A keyword extraction method and system

Abstract

The application discloses a keyword extraction method and system, and the method comprises the following steps: acquiring a first data stream, extracting the text content and function characteristics of the first data stream by using a first text analysis method, and performing a first judgment on the text content; identifying the feature information in the text content by using a first similarity algorithm, aligning the feature information and the function characteristics according to a first feature alignment method, composing a first matrix by using the aligned feature information and function characteristics, extracting the characteristic equation of the first matrix, and obtaining a first judgment model; training the first judgment model to obtain a recognition success probability, performing a second judgment on the recognition success probability, and outputting a second judgment model; acquiring a real-time data stream, inputting the real-time data stream into the second judgment model, and obtaining a risk result, so that the response efficiency of a security protection system to network attacks is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of keyword extraction, and in particular to a keyword extraction method and system. BACKGROUND

[0002] Network and information security information notification technology is an important technical point in the field of network security. The field of network security often conducts in-depth analysis and summary based on security information notification data to analyze major network security risks. High false alarm rate of security warning of the security protection system often causes delay in discovering network attacks on core systems.

[0003] In a network device cluster, security protection technology is relatively complex. In the development and construction process of the information system of the network device cluster, the use of high code volume code control and dangerous functions makes the security alarm false alarm rate generated by relying on the rule library matching keyword mode high. The high false alarm rate of security alarm directly leads to a large workload of the security protection system. Under the large workload of security screening, the security protection system is difficult to efficiently respond to diversified and complex network attack means. Therefore, it is necessary to propose a keyword extraction method and system in view of the defect that the security warning false alarm rate of the traditional security protection system is high. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a keyword extraction method and system to solve the problem of high security alarm false alarm rate of the traditional security protection system.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a keyword extraction method, comprising:

[0008] Obtaining a first data stream, extracting the text content and function features of the first data stream by using a first text analysis method, and performing a first judgment on the text content;

[0009] Identifying the feature information in the text content by using a first similarity algorithm, aligning the feature information and the function features according to a first feature alignment method, forming a first matrix by aligning the feature information and the function features, extracting the characteristic equation of the first matrix, and obtaining a first judgment model;

[0010] Training the first judgment model to obtain a recognition success probability, performing a second judgment on the recognition success probability, and outputting a second judgment model;

[0011] Obtaining a real-time data stream, inputting the real-time data stream into the second judgment model, and obtaining a risk result.

[0012] As a preferred embodiment of the keyword extraction method of the present invention, identifying feature information in the text content using the first similarity algorithm includes:

[0013] The text content is input into the first similarity algorithm, an output value of the first similarity algorithm is obtained, and the text content is returned until all the text content is selected.

[0014] As a preferred solution of the keyword extraction method of the present invention, wherein: aligning the feature information and the function feature according to the first feature alignment method includes:

[0015] Based on the first feature alignment method, function features are selected, output values ​​of text content corresponding to the function features are determined, and the alignment operation is repeated until all function features are selected.

[0016] As a preferred solution of the keyword extraction method of the present invention, obtaining the data stream includes:

[0017] Extracting at least one first attack event, and obtaining a first network information flow link under attack based on the first attack event;

[0018] Setting the first network information flow link to a first data flow;

[0019] The attacked point of the first network information flow link is used as a sample identification and judgment point.

[0020] As a preferred embodiment of the keyword extraction method of the present invention, the first judgment of the text content includes:

[0021] If the text content of the first data stream matches the sample recognition judgment point, the content of the first data stream is returned until the content of all data streams is selected, and the text content of the first data stream is assigned a warning label;

[0022] If the text content of the first data stream does not match the sample recognition judgment point, return to the sample recognition judgment point until all sample recognition judgment points are selected;

[0023] Repeat the first judgment until the contents of all data streams are selected.

