An improved SVM-based network security detection method based on text semantics

Abstract

The application provides an improved SVM network security detection method based on text semantics and relates to the technical field of network security. The method comprises the following steps: obtaining text data to be detected; inputting the text data to be detected into a final detection model to obtain a detection result; the final detection model is constructed by the following method: constructing an initial detection model based on SVM; obtaining network security related data; preprocessing the network security related data to obtain preprocessed data; extracting features from the preprocessed data to obtain a set of recognition feature values; constructing training samples according to the set of recognition features; improving the kernel function of the initial detection model based on a Gaussian function to obtain an improved kernel function; determining an improved detection model according to the improved kernel function; and optimizing the parameters of the improved detection model by using a Bayesian optimization algorithm to obtain the final detection model. The application solves the problem of low efficiency of the intelligent recognition method for network security data in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security detection method based on improved SVM of text semantics. BACKGROUND

[0002] In recent years, with the rapid progress of artificial intelligence technology, the ability of programs to mimic human behavior in the field of network security continues to improve. Today, some attackers have begun to use advanced artificial intelligence methods to collect various types of data, including information from public websites, social networks, emails, etc. Through in-depth analysis of these large amounts of text data, they can extract users' personal information such as date of birth, gender, residence, phone number, and email address, and then conduct security attacks in the aspect of semantic understanding. As the complexity of network attacks and security threats continues to increase, traditional network security detection methods are not up to the task when facing advanced attacks. In order to improve the intelligent level of network security detection, the combination of semantic analysis technology and support vector machine (SVM) provides potential for a new network security detection method. The network security intelligent identification method based on semantic analysis and improved SVM can effectively deal with phishing attacks, malware, social engineering attacks, and other threats by deeply understanding the semantic information and feature patterns behind the data.

[0003] The network security data intelligent identification research based on traditional machine learning and deep learning involves methods including Naive Bayes (NB), Neural Network (NN), Decision Tree (DT), k-Nearest Neighbor (KNN) and Adaptive Boosting (AdaBoost) and the like. The analysis of email, social engineering, data leakage and threat intelligence shows that the accuracy of the decision tree and the nearest neighbor classification method is too low, and the DT, KNN and AdaBoost methods all have significant identification errors. When the Convolutional Neural Networks (CNN) deep learning method is further introduced, the results show that the support vector machine (SVM) has a higher classification accuracy in the detection of several network security data, and the algorithm running time is significantly lower than the CNN method based on deep learning. Although the CNN has excellent performance in classification accuracy, its training process is relatively time-consuming. When the training iteration reaches 41 times, the CNN can achieve the best test performance (the accuracy can reach 99.53%), but the time required for its algorithm to converge to the saturation state is longer. For network security data detection and intelligent identification with high real-time requirements, although the accuracy is high, the detection efficiency is significantly reduced, which is difficult to apply to security situation awareness. In addition, since the CNN is a "black box" model, its identification performance under the adversarial sample cannot be guaranteed, and when the gradient descent method is used, it may fall into a local minimum value instead of a global minimum value. The information loss in the pooling process may also lead to a decrease in the relevance between the local and the whole, thereby affecting its application effect in network security data detection. SUMMARY

[0004] In order to overcome the shortcomings of the prior art, the purpose of the present application is to provide an improved SVM network security detection method based on text semantics, which solves the problem of low efficiency of the network security data intelligent identification method in the prior art.

[0005] To achieve the above purpose, the present application provides the following scheme:

[0006] An improved SVM network security detection method based on text semantics, comprising:

[0007] acquiring text data to be detected;

[0008] inputting the text data to be detected into a final detection model to obtain a detection result;

[0009] The construction method of the final detection model is:

[0010] constructing an initial detection model based on SVM;

[0011] obtaining network security related data;

[0012] preprocessing the network security related data to obtain preprocessed data;

[0013] performing feature extraction on the preprocessed data to obtain a set of identification feature values;

[0014] constructing a training sample according to the set of identification features;

[0015] improving a kernel function of the initial detection model based on a Gaussian function to obtain an improved kernel function;

[0016] determining an improved detection model according to the improved kernel function;

[0017] optimizing parameters of the improved detection model using a Bayesian optimization algorithm to obtain a final detection model.

[0018] Preferably, the svm-based construction of the initial detection model comprises:

[0019] determining a margin of support vectors;

[0020] expressing the margin according to a first constraint parameter expression and determining an equivalent constraint model of the first constraint parameter according to the first constraint parameter expression;

[0021] obtaining a first dual expression according to the equivalent constraint model through a Lagrange function;

[0022] obtaining an equivalent dual expression of the initial detection model according to the first dual expression;

[0023] solving the equivalent dual expression using an SMO algorithm and determining a soft margin optimization expression;

[0024] determining an initial detection model expression according to the soft margin optimization expression.

