of this specification, the method further includes:
[0023] The first duration threshold when the target model is updated during the time period between the last malicious load check on the target network and the current moment is less than the first duration threshold when the target model is not updated during the time period between the last malicious load check on the target network and the current moment.
[0024] In an optional embodiment of this specification, the method further includes:
[0025] The probability threshold is negatively correlated with the security level of the target network and negatively correlated with the length of the historical time period.
[0026] In an optional embodiment of this specification, the method further includes:
[0027] The specified number is negatively correlated with the probability indicated by the analysis result.
[0028] In an optional embodiment of this specification, the method further includes:
[0029] When deleting a node to be analyzed, the node to be analyzed at the time when the network security risk event is detected cannot be deleted.
[0030] In an optional embodiment of this specification, the method further includes:
[0031] If the result of checking the malicious payload delivered to the target network based on the data of the target network collected during the target time period indicates that the malicious payload is successfully delivered, the time when the successful delivery is completed is taken as the target time;
[0032] If the time length from the target time to the current time is greater than a preset second time length threshold, network security threat detection is performed on other networks associated with the target network.
[0033] In a second aspect, an embodiment of the present application also provides an artificial intelligence-based network security threat detection device, which is used to implement the method steps in the first aspect.
[0034] In a third aspect, an embodiment of the present application further provides an electronic device, including:
[0035] Processor; and
[0036] A memory arranged to store computer executable instructions which, when executed, cause the processor to perform the method steps described in the first aspect.
[0037] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple applications, the electronic device executes the method steps described in the first aspect.
[0038] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:
[0039] In response to APT, an attack method with good concealment and long latency, the method in this specification processes historical data to construct a sample sequence. On the one hand, the sample sequence can express the operating status of the target network, so that the sample sequence has the attributes of a positive sample; on the other hand, it can also show the characteristics exhibited during the entire cycle of the attack, so that the sample sequence has the attributes of a negative sample. The target model obtained based on this sample training learns the characteristics of the APT's latent process, which is conducive to identifying threats. Furthermore, when the method in this specification uses the target model online, by adjusting the model input when a threat is detected, it can locate the time of delivery of the malicious payload of the APT attack to a certain extent, so as to more efficiently detect the malicious payload and reduce the threat. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0041] Figure 1 A schematic diagram of a process of a network security threat detection method based on artificial intelligence provided in an embodiment of this specification;
[0042] Figure 2 It is a schematic diagram of the structure of an electronic device in an embodiment of this specification. DETAILED DESCRIPTION
[0043] The present invention is further described in detail below by specific embodiments in conjunction with the accompanying drawings. Wherein similar elements in different embodiments adopt associated similar element numbers. In the following embodiments, many detailed descriptions are for making the present application better understood. However, those skilled in the art can easily recognize that some features can be omitted in different situations, or can be replaced by other elements, materials, methods. In some cases, some operations related to the present application are not shown or described in the specification, and this is to avoid the core part of the present application being overwhelmed by too much description, and for those skilled in the art, it is not necessary to describe these related operations in detail, and they can fully understand the related operations according to the description in the specification and the general technical knowledge in the art.
[0044] In addition, the features, operations or characteristics described in the specification can be combined in any appropriate manner to form various implementations. At the same time, the steps or actions in the method description can also be interchanged or adjusted in a manner that is obvious to those skilled in the art. Therefore, the various sequences in the specification and the drawings are only for the purpose of clearly describing a certain embodiment and are not meant to be a required sequence, unless otherwise specified that a certain sequence must be followed.
[0045] The serial numbers of the components in this document, such as "first", "second", etc., are only used to distinguish the objects described and do not have any order or technical meaning. The "connection" and "coupling" mentioned in this application, unless otherwise specified, include direct and indirect connections (couplings).
[0046] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.
[0047] like Figure 1 As shown, the network security threat detection method based on artificial intelligence in this specification includes the following steps:
[0048] S100: Acquire historical data collected during the historical operation of the target network.
[0049] The target network in this specification can be applied to any scenario if conditions permit. In the case of multiple networks being interrelated, one of them can be used as the target network in this specification; or, the multiple networks can be considered as a whole.