[0024] As a preferred solution of the keyword extraction method of the present invention, training the first judgment model includes:

[0025] Selecting text content with a warning label, and inputting a judgment value corresponding to the text content with the warning label into a first judgment model;

[0026] If the characteristic equation of the first judgment model is established, the text content with the warning label is returned until all the text contents with the warning label are selected;

[0027] If the characteristic equation of the first judgment model does not hold, the text content with the warning label is included in the sample library, and the training operation is repeated until all the text content with the warning label is selected;

[0028] Count the number of text contents with warning labels;

[0029] The probability of successful recognition is obtained according to the quotient of the value in the misjudgment value table and the number of text contents with warning labels.

[0030] As a preferred embodiment of the keyword extraction method of the present invention, the second determination of the recognition success probability includes:

[0031] If the probability of successful identification is greater than or equal to the first threshold, outputting the second judgment model;

[0032] If the probability of successful identification is less than the first threshold, the misjudged data stream is included in the sample library, and all data streams are returned until the probability of successful identification is greater than or equal to the first threshold.

[0033] In a second aspect, the present invention provides a keyword extraction system, comprising:

[0034] A first judgment module is configured to obtain a first data stream, extract text content and function features of the first data stream using a first text parsing method, and perform a first judgment on the text content;

[0035] an alignment module, configured to identify feature information in the text content using a first similarity algorithm, align the feature information with the function features according to a first feature alignment method, form a first matrix with the aligned feature information and function features, and extract a characteristic equation of the first matrix to obtain a first judgment model;

[0036] a second judgment module, configured to train the first judgment model to obtain a recognition success probability, perform a second judgment on the recognition success probability, and output a second judgment model;

[0037] The verification module is used to obtain a real-time data stream, input the real-time data stream into the second judgment model, and obtain a risk result.

[0038] In a third aspect, the present invention provides a computing device, comprising:

[0039] memory and processor;

[0040] The memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement the steps of the keyword extraction method.

[0041] In a fourth aspect, the present application provides a computer readable storage medium storing computer executable instructions, which, when executed by a processor, implement the steps of the keyword extraction method.

[0042] Compared with the prior art, the present application has the following beneficial effects: by deep segmentation of text information and keyword extraction, combined with SimHash algorithm and timestamp alignment feature information and function characteristics, the false positive rate of security warning of the security protection system is effectively reduced; by using the method of characteristic equation and security matrix, the identification accuracy of network attack means is improved, the detection capability of the security protection system on real threats is enhanced, the risk result is quickly obtained by training the judgment model and processing the data stream in real time, and the response efficiency of the security protection system on network attacks is improved. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0044] Figure 1 The overall flow logic diagram of the keyword extraction method of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0046] Embodiment 1

[0047] Reference Figure 1 For an embodiment of the present application, a keyword extraction method is provided, comprising:

[0048] S100: obtaining a first data stream, extracting text content and function characteristics of the first data stream by using a first text parsing method, and performing a first judgment on the text content;

[0049] S200: identifying feature information in the text content using a first similarity algorithm, aligning the feature information and function features using a first feature alignment method, forming a first matrix with the aligned feature information and function features, and extracting a characteristic equation of the first matrix to obtain a first judgment model;

[0050] S300: training the first judgment model to obtain a recognition success probability, performing a second judgment on the recognition success probability, and outputting a second judgment model;

[0051] S400: Acquire a real-time data stream, input the real-time data stream into a second judgment model, and obtain a risk result;

[0052] It should be noted that by combining text parsing and similarity algorithms, key feature information can be extracted from data streams more accurately, thereby improving the accuracy of identifying network attacks or abnormal behaviors. The establishment and training of the first judgment model helps to distinguish between real threats and false alarms. The model is further optimized through the evaluation of the probability of successful identification, effectively reducing the false alarm rate. The ability to analyze real-time data streams enables the system to quickly respond to emerging security threats and provide risk results in a timely manner, enhancing the timeliness and dynamic defense capabilities of the system.

