Network security detection method of improved SVM (Support Vector Machine) based on text semantics

Abstract

The invention provides a network security detection method of an improved SVM (Support Vector Machine) based on text semantics, and relates to the technical field of network security. Comprising the steps of obtaining to-be-detected text data; inputting to-be-detected text data into the final detection model to obtain a detection result; the construction method of the final detection model comprises the following steps: constructing an initial detection model based on the svm; obtaining network security related data; preprocessing the network security related data to obtain preprocessed data; performing feature extraction on the preprocessed data to obtain a recognition feature value set; constructing a training sample according to the recognition feature set; based on a Gaussian function, improving a kernel function of the initial detection model to obtain an improved kernel function; determining an improved detection model according to the improved kernel function; and optimizing parameters of the improved detection model by using a Bayesian optimization algorithm to obtain a final detection model. According to the invention, the problem of low efficiency of a network security data intelligent identification method in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security detection method based on an improved SVM of text semantics. Background Art

[0002] In recent years, with the rapid progress of artificial intelligence technology, the ability of programs to imitate human behavior in the field of network security has continued to improve. Nowadays, some attackers have begun to use advanced artificial intelligence methods to collect various types of data, including public websites, social networks, emails and other information. Through in-depth analysis of these text big data, they can extract users' personal information, such as date of birth, gender, place of residence, telephone number and email, and then conduct security attacks in terms of semantic understanding. With the increasing complexity of network attacks and security threats, traditional network security detection methods seem to be powerless in the face of advanced attacks. In order to improve the intelligence level of network security detection, the combination of semantic analysis technology and support vector machine (SVM) provides potential for new network security detection methods. The network security intelligent recognition method based on semantic analysis and improved SVM can effectively deal with various threats such as phishing attacks, malware, social engineering attacks, etc. by deeply understanding the semantic information and feature patterns behind the data.

[0003] Research on intelligent identification of network security data based on traditional machine learning and deep learning involves methods such as Naive Bayes (NB), Artificial Neural Network (NN), Decision Tree (DT), K-Nearest Neighbor (KNN), and Adaptive Boosting (AdaBoost). Analysis of email, social engineering, data leakage, and threat intelligence shows that the accuracy of decision tree and nearest neighbor classification methods is too low, and DT, KNN, and AdaBoost methods all have significant recognition errors. When the convolutional neural network (CNN) deep learning method is further introduced, the results show that the support vector machine (SVM) has a high classification accuracy in several types of network security data detection, and its algorithm running time is significantly lower than the CNN method based on deep learning. Although CNN performs well in classification accuracy, its training process is relatively time-consuming. When the training iteration reaches 41 times, CNN can achieve the best test performance (accuracy can reach 99.53%), but the time required for its algorithm to converge to saturation is longer. For network security data detection and intelligent recognition with high real-time requirements, although the accuracy is high, it significantly reduces the detection efficiency and is difficult to apply to security situation awareness. In addition, since CNN is a "black box" model, its recognition performance under adversarial samples is difficult to guarantee, and when using the gradient descent method, it may fall into the local minimum rather than the global minimum. The information loss in the pooling process may also lead to a decrease in the correlation between the local and the whole, thereby affecting its application effect in network security data detection. Summary of the invention

[0004] In order to overcome the deficiencies of the prior art, the purpose of the present invention is to provide a network security detection method based on an improved SVM of text semantics, which solves the problem of low efficiency of the network security data intelligent identification method in the prior art.

[0005] To achieve the above object, the present invention provides the following solutions:

[0006] A network security detection method based on improved SVM of text semantics, comprising:

[0007] Obtain the text data to be detected;

[0008] Inputting the text data to be detected into the final detection model to obtain the detection result;

[0009] The final detection model is constructed as follows:

[0010] Build an initial detection model based on svm;

[0011] Obtain cybersecurity-related data;

[0012] Preprocessing the network security related data to obtain preprocessed data;

[0013] Performing feature extraction on the preprocessed data to obtain an identification feature value set;

[0014] Constructing training samples according to the identification feature set;

[0015] Based on the Gaussian function, the kernel function of the initial detection model is improved to obtain an improved kernel function;

[0016] Determining an improved detection model according to the improved kernel function;

[0017] The parameters of the improved detection model are optimized using a Bayesian optimization algorithm to obtain a final detection model.

[0018] Preferably, the constructing of the initial detection model based on SVM includes:

[0019] Determine the spacing of support vectors;

[0020] Determine an equivalent constraint model of the first constraint parameter according to the interval first constraint parameter expression and according to the first constraint parameter expression;

[0021] Obtaining a first dual expression according to the equivalent constraint model through a Lagrangian function;

[0022] Obtaining an equivalent dual expression of the initial detection model according to the first dual expression;

[0023] Using the SMO algorithm to solve the equivalent dual expression and determine the soft margin optimization expression;

[0024] An initial detection model expression is determined according to the soft interval optimization expression.

[0025] Preferably, the parameter expression of the initial detection model is:

[0026]

[0027] Preferably, the preprocessing of the network security related data to obtain preprocessed data includes:

[0028] Filter the network security related data to obtain filtered data;

[0029] Performing Chinese word segmentation on the filtered data to obtain word segmentation data;

[0030] The word segmentation data is processed to remove stop words to obtain preprocessed data.

[0031] Preferably, feature extraction is performed on the preprocessed data to obtain an identification feature value set, including:

[0032] Determining the types of extracted features by natural language processing technology, wherein the types of feature extraction include: word frequency feature, inverse document frequency, TF-IDF, vocabulary density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency depth;

[0033] Feature extraction is performed on the preprocessed data according to the feature extraction type to obtain an identification feature value set.

[0034] Preferably, constructing a training sample according to the identification feature set includes:

[0035] Determine preset feature types as training features;

[0036] Outliers are determined based on the training features and removed to obtain training samples.

