Network data asset affiliation identification method and system based on stacking model

Abstract

The invention provides a network data asset affiliation identification method and system based on a stacking model, and relates to the technical field of network security. The method comprises the following steps: acquiring a network data asset data set comprising a plurality of network data asset samples; extracting a plurality of network features of the network data asset sample; constructing a plurality of base models; according to each network feature, determining a base classification result of each base model for the network data asset sample; determining the weight of each base model according to a base classification result; taking the output of each base model as the input of each channel of the multi-layer perceptron, taking the weight of each base model as the weight of the channel, and stacking the base models and the multi-layer perceptron to form a stacked model; determining a comprehensive classification result of the stacking model for the network data asset samples; obtaining to-be-identified network data assets; and determining a comprehensive classification result of the to-be-identified network data assets through the stacking model, and performing attribution identification on the to-be-identified network data assets.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for identifying network data asset ownership based on a stacking model. Background Art

[0002] With the rapid development of network technology and the continuous increase in the amount of network data, it is increasingly important to effectively manage and classify network data assets. Network data assets include a wide range of information types, such as transaction data, user behavior data, and various communication data, which are critical to network security and business decision-making. However, due to the complexity and dynamic changes of network data, traditional data processing methods often cannot meet the needs of efficient and accurate management.

[0003] In existing technical solutions, traditional network data asset attribution identification methods mainly use a single model for data processing and analysis, which has low identification accuracy when faced with diverse data features and complex environments.

[0004] In addition, a single model usually requires huge computing resources when processing massive network data assets, and performance bottlenecks are prone to occur when the amount of data increases sharply, which not only increases processing time but also leads to insufficient real-time data processing capabilities. Summary of the invention

[0005] In order to solve the technical problems that traditional network data asset ownership identification methods mainly use a single model for data processing and analysis, the identification accuracy is low when faced with diverse data features and complex environments, and the single model usually requires huge computing resources when processing massive network data assets, and performance bottlenecks are prone to occur when the amount of data increases sharply, which not only increases the processing time but also leads to insufficient real-time data processing capabilities, the present invention provides a network data asset ownership identification method and system based on a stacking model.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect:

[0008] An embodiment of the present invention provides a method for identifying network data asset ownership based on a stacking model, comprising:

[0009] S1: Acquire a network data asset dataset, where the network data asset dataset includes a plurality of network data asset samples;

[0010] S2: extracting multiple network features of the network data asset sample;

[0011] S3: construct multiple base models;

[0012] S4: determining the base classification results of each base model for the network data asset sample according to the multiple network features of the network data asset sample;

[0013] S5: dynamically determining the weight of each base model according to the base classification results of each base model for the network data asset sample;

[0014] S6: using the output of each base model as the input of each channel of the multilayer perceptron, using the weight of each base model as the weight of the channel, and stacking the base model and the multilayer perceptron to form a stacked model;

[0015] S7: Determine the comprehensive classification result of the stacking model for the network data asset sample;

[0016] S8: training the stacking model according to the comprehensive classification result of the network data asset sample;

[0017] S9: Obtain the network data assets to be identified;

[0018] S10: Determine the comprehensive classification result of the network data assets to be identified through the trained stacking model, and perform attribution identification on the network data assets to be identified.

[0019] Second aspect:

[0020] An embodiment of the present invention provides a network data asset attribution identification system based on a stacking model, comprising: a memory and one or more processors;

[0021] One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the above-mentioned network data asset attribution identification method based on the stacking model.

[0022] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0023] In the present invention, by constructing multiple base models, according to multiple network features of the network data asset samples, the base classification results of each base model for the network data asset samples are determined, and according to the base classification results of each base model for the network data asset samples, the weights of each base model are dynamically determined, the outputs of each base model are used as the inputs of each channel of the multi-layer perceptron, the weights of each base model are used as the weights of the channels, the base models and the multi-layer perceptron are stacked to form a stacked model, avoiding the use of a single model for data processing and analysis, and having a high recognition accuracy when faced with diverse data features and complex environments. When processing massive network data assets, huge computing resources are not required, and performance bottlenecks are not likely to occur when the amount of data increases sharply, thereby reducing processing time and improving real-time data processing capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A schematic diagram of a flow chart of a network data asset attribution identification method based on a stacking model provided by an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of the structure of a network data asset attribution identification system based on a stacking model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0028] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0029] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0030] Reference Manual Attached Figure 1 , showing a flow chart of a network data asset ownership identification method based on a stacking model provided in an embodiment of the present invention.