[0053] In the embodiment of the present application, the above step S100 includes the following sub-steps A1-A3;

[0054] In A1: extracting at least one first attack event, and obtaining a first attacked network information flow link based on the first attack event;

[0055] In A2: setting the first network information flow link to the first data flow;

[0056] In A3: the attacked point of the first network information flow link is used as a sample identification and judgment point.

[0057] In an embodiment of the present application, attack events from operating system logs, attack events from firewall logs, and attack events from intrusion detection alarms are extracted, and the first data stream includes one or more of operating system logs, firewall logs, and intrusion detection alarms;

[0058] Specifically, attack events in operating system logs, firewall logs, and intrusion detection alerts can be used to determine if a network attack exists within a data stream. If the text content of a data stream contains information suggestive of a network attack or leaked file content, the network information flow link can be determined to be under attack.

[0059] It should be noted that combining multiple data sources can improve the accuracy of attack detection. A single data source may have false positives or omissions. Being able to quickly extract attack event information from multiple data streams helps shorten the response time to security incidents.

[0060] In an optional embodiment, the first text parsing method may include a natural language processing tool for understanding and extracting language features in the text, using an NLP library to perform operations such as word segmentation, part-of-speech tagging, and entity recognition on the text to extract useful information; the first text parsing method may also include a bag-of-words model to convert the text into a vector form for input to a machine learning model, decomposing the text into a list of words, ignoring the order and grammar of the words in the document, and only considering the number of word occurrences;

[0061] In an optional embodiment, the first text parsing method may further include a text mining algorithm for parsing a data stream in a specific format and converting structured data into an operable data structure using a specialized parsing library.

[0062] In this embodiment of the present application, the first text parsing method includes:

[0063] Define a regular expression pattern based on the specific format of the text content in the data stream, use the defined regular expression to match the text content in the data stream, and extract the fields of interest;

[0064] In the embodiment of the present application, the first text parsing method further includes:

[0065] Determine the characters or strings used to separate fields in the data stream, split the text content in the data stream into multiple fields or substrings based on the selected separator, process the split fields, and extract useful information;

[0066] Specifically, the code of the database, data model, and security protection model will follow a top-level function law, and the top-level function law will obey the functional characteristics of the data flow;

[0067] It should be noted that the use of regular expressions and string segmentation technology can accurately extract text content and function features from data streams, which is crucial for subsequent security analysis. Identifying function features in data streams helps to better understand the context of the data, thereby more accurately identifying potential security threats. Accurate text content extraction and function feature analysis can reduce false positives and negatives, and improve the reliability of security systems.

[0068] In the embodiment of the present application, after completing steps A1-A3 in the above step S100, the following steps A4-A6 are further included;

[0069] In A4: If the text content of the first data stream matches the sample recognition judgment point, the content of the first data stream is returned until the content of all data streams is selected, and the text content of the first data stream is assigned a warning label;

[0070] In A5: if the text content of the first data stream does not match the sample recognition judgment point, return to the sample recognition judgment point until all sample recognition judgment points are selected;

[0071] In A6: Repeat the first determination until the contents of all data streams are selected.

[0072] Specifically, due to the high volume of data streams, we can mark the risks of textual content within the data stream. We can then use the differences between the textual content and the marked textual content to predict network attacks. The differences between the textual content and the marked textual content are actually differences in feature information. Based on the different representations of these differences in feature information in the feature equation, we can quickly determine whether a network attack exists.

[0073] It should be noted that using sample identification judgment points to determine whether the text content of the data stream in the sample library contains a network attack is conducive to improving the judgment accuracy of the judgment model.

[0074] In the embodiment of the present application, the above step S200 includes the following sub-step B1:

[0075] In B1: the text content is input into the first similarity algorithm, the output value of the first similarity algorithm is obtained, and the text content is returned until all the text content is selected.

[0076] In an optional embodiment, the first similarity algorithm may include an MSER algorithm, which converts text content into image format, constructs a scale space for the text image, identifies extreme regions in the image at each scale, evaluates the stability of these extreme regions, and uses these stable regions as feature information of the text content; the first similarity algorithm may also include TF-IDF, which evaluates the importance of words in a document by calculating the frequency of the word in the document and the inverse document frequency in the entire corpus, and then multiplying them to obtain a TF-IDF value for identifying key words in the text.