[0037] Preferably, the expression of the improved kernel function is:

[0038]

[0039] Preferably, the expression of the improved detection model is:

[0040]

[0041] Preferably, the expression of the final detection model is:

[0042]

[0043] The present invention discloses the following technical effects:

[0044] The present invention provides a network security detection method of an improved SVM based on text semantics, including: obtaining text data to be detected; inputting the text data to be detected into a final detection model to obtain a detection result; the construction method of the final detection model is: constructing an initial detection model based on SVM; obtaining network security related data; preprocessing the network security related data to obtain preprocessed data; extracting features from the preprocessed data to obtain a set of identification feature values; constructing training samples according to the identification feature set; improving the kernel function of the initial detection model based on a Gaussian function to obtain an improved kernel function; determining an improved detection model according to the improved kernel function; optimizing the parameters of the improved detection model using a Bayesian optimization algorithm to obtain a final detection model. The present invention can significantly improve the detection accuracy and response speed of network attacks for complex threats such as e-mails, social engineering, data leakage, threat intelligence (network security data), and is suitable for security protection of large network environments such as enterprises and governments. In future applications, this intelligent recognition method can be combined with real-time monitoring systems and automated emergency response mechanisms to achieve more efficient network security protection. At the same time, this method can also be extended to other fields, such as financial risk control, information leakage protection, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0046] Figure 1 A flowchart of a network security detection method based on an improved SVM of text semantics provided by an embodiment of the present invention;

[0047] Figure 2 A comparison chart of classification and recognition accuracy of different kernel functions for network security data provided by an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of observing abnormal points in network security detection data provided by an embodiment of the present invention;

[0049] Figure 4 A schematic diagram of a comparison curve of an improved kernel function provided in an embodiment of the present invention;

[0050] Figure 5 A schematic diagram of a change curve of an improved kernel function under different parameters provided by an embodiment of the present invention, wherein: Figure 5 (a) is a first schematic diagram, Figure 5(b) is a second schematic diagram;

[0051] Figure 6 A comparison chart of ROC curves of different kernel functions provided in an embodiment of the present invention;

[0052] Figure 7 The Bayesian optimization SVM objective function and iteration curve diagram provided by the embodiment of the present invention;

[0053] Figure 8 A schematic diagram of a Bayesian optimization SVM objective function model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0056] like Figure 1 As shown, the present invention provides a network security detection method based on text semantics improved SVM, including:

[0057] Step 100: Obtain text data to be detected;

[0058] Step 200: input the text data to be detected into the final detection model to obtain the detection result;

[0059] The final detection model is constructed as follows:

[0060] Step 201: construct an initial detection model based on SVM;

[0061] Step 202: Acquire network security related data;

[0062] Step 203: preprocessing the network security related data to obtain preprocessed data;

[0063] Step 204: extracting features from the preprocessed data to obtain a set of identification feature values;

[0064] Step 205: constructing a training sample according to the identification feature set;

[0065] Step 206: Based on the Gaussian function, the kernel function of the initial detection model is improved to obtain an improved kernel function;

[0066] Step 207: Determine an improved detection model according to the improved kernel function;

[0067] Step 208: Optimize the parameters of the improved detection model using a Bayesian optimization algorithm to obtain a final detection model.

[0068] Specifically, semantic analysis can unearth hidden malicious intent by analyzing the semantic features of text in emails, social engineering, data leaks, threat intelligence, etc. For example, by understanding the sentence structure, word meaning, and contextual relationships in emails, it is possible to identify hidden attack methods in phishing emails. This semantic-level recognition goes beyond traditional methods that rely on character similarity and simple feature matching, and has significant advantages, especially when facing advanced threats.

[0069] Semantic analysis is an important field in artificial intelligence and the core of natural language processing technology. It involves multiple disciplines, such as machine learning, cognitive linguistics, linguistics, and computational linguistics. The progress of semantic analysis technology has promoted the rapid development of other natural language processing tasks. In recent years, with the rapid development of deep learning technology, semantic analysis has achieved remarkable achievements in various fields of artificial intelligence. For example, there have been important breakthroughs in autonomous driving, speech recognition, Go games, image recognition, etc.

[0070] Semantic analysis uses various means to identify and understand the semantic information contained in the text. In-depth understanding of language can be attributed to the scope of semantic analysis. Usually, the text is composed of words, sentences and paragraphs. Semantic analysis at the lexical level mainly focuses on how to obtain or distinguish the meaning of words. In short, semantic analysis automatically parses various languages ​​by establishing effective models and systems to fully understand the meaning conveyed by the text.

[0071] With the rapid development of Internet technology, network security incidents occur frequently, and network attack methods and threats are constantly escalating. Semantic analysis technology is a technology that identifies language patterns, contextual relationships, and information meaning by understanding and parsing the meaning of words and sentences in text. It is not limited to superficial vocabulary matching, but deeply explores the potential meaning of words, sentences, and paragraphs, and then determines the intention and meaning behind the language. Semantic analysis is widely used in network security, especially in email security, social engineering attack protection, malware detection, etc. By analyzing the language patterns in emails, files, or logs, semantic analysis can identify phishing attacks, fraud attempts, or sensitive information leaks. The high-level semantic features extracted based on semantic analysis can effectively reduce the input dimension and enhance the efficiency of SVM.