[0025] Preferably, the parameter expression of the initial detection model is:

[0026]

[0027] Preferably, the preprocessing of the network security related data to obtain preprocessed data comprises:

[0028] performing data filtering on the network security related data to obtain filtered data;

[0029] performing Chinese word segmentation on the filtered data to obtain segmented data;

[0030] The stop word removal processing is performed on the segmented data to obtain preprocessed data.

[0031] Preferably, feature extraction is performed on the preprocessed data to obtain a set of recognition feature values, including:

[0032] The feature extraction types are determined through natural language processing technology, wherein the feature extraction types include word frequency feature, inverse document frequency, TF-IDF, lexical density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency relationship depth.

[0033] The preprocessed data is subjected to feature extraction according to the feature extraction types respectively to obtain the set of recognition feature values.

[0034] Preferably, a training sample is constructed according to the set of recognition features, including:

[0035] A preset feature type is determined as a training feature.

[0036] An abnormal point is determined and removed according to the training feature to obtain the training sample.

[0037] Preferably, the expression of the improved kernel function is:

[0038]

[0039] Preferably, the expression of the improved detection model is:

[0040]

[0041] Preferably, the expression of the final detection model is:

[0042]

[0043] The present application discloses the following technical effects:

[0044] The application provides a network security detection method based on improved SVM of text semantics, and comprises the following steps: obtaining text data to be detected; inputting the text data to be detected into a final detection model to obtain a detection result; the final detection model is constructed by the following method: constructing an initial detection model based on SVM; obtaining network security related data; pre-processing the network security related data to obtain pre-processed data; extracting features from the pre-processed data to obtain a set of identification characteristic values; constructing a training sample according to the set of identification characteristics; improving a kernel function of the initial detection model based on a Gaussian function to obtain an improved kernel function; determining an improved detection model according to the improved kernel function; and optimizing parameters of the improved detection model by using a Bayesian optimization algorithm to obtain the final detection model. The intelligent identification of the improved kernel function SVM based on semantic analysis can significantly improve the detection accuracy and response speed of network attacks on complex threats such as emails, social engineering, data leakage, threat intelligence (network security data), and is suitable for security protection of large network environments such as enterprises and governments. In future applications, this intelligent identification method can be combined with real-time monitoring systems and automatic emergency response mechanisms to achieve more efficient network security protection. Meanwhile, the method can also be popularized to other fields such as financial risk control and information leakage protection. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0046] Figure 1 A network security detection method based on improved SVM of text semantics is provided for the embodiments of the present application;

[0047] Figure 2 A network security data different kernel function classification identification precision comparison graph is provided for the embodiments of the present application;

[0048] Figure 3 A network security detection data anomaly point observation schematic diagram is provided for the embodiments of the present application;

[0049] Figure 4 An improved kernel function comparison curve schematic diagram is provided for the embodiments of the present application;

[0050] Figure 5 An improved kernel function change curve schematic diagram under different parameters is provided for the embodiments of the present application, wherein, Figure 5 (a) is a first schematic diagram, Figure 5(b) is a second schematic diagram;

[0051] Figure 6 A different kernel function ROC curve comparison chart provided for the embodiment of the present application;

[0052] Figure 7 A Bayesian optimization SVM objective function and iteration curve chart provided for the embodiment of the present application;

[0053] Figure 8 A Bayesian optimization SVM objective function model schematic diagram provided for the embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0055] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0056] As Figure 1 shown, the present application provides an improved SVM network security detection method based on text semantics, comprising:

[0057] Step 100: obtaining text data to be detected;

[0058] Step 200: inputting the text data to be detected into a final detection model to obtain a detection result;

[0059] The construction method of the final detection model is:

[0060] Step 201: constructing an initial detection model based on svm;

[0061] Step 202: obtaining network security related data;

[0062] Step 203: preprocessing the network security related data to obtain preprocessed data;

[0063] Step 204: performing feature extraction on the preprocessed data to obtain a set of recognition feature values;

[0064] Step 205: constructing training samples according to the recognition feature set;

[0065] Step 206: Based on the Gaussian function, the kernel function of the initial detection model is improved to obtain an improved kernel function;

[0066] Step 207: An improved detection model is determined according to the improved kernel function.

[0067] Step 208: A Bayesian optimization algorithm is used to optimize the parameters of the improved detection model to obtain a final detection model.

[0068] Specifically, semantic analysis extracts hidden malicious intent by analyzing text semantic features in emails, social engineering, data breaches, and threat intelligence. For example, by understanding the sentence structure, vocabulary meaning, and contextual relationships in emails, it can identify hidden attack methods in phishing emails. This semantic-level recognition goes beyond traditional methods that rely on character similarity and simple feature matching, and has a significant advantage, especially in the face of advanced threats.

[0069] Semantic analysis is an important field in artificial intelligence and the core of natural language processing technology, involving multiple disciplines such as machine learning, cognitive linguistics, linguistics, and computational linguistics. The progress of semantic analysis technology has driven the rapid development of other natural language processing tasks. In recent years, with the rapid development of deep learning technology, semantic analysis has made significant achievements in various fields of artificial intelligence. For example, in autonomous driving, speech recognition, Go games, image recognition, and other aspects, there have been important breakthroughs.