[0050] The historical data in this specification is used to characterize the state of the target network at different historical moments, such as historical data in the past three years. The historical data includes historical traffic data, historical visitor attribute data (such as visitor IP, etc.), and historical encrypted communication attribute data (such as the size of encrypted data packets, etc.). The historical data can be obtained at least in part through management logs.
[0051] S102: Constructing a sample sequence based on the historical data and a sample label corresponding to the sample sequence.
[0052] The model training in this specification adopts supervised learning, and the sample sequences are not unique. Different sample sequences may or may not overlap in time.
[0053] The sample sequence includes several sample nodes arranged in chronological order, and the sample nodes are used to characterize the state of the target network at the historical moment to which they belong, the operation status of network security repair (for example, network security repair performed by repair software), and whether a network security risk event is detected at the historical moment to which they belong (risk events are different from threat events. Risk events indicate the possibility of risk. Threat events indicate a high probability of the existence of threats, which may have led to adverse consequences. Risk events and threat events involved in related technologies are applicable to this specification when conditions permit). The sample label is used to characterize whether a network security threat event occurs at the historical moment to which the sample node closest to the current moment in the corresponding sample sequence belongs. The sample sequence corresponds one-to-one to the sample label.
[0054] S104: Using the sample sequence and the sample labels, the LSTM model to be trained is trained to obtain a target model.
[0055] The LSTM model (Long Short-Term Memory) is a special recurrent neural network (RNN) that is mainly used to process and predict important events with relatively long intervals and delays in time series. LSTM solves the gradient vanishing and gradient exploding problems in traditional RNNs by introducing a gating mechanism (input gate, forget gate, and output gate) to control the flow of information. This makes LSTM more effective in processing long sequence data and able to learn long-term dependencies.
[0056] S106: During the operation of the target network, data of the target network collected in a historical time period starting from the current moment is used as data to be analyzed.
[0057] The data to be analyzed in this specification includes several nodes to be analyzed arranged in time order, and the data format is the same or similar to the sample sequence to facilitate the processing of the target model. The nodes to be analyzed are also data that characterize the state of the target network.
[0058] In an optional embodiment of the present specification, the historical time period is the time period between the last time the target network was checked for malicious payloads and the current time. It is assumed that the malicious payloads in the history have been cleared in the last malicious payload check.
[0059] In addition, there is a possibility that the last check was not thorough. In another optional embodiment of the present specification, when the time between the last malicious payload check on the target network and the current moment is greater than a preset first time threshold, the historical time period also includes the time period before the last malicious payload check on the target network.
[0060] The first duration threshold may be an empirical value, which is determined manually.
[0061] In addition, the first duration threshold may also be determined based on the update of the target model. For example, the first duration threshold when the target model is updated during the period from the last malicious load screening on the target network to the current moment is less than the first duration threshold when the target model is not updated during the period from the last malicious load screening on the target network to the current moment. In this embodiment, the update of the target model indicates that the model capability has been enhanced, so the screening efforts can be increased to eliminate risks in a timely manner.
[0062] The updating of the target model may be further training of the target model using a new sample sequence.
[0063] S108: Input the data to be analyzed into the target model to obtain analysis results.
[0064] The analysis results indicate the probability of a network security threat event occurring at the current moment.
[0065] S110: If the analysis result indicates that the probability of a network security threat event occurring at the current moment is greater than a preset probability threshold, the data to be analyzed is reconstructed to obtain first data.
[0066] The first data only deletes some of the nodes, but at a macro level, it still has a sequence data format.
[0067] In an optional embodiment of the present specification, the probability threshold is negatively correlated with the security level of the target network (the higher the security requirement, the greater the intensity of the investigation should be), and is negatively correlated with the length of the historical time period (the longer the historical time period, the longer the malicious payload has been hidden when an attack exists, and an investigation should be triggered to avoid further harm caused by hiding).
[0068] In a further optional embodiment of the present specification, when deleting the node to be analyzed, the node to be analyzed at the time of detecting the network security risk event cannot be deleted. The characteristics of such a node to be analyzed may be caused by an attack behavior, which is more critical, and deletion may affect the accuracy of subsequent judgments.
[0069] In an optional embodiment, if the analysis result indicates that the probability of a network security threat event occurring at the current moment is not greater than a preset probability threshold, indicating that the risk is low, then wait for the next execution of the determination of the data to be analyzed.