[0072] The application of semantic analysis technology in email network security detection is no longer limited to matching malicious samples. Instead, it improves traditional character similarity detection by deeply analyzing the semantic features in emails, especially the semantic relationship between characters, and transforms it into a more flexible and in-depth "semantic level" recognition. In addition, semantic analysis also plays an important role in preventing social engineering attacks. It can detect malicious intent and identify phishing attacks by analyzing the content of conversations in social media and instant messaging. Data leakage detection also benefits from semantic analysis. It identifies sensitive information leakage by analyzing the language patterns of corporate files, databases and emails, and detects abnormal usage behavior through contextual analysis of encrypted or fragmented data. Authentication and account security also rely on semantic analysis. By identifying user behavior patterns and language habits, account takeover attacks (ATO) can be discovered in a timely manner, and additional security verification can be triggered. In the field of threat intelligence, semantic analysis is crucial. It can help the system identify emerging threats in advance by analyzing discussions in cybersecurity forums, hacker forums, social networks and dark webs. In terms of malware detection, semantic analysis identifies the behavior patterns of software instead of relying solely on code signatures. Even if the code is obfuscated, it can still detect potential threats by analyzing the function call sequence and memory operation behaviors. Semantic analysis can also be used for network intrusion detection, parsing the communication content in network traffic, and combined with deep packet inspection technology (DPI), discovering abnormal communications at the protocol layer or application layer, thereby identifying potential intrusions. In addition, in log analysis and anomaly detection, semantic analysis can quickly extract suspicious behaviors from a large number of logs and discover potential attacks and data abuse. In short, semantic analysis technology has great application potential in the field of network security and can help enterprises and organizations respond to complex network threats intelligently.

[0073] Furthermore, the construction of the initial detection model based on SVM includes:

[0074] Determine the spacing of support vectors;

[0075] Determine an equivalent constraint model of the first constraint parameter according to the interval first constraint parameter expression and according to the first constraint parameter expression;

[0076] Obtaining a first dual expression according to the equivalent constraint model through a Lagrangian function;

[0077] Obtaining an equivalent dual expression of the initial detection model according to the first dual expression;

[0078] Using the SMO algorithm to solve the equivalent dual expression and determine the soft margin optimization expression;

[0079] An initial detection model expression is determined according to the soft interval optimization expression.

[0080] Specifically, as a common supervised machine learning method, SVM has been widely used in classification statistics and regression analysis. SVM achieves the mapping of low-dimensional vectors to high-dimensional vectors by establishing the maximum margin hyperplane in the spatial domain, and distinguishes different categories of data. It also has broad application prospects in the intelligent identification and classification of network security data.

[0081] Assume that the sample x of network security data satisfies the following linear equation in the spatial domain:

[0082] w T x+b=0 (1)

[0083] In the formula, w and b are the normal vector and the displacement of the sample space respectively. The distance from any point in the sample space to the hyperplane (w, b) can be expressed as:

[0084]

[0085] Where L is the distance from any point in space to the hyperplane (w, b).

[0086] Obviously, the interval of the support vectors formed by the sample training points closest to both sides of the hyperplane is When the support vector interval is the largest, the optimal classification effect can be obtained. Therefore, when finding the maximum interval, the constraint parameters must meet the following constraints:

[0087]

[0088] γ represents the interval of support vectors, y i Indicates the distance of each sample point on one side of the hyperplane. "st" is the abbreviation of "subject to", which means "under the condition of..." or "satisfying...". It is usually used to introduce constraints to indicate the restrictions or conditions that need to be met during the optimization process. i is the sample point.

[0089] Further simplifying formula (3) yields the equivalent constraint model:

[0090]

[0091] According to the calculation principle of the Langrange multiplier method of convex quadratic programming, equation (4) can be transformed into the following dual problem through the Lagrange function:

[0092]

[0093] The Lagrange multiplier is λ i (i=1,2,3,…m), calculate the partial derivatives of the Langrange function with respect to the parameters w and b and set them to zero to obtain:

[0094]

[0095] Further simplifying and calculating formula (6) we can get:

[0096]

[0097] Substituting formula (7) into formula (5) yields:

[0098]

[0099] Combining the constraints in formula (4), the equivalent dual problem of the SVM model is:

[0100]

[0101] The corresponding KKT conditions are:

[0102]

[0103] In order to avoid the large amount of calculation caused by the conventional quadratic programming algorithm to solve equation (9), the SMO algorithm can generally be used to first select two variables λ g and λ h , respectively correspond to the Lagrange multipliers of the two selected training samples, and other parameters are fixed, and the iterative update method is used until convergence. Then the constraint condition in equation (9) can be simplified as:

[0104] λ g y g +λ h y h =c λ g ≥0,λ h ≥0 (11)

[0105] In formula (11), the constant is introduced:

[0106]

[0107] Since for any support vector (x s ,y s ) all satisfy y s f(x s )=1, that is:

[0108]

[0109] y s is the label of the sth support vector.

[0110] Therefore, the offset term b can be further calculated. Considering the robustness of the calculation, the average value of the SVM solution is generally used:

[0111]

[0112] Among them, S represents the subscript set of support vectors, that is:

[0113] S={i|λ i >0,i=1,2,...,m} (15)

[0114] Further extending the linearly separable to linearly inseparable cases in SVM, considering some SVM samples that do not meet the constraints, soft margin optimization is generally used:

[0115] y i (w T x i +b)≥1 (16)

[0116] In order to minimize the number of support vectors that do not meet the constraints and maximize the hyperplane interval, a slack variable ζ is generally introduced. i , so that it satisfies:

[0117] y i (w T x i +b)+ζ i ≥1 (17)

[0118] Combining the Lagrange multiplier method to solve the quadratic programming problem, the constraints of soft margin optimization can be obtained as follows:

[0119]

[0120] Combined with the first Lagrangian operator λ i and the second Lagrangian operator μ i And the constant C, we can get the Lagrangian function as:

[0121]

[0122] The constraints are: stλ i ≥0,μ i ≥0(20)

[0123] In order to obtain the extreme value of the Lagrangian function, the partial derivatives of Γ(w,b,ζ,λ,μ) with respect to the parameters w,b and ζ are calculated and set to 0, that is:

[0124]

[0125] Substituting equation (21) into equation (18), we can further calculate the dual problem in soft margin optimization:

[0126]

[0127] The KKT condition (Karush-Kuhn-Tucker) is:

[0128]

[0129] SMO optimization is used to solve the Lagrangian function and obtain the Lagrangian multiplier λ i , substituting into equation (21) and equation (16), the SVM model parameters (parameter expression of the initial detection model) can be obtained as follows:

[0130]

[0131] In the formula, S is still the subscript set of support vectors S = {i|λ i >0,i=1,2,...,m}. According to the calculation results of the model parameters, the optimal hyperplane (w T x+b)=0.