[0070] Semantic analysis recognizes and understands the semantic information contained in text through various means, and the in-depth understanding of language can be attributed to semantic analysis. Generally, text is composed of words, sentences, and paragraphs. Semantic analysis at the word level focuses on how to obtain or distinguish the meaning of words. In short, semantic analysis automatically parses various languages through the establishment of effective models and systems to fully understand the meaning conveyed by the text.

[0071] With the rapid development of Internet technology, network security incidents occur frequently, and network attack methods and threats are constantly escalating. Semantic analysis technology is a technology that understands and analyzes the meaning of words and sentences in text to identify language patterns, contextual relationships, and information meaning. It goes beyond surface-level word matching and delves into the underlying meaning of words, sentences, and paragraphs to determine the intent and meaning behind the language. Semantic analysis is widely used in network security, especially in email security, social engineering attack protection, and malware detection. By analyzing language patterns in emails, files, or logs, semantic analysis can identify phishing attacks, fraudulent attempts, or sensitive information leaks. Based on the advanced semantic features extracted by semantic analysis, the input dimension can be effectively reduced, and the efficiency of SVM can be enhanced.

[0072] The application of semantic analysis technology in email network security detection is no longer limited to matching malicious samples. Instead, by deeply analyzing the semantic features in emails, especially the semantic relationships between characters, traditional character similarity detection is transformed into more flexible and in-depth "semantic level" recognition. In addition, semantic analysis plays an important role in preventing social engineering attacks. It can detect malicious intent and identify phishing attacks by analyzing the content of social media and instant messaging. Data breach detection also benefits from semantic analysis, which identifies sensitive information leaks by analyzing language patterns in enterprise files, databases, and emails, and detects abnormal usage behavior by analyzing encrypted or fragmented data in context. Identity verification and account security also rely on semantic analysis, which can identify user behavior patterns and language habits to detect account takeover attacks (ATO) and trigger additional security verification. In the field of threat intelligence, semantic analysis is crucial in identifying emerging threats by analyzing discussions on network security forums, hacker forums, social networks, and the dark web. In malware detection, semantic analysis identifies software behavior patterns rather than relying solely on code signatures, allowing it to detect potential threats even when code is obfuscated by analyzing function call sequences and memory operations. Semantic analysis can also be used in network intrusion detection to analyze communication content in network traffic, combined with deep packet inspection technology (DPI) to detect abnormal communications at the protocol or application layer, thereby identifying potential intrusions. In addition, in log analysis and anomaly detection, semantic analysis can quickly extract suspicious behavior from large amounts of logs to identify potential attacks and data misuse. In summary, semantic analysis technology has great potential in the field of network security, helping enterprises and organizations intelligently respond to complex network threats.

[0073] Further, the svm-based initial detection model is constructed, comprising:

[0074] determining the interval of support vectors;

[0075] expressing the first constraint parameter according to the interval and determining the equivalent constraint model of the first constraint parameter according to the first constraint parameter expression;

[0076] obtaining a first dual expression according to the equivalent constraint model through a Lagrange function;

[0077] obtaining an equivalent dual expression of the initial detection model according to the first dual expression;

[0078] solving the equivalent dual expression by using an SMO algorithm and determining a soft interval optimization expression;

[0079] determining an initial detection model expression according to the soft interval optimization expression.

[0080] Specifically, as a common supervised machine learning method, SVM has been widely used in classification statistics and regression analysis. SVM realizes the mapping of low-dimensional vectors to high-dimensional vectors by establishing a maximum interval hyperplane in the spatial domain, and differentiates data of different categories. In the intelligent identification and classification of network security data, it also has broad application prospects.

[0081] Suppose that the sample x of network security data satisfies the following linear equation in the spatial domain:

[0082] w T x+b=0 (1)

[0083] In the formula, w and b are the normal vector and sample space displacement, respectively. The distance of any point in the sample space to the hyperplane (w, b) can be expressed as:

[0084]

[0085] Where L is the distance of any point in space to the hyperplane (w, b).

[0086] Obviously, the interval of support vectors composed of the sample training points closest to the hyperplane on both sides is When the interval of support vectors is maximum, the optimal classification effect can be obtained. Therefore, when finding the maximum interval, the constraint parameter needs to satisfy the following constraint condition:

[0087]

[0088] γ represents the interval of support vectors, y i represents the distance of each sample point on one side of the hyperplane, and "s.t." is the abbreviation of "subject to", which means "under the condition of" or "satisfy". x i is a sample point.