[0031] The embodiment of the present invention provides a method for identifying network data asset ownership based on a stacking model, which can be implemented by a network data asset ownership identification device based on a stacking model, and the network data asset ownership identification device based on a stacking model can be a terminal or a server. The processing flow of the method for identifying network data asset ownership based on a stacking model may include the following steps:

[0032] S1: Obtain a network data asset dataset, where the network data asset dataset includes multiple network data asset samples.

[0033] Specifically, a network data asset data set is constructed by collecting multiple network data asset samples transmitted in the network in real time through a network packet capture tool (such as Wireshark or tcpdump).

[0034] It should be noted that Wireshark is a widely used open source network packet capture tool for real-time monitoring and analysis of network communication data. It can capture various types of data packets transmitted in the network, support multiple protocol parsing, and help users gain in-depth understanding of the detailed information of data packets, such as source IP, destination IP, port, protocol type, and data content. Wireshark is often used for network troubleshooting, network security analysis, and performance optimization, and is suitable for network engineers, system administrators, and network security personnel.

[0035] It should be noted that tcpdump is a powerful command-line network packet capture tool, widely used in Unix / Linux systems for real-time capture and analysis of network packets. It can intercept all packets passing through the network interface and filter out the traffic of interest based on the specified filtering conditions (such as IP address, port, protocol, etc.). tcpdump supports printing detailed packet information to the screen or saving it to a file for subsequent analysis. It is often used for tasks such as network troubleshooting, security monitoring, and performance tuning. It is a common tool for network administrators and security experts.

[0036] In the present invention, Wireshark and tcpdump can be used to capture data packets in real time in the network, which makes the data set reflect the latest status of the current network environment and interaction, thereby ensuring the timeliness and relevance of the data. These tools support a wide range of network protocols, ensuring applicability in different network environments and applications. By parsing multiple protocols, a multifunctional network data asset identification system can be built, which is applicable to different types of networks and data flows.

[0037] S2: Extract multiple network features of network data asset samples.

[0038] Specifically, multiple network features are extracted by parsing the acquired network data asset samples.

[0039] Optionally, the network characteristics include source IP address, destination IP address, source port, destination port, transmission protocol, data packet size, data packet transmission time, data flow direction, connection duration, data flow rate and protocol type.

[0040] In the present invention, network features such as source IP address, destination IP address, port number, protocol type, etc. provide the basic context of the data flow, while packet size, transmission time, connection duration, etc. provide dynamic information of network behavior. This comprehensive information enables the model to more accurately learn and predict the behavior and attributes of network data assets. By using diverse features, it can help the model capture more dimensional information, thereby improving the accuracy of classification.

[0041] S3: Construct multiple base models.

[0042] In a possible implementation, S3 is specifically:

[0043] Multiple base models are constructed based on logistic regression, support vector machine and decision tree.

[0044] It should be noted that logistic regression is a statistical model used for classification tasks, usually used to predict the probability that a sample belongs to a certain category. Although the name contains "regression", logistic regression is actually a classification algorithm, especially suitable for binary classification problems. It is based on linear regression and maps the output to a probability value between 0 and 1 by applying the Sigmoid function to the prediction result to determine the possibility that the sample belongs to a certain category.

[0045] It should be noted that Support Vector Machine (SVM) is a supervised learning algorithm commonly used for classification and regression tasks. SVM achieves the classification goal by finding an optimal hyperplane in the feature space to separate samples of different categories as much as possible. This optimal hyperplane is determined by the closest sample (i.e., support vector), ensuring that the boundary interval between the two categories of samples is maximized, thereby improving the generalization ability of the model. SVM can map nonlinear data to high-dimensional space through kernel functions, enabling it to handle complex classification problems.

[0046] It should be noted that the decision tree is a supervised learning algorithm based on a tree structure, which is used for classification and regression tasks. It divides the samples into multiple subsets according to the feature values ​​by continuously splitting the data, starting from the root node, creating branches according to the conditional judgments of different features (such as "yes" or "no"), until reaching the leaf node to output the final prediction result. Each branch node represents a feature decision, and the leaf node represents the classification or prediction result.