[0132] In most cases, due to the nonlinear and multi-source characteristics of network security data, it is generally difficult to achieve complete linear separability of training sample data. Assuming that the vector of sample point x mapped to high-dimensional space is φ(x), the separation hyperplane in nonlinear SVM can be expressed as:

[0133] f(x)=w T φ(x)+b (25)

[0134] The corresponding constraints can be expressed as:

[0135]

[0136] Similarly, when the SMO solution algorithm is used, the dual problem of nonlinear support vector machine constraints can be transformed into:

[0137]

[0138] Assume that the inner product after high-dimensional feature space mapping can be expressed as:

[0139] k(x i ,x j )=<φ(x i ),φ(x j )>=φ(x i ) T ·φ(x j ) (28)

[0140] Where k(x) is the kernel function of the support vector machine. Substituting equation (28) into (27), the constraint condition can be simplified as follows:

[0141]

[0142] Similarly, the Lagrange multiplier method is used to calculate:

[0143]

[0144] Obviously, choosing an appropriate kernel function is the key to solving the linear inseparable problem or obtaining the optimal hyperplane of the nonlinear interval. Since the kernel matrix is ​​semi-positive definite, a corresponding regenerated Hilbert eigenspace can always be found. The general linear kernel function can be expressed as:

[0145] k(x i ,x j )=x i T x j (32)

[0146] The polynomial kernel function can be expressed as:

[0147] k(x i ,x j )=(x i T x j ) d (33)

[0148] The parameter d is the order, which determines the degree of nonlinearity of the kernel function.

[0149] The Gaussian kernel function can be expressed as:

[0150]

[0151] In order to optimize the nonlinear classification effect of SVM, the customized kernel function method can also be used to find the optimization algorithm with the highest accuracy and efficiency of intelligent classification of network security data training set, so that SVM can better handle high-dimensional semantic feature space, thereby improving classification performance. However, it is necessary to obtain the optimal training data set or feature value space first. This enables SVM to better handle high-dimensional semantic feature space, thereby improving classification performance.

[0152] Further, the preprocessing of the network security related data to obtain preprocessed data includes:

[0153] Filter the network security related data to obtain filtered data;

[0154] Performing Chinese word segmentation on the filtered data to obtain word segmentation data;

[0155] The word segmentation data is processed to remove stop words to obtain preprocessed data.

[0156] Specifically, in the context of network security related to semantic analysis, this paper collects data directly related to the network security field through various methods to build a network security intelligent detection platform and improve the ability to accurately identify data. These methods include crawling data from the Internet, data manually entered by experimenters, and data imported from a dedicated network security experiment platform. In data collection, we pay special attention to screening data sources that are highly relevant to network security threats to ensure that the collected data has high relevance and practicality.

[0157] In today's context of rapid development of information technology, the complexity of network attacks continues to increase, so the processing and analysis of network security data is particularly important. Especially when processing large amounts of network traffic, emails, logs and other data, how to effectively improve the availability and processing quality of data has become a key issue in research and application. Through experimental data collection, this paper deeply explores how to improve the quality of network security data through semantic analysis in data preprocessing. The preprocessing of experimental data includes steps such as data filtering, feature extraction and removal of redundant information, aiming to convert the original unstructured text data into a format suitable for computer processing and analysis, so as to improve the accuracy of threat detection.

[0158] Data filtering. In the early stages of network security data processing, the first task is to filter data. The large number of images, videos, hyperlinks, and non-text symbols contained in the original data are both noise and interference for text analysis. Filtering out these irrelevant contents can not only clean the data, but also improve the efficiency and accuracy of subsequent semantic analysis. Through fine filtering, we ensure that the data entering the analysis process is pure and high-quality, laying the foundation for detecting malicious traffic, phishing emails and other attack behaviors.

[0159] Chinese word segmentation. As the core step of data preprocessing, word segmentation directly affects the subsequent label generation and text analysis. Unlike the whitespace character separation in English, Chinese word segmentation faces challenges such as no clear separator, strong vocabulary polysemy, rich synonyms, and complex grammatical structure. This paper adopts Jieba word segmentation technology, which combines rule-based methods and statistical methods to effectively solve the problem of Chinese word segmentation. Jieba word segmentation improves scanning efficiency by constructing a triangular tree structure to scan the word graph, and uses a directed acyclic graph (DAG) to divide all possible word formation situations in detail. Finally, the maximum probability path is determined through dynamic programming to achieve accurate word segmentation. For new words outside the dictionary, Jieba word segmentation also introduces the hidden Markov model (HMM) and Viterbi algorithm based on Chinese characters to further improve the accuracy and flexibility of word segmentation. In addition, Jieba word segmentation supports user-defined dictionaries, which greatly improves the adaptability and accuracy of the word segmentation system in the field of network security semantic analysis. By introducing specific terms in the field of network security, we can effectively avoid the situation where network security professional terms are incorrectly segmented, thereby ensuring the accuracy and completeness of the network security segmentation results.

[0160] Remove stop words. Removing stop words is another important step in text preprocessing. Although frequently appearing conjunctions, prepositions, pronouns, etc. in text are essential in language expression, they are not very helpful in capturing the core meaning of the text and conducting in-depth analysis. By removing these stop words, data noise can be further reduced and key information in text data can be highlighted. After completing basic text preprocessing, semantic-based feature value extraction is performed.