[0089] Further simplifying equation (3) can obtain its equivalent constraint model as:

[0090]

[0091] According to the Lagrange multiplier method of convex quadratic programming, equation (4) can be transformed into the following dual problem through the Lagrange function:

[0092]

[0093] The Lagrange multiplier is λ i (i = 1, 2, 3, … m), and the partial derivatives of the Lagrange function with respect to parameters w and b are calculated and set to zero to obtain:

[0094]

[0095] Further simplifying and calculating equation (6) gives,

[0096]

[0097] Substituting equation (7) into equation (5) gives:

[0098]

[0099] Combining the constraint condition in equation (4) gives the equivalent dual problem of the SVM model as:

[0100]

[0101] The corresponding KKT condition is:

[0102]

[0103] To avoid the large amount of calculation caused by solving equation (9) by the conventional quadratic programming algorithm, the SMO algorithm can be used to select two variables λ g and λ h corresponding to the selected two training samples, respectively, and fix the other parameters, and through the iterative updating method until convergence.

[0104] λ g y g + λ h y h = c λ g ≥ 0, λ h ≥ 0 (11)

[0105] In equation (11), a constant is introduced:

[0106]

[0107] Since for any support vector (x s , y s ) satisfies y s f(x s ) = 1, that is:

[0108]

[0109] y s is the label of the s-th support vector.

[0110] Therefore, the offset term b can be further calculated, and considering the robustness of the calculation, the average value of the SVM solution is generally used:

[0111]

[0112] where S denotes the index set of support vectors, i.e.,

[0113] S = {i | λ i > 0, i = 1, 2,..., m} (15)

[0114] To further extend the linear separable to linear inseparable case in SVM, some SVM samples that do not satisfy the constraints are considered, and soft margin optimization is generally used:

[0115] y i (w T x i +b)≥1 (16)

[0116] To minimize the number of support vectors that do not satisfy the constraint condition and maximize the interval between hyperplanes, a slack variable ζ i is generally introduced, which satisfies:

[0117] y i (w T x i +b)+ζ i ≥1 (17)

[0118] Combined with the solution of quadratic programming problem by Lagrange multiplier method, the constraint condition of soft margin optimization is obtained as:

[0119]

[0120] Combined with the first Lagrange operator λ i and the second Lagrange operator μ i and the constant C, the Lagrange function is obtained as:

[0121]

[0122] The constraint condition is: s.t. λ i ≥ 0, μ i ≥ 0 (20)

[0123] To obtain the extreme value of the Lagrange function, the partial derivatives of Γ(w, b, ζ, λ, μ) with respect to parameters w, b and ζ are calculated and set to 0, i.e.:

[0124]

[0125] Substituting equation (21) into equation (18) can further calculate the dual problem in soft margin optimization:

[0126]

[0127] The KKT condition (Karush-Kuhn-Tucker) is:

[0128]

[0129] The SMO optimization is used to solve the Lagrange function, and the Lagrange multiplier λ is obtained i . Substituting formula (21) and formula (16) into formula (22), the parameter expression of the initial detection model of the SVM model parameter is obtained:

[0130]

[0131] In the formula, S is still the subscript set of the support vector S={i|λ i >0, i=1, 2,..., m}. According to the calculation result of the model parameter, the optimal hyperplane (w T x+b)=0 is obtained.

[0132] For most cases, due to the nonlinear and multi-source characteristics of network security data, it is generally difficult to achieve complete linear separability of training sample data. Assuming that the sample point x is mapped to a vector in a high-dimensional space φ(x), the separation hyperplane in the nonlinear SVM can be expressed as:

[0133] f(x)=w T φ(x)+b (25)

[0134] The corresponding constraint condition can be expressed as:

[0135]

[0136] Similarly, when the SMO solving algorithm is used, the dual problem of the constraint condition of the nonlinear support vector machine can be converted to:

[0137]

[0138] Assuming that the inner product after the mapping of the high-dimensional feature space can be expressed as:

[0139] k(x i ,x j )=<φ(x i ),φ(x j )>=φ(x i ) T ·φ(x j ) (28)

[0140] In which k(x) is the support vector machine kernel function, substituting formula (28) into (27), the constraint condition can be simplified as:

[0141]

[0142] Similarly, the Lagrange multiplier method is used to calculate:

[0143]

[0144] Obviously, selecting an appropriate kernel function is the key to solving the problem of linear non-separable or obtaining a non-linear optimal hyperplane. Since the kernel matrix is semi-positive definite, a corresponding reproducing Hilbert feature space can always be found. A general linear kernel function can be expressed as:

[0145] k(x i ,x j )=x i T x j (32)

[0146] The polynomial kernel function can be expressed as:

[0147] k(x i ,x j )=(x i T x j ) d (33)

[0148] The parameter d is the order, which determines the degree of nonlinearity of the kernel function.

[0149] The Gaussian kernel function can be expressed as:

[0150]

[0151] To optimize the nonlinear classification effect of SVM, a customized kernel function method can also be used to find the optimal algorithm for intelligent classification accuracy and efficiency of the network security data training set, so that SVM can better handle high-dimensional semantic feature space and improve classification performance. But first, we need to get the optimal training data set or feature value space. So that SVM can better handle high-dimensional semantic feature space and improve classification performance.