[0047] In the present invention, different models have different assumptions and learning capabilities. Logistic regression is suitable for processing linear classification problems, SVM can handle linear and nonlinear problems, and decision trees can automatically capture the hierarchical structure in the data. By combining these models, their respective advantages can be utilized to improve the generalization ability of the stacked model on different data distributions. Each model is different in algorithm structure. Constructing multiple base models can not only utilize their respective advantages, but also speed up the model reasoning process through effective combination. The diversity of base models enables the model to make classification judgments from multiple angles when making decisions.

[0048] S4: Determine the base classification results of each base model for the network data asset sample according to multiple network features of the network data asset sample.

[0049] In the present invention, by analyzing multiple network features of the sample (such as IP address, port, protocol type, etc.), each base model can extract important classification information from its specific perspective and algorithm logic, which helps to fully understand the behavior and nature of the sample. Different base models may give different classification results for the same input features. By combining these results, the judgments of each model can be compared and verified, thereby achieving a higher accuracy in the final decision.

[0050] In a possible implementation manner, after S4 and before S5, the method further includes:

[0051] According to the base classification results of each base model for the network data asset sample, the accuracy index of each base model is calculated, and the base model with an accuracy index less than the accuracy index threshold is deleted.

[0052] It should be noted that the accuracy index is an indicator to measure the overall correctness of the model in the classification task. It is used to evaluate the correct prediction ratio of the base model in all prediction samples. The higher the accuracy index, the better the classification effect of the base model on the data set.

[0053] It should be noted that those skilled in the art can set the accuracy index threshold according to actual needs, and the present invention does not limit this.

[0054] Optionally, the accuracy index of each base model is calculated according to the following formula:

[0055]

[0056] Among them, A k Represents the accuracy index of the kth base model, TP k represents the true number of examples of the k-th base model, TN k Represents the number of true negative examples of the k-th base model, FP k The number of false positives of the k-th base model, FNk Represents the number of false negative examples of the k-th base model.

[0057] In the present invention, deleting models with low accuracy can reduce noise and inconsistent predictions in the ensemble, thereby improving the performance of the entire system. Retaining only those models that perform well on the current data set helps to ensure the quality of the model ensemble and the accuracy of the prediction. Eliminating poorly performing models can save computing resources, because maintaining and running more models requires more computing and storage resources. In this way, resources can be concentrated on improving those models with excellent performance, improving efficiency. By screening out models with high accuracy, it can be ensured that each model in the ensemble is of high quality, which can increase the stability and reliability of model predictions.

[0058] S5: Dynamically determine the weight of each base model according to the base classification results of each base model for the network data asset sample.

[0059] Optionally, the weight of each base model is dynamically determined based on the number of correctly classified network data asset samples or the posterior probability of the base model.

[0060] It should be noted that weight calculation based on the posterior probability of the base model provides a more comprehensive model performance evaluation method compared to the number of correctly classified network data asset samples. This is because the posterior probability not only measures the classification correctness of the model, but also takes into account the confidence and uncertainty of each classification decision. This method makes the weight distribution not only reflect whether the classification is correct, but also reflects the confidence level of the classification decision. By using the posterior probability, the adjustment of the model weight can be more refined, especially in the case of imbalanced sample categories, which can effectively improve the performance of the model in dealing with uncertain and complex scenarios, so that the weight distribution is more accurate and consistent with the actual classification effect.

[0061] In the present invention, the weights are adjusted dynamically so that the model with a larger number of correctly classified samples or a higher posterior probability has a greater influence in the final decision, thereby enhancing the accuracy of the classification results. Dynamic weight assignment enables the model to automatically adapt to changes in data distribution. For example, some models may perform better on specific types of samples. As the data distribution changes, the weights will be adjusted accordingly, making the stacked model more flexible.

[0062] In a possible implementation, S5 is specifically:

[0063] The weights of each base model are determined according to the following formula:

[0064]

[0065] Among them, η k represents the weight of the kth base model, rk,true represents the number of network data asset samples correctly classified by the kth base model, and S represents the total number of network data asset samples.