[0161] Furthermore, feature extraction is performed on the preprocessed data to obtain an identification feature value set, including:

[0162] Determining the types of extracted features by natural language processing technology, wherein the types of feature extraction include: word frequency feature, inverse document frequency, TF-IDF, vocabulary density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency depth;

[0163] Feature extraction is performed on the preprocessed data according to the feature extraction type to obtain an identification feature value set.

[0164] Specifically, feature extraction in semantic analysis is the core step of preprocessing, which directly affects the effect of subsequent classification and attack detection. Unlike traditional character or pattern matching, the language structure in network attacks is complex and faces the challenges of polysemy, synonyms, and specific domain terms. By extracting these 10 semantic-based network security identification feature values ​​to construct a normalized feature vector, we can accurately extract semantic features in text and further improve the accuracy of network security detection. These feature values ​​not only reveal important information in network data, but also provide a solid foundation for subsequent classification and detection. The word frequency feature (TF) reflects the frequency of attack-related keywords. For example, when common words in phishing attacks (such as "urgent", "account", etc.) appear frequently in the text, potential phishing emails or social engineering attacks can be detected through word frequency features. The inverse document frequency (IDF) reflects the rarity of keywords in the entire dataset. Network attacks often use specific terms. IDF helps identify keywords that are uncommon in most normal traffic but frequently appear in malicious traffic, which is suitable for detecting malware, viruses, or malicious instructions. TF-IDF combines word frequency and inverse document frequency to reflect the importance of a word in a single document. TF-IDF can help prioritize key terms in a specific attack, thereby improving the accuracy of identifying malicious emails and malicious web pages. Lexical Density reflects the complexity of the text and measures the ratio of functional words to content words in the text. Many phishing emails or malicious web pages use simple language and low lexical density. This feature can be used to detect attacks with unusually simple language and hidden intentions. Syntactic Complexity reflects the complexity of the syntactic structure of the text. Advanced persistent threats (APTs) or complex attacks may use highly complex syntactic structures to conceal their intentions. Syntactic complexity helps identify these advanced attacks. Sentiment Polarity Score reflects the emotional tendency of the text. Phishing attacks, fraudulent emails, etc. are often accompanied by strong negative or positive emotional tendencies (such as threat and urgency). Sentiment Polarity Score can help identify such attacks with emotional manipulation intent in language. Keyword Density reflects the density of keywords related to a specific attack. Many malicious emails and cyber attacks contain specific terms, such as "act now" and "security warning". Keyword density can reveal the abnormally high frequency of these sensitive words and is used to detect phishing attacks or malicious marketing. Context Similarity reflects the relevance of keywords to their context. Attackers often use keywords that are unreasonable in normal contexts or disguise information to make attacks look normal. Context Similarity helps detect mismatched word combinations and thus discover potential threats.Named Entity Recognition (NER) reflects whether the attack target involves key entities, such as personal, company or organization names. Phishing emails or social engineering attacks often contain disguised well-known company names or personal names. NER can help identify the target objects of these attacks. Dependency Depth reflects the complexity of sentence structure. Malicious attacks sometimes hide attack content through complex sentence structures. Dependency Depth can reveal texts with overly complex or abnormal syntax, which may indicate advanced threats or forged communication content. These feature values ​​can not only effectively improve the intelligence and accuracy of attack detection, but also help security analysts understand the language patterns and potential strategies of attacks.

[0165] In order to obtain the best accuracy of intelligent recognition of network security data, combined with the near-Gaussian distribution characteristics of network security detection data, it is necessary to normalize the original network security detection data and select eigenvalues ​​to construct the SVM training sample space. Therefore, the 10 eigenvalues ​​shown above are considered separately. In the network security intelligent recognition method based on semantic analysis, the extracted eigenvalues ​​can be realized by natural language processing (NLP) technology. The following lists 10 commonly used semantic eigenvalues, each of which has a corresponding formula or description to help the system extract useful semantic information from network traffic, emails or texts. These eigenvalues ​​can help the system effectively identify potential attack behaviors in texts in network security detection based on semantic analysis, thereby improving the accuracy of network security intelligent recognition.

[0166] (1) Term Frequency (TF)

[0167] Indicates the number of times a specific word appears in a document.

[0168]

[0169] Where count(tt) is the number of times word tt appears in the document, ∑ all words count(ω) is the total number of times all words appear in the document.

[0170] (2) Inverse Document Frequency (IDF)

[0171] A measure of the importance of a word in the entire corpus. The less a word appears, the higher its IDF value.

[0172]

[0173] Where N is the total number of documents, and |{dd∈DD:tt∈dd}| represents the number of documents in which word tt appears and the total number of documents in DD.

[0174] (3) TF-IDF

[0175] Combining word frequency and inverse document frequency is used to measure the importance of a word in a document.

[0176] TF-IDF(tt,dd)=TF(tt,dd)×IDF(tt)

[0177] Among them, TF(tt,dd) is the word frequency in document dd, and IDF(tt) is the inverse document frequency of the word.

[0178] (4) Lexical Density

[0179] Measures the ratio of function words to content words in a text and is used to analyze text complexity.

[0180]

[0181] Among them, content words are nouns, verbs, adjectives and adverbs, and function words are prepositions, conjunctions, etc.

[0182] (5) Syntactic Complexity

[0183] The complexity of the sentence is measured by analyzing the dependency structure of the sentence.

[0184]

[0185] Among them, the nodes represent the word or phrase dependencies in the sentence.

[0186] (6) Sentiment Polarity Score

[0187] Based on the sentiment analysis model, the sentiment polarity of the text is extracted, and the score range is usually [-1,1].