[0152] Further, the preprocessing of the network security related data to obtain the preprocessed data comprises:

[0153] Filtering the network security related data to obtain filtered data;

[0154] Chinese word segmentation of the filtered data to obtain segmented data;

[0155] Removing stop words from the segmented data to obtain the preprocessed data.

[0156] Specifically, in the context of network security related to semantic analysis, this paper collects data directly related to the field of network security in various ways to build a network security intelligent detection platform and improve the accuracy of data recognition. These methods include scraping data from the Internet, manually entering data by experimenters, and importing data from specialized network security experiment platforms. In data collection, we pay special attention to filtering data sources highly related to network security threats to ensure that the collected data has high relevance and practicality.

[0157] In the context of rapid development of information technology today, the complexity of network attacks is increasing, so the processing and analysis of network security data are particularly important. Especially in the processing of large amounts of network traffic, mail, log data, etc., how to effectively improve the usability and processing quality of data has become a key problem in research and application. This paper discusses how to improve the quality of network security data through semantic analysis in data preprocessing through experimental data collection. Data preprocessing includes data filtering, feature extraction, and removing redundant information, etc. steps, aiming to convert raw unstructured text data into a format suitable for computer processing and analysis to improve the accuracy of threat detection.

[0158] Data filtering. In the early stage of network security data processing, the first task is data filtering. A large amount of pictures, videos, hyperlinks and non-text symbols in the original data are both noise and interference for text analysis. Filtering out these irrelevant content not only cleans the data, but also improves the efficiency and accuracy of subsequent semantic analysis. Through careful filtering, we ensure that the data entering the analysis process is pure and high-quality, laying the foundation for detecting malicious traffic, phishing emails and other attack behaviors.

[0159] Chinese word segmentation. As the core step of data preprocessing, Chinese word segmentation directly affects the effectiveness of subsequent label generation and text analysis. Unlike English, which is separated by white space characters, Chinese word segmentation faces challenges such as lack of clear separators, strong ambiguity of vocabulary, rich synonyms, and complex grammatical structures. This paper adopts the Jieba word segmentation technology, which combines rule-based and statistical methods, to effectively solve the problem of Chinese word segmentation. Jieba word segmentation improves scanning efficiency by constructing a triangular tree structure to scan the word graph, and uses a directed acyclic graph (DAG) to divide all possible word formation cases in detail. Finally, it determines the maximum probability path through dynamic programming to achieve accurate word segmentation. For new words outside the dictionary, Jieba word segmentation also introduces a Hidden Markov Model (HMM) based on Chinese characters and the Viterbi algorithm to further improve the accuracy and flexibility of word segmentation. In addition, Jieba word segmentation supports user-defined dictionaries, which greatly improves the adaptability and accuracy of the word segmentation system in the field of network security semantic analysis. By introducing specific proper nouns in the network security field, the incorrect segmentation of network security professional terms can be effectively avoided, ensuring the accuracy and integrity of the network security segmentation results.

[0160] Removing stop words. Removing stop words is another important step in text preprocessing. Frequent conjunctions, prepositions, pronouns, and other words in text, although essential for language expression, are not very helpful for capturing the core meaning of the text and conducting in-depth analysis. By removing these stop words, data noise can be further reduced, highlighting the key information in the text data. After completing the basic text preprocessing, semantic-based feature value extraction is performed.

[0161] Further, feature extraction is performed on the preprocessed data to obtain a set of recognition feature values, including:

[0162] The type of feature extraction is determined by natural language processing technology, including word frequency, inverse document frequency, TF-IDF, lexical density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency relationship depth.

[0163] According to the feature extraction type, feature extraction is performed on the preprocessed data to obtain a set of recognition feature values.