[0070] S112: Input the first data into the target model to obtain a first result.
[0071] The first result indicates the probability of a network security threat event occurring at the current moment.
[0072] S114: If the first result indicates that the probability of a network security threat event occurring at the current moment is not greater than the probability threshold, the time period to which the deleted node to be analyzed belongs is used as the target time period.
[0073] The target time period in this specification is the time period during which successful delivery of malicious payloads may occur.
[0074] The first data in this specification is obtained by deleting the adjacent specified number of nodes to be analyzed in the data to be analyzed. This deletion processing method, on the one hand, interrupts the temporal coherence of data expression, making the characteristics of the two sections before and after more distinct, which is conducive to the capture of characteristics by the target model; on the other hand, the successful delivery of malicious payloads is the basis for the occurrence of network security threat events. If the malicious payload fails to be successfully delivered, subsequent network security threat events will not occur. However, the actual situation is that even if relatively complete historical data is obtained, it is difficult to determine the specific delivery time of the malicious payload due to the high concealment of the malicious payload; moreover, it can only be determined that the network security threat event occurred after the malicious payload, but the time difference between the two is difficult to determine. After all, the malicious payload does not have a fixed latent period, and it may also be activated by artificial triggering to launch an attack, so it is even more difficult to predict in time. In other words, it is almost impossible to learn the time relationship between the delivery of malicious payloads and the occurrence of network security threat events. However, it is possible to roughly calculate the impact of a certain moment in history on the events that occurred in subsequent moments through the control variable method. The method in this specification is based on various characteristics shown in historical data, and can roughly infer the moments that play a more critical role in the occurrence of network security threat events. These moments may be the moments when malicious payloads are delivered.
[0075] In an optional embodiment of the present specification, the specified number is negatively correlated with the probability represented by the analysis result. The higher the probability, the clearer the attack behavior, the easier it is to find the payload, and the clearer the time period for the malicious payload to be delivered is.
[0076] In an optional embodiment, it is possible that the first result obtained from some of the nodes to be analyzed after the first deletion indicates that the probability of a network security threat event occurring at the current moment is still greater than the probability threshold, and the nodes to be analyzed that need to be deleted are then re-determined. This re-deletion process may need to be performed several times before the target time period is determined. Of course, there are also situations where the target time period cannot be determined after deleting different arrangements. In this case, the historical time period can be optionally used as the target time period. It is also possible to check for malicious payloads delivered to the target network based on data collected in the time period before the historical time period.
[0077] S116: Based on the data of the target network collected during the target time period, malicious payloads delivered to the target network are checked.
[0078] Malicious payloads can be checked through professional troubleshooting software. Since the troubleshooting consumes system computing power and may affect the normal use of the target network, if the troubleshooting is performed periodically, on the one hand, it is difficult to find risks in time, and on the other hand, the efficiency of the non-targeted troubleshooting is also low. The method in this manual can solve the above problems to a certain extent.
[0079] In response to APT, an attack method with good concealment and long latency, the method in this specification processes historical data to construct a sample sequence. On the one hand, the sample sequence can express the operating status of the target network, so that the sample sequence has the attributes of a positive sample; on the other hand, it can also show the characteristics exhibited during the entire cycle of the attack, so that the sample sequence has the attributes of a negative sample. The target model obtained based on this sample training learns the characteristics of the APT's latent process, which is conducive to identifying threats. Furthermore, when the method in this specification uses the target model online, by adjusting the model input when a threat is detected, it can locate the time of delivery of the malicious payload of the APT attack to a certain extent, so as to more efficiently detect the malicious payload and reduce the threat.
[0080] Furthermore, the malicious payload can replicate and spread itself in some cases. This spread may occur even if the malicious payload does not perform clear attack behaviors. In view of this, in an optional embodiment of the present specification, if the result of checking the malicious payload delivered to the target network based on the data of the target network collected during the target time period indicates that the malicious payload was successfully delivered, the moment when the successful delivery was completed is used as the target moment. If the duration from the target moment to the current moment is greater than a preset second duration threshold, indicating that the malicious payload has sufficient time to spread, the network security threat detection in this specification is performed on other networks associated with the target network to prevent the risk from spreading. The second duration threshold may be an empirical value.