[0188]

[0189] Among them, positive words and negative words are given corresponding sentiment scores respectively. p represents the sentiment polarity score of the text.

[0190] (7) Keyword Density

[0191] Measures the frequency of specific attack-related keywords in the text.

[0192]

[0193] Where count(k) is the number of times the keyword appears in the text.

[0194] (8) Context Similarity

[0195] The similarity between the word and the context is calculated through word vectors (Word2Vec, GloVe, etc.) to detect whether the context of the keyword is abnormal.

[0196]

[0197] in, and They are the word vectors of keywords and context respectively.

[0198] (9) Named Entity Recognition (NER)

[0199] Detect potential attack targets by identifying named entities in text (such as names of people, places, and organizations).

[0200]

[0201] Among them, entity types include names of people, places, etc., and count (entity type) is the number of times each entity type appears.

[0202] (10) Dependency Depth

[0203] Analyze the dependency structure of sentences and measure the depth of syntactic dependency trees to detect abnormally complex sentence structures.

[0204]

[0205] Dependency Depth: The dependency depth of a sentence, which indicates the length of the longest path from the root node to the deepest leaf node in the syntactic dependency tree. This value reflects the complexity of the sentence structure. Dependency Tree: A tree structure built with the central word of a sentence as the root node. Each node in the tree represents a word, and each edge represents the dependency relationship between two words. Syntactic analysis organizes sentences through this tree structure. Depth: The depth of the dependency tree, that is, the length of the longest path from the root node to the farthest node. The greater the depth, the more levels the sentence has and the more complex the structure.

[0206] Furthermore, Figure 2As shown, according to the above eigenvalue calculation formula, when the above 10 eigenvalues ​​are selected respectively as network security data detection and intelligent recognition sample sets for training, when the linear kernel function, polynomial kernel function and Gaussian (RBF) kernel function are used for SVM classification respectively, and 10-fold cross validation is used at the same time.

[0207] Furthermore, constructing a training sample according to the identification feature set includes:

[0208] Determine preset feature types as training features;

[0209] Outliers are determined based on the training features and removed to obtain training samples.

[0210] Specifically, it can be observed that when 10 eigenvalues ​​are selected to construct a detection and classification support vector machine supervised learning model, the classification accuracy is 85% (polynomial kernel), 75% (linear kernel) and 86% (Gaussian kernel). Obviously, when the original detection data and its eigenvalues ​​are directly used as the sample space for training and testing, the accuracy of the network security data identification and distinction method based on SVM still needs to be improved. The main reason is that there may be individual anomalies in the training set. Therefore, it is necessary to detect and eliminate the anomalies of the sample space eigenvalues ​​in the SVM training set. When the eigenvalue word frequency feature and the inverse document frequency in the normalized data of network security data detection are selected as two training features, the distribution of anomalies and the observation results are as follows: Figure 3 As shown, the eigenvalues ​​1 and 2 of the horizontal and vertical axes represent the word frequency features and inverse document frequency in Table 5.2 respectively; according to Figure 3 The support vectors shown can observe the eigenvalue anomaly and its marginal distribution caused by text semantic interference, and the eigenvalue anomaly rate is 5%.

[0211] Furthermore, SVM has limitations when processing high-dimensional and large-scale data, and needs to improve its efficiency and accuracy by improving the algorithm. The improved SVM model combined with semantic analysis can improve the accuracy of classification by extracting more accurate semantic features.

[0212] In order to examine the data characteristics of network security data in a multi-context semantic environment, assuming that network security data satisfies independent and identical distribution, the corresponding kernel density function is estimated as:

[0213]

[0214] Among them, K and h are kernel function and sliding bandwidth respectively, and scaling function K h satisfy:

[0215]

[0216] A Gaussian scaling kernel function can be used:

[0217]

[0218] Combined with formula (36), it can be seen that the appropriate sliding bandwidth is the key to determining the accuracy of kernel density estimation. Therefore, the integrated square error expectation M(h) is considered to characterize the kernel density estimation error. Its specific expression is:

[0219]

[0220] Here E is used to measure the overall performance of kernel density estimation.

[0221] Under the weak integral assumption, the asymptotic form of the error expectation M(h) can be expressed as:

[0222]

[0223] Among them, A1 is a constant term related to kernel density estimation, r(K) and m(K) are the quadratic integral term and convolution square term of the kernel function, respectively.

[0224]

[0225] Similarly, to obtain the extreme value of the asymptotic form A1M(h), we can calculate the partial derivative and set it to 0, and let:

[0226]

[0227] According to formula (41), the optimal sliding bandwidth can be calculated as:

[0228]

[0229] In the actual calculation process, if the Gaussian kernel function is selected, the bandwidth parameter h can generally be obtained by an adaptive method. Similarly, when the texts such as email, social engineering, data leakage, and threat intelligence are used as the research and comparison objects, the one-dimensional kernel density estimation curves of several different detection data are obtained by adaptive kernel density function estimation. The detection signal data all show Gaussian distribution characteristics, that is, the data components greater than the detection baseline and less than the detection baseline all show a small probability distribution, and the closer the data is to the detection baseline, the greater the distribution probability. Further examining the two-dimensional and three-dimensional distribution results of the kernel density function, the two-dimensional distribution scatter plots of several detection data show elliptical characteristics, and the data are mainly symmetrically Gaussian distributed along the long axis, and there are individual interference points on both sides of the short axis. Similarly, from the three-dimensional kernel density estimation of the detection data, it can be seen that several detection data show a trend of high geometric center distribution density and gradually decreasing distribution probability of surrounding data. The result is that several detection data have Gaussian distribution characteristics.