[0077] In an optional embodiment, the first similarity algorithm may also include Word2Vec or Doc2Vec, which converts words in the text or the entire document into vector form to capture semantic information of the words or document for subsequent feature extraction and similarity calculation.

[0078] In this embodiment of the present application, the first similarity algorithm includes:

[0079] Generate a metric vector for each word with respect to a fixed parameter f. For each word, add up the corresponding vectors to obtain an aggregate vector. Compare each element in the aggregate vector with a threshold, which is generally the modulus of the metric vector of the f parameter in the dimension. If the value is greater than the threshold, it is set to 1; otherwise, it is set to 0. The resulting binary string is output as the hash value.

[0080] Specifically, the SimHash algorithm converts a document into a feature vector, then calculates the hash value of the feature vector, and finally determines the similarity between different documents by comparing their hash values.

[0081] It should be noted that the SimHash algorithm can be used to determine the number of characters, which is conducive to accurate processing of text and to quickly compare the similarity between a large number of documents. Their hash values ​​can be output, and the output hash values ​​can be used as feature information in the text content. The text content is marked text content, and the feature information in the text content is the output hash value. The text content is not marked text content, and the feature information in the text content is the value zero.

[0082] In the embodiment of the present application, after completing step B1 in the above step S200, the following step B2 is further included;

[0083] In B2: based on the first feature alignment method, function features are selected, the output values ​​of the text content corresponding to the function features are determined, and the alignment operation is repeated until all function features are selected.

[0084] In an optional embodiment, the first feature alignment method may include a DPO model, which aligns feature information and function features based on the purpose of reducing the false alarm rate of security warnings of the security protection system; the first feature alignment method may also include event-driven alignment, which aligns feature information and function features based on specific security events or event markers in system logs;

[0085] In an optional embodiment, the first feature alignment method may further include log level alignment, aligning feature information and function features according to log levels, because a specific log level is associated with a specific function behavior;

[0086] In the embodiment of the present application, the first feature alignment method includes:

[0087] Select a timestamp, select a function feature based on the timestamp, and determine the output values ​​of multiple text contents corresponding to the function feature; return to select a function feature based on the timestamp until all function features are selected; return to select a timestamp until all timestamps are selected.

[0088] Specifically, the output value of a function feature and a text content forms a coordinate point of a security matrix. A function feature can correspond to different text contents. When a text content is a marked text content, the value of the coordinate point of the security matrix is ​​the hash value. When the text content is not a marked text content, the value of the coordinate point of the security matrix is ​​zero.

[0089] It should be noted that by selecting a timestamp and selecting function features based on the timestamp, it is possible to ensure that the feature information is accurately associated with the event at a specific time point, thereby enhancing the timeliness and accuracy of event analysis, determining the output values ​​of multiple text contents corresponding to the function features, and allowing the system to comprehensively analyze all text contents related to specific function features, thereby improving the breadth of data analysis. By iteratively selecting timestamps and function features until all possible feature combinations are considered, the comprehensiveness and systematicness of the feature matching process are ensured.

[0090] In the embodiment of the present application, the first matrix is ​​a security matrix, which includes establishing a security matrix in which columns represent function features and rows represent feature information, adding output values ​​of feature information corresponding to the same function feature to obtain feature values, and incorporating the obtained feature values ​​into the security matrix;

[0091] Specifically, the output value of the feature information corresponding to the same function feature is unique. However, before the network attack, the feature information corresponding to the function feature is zero. Therefore, summing the output values ​​of the feature information corresponding to the same function feature to obtain the feature value can maximize the judgment accuracy of the judgment model. When the output values ​​of the feature information corresponding to the same function feature are the same, the duplicate values ​​are not summed.