[0066] In the present invention, by adjusting the weights to reflect the actual performance of each model, the robustness of the system can be maintained when data characteristics or network environment changes, ensuring that the integrated model continues to provide reliable predictions. Directly converting the correct classification ratio of the model into a weight helps to give priority to the output of the model with better performance in the integrated decision-making process. This can significantly improve the accuracy and efficiency of the overall integrated model.

[0067] In a possible implementation, S5 specifically includes:

[0068] S501: Calculate prior probability:

[0069]

[0070] Among them, p(c j,i ) represents the prior probability that the i-th network data asset sample actually belongs to the j-th class label, S represents the total number of network data asset samples, and I represents the indicator function.

[0071] S502: Calculate edge probability:

[0072]

[0073] Among them, p(a l,i ) represents the marginal probability that the i-th network data asset sample is classified as the l-th category by the base model.

[0074] S503: Calculate the conditional probability based on the prior probability and the marginal probability:

[0075]

[0076] Among them, p(a l,i |c j,i ) represents the conditional probability that the i-th network data asset sample is classified as the l-th category by the base model when it actually belongs to the j-th class label.

[0077] S504: Calculate the posterior probability of the base model according to the conditional probability:

[0078]

[0079]

[0080] Among them, P k represents the posterior probability of the kth base model, L represents the total number of classification categories, J represents the total number of class labels, and Q() represents the discriminant function.

[0081] S505: Determine the weight of the base model according to the posterior probability of the base model:

[0082]

[0083] Among them, η k represents the weight of the kth base model, and K represents the total number of base models.

[0084] In the present invention, the posterior probability of the base model is determined by calculating the prior probability, marginal probability and conditional probability, so that the classification ability of each model for different categories can be evaluated more accurately. The posterior probability is an updated probability obtained based on the actual observed data, which can better reflect the performance of the model under specific conditions. The weight distribution is based on the posterior probability of the model, which means that the weight of the model is directly related to its ability to interpret the data and the classification accuracy. This weight distribution mechanism ensures that the high-performance model has a greater influence in the final decision and improves the predictive performance of the overall model. Considering the prior probability and conditional probability enables the model to maintain stable performance when facing complex and changeable data environments. This method helps to reduce the performance fluctuations of the model due to data changes.

[0085] In a possible implementation manner, after S5 and before S6, the method further includes:

[0086] Calculate the local weights of each network feature in the base model.

[0087] Optionally, the local weight of each network feature in the base model is calculated according to the following formula:

[0088]

[0089] Among them, w kj represents the local weight of the jth network feature in the kth base model, M kj represents the feature importance score of the jth network feature in the kth base model, and N represents the total number of network features.

[0090] The global weight of each network feature is calculated based on the local weight of each network feature in the base model and the weight of each base model.

[0091] Optionally, the global weight of each network feature is calculated according to the following formula:

[0092]

[0093] Among them, ω j represents the global weight of the jth network feature, K represents the total number of base models, η k represents the weight of the kth base model, w kjIt represents the local weight of the jth network feature in the kth base model, and max represents the maximum value.

[0094] Determine whether the global weight of the network feature is greater than the preset weight value. If so, keep it. Otherwise, delete it and prune the network feature.

[0095] It should be noted that those skilled in the art can set the size of the preset weight value according to actual needs, and the present invention is not limited here.

[0096] In the present invention, by evaluating the importance of each network feature in different models and calculating its global weight, it is possible to effectively identify which features are more helpful for model prediction, which helps to optimize the feature set, remove those features that contribute little to model decision-making, and retain more influential features. Automating the process of calculating the importance and pruning of features reduces the need for manual feature selection, which can reduce bias and errors while improving scalability and efficiency when processing large data sets. Reducing the number of features can reduce the complexity of the model, thereby improving the operating efficiency of the model. This method can also reduce the risk of overfitting because some unimportant features that may cause the model to overfit the data are removed.

[0097] S6: Use the output of each base model as the input of each channel of the multi-layer perceptron, use the weight of each base model as the weight of the channel, and stack the base model and the multi-layer perceptron to form a stacked model.