[0230] Furthermore, according to the problems found above, the kernel function of the support vector machine is the bridge from the input feature space to the mapping space, and is also the key to determining the accuracy of network security data detection and classification recognition. The conventional kernel function of the support vector machine (sigmoid function) based on multi-layer neural network perception training has the following expression:

[0231] κ(u,v)=tanh(λ<u,v>+c) (43)

[0232] u and v are the first eigenvector and the second eigenvector of the input sample respectively; λ controls the slope of the function and determines how the similarity between samples affects the kernel value. A larger value makes the kernel function more sensitive to changes in the input; c adjusts the translation of the function and affects the offset of the kernel value. By adjusting it, the relationship between samples can be changed, such as enhancing or weakening the influence of certain features.

[0233] Obviously, by transforming the feature space vector through the hyperbolic tangent activation function, the training of neuron input can be realized, but the initial value of the input parameter is large, which can easily lead to neuron saturation and make it difficult to achieve the purpose of learning and training. Therefore, this paper proposes a hybrid improved kernel function based on the sigmoid function and the Gaussian function, in order to improve the sigmoid function to reduce the under-learning state caused by input saturation. The kernel function has the following mathematical form:

[0234]

[0235] Among them, A and σ are the kernel function amplitude excitation and response adjustment parameters respectively. When A=1, σ=0.5, the comparison curve between the improved kernel function and the conventional sigmoid kernel function is as follows: Figure 4 shown.

[0236] Specifically, the expression of the improved detection model is:

[0237]

[0238] Specifically, it can be observed that the initial curve of the conventional sigmoid function is smooth, and the gradient is almost 0. After rapid learning and training near 0, the curve becomes smooth again and the learning and training speed decreases; while the initial curve of the improved kernel function has a certain gradient, and the gradient gradually increases in the later stage, that is, the improved kernel function can realize rapid learning and training of the input data set, and there is almost no saturation phenomenon for large initial value input. Therefore, with the help of the fast learning and training characteristics of the hyperbolic tangent function and the Gaussian function, the morphological curves of the proposed improved kernel function under different excitation parameters are as follows: Figure 5 As shown. Figure 5 (a) and Figure 5(b) The improved kernel function under different kernel function excitation amplitudes A and different response adjustment parameters. The legends indicate the change of A from 0.01 to 20 and the change of σ from 10 to 300. Figure 5 (a) σ = 10, A = 0.01 to 20; Figure 5 (b)A=1,σ=10~300.

[0239] From the observation and comparison, we can see that as the kernel function excitation amplitude A gradually increases, the kernel function curve gradually tends to be smooth. When A is greater than 10, the kernel function curve gradient gradually approaches, and the learning and training speed gradually decreases. Therefore, when conducting SVM eigenvalue sample space training, it is not advisable to select an amplitude A that is too large. In addition, according to Figure 5 From the curves of different response adjustment parameters shown in (b), we can see that as σ gradually increases, the improved kernel function curve gradually becomes stable, and the gradient difference of the kernel function curve under different σ also gradually decreases, but there is still a certain saturation training space. However, from the comparison of learning and training speed, we can see that a smaller σ can better meet the needs of SVM feature space mapping and fast learning and training.

[0240] When further classifying and identifying texts such as emails, social engineering, data leakage, and threat intelligence, the receiver operating characteristic curve (ROC curve) calculation results of the improved kernel function are as follows: Figure 6 As shown. The results show that after training the improved kernel function, the classification and recognition accuracy of texts such as email, social engineering, data leakage, and threat intelligence is 0.9581, while the classification accuracy of the conventional sigmoid kernel function and Gaussian kernel function are 0.7305 and 0.9191 respectively, that is, the improved kernel function has a higher classification accuracy in network security data recognition. In fact, by comparing the ROC curves of the three types of kernel functions, it can be seen that the improved kernel function has a higher hit rate and a smaller false alarm rate and misjudgment rate. This result also confirms that the hybrid improved kernel function based on the hyperbolic tangent function and the Gaussian function has a high feasibility in the intelligent recognition and classification of network security data.

[0241] Furthermore, in order to further optimize the operating efficiency of the traditional SVM supervised machine learning algorithm and the accuracy of the objective function calculation model, Bayesian optimization can be used to optimize SVM hyperparameters and improve the calculation and classification performance. The specific algorithm steps and pseudo code are as follows:

[0242]

[0243]

[0244] Specifically, assuming that the sample space to be trained satisfies the Gaussian distribution characteristics, the hyperparameter to be optimized is x = {x1, x2, ..., x n}, first use the optimal acquisition function to iteratively obtain new sample points x n+1 , and then obtain the next objective function value based on the relationship between the SVM objective function and the hyperparameters, and integrate the data set D after multiple iterations n , and finally update the probability statistical model and repeat the above process until all hyperparameter values ​​are obtained. Among them, the acquisition function can be regarded as the weighted sum of the posterior mean and the posterior variance, that is:

[0245]

[0246] Among them, μ and σ1 are the posterior mean and posterior standard deviation respectively, and β is a weighting constant.

[0247] μ i-1 and σ1 i-1 is the posterior mean and posterior standard deviation of the previous step, which are used to iteratively calculate formula (46).

[0248] Specifically, in the semantic analysis SVM network security intelligent identification calculation process based on Bayesian optimization, the official Statistics and Machine Learning Toolbox of MATLAB, a commercial mathematical software produced by MathWorks, USA, was called. The specific Bayesian optimization method is introduced as follows:

[0249] The sample point function selection improves the current maximum f(x + ) value probability density value as the next new sampling query point, that is:

[0250] x t+1 =arg max(αPI(x))=arg max(P(f(x))≥(f(x) + )+∈)) (47)

[0251] Among them, P(·) represents the probability, ∈ is a small positive number, and x + = arg max xi∈x1:t f(x i ), is the next optimization point selected by the current model, x i is the position of the query point in step i.