[0164] Specifically, feature extraction in semantic analysis is the core step of preprocessing, directly affecting the effectiveness of subsequent classification and attack detection. Unlike traditional character or pattern matching, the language structure in cyber attacks is complex, facing challenges such as ambiguity, synonyms, and specific domain terminology. By extracting these 10 semantic-based cyber security identification feature values, a normalized feature vector is constructed. We can accurately extract the semantic features in the text, further improving the accuracy of network security detection. These feature values not only reveal important information in network data, but also provide a solid foundation for subsequent classification and detection. Term Frequency (TF) reflects the frequency of attack-related keywords. For example, common words in phishing attacks (such as "urgent", "account", etc.) frequently appear in text, which can be detected by the term frequency feature to detect potential phishing emails or social engineering attacks. Inverse Document Frequency (IDF) reflects the rarity of keywords in the entire dataset. Network attacks often use specific terms, and IDF helps identify keywords that are not common in most normal traffic but frequently appear in malicious traffic, suitable for detecting malware, viruses, or malicious instructions. TF-IDF combines term frequency and inverse document frequency, reflecting the importance of a word in a single document. TF-IDF can help prioritize key terms in specific attacks, improving the accuracy of identifying malicious emails, malicious web pages. Lexical Density reflects the complexity of the text, measuring the ratio of function words to content words in the text. Many phishing emails or malicious web pages use simple language, with low lexical density, which can be detected by this feature to detect attacks with unusually simple language and hidden intentions. Syntactic Complexity reflects the syntactic structure complexity of the text. Advanced Persistent Threats (APTs) or complex attacks may use highly complex syntactic structures to hide their intentions, and syntactic complexity helps identify these advanced attacks. Sentiment Polarity Score reflects the sentiment tendency of the text. Phishing attacks, fraudulent emails, etc. often have strong negative or positive sentiment tendencies (such as threats, urgency), and sentiment polarity scores can help identify attacks with emotional manipulation intentions in language. Keyword Density reflects the density of specific attack-related keywords. Many malicious emails and cyber attacks contain specific terms such as "immediate action", "security warning", etc., and keyword density can reveal the abnormally high frequency of these sensitive words to detect phishing attacks or malicious marketing. Context Similarity reflects the relevance of keywords to their context. Attackers often use keywords that are unreasonable in normal context, or disguise information to make attacks appear normal. Context similarity helps detect mismatched word combinations to discover potential threats.Named Entity Recognition (NER) reflects whether the attack target involves key entities such as personal, company or institution names. In phishing emails or social engineering attacks, there are often disguised famous company names or personal names, and NER can help identify the target objects of these attacks. Dependency Depth reflects the complexity of sentence structure. Malicious attacks sometimes hide attack content through complex sentence structure, and dependency depth can reveal those texts with overly complex or abnormal syntax, which may indicate high-level threats or fake communication content. These feature values not only effectively improve the intelligence and accuracy of attack detection, but also help security analysts understand the language patterns and potential strategies of attacks.

[0165] To obtain the best accuracy of network security data intelligent identification, and considering the nearly Gaussian distribution characteristics of network security detection data, it is necessary to normalize the original network security detection data and select feature values to construct the SVM training sample space. Therefore, the above-mentioned 10 kinds of feature values are considered respectively. In the network security intelligent identification method based on semantic analysis, the extracted feature values can be realized through natural language processing (NLP) technology. The following lists 10 commonly used semantic feature values, each with a corresponding formula or description, to help the system extract useful semantic information from network traffic, emails or texts. These feature values can help the system effectively identify potential attack behaviors in texts in network security detection based on semantic analysis, thereby improving the accuracy of network security intelligent identification.

[0166] (1) Term Frequency (TF-Term Frequency)

[0167] represents the number of times a specific word appears in a document.

[0168]

[0169] where count(tt) is the number of times the word tt appears in the document, and ∑ all words count(ω) is the total number of all word occurrences in the document.

[0170] (2) Inverse Document Frequency (IDF-Inverse Document Frequency)

[0171] measures the importance of a word in the entire corpus. The less frequently a word appears, the higher its IDF value.

[0172]

[0173] where N is the total number of documents, and |{dd∈DD:tt∈dd}| represents the number of times the word tt appears in dd documents and the total number of documents DD.

[0174] (3) TF-IDF

[0175] Combining word frequency and inverse document frequency, used to measure the importance of a word in a document.

[0176] TF-IDF(tt,dd) = TF(tt,dd) × IDF(tt)

[0177] Where TF(tt,dd) is the word frequency of the word in the document dd, and IDF(tt) is the inverse document frequency of the word.

[0178] (4) Lexical Density

[0179] Measures the proportion of function words and content words in a text, used to analyze text complexity.

[0180]

[0181] Where content words are nouns, verbs, adjectives and adverbs, and function words are prepositions, conjunctions, etc.

[0182] (5) Syntactic Complexity

[0183] By analyzing the dependency structure of the sentence, measure the complexity of the syntax.

[0184]

[0185] Where nodes represent the dependency relationship between words or phrases in the sentence.

[0186] (6) Sentiment Polarity Score

[0187] Based on sentiment analysis model, extract the sentiment polarity of the text, the score range is usually [-1,1].

[0188]

[0189] Where positive words and negative words give the corresponding sentiment score. p represents the sentiment polarity score of the text.

[0190] (7) Keyword Density

[0191] Measures the frequency of specific attack-related keywords in the text.

[0192]

[0193] Where count(k) is the number of occurrences of the keyword in the text.

[0194] (8) Context Similarity

[0195] Calculate the similarity between words and context through word vectors (Word2Vec, GloVe, etc.), to detect whether the context of the keyword is abnormal.

[0196]

[0197] where, and are the word vectors of the keyword and context, respectively.

[0198] (9) NER-Named Entity Recognition

[0199] Detect potential attack targets by identifying named entities (such as names, place names, organization names, etc.) in the text.

[0200]

[0201] where, entity type includes names, place names, etc., and count(entity type) is the number of occurrences of each entity type.

[0202] (10) Dependency Depth

[0203] Analyze the dependency structure of the sentence to measure the depth of the syntactic dependency tree, to detect abnormal complex sentence structure.