[0098] Specifically, network data asset samples are independently classified through each base model, and prediction outputs for each sample are generated, which represent the classification results of each base model. The outputs of these base models are used as different channels of multi-layer perceptron (MLP) input, thus forming a multi-channel input structure. At the same time, the weights of the base models are also used as the weights of each input channel of the MLP, that is, the influence of each base model on the final classification result is determined by its weight. Finally, the multi-layer perceptron calculates these weighted inputs to obtain the comprehensive classification results of network data assets, thus forming a complete stacking model.

[0099] It should be noted that the Multilayer Perceptron (MLP) is a feedforward artificial neural network that includes an input layer, one or more hidden layers, and an output layer. Each layer consists of multiple neurons (also called nodes or units), and the neurons between layers are fully connected. MLP passes the input data layer by layer through forward propagation, and performs nonlinear transformations in the hidden layer through nonlinear activation functions (such as ReLU or Sigmoid) to improve the model's expressiveness. Using the backpropagation algorithm to adjust the weight of each connection, MLP can fit complex nonlinear relationships and is widely used in tasks such as classification and regression.

[0100] In the present invention, by using the outputs of different base models as the input of MLP, the predictions of multiple models can be integrated, making full use of the different perspectives and interpretations of the data by different models. This integration can enhance the predictive power and accuracy of the final model. The stacked model combines the advantages of multiple base models and further learns and synthesizes the outputs of these base models through an advanced neural network. Such a hierarchical model structure helps to improve generalization ability and reduce the risk of overfitting.

[0101] In a possible implementation, the multilayer perceptron includes an input layer, multiple hidden layers, and an output layer, and S6 specifically includes:

[0102] S601: In the input layer, the output of each base model is used as input.

[0103] S602: In a hidden layer, a nonlinear transformation is performed through an activation function, and the hidden layer includes a first hidden layer, a second hidden layer, and a third hidden layer.

[0104] Optionally, the first and second hidden layers use the ReLU activation function:

[0105] ReLU(x′)=max(0,x′)

[0106] Among them, ReLU() represents the ReLU activation function, and x' represents the output of the base model.

[0107] Optionally, the third hidden layer uses a Sigmoid activation function:

[0108]

[0109] Among them, Sigmoid() represents the Sigmoid activation function.

[0110] S603: In the output layer, the comprehensive classification results of the network data asset samples are output.

[0111] In the present invention, through the multi-layer structure, MLP can learn data representations at various levels, making the model more robust and reducing sensitivity to noise and outliers. The multi-layer structure provides a mechanism by which the model can integrate and purify information from various base models to form more accurate predictions. By setting multiple hidden layers, MLP can learn more complex feature representations, and each layer can further abstract and optimize information from the representation learned in the previous layer. This hierarchical processing enables the model to handle more complex nonlinear relationships and improve the classification accuracy of complex data.

[0112] S7: Determine the comprehensive classification results of the stacking model for the network data asset samples.

[0113] In the present invention, the stacked model can effectively integrate the learning results of different models by combining the advantages of multiple base models to provide more accurate classification decisions. When facing a complex and changeable network environment, the stacked model can better adapt to and handle noise and abnormal situations in the data by integrating the predictions of multiple base models, thereby improving the robustness and stability of the model.

[0114] S8: Train the stacking model based on the comprehensive classification results of the network data asset samples.

[0115] In a possible implementation manner, S8 specifically includes:

[0116] According to the comprehensive classification results of network data asset samples, the stacking model is trained through the cuckoo search algorithm with the goal of minimizing the mean square error loss function.

[0117] It should be noted that the Mean Squared Error (MSE) is a commonly used loss function that measures the difference between the predicted value and the actual value. It evaluates the prediction performance of the model by calculating the square average of the difference between the predicted value and the actual value, and is usually used in regression tasks. The smaller the MSE value, the smaller the error between the model's predicted result and the true result, that is, the better the performance of the model. In neural networks, using the mean squared error loss function can help optimize model parameters to minimize prediction errors.

[0118] It should be noted that the cuckoo search algorithm is a population-based optimization technique inspired by the parasitic reproduction behavior of cuckoos. The algorithm imitates the behavior of cuckoos parasitizing other birds' nests with eggs that are slightly mutated instead of other birds' eggs. In the algorithm, each solution is regarded as an egg in a bird's nest, and new solutions are generated through random walks and Levy flight operations, and probability parameters are used to decide whether to accept new solutions, thereby exploring the optimal solution in the solution space. The cuckoo search algorithm is widely used in various optimization problems due to its simplicity, efficiency and ease of implementation.