[0092] It should be noted that by adding the output values ​​of the feature information corresponding to the same function feature, a more comprehensive feature value can be obtained, which helps to improve the accuracy of the judgment model. The security matrix provides a structured way to represent data by linking function features with feature information, making the relationship between features clearer. Only the unique feature information output value is accumulated, avoiding repeated calculations, optimizing the utilization of computing resources, and improving processing efficiency.

[0093] In the embodiment of the present application, the above step S300 includes the following sub-steps C1-C5;

[0094] In C1: select text content with a warning label, and input the judgment value corresponding to the text content with the warning label into the first judgment model;

[0095] In C2: If the characteristic equation of the first judgment model is established, the text content with the warning label is returned until all the text contents with the warning label are selected;

[0096] In C3: If the characteristic equation of the first judgment model does not hold, the text content with the warning label is included in the sample library, and the training operation is repeated until all the text content with the warning label is selected;

[0097] In C4: count the number of text contents with warning labels;

[0098] In C5: the probability of successful recognition is obtained based on the quotient of the value in the misjudgment value table and the number of text contents with warning labels.

[0099] Specifically, after extracting the characteristic equation of the first matrix, a text content with a warning label is selected, the function characteristics of the text content are determined, the text content is input into the SimHash algorithm, the judgment value of the SimHash algorithm is obtained, and a text content with a warning label is selected again until all text contents with warning labels are selected. In order to ensure that the content of the sample library can effectively train the judgment model to be trained, it is necessary to extract the judgment value corresponding to the text content with the warning label using the SimHash algorithm, and mix the text content with the warning label into the text content in each sample library.

[0100] Specifically, the first judgment model is based on a characteristic equation, whose parameters are function features and characteristic information. The characteristic information of the warning label's text content serves as the judgment value. If the judgment model to be trained receives the judgment value corresponding to the text content with the warning label and the characteristic equation holds true, it indicates that the judgment model to be trained has successfully identified the warning label. If the characteristic equation does not hold true, it indicates that the judgment model to be trained has not successfully identified the warning label.

[0101] To improve the accuracy of the judgment model being trained, feature information from text content without warning labels can also be incorporated into the model. If the feature equation holds true, the model being trained failed to successfully identify the text content. If the feature equation does not hold true, the model successfully identified the text content.

[0102] It should be noted that by inputting text content with warning labels into the judgment model, the model can be trained to recognize specific warning patterns and improve the model's ability to recognize warning signals. By repeating the training operation until all text content with warning labels is processed, it is ensured that the model can maintain stable performance when facing various warning situations. The SimHash algorithm judgment value is combined with the warning label to optimize the content of the sample library, making the sample library richer and more representative. By counting the number of text contents with warning labels and the judgment error value table, the training effect of the model can be quantified to guide subsequent training optimization.

[0103] In the embodiment of the present application, after completing steps C1-C5 in the above step S300, the following steps C6-C7 are further included;

[0104] In C6: if the recognition success probability is greater than or equal to the first threshold, output the second judgment model;

[0105] In C7: if the probability of successful identification is less than the first threshold, the misjudged data stream is included in the sample library, and all data streams are returned until the probability of successful identification is greater than or equal to the first threshold.

[0106] In the embodiment of the present application, the first threshold value may be 0.7, and the first threshold value is the degree of fit between the high-dimensional curve of the characteristic equation and the target high-dimensional curve;

[0107] Specifically, when only text contents with warning labels are used to train the judgment model to be trained, the probability of recognition failure is determined based on the quotient of the value of the judgment error value table and the number of text contents with warning labels.

[0108] When the judgment model to be trained is trained with text contents without warning labels and text contents with warning labels, the probability of recognition failure is determined based on the quotient of the value of the judgment error value table and the number of all text contents.

[0109] It should be noted that the model's probability of successful identification is determined by setting a threshold. Only when the model's performance reaches or exceeds the preset performance standard will it be output as the second judgment model, which helps to ensure the reliability and effectiveness of the model. If the probability of successful identification is lower than the threshold, the model will be retrained by incorporating data streams with misjudgments. This dynamic adjustment mechanism enables the model to continuously learn and adapt to new data. By setting a threshold, it can be ensured that only highly accurate models are used for actual risk assessment, thereby improving the accuracy of the overall system.