[0204]

[0205] Dependency Depth: The depth of the dependency relationship of the sentence, representing the length of the longest path from the root node to the deepest leaf node in the syntactic dependency tree. This value reflects the complexity of the sentence structure. Dependency Tree: A tree structure constructed with the center word of the sentence as the root node. Each node in the tree represents a word, and each edge represents the dependency relationship between two words. Syntax analysis organizes sentences through this tree structure. Depth: The depth of the dependency tree, that is, the length of the longest path from the root node to the farthest node. The greater the depth, the more levels the sentence has, and the more complex the structure.

[0206] Further, such as Figure 2As shown, according to the above characteristic value calculation formula, when the above 10 characteristic values are selected as the network security data detection and intelligent identification sample set for training, when linear kernel function, polynomial kernel function and Gaussian (RBF) kernel function are used for SVM classification, and 10-fold cross-validation is used.

[0207] Further, the training sample is constructed according to the identification feature set, including:

[0208] The preset characteristic type is determined as the training feature;

[0209] The abnormal points are determined according to the training feature and are removed to obtain the training sample.

[0210] Specifically, it is observed that when 10 characteristic values are selected to construct a detection classification support vector machine supervised learning model, the classification accuracy is 85% (polynomial kernel), 75% (linear kernel) and 86% (Gaussian kernel). Obviously, when the original data and its characteristic values are directly used as sample space for training and testing, the accuracy of the network security data recognition and differentiation method based on SVM still needs to be improved, and the main reason is that there may be individual abnormal points in the training set. Therefore, the abnormal points in the sample space characteristic value of the SVM training set need to be detected and removed. When the characteristic value frequency feature and the inverse document frequency in the network security data detection normalized data are selected as two training features, the abnormal point distribution and observation results are as shown in Figure 3 , wherein the characteristic value 1 and the characteristic value 2 of the horizontal coordinate and the vertical coordinate represent the word frequency feature and the inverse document frequency in Table 5.2; according to Figure 3 , the support vector can be observed, and the characteristic value abnormality and marginalization distribution caused by the text semantic interference can be observed, and the characteristic value abnormality rate is 5%.

[0211] Further, SVM has limitations in processing high-dimensional data and large-scale data, and needs to be improved by improving the algorithm to improve its efficiency and accuracy. The improved SVM model combined with semantic analysis can improve the classification accuracy by extracting more accurate semantic features.

[0212] In order to investigate the data characteristics of network security data in multiple context semantic environments, it is assumed that the network security data satisfies independent and identical distribution, and the corresponding kernel density function estimation is:

[0213]

[0214] Where K and h are the kernel function and the sliding bandwidth, respectively, and the scaling function K h satisfies:

[0215]

[0216] The Gaussian scaling kernel function can be used:

[0217]

[0218] According to formula (36), the appropriate bandwidth is the key to determine the accuracy of the kernel density estimation, so the integral square error expectation M(h) is used to represent the kernel density estimation error, and the specific expression is:

[0219]

[0220] Here E is used to measure the overall performance of the kernel density estimation.

[0221] Under the weak integral assumption, the asymptotic form of the error expectation M(h) can be expressed as:

[0222]

[0223] Where A1 is a constant term related to the kernel density estimation, and r(K) and m(K) are the quadratic integral term and convolution square term of the kernel function, respectively.

[0224]

[0225] Similarly, to get the extreme value of the asymptotic form A1M(h), the partial derivative can be taken and set to 0, that is:

[0226]

[0227] According to formula (41), the optimal bandwidth can be calculated as:

[0228]

[0229] In actual calculation, if the Gaussian kernel function is selected, the bandwidth parameter h can also be obtained by adaptive method. Similarly, when the email, social engineering, data leakage, threat intelligence and other texts are taken as the research comparison objects, the one-dimensional kernel density estimation curves of several different detection data are calculated by adaptive kernel density function estimation. The detection signal data all show Gaussian distribution characteristics, that is, the data components greater than the detection baseline and less than the detection baseline all show small probability distribution, and the closer to the detection baseline, the greater the distribution probability. Further investigation of the two-dimensional and three-dimensional distribution results of the kernel density function shows that the two-dimensional distribution scatter plots of several detection data show elliptical characteristics, and the data mainly shows symmetric Gaussian distribution along the long axis direction, and there are individual interference points on the upper and lower sides along the short axis direction. Similarly, from the three-dimensional kernel density estimation of the detection data, it can be seen that several detection data all show the trend of higher geometric center distribution density and gradually decreasing surrounding data distribution probability, and the results show that several detection data are Gaussian distribution characteristics.