[0119] Among them, the Lévy flight operation is a random walking strategy whose step size follows the Lévy distribution. This distribution allows occasional large jumps in the step size, which enables the Lévy flight to effectively avoid local optimality in the exploration of complex search spaces and enhance global search capabilities. In the optimization algorithm, especially in the cuckoo search algorithm, the introduction of Lévy flight can help the algorithm jump out of the current solution and enter a potentially better solution, thereby increasing the probability and speed of finding the global optimal solution. This strategy is particularly suitable for solving complex optimization problems with multiple peaks.

[0120] Furthermore, the cuckoo search algorithm is improved by introducing an adaptive adjustment strategy so that the step size factor, discovery probability and scaling factor can be dynamically adjusted according to the number of iterations, thereby improving the convergence speed of the algorithm and the quality of the solution.

[0121] Specifically, with the goal of minimizing the mean square error loss function, the objective function is constructed:

[0122]

[0123] Among them, min means taking the minimum value, MSE represents the objective function, θ represents the network parameter set of the stacking model, S represents the total number of network data asset samples, and y i represents the true category of the i-th network data asset sample, Represents the actual category of the i-th network data asset sample.

[0124] Furthermore, the stacking model is trained through the cuckoo search algorithm according to the objective function.

[0125] In the present invention, the cuckoo search algorithm allows the algorithm to make occasional large jumps through its unique Levy flight mechanism, which helps to jump out of the local optimal solution, explore a wider solution space, and increase the possibility of finding the global optimal solution. Through the adaptive adjustment strategy, the cuckoo search algorithm can dynamically adjust the step size factor and the discovery probability during the training process. Such an adaptive mechanism helps to improve the convergence speed of the algorithm and its ability to respond to changes.

[0126] Optionally, the cuckoo search algorithm specifically includes:

[0127] Initialization parameters, set the maximum number of iterations of the cuckoo search algorithm.

[0128] An initial population is randomly generated, which includes multiple bird nests, and each bird nest represents a parameter set of a feasible stacking model.

[0129] The objective function is used as the fitness function to calculate the fitness value of each bird's nest, and the bird's nest with the maximum fitness value is used as the current bird's nest.

[0130] According to the current number of iterations, the step size factor, discovery probability, and scaling factor are adaptively adjusted:

[0131]

[0132] Among them, α t represents the step size factor at the tth iteration, α max represents the maximum value of the step size factor, T represents the maximum number of iterations, α min represents the minimum value of the step factor, represents the probability of finding the i-th bird nest at the t-th iteration, P max Represents the maximum value of the discovery probability, P min represents the minimum value of the discovery probability, represents the fitness value of the ith bird nest at the tth iteration, represents the maximum fitness value at the tth iteration, The scaling factor of the ith nest at the tth iteration, γ max represents the maximum value of the scaling factor, γ min represents the minimum value of the scaling factor, Represents the minimum fitness value at the tth iteration.

[0133] According to the adaptively adjusted step size factor, update the current bird's nest through Levy flight operation:

[0134]

[0135] in, represents the i-th bird's nest at the t+1-th iteration, represents the i-th bird nest at the t-th iteration, α represents the step size factor after adaptive adjustment, represents the dot product operation, and levy(β) represents the random step size generated by the Levy flight operation.

[0136] Calculate the fitness value of the updated bird's nest and compare the fitness value of the updated bird's nest with the fitness value of the current bird's nest. When the fitness value of the updated bird's nest is greater than the fitness value of the current bird's nest, replace the current bird's nest with the updated bird's nest. When the fitness value of the updated bird's nest is less than or equal to the fitness value of the current bird's nest, keep the current bird's nest unchanged.

[0137] Generate a random number between 0 and 1, and compare the random number with the adaptively adjusted discovery probability. When the random number is greater than the adaptively adjusted discovery probability, the current bird nest is discovered, and the current bird nest is updated according to the adaptively adjusted scaling factor. When the random number is less than or equal to the adaptively adjusted discovery probability, the current bird nest is not discovered, and the current bird nest remains unchanged.