[0110] The above is a schematic scheme of a keyword extraction method of this embodiment. It should be noted that the technical scheme of this keyword extraction system and the technical scheme of the keyword extraction method described above are based on the same concept. For details not described in detail in the technical scheme of the keyword extraction system of this embodiment, please refer to the description of the technical scheme of the keyword extraction method described above.

[0111] Example 2

[0112] This embodiment is different from the first embodiment. It provides an application embodiment of the keyword extraction method to verify and illustrate the technical effects adopted in this method.

[0113] Take the deep learning model that integrates image and text features as an example;

[0114] Collect network security-related data, including system logs, firewall logs, intrusion detection alerts, etc., clean and format the collected text data, and perform image processing on alert information containing images;

[0115] Use convolutional neural networks to extract features from graphics, and recurrent neural networks and long short-term memory networks to extract features from text;

[0116] Define a fusion model. When receiving a new data stream, the fusion model uses the image feature extractor to extract the features of the image data and the text feature extractor to extract the features of the text. The extracted image features and text features are concatenated in reverse order. The concatenated feature vector is input to the fully connected layer. The output of the fully connected layer is activated to generate the final output.

[0117] During the training phase, the fusion model is trained using labeled data and the network parameters are optimized to maximize the recognition accuracy of the model.

[0118] After training is complete, the model can be deployed into a real-time system to analyze new data streams and provide risk assessment results.

[0119] The data streams during system operation are used as a sample library to train a judgment model. This trained judgment model is then used to receive real-time data streams. Based on the judgment model's analysis results, the risks to the security protection system associated with these real-time data streams are determined. Because the SimHash algorithm can identify the characteristic information of the textual content of data streams, a security matrix is ​​formed based on this information and functional features. The characteristic equation of the security matrix can be extracted. This judgment model, based on the characteristic equation, facilitates efficient response to diverse and complex cyberattacks by the security protection system, even under high-volume security screening.

[0120] On the one hand, the judgment model has the functional characteristics of data flow, which can trace the source of cyberattack methods. Due to the high data volume of data flow, the text content of the data flow is marked as risky. The difference between the text content and the marked text content can be used to predict cyberattacks. The difference between the text content and the marked text content is actually the difference in feature information. Based on the different manifestations of this difference in feature information in the characteristic equation, it can quickly determine whether a cyberattack exists. On the other hand, the judgment model has the ability to judge feature information, which can simplify the amount of information required for judgment. The SimHash algorithm can determine the number of characters, which is conducive to accurate text processing. The maximum stable extreme value region algorithm can achieve high text recognition speed, which is conducive to effectively processing large text samples.

[0121] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0122] Example 3

[0123] The keyword extraction system in this embodiment includes:

[0124] A first judgment module is configured to obtain a first data stream, extract text content and function features of the first data stream using a first text parsing method, and perform a first judgment on the text content;

[0125] an alignment module, configured to identify feature information in the text content using a first similarity algorithm, align the feature information with the function features according to a first feature alignment method, form a first matrix with the aligned feature information and function features, and extract a characteristic equation of the first matrix to obtain a first judgment model;

[0126] a second judgment module, configured to train the first judgment model to obtain a recognition success probability, perform a second judgment on the recognition success probability, and output a second judgment model;

[0127] The verification module is used to obtain a real-time data stream, input the real-time data stream into the second judgment model, and obtain a risk result.

[0128] This embodiment further provides a computing device suitable for keyword extraction, including:

[0129] Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the keyword extraction method proposed in the above embodiment.

[0130] This embodiment further provides a storage medium storing a computer program, which, when executed by a processor, implements the keyword extraction method proposed in the above embodiment.