[0081] Figure 2 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 2 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.
[0082] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0083] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.
[0084] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a network security threat detection device based on artificial intelligence at the logical level. The processor executes the program stored in the memory and is specifically used to execute any of the aforementioned network security threat detection methods based on artificial intelligence.
[0085] The above application Figure 1The embodiment shown discloses a network security threat detection method based on artificial intelligence, which can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
[0086] The electronic device may also perform Figure 1 A network security threat detection method based on artificial intelligence is implemented Figure 1 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.
[0087] An embodiment of the present application also proposes a computer-readable storage medium, which stores one or more programs, and the one or more programs include instructions. When the instructions are executed by an electronic device including multiple applications, any one of the aforementioned artificial intelligence-based network security threat detection methods is executed.
[0088] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.
[0089] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0092] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0093] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0094] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0095] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0096] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0097] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims
1. A network security threat detection method based on artificial intelligence, characterized in that: The method comprises: Acquire historical data collected during the historical operation of the target network; the historical data is used to characterize the state of the target network at different historical moments; the historical data includes historical traffic data, historical visitor attribute data, and historical encrypted communication attribute data; A sample sequence and a sample label corresponding to the sample sequence are constructed based on the historical data; the sample sequence includes a number of sample nodes arranged in chronological order, and the sample nodes are used to characterize the state of the target network at the historical moment to which they belong, the operation status of network security repair, and whether a network security risk event is detected at the historical moment to which they belong; the sample label is used to characterize whether a network security threat event occurs at the historical moment to which the sample node closest to the current moment in the corresponding sample sequence belongs; Using the sample sequence and the sample label to train the LSTM model to be trained to obtain a target model; During the operation of the target network, data of the target network collected in a historical time period starting from the current time is used as data to be analyzed; the data to be analyzed includes a plurality of nodes to be analyzed arranged in time order; Inputting the data to be analyzed into the target model to obtain analysis results; If the analysis result indicates that the probability of a network security threat event occurring at the current moment is greater than a preset probability threshold, the data to be analyzed is reconstructed to obtain first data; the first data is obtained by deleting a specified number of adjacent nodes to be analyzed in the data to be analyzed; Inputting the first data into the target model to obtain a first result; If the first result indicates that the probability of a network security threat event occurring at the current moment is not greater than the probability threshold, the time period to which the deleted node to be analyzed belongs is used as the target time period; Based on the data of the target network collected during the target time period, malicious payloads delivered to the target network are checked.
2. The method according to claim 1, characterized in that: The method further comprises: If after repeatedly constructing the first data and analyzing based on the target model, the probabilities indicated by the first results obtained are all greater than the probability threshold, malicious payloads delivered to the target network are checked based on data collected in the time period before the historical time period.
3. The method according to claim 1, characterized in that: The method further comprises: The historical time period is the time period from the last time a malicious payload check was performed on the target network to the current moment.
4. The method according to claim 1, characterized in that: The method further comprises: When the duration from the last malicious payload screening on the target network to the current moment is greater than a preset first duration threshold, the historical time period also includes a time period before the last malicious payload screening on the target network was performed.
5. The method according to claim 4, characterized in that: The method further comprises: The first duration threshold when the target model is updated during the time period between the last malicious load check on the target network and the current moment is less than the first duration threshold when the target model is not updated during the time period between the last malicious load check on the target network and the current moment.
6. The method according to claim 1, characterized in that: The method further comprises: The probability threshold is negatively correlated with the security level of the target network and negatively correlated with the length of the historical time period.
7. The method according to claim 1, characterized in that: The method further comprises: The specified number is negatively correlated with the probability indicated by the analysis result.
8. The method according to claim 1, characterized in that: The method further comprises: When deleting a node to be analyzed, the node to be analyzed at the time when the network security risk event is detected cannot be deleted.
9. The method according to claim 1, characterized in that: The method further comprises: If the result of checking the malicious payload delivered to the target network based on the data of the target network collected during the target time period indicates that the malicious payload is successfully delivered, the time when the successful delivery is completed is taken as the target time; If the time length from the target time to the current time is greater than a preset second time length threshold, network security threat detection is performed on other networks associated with the target network.
10. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, causes the electronic device to execute any one of the methods of claims 1 to 9.