[0138] Among them, when the random number is greater than the adaptively adjusted discovery probability, the current bird nest is discovered, and the current bird nest is updated according to the adaptively adjusted scaling factor, specifically:

[0139]

[0140] in, represents the i-th bird's nest at the t+1th iteration after the current bird's nest is discovered, represents the i-th bird nest at the t-th iteration after the current bird nest is discovered, γ represents the adaptively adjusted scaling factor, and Represents two individuals l1 and l2 randomly selected from the population at the tth iteration after the current bird's nest is discovered.

[0141] Repeat the above steps until the maximum number of iterations is reached.

[0142] In the present invention, the cuckoo search algorithm provides a powerful global search capability through the generation of random initial populations and the step-size update mechanism of Levy flight. This enables the algorithm to explore a wide range of parameter spaces and increase the possibility of finding the global optimal solution. By adaptively adjusting the step-size factor, discovery probability and scaling factor, the cuckoo search algorithm can dynamically adjust the search strategy according to the performance in the iterative process, optimize the search efficiency and speed, which helps the algorithm to adopt the most appropriate exploration and development strategy at different stages. The optimal parameters found by global optimization can significantly improve the performance of the stacked model, and also enhance the generalization ability of the model on unseen data.

[0143] S9: Obtain the network data assets to be identified.

[0144] S10: Determine the comprehensive classification results of the network data assets to be identified through the trained stacking model, and perform attribution identification on the network data assets to be identified.

[0145] In the present invention, the stacked model combines the strengths of multiple base models to more accurately identify and classify network data assets. This method utilizes the different understanding and processing methods of different models on data, thereby improving the accuracy of identification. Providing comprehensive classification results can help network administrators or security experts make more accurate decisions. For example, in the field of network security, correct attribution identification can help determine security strategies and countermeasures.

[0146] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0147] In the present invention, by constructing multiple base models, according to multiple network features of the network data asset samples, the base classification results of each base model for the network data asset samples are determined, and according to the base classification results of each base model for the network data asset samples, the weights of each base model are dynamically determined, the outputs of each base model are used as the inputs of each channel of the multi-layer perceptron, the weights of each base model are used as the weights of the channels, the base models and the multi-layer perceptron are stacked to form a stacked model, avoiding the use of a single model for data processing and analysis, and having a high recognition accuracy when faced with diverse data features and complex environments. When processing massive network data assets, huge computing resources are not required, and performance bottlenecks are not likely to occur when the amount of data increases sharply, thereby reducing processing time and improving real-time data processing capabilities.

[0148] Reference Manual Attached Figure 2 , showing a structural schematic diagram of a network data asset ownership identification system based on a stacking model provided by the present invention.

[0149] The present invention further provides a network data asset attribution identification system 30 based on a stacking model, comprising: a memory 303 and one or more processors 301 .

[0150] The memory 303 stores one or more application programs, and the one or more application programs are suitable for being executed by the one or more processors 301 to implement the stacking model-based network data asset attribution identification method described in the method embodiment.

[0151] The network data asset attribution identification system 30 based on the stacking model includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, through a bus 302.

[0152] The structure of the network data asset ownership identification system 30 based on the stacking model does not constitute a limitation on the embodiment of the present invention.

[0153] Processor 301 may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0154] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI bus or an EISA bus, etc. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0155] The memory 303 can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0156] It should be noted that the network data asset ownership identification system 30 based on the stacking model can implement the above-mentioned network data asset ownership identification method based on the stacking model, and can achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0157] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0158] In the present invention, by constructing multiple base models, according to multiple network features of the network data asset samples, the base classification results of each base model for the network data asset samples are determined, and according to the base classification results of each base model for the network data asset samples, the weights of each base model are dynamically determined, the outputs of each base model are used as the inputs of each channel of the multi-layer perceptron, the weights of each base model are used as the weights of the channels, the base models and the multi-layer perceptron are stacked to form a stacked model, avoiding the use of a single model for data processing and analysis, and having a high recognition accuracy when faced with diverse data features and complex environments. When processing massive network data assets, huge computing resources are not required, and performance bottlenecks are not likely to occur when the amount of data increases sharply, thereby reducing processing time and improving real-time data processing capabilities.