[0230] Further, according to the aforementioned problems, it is known that the support vector machine kernel function is a bridge from the input feature space to the mapping space, and is also a key to determine the accuracy of network security data detection and classification. The support vector machine kernel function (sigmoid function) based on the conventional multi-layer neural network perception training has the following expression form:

[0231] κ(u,v) = tanh(λ

[0232] u and v are the first feature vector and the second feature vector of the input sample, respectively; λ controls the slope of the function, determines how the similarity between samples affects the kernel value, and a larger value will make the kernel function more sensitive to the change of input; c adjusts the translation of the function, affects the offset of the kernel value, and by adjusting it, the relationship between samples can be changed, such as enhancing or weakening the influence of some features.

[0233] Obviously, by transforming the feature space vector through the hyperbolic tangent activation function, the training of neuron input can be realized, but the initial value of the larger input parameter is also easy to lead to neuron saturation and difficult to achieve the purpose of learning and training. Therefore, this paper proposes a hybrid improved kernel function based on sigmoid function and Gaussian function, in order to improve the sigmoid function to reduce the under-learning state caused by input saturation. The kernel function has the following mathematical form:

[0234]

[0235] Where A and σ are the amplitude excitation and response adjustment parameters of the kernel function, respectively. When A = 1 and σ = 0.5, the comparison curve of the improved kernel function and the conventional sigmoid kernel function is as shown in Figure 4 .

[0236] Specifically, the expression of the improved detection model is:

[0237]

[0238] Specifically, it can be observed that the initial curve of the conventional sigmoid function is smooth, and the gradient is almost 0. After rapid learning and training near 0, the curve tends to be smooth again and reduces the learning and training speed. The initial curve of the improved kernel function has a certain gradient, and the gradient gradually increases in the later period, that is, the improved kernel function realizes the rapid learning and training of the input data set, and there is almost no saturation phenomenon for larger initial value input. Therefore, by virtue of the rapid learning and training characteristics of the hyperbolic tangent function and the Gaussian function, the shape curve of the improved kernel function under different excitation parameters is as shown in Figure 5 . Wherein Figure 5 (a) and Figure 5(b) shows the improved kernel functions for different kernel function excitation amplitudes A and different response adjustment parameters. The legend indicates that the variation of A is 0.01 to 20 and the variation of σ is 10 to 300. Figure 5 (a) σ=10, A=0.01~20; Figure 5 (b)A=1,σ=10~300。

[0239] Observation and comparison show that as the kernel function excitation amplitude A gradually increases, the kernel function curve gradually becomes smoother. When A is greater than 10, the gradient of the kernel function curve gradually converges, and the learning and training speed gradually decreases. Therefore, when conducting SVM feature value sample space training, it is not advisable to select an excessively large amplitude A. Furthermore, according to... Figure 5 As shown in (b) with different response adjustment parameter curves, it can be seen that as σ gradually increases, the improved kernel function curve gradually becomes stable, and the gradient difference of the kernel function curves under different σ also gradually decreases, but there is still a certain saturation training space. However, from the comparison of learning and training speed, it can be seen that a smaller σ is better able to meet the needs of SVM feature space mapping and fast learning and training.

[0240] When further classifying and identifying texts such as emails, social engineering, data breaches, and threat intelligence, the results of calculating the receiver operating characteristic (ROC) curve of the improved kernel function are as follows: Figure 6 As shown in the figure, the results indicate that the text classification accuracy for emails, social engineering, data breaches, and threat intelligence after training with the improved kernel function is 0.9581, while the classification accuracies of the conventional sigmoid kernel function and the Gaussian kernel function are 0.7305 and 0.9191, respectively. This means that the improved kernel function has a higher classification accuracy in cybersecurity data identification. In fact, comparing the ROC curves of the three types of kernel functions also shows that the improved kernel function has a higher hit rate and a lower false alarm rate and misclassification rate. These results also confirm the high feasibility of a hybrid improved kernel function based on the hyperbolic tangent function and the Gaussian function in intelligent identification and classification of cybersecurity data.

[0241] Furthermore, to further optimize the running efficiency and objective function calculation model accuracy of the traditional SVM supervised machine learning algorithm, Bayesian optimization can be used to optimize SVM hyperparameters and improve classification performance. The specific algorithm steps and pseudocode are as follows:

[0242]

[0243]

[0244] Specifically, assuming the training sample space follows a Gaussian distribution, the hyperparameters to be optimized are x = {x1, x2, ..., x...} n}, first, a new sample point x n+1 is obtained by using the optimization acquisition function iteration, then the next objective function value is obtained according to the relationship between the SVM objective function and the hyperparameter, and the data set D integrated after multiple iterations n is obtained, finally, the probability statistical model is updated and the above process is repeated until all hyperparameter values are obtained. The acquisition function can be regarded as the weighted sum of the posterior mean and the posterior variance, that is:

[0245]

[0246] Where μ and σ1 are the posterior mean and the posterior standard deviation, respectively, and β is the weighting constant.

[0247] μ i-1 and σ1 i-1 are the posterior mean and the posterior standard deviation of the previous step, respectively, which are used for iterative calculation of equation (46).

[0248] Specifically, in the process of semantic analysis SVM network security intelligent identification calculation based on Bayesian optimization, the official Statistics and