[0252] Since the Gaussian process model is assumed in advance, the above formula can be further calculated as:

[0253]

[0254] where Φ(·) represents the standard normal cumulative distribution function.

[0255] In order to minimize the distance between the points and the maximum target value, the expected value is considered as the basis for selecting the next sample query point, that is:

[0256]

[0257] Among them, f is the real function, h t+1 is the posterior mean of the surrogate model at step t+1, is the training data.

[0258] Specifically, the expression of the final detection model is:

[0259]

[0260] D i Represents the dataset at step i. The optimized dataset.

[0261] Finally, by minimizing the number of evaluation queries and combining the active Gaussian model Bayesian optimization to intelligently select the next query sample point, the estimation of the objective function f(x) is optimized for the data point with the highest uncertainty until the convergence or stopping conditions are met, thus completing the Bayesian optimization process.

[0262] Combining the above Bayesian optimization algorithm and using the SMO solver, the SVM objective function optimization iterative process is obtained as follows: Figure 7 shown.

[0263] It can be observed that the estimated minimum target value obtained through Bayesian optimization and search changes almost consistently with the minimum observed target value. Only at the fifth optimization iteration does the estimated target value jump, and this continues until 31 iterations are completed, ultimately obtaining a minimum optimization target value of about 0.27.

[0264] Similarly, the Bayesian optimization objective function model is obtained as Figure 8 As shown, it can be observed that with the changes in the optimization kernel scale and box constraints, the target observation value and the model gradually converge, and the model mean also shows a near-Gaussian distribution feature in three-dimensional space.

[0265] The final calculation results of the Bayesian optimization model are shown in Table 1. The results show that the number of iterations for the best observation feasible point is 31, while after model optimization, the number of iterations is only 22; and the calculated objective function values ​​are 0.27 and 0.26852, respectively, that is, the estimation error is 0.15%.

[0266] In addition, after Bayesian optimization, the estimation time of the best feasible point of the objective function was 29.132s, which was 6.54s lower than the calculation time of the best observation feasible point of 35.672s, and the final SVM classification recognition accuracy was increased from 84.92% to 99.31%.

[0267] Table 1 is a table of calculation results of the Bayesian optimization SVM model. Table 1 is as follows:

[0268] Table 1 Bayesian optimization SVM model calculation results

[0269]

[0270]

[0271] The comparison of the detection accuracy results of other support vector machine algorithms such as linear SVM (LSVM), power SVM (PSVM), twin SVM (R-TWSVM) and Gaussian sample uncertainty SVM (SVM-GSU) is shown in Table 2. Compared with the Bayesian optimization semantic analysis SVM based on the SMO solver described in this paper, it can be seen that the test accuracy calculation results of the relevant SVM and its improved model are not higher than 97%. Table 2 is an algorithm comparison table, as shown below:

[0272] Table 2 Algorithm comparison table

[0273]

[0274] Therefore, compared with the existing similar SVM algorithms, the improved kernel function semantic analysis SVM model based on Bayesian optimization described in this paper not only has a higher classification advantage in network security data detection accuracy, but also has better algorithm robustness in anomaly identification and complex interference environments.

[0275] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0276] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A network security detection method based on improved SVM of text semantics, characterized in that: include: Obtain the text data to be detected; Inputting the text data to be detected into the final detection model to obtain the detection result; The final detection model is constructed as follows: Build an initial detection model based on svm; Obtain cybersecurity-related data; Preprocessing the network security related data to obtain preprocessed data; Performing feature extraction on the preprocessed data to obtain an identification feature value set; Constructing training samples according to the identification feature set; Based on the Gaussian function, the kernel function of the initial detection model is improved to obtain an improved kernel function; Determining an improved detection model according to the improved kernel function; The parameters of the improved detection model are optimized using a Bayesian optimization algorithm to obtain a final detection model.

2. According to claim 1, a network security detection method based on improved SVM of text semantics is characterized in that: The initial detection model is constructed based on SVM, including: Determine the spacing of support vectors; Determine an equivalent constraint model of the first constraint parameter according to the interval first constraint parameter expression and according to the first constraint parameter expression; Obtaining a first dual expression according to the equivalent constraint model through a Lagrangian function; Obtaining an equivalent dual expression of the initial detection model according to the first dual expression; Using the SMO algorithm to solve the equivalent dual expression and determine the soft margin optimization expression; An initial detection model expression is determined according to the soft interval optimization expression.

3. The network security detection method based on improved SVM of text semantics according to claim 1 is characterized in that: The parameter expression of the initial detection model is:

4. The network security detection method based on improved SVM of text semantics according to claim 1 is characterized in that: The preprocessing of the network security related data to obtain preprocessed data includes: Filter the network security related data to obtain filtered data; Performing Chinese word segmentation on the filtered data to obtain word segmentation data; The word segmentation data is processed to remove stop words to obtain preprocessed data.

5. The network security detection method based on improved SVM of text semantics according to claim 1 is characterized in that: Feature extraction is performed on the preprocessed data to obtain an identification feature value set, including: Determining the types of extracted features by natural language processing technology, wherein the types of feature extraction include: word frequency feature, inverse document frequency, TF-IDF, vocabulary density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency depth; Feature extraction is performed on the preprocessed data according to the feature extraction type to obtain an identification feature value set.

6. The network security detection method based on improved SVM of text semantics according to claim 5 is characterized in that: Constructing a training sample according to the recognition feature set includes: Determine preset feature types as training features; Outliers are determined based on the training features and removed to obtain training samples.

7. The network security detection method based on improved SVM of text semantics according to claim 5 is characterized in that: The expression of the improved kernel function is:

8. The network security detection method based on improved SVM of text semantics according to claim 7 is characterized in that: The expression of the improved detection model is:

9. The network security detection method based on improved SVM of text semantics according to claim 7 is characterized in that: The expression of the final detection model is:

Images