[0159] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0160] There are a few points to note:

[0161] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0162] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0163] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0164] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network data asset attribution identification method based on a stacking model, characterized in that: include: S1: Acquire a network data asset dataset, where the network data asset dataset includes a plurality of network data asset samples; S2: extracting multiple network features of the network data asset sample; S3: construct multiple base models; S4: determining the base classification results of each base model for the network data asset sample according to the multiple network features of the network data asset sample; S5: dynamically determining the weight of each base model according to the base classification results of each base model for the network data asset sample; S6: using the output of each base model as the input of each channel of the multilayer perceptron, using the weight of each base model as the weight of the channel, and stacking the base model and the multilayer perceptron to form a stacked model; S7: Determine the comprehensive classification result of the stacking model for the network data asset sample; S8: training the stacking model according to the comprehensive classification result of the network data asset sample; S9: Obtain the network data assets to be identified; S10: Determine the comprehensive classification result of the network data assets to be identified through the trained stacking model, and perform attribution identification on the network data assets to be identified.

2. The network data asset attribution identification method based on the stacking model according to claim 1 is characterized in that: The network characteristics include source IP address, destination IP address, source port, destination port, transmission protocol, data packet size, data packet transmission time, data flow direction, connection duration, data flow rate and protocol type.

3. The method for identifying network data asset ownership based on a stacking model according to claim 1, characterized in that: The S3 is specifically: Multiple base models are constructed based on logistic regression, support vector machine and decision tree.

4. The method for identifying network data asset ownership based on a stacking model according to claim 1, characterized in that: After S4 and before S5, the method further includes: According to the base classification results of each base model for the network data asset sample, the accuracy index of each base model is calculated, and the base model whose accuracy index is less than the accuracy index threshold is deleted.

5. The method for identifying network data asset ownership based on a stacking model according to claim 1, characterized in that: The S5 is specifically: The weights of the base models are determined according to the following formula: Among them, η k represents the weight of the kth base model, r k,true represents the number of network data asset samples correctly classified by the kth base model, and S represents the total number of network data asset samples.

6. The network data asset sample attribution identification method based on the stacking model according to claim 1 is characterized in that: The S5 specifically includes: S501: Calculate prior probability: Among them, p(c j,i ) represents the prior probability that the i-th network data asset sample actually belongs to the j-th class label, S represents the total number of network data asset samples, and I represents the indicator function; S502: Calculate edge probability: Among them, p(a l,i ) represents the marginal probability that the i-th network data asset sample is classified as the l-th category by the base model; S503: Calculate the conditional probability according to the prior probability and the marginal probability: Among them, p(a l,i |c j,i ) represents the conditional probability that the i-th network data asset sample is classified as the l-th category by the base model when it actually belongs to the j-th class label; S504: Calculate the posterior probability of the base model according to the conditional probability: Among them, P k represents the posterior probability of the kth base model, L represents the total number of classification categories, J represents the total number of class labels, and Q() represents the discriminant function; S505: Determine the weight of the base model according to the posterior probability of the base model: Among them, η k represents the weight of the kth base model, and K represents the total number of base models.

7. The method for identifying network data asset ownership based on a stacking model according to claim 1, characterized in that: After S5 and before S6, the method further includes: Calculating the local weight of each of the network features in the base model; Calculating the global weight of each of the network features according to the local weight of each of the network features in the base model and the weight of each of the base models; Determine whether the global weight of the network feature is greater than a preset weight value; if so, retain it; otherwise, delete it and prune the network feature.

8. The network data asset attribution identification method based on the stacking model according to claim 1 is characterized in that: The multi-layer perceptron includes an input layer, multiple hidden layers and an output layer, and S6 specifically includes: S601: In the input layer, the output of each base model is used as input; S602: performing a nonlinear transformation in the hidden layer by using an activation function, the hidden layer including a first hidden layer, a second hidden layer and a third hidden layer; S603: In the output layer, the comprehensive classification results of the network data asset samples are output.

9. The method for identifying network data asset ownership based on a stacking model according to claim 1, characterized in that: The S8 is specifically: According to the comprehensive classification results of the network data asset samples, the stacking model is trained through the cuckoo search algorithm with the goal of minimizing the mean square error loss function.

10. A network data asset ownership identification system based on a stacking model, characterized in that: include: memory and one or more processors; One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the network data asset attribution identification method based on the stacking model as described in any one of claims 1 to 9.

Images