[0131] The storage medium proposed in this embodiment and the keyword extraction method proposed in the above embodiment belong to the same inventive concept. For technical details not fully described in this embodiment, please refer to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0132] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general hardware, and of course can also be implemented by hardware. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

Claims

1. A keyword extraction method, characterized in that: include: Obtaining a first data stream, extracting text content and function features of the first data stream using a first text parsing method, and performing a first judgment on the text content; identifying feature information in the text content using a first similarity algorithm, aligning the feature information with the function features according to a first feature alignment method, forming a first matrix with the aligned feature information and function features, and extracting a characteristic equation of the first matrix to obtain a first judgment model; Training the first judgment model to obtain a recognition success probability, performing a second judgment on the recognition success probability, and outputting a second judgment model; Acquire a real-time data stream, input the real-time data stream into the second judgment model, and obtain a risk result; Obtaining data streams includes: Extracting at least one first attack event, and obtaining a first network information flow link under attack based on the first attack event; Setting the first network information flow link to a first data flow; Using the attacked point of the first network information flow link as a sample identification and judgment point; The first feature alignment method includes: Select a timestamp, select a function feature based on the timestamp, and determine the output values ​​of multiple text contents corresponding to the function feature; Return to select a function feature based on the timestamp until all function features are selected; Go back and select a timestamp until all timestamps are selected.

2. The keyword extraction method according to claim 1, wherein: Identifying feature information in the text content using a first similarity algorithm includes: The text content is input into the first similarity algorithm, an output value of the first similarity algorithm is obtained, and the text content is returned until all the text content is selected.

3. The keyword extraction method according to claim 2, wherein: Aligning the feature information and the function feature according to the first feature alignment method includes: Based on the first feature alignment method, function features are selected, output values ​​of text content corresponding to the function features are determined, and the alignment operation is repeated until all function features are selected.

4. The keyword extraction method according to claim 3, wherein: Performing a first judgment on the text content includes: If the text content of the first data stream matches the sample recognition judgment point, the content of the first data stream is returned until the content of all data streams is selected, and the text content of the first data stream is assigned a warning label; If the text content of the first data stream does not match the sample recognition judgment point, return to the sample recognition judgment point until all sample recognition judgment points are selected; Repeat the first judgment until the contents of all data streams are selected.

5. The keyword extraction method according to claim 4, wherein: Training the first judgment model includes: Selecting text content with a warning label, and inputting a judgment value corresponding to the text content with the warning label into a first judgment model; If the characteristic equation of the first judgment model is established, the text content with the warning label is returned until all the text contents with the warning label are selected; If the characteristic equation of the first judgment model does not hold, the text content with the warning label is included in the sample library, and the training operation is repeated until all the text content with the warning label is selected; Count the number of text contents with warning labels; The probability of successful recognition is obtained according to the quotient of the value in the misjudgment value table and the number of text contents with warning labels.

6. The keyword extraction method according to claim 5, wherein: The second determination of the probability of successful identification includes: If the probability of successful identification is greater than or equal to the first threshold, outputting the second judgment model; If the probability of successful identification is less than the first threshold, the misjudged data stream is included in the sample library, and all data streams are returned until the probability of successful identification is greater than or equal to the first threshold.

7. A system using the keyword extraction method according to any one of claims 1 to 6, characterized in that: include: A first judgment module is configured to obtain a first data stream, extract text content and function features of the first data stream using a first text parsing method, and perform a first judgment on the text content; an alignment module, configured to identify feature information in the text content using a first similarity algorithm, align the feature information with the function features according to a first feature alignment method, form a first matrix with the aligned feature information and function features, and extract a characteristic equation of the first matrix to obtain a first judgment model; a second judgment module, configured to train the first judgment model to obtain a recognition success probability, perform a second judgment on the recognition success probability, and output a second judgment model; The verification module is used to obtain a real-time data stream, input the real-time data stream into the second judgment model, and obtain a risk result.

8. An electronic device comprising: memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the keyword extraction method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the keyword extraction method according to any one of claims 1 to 6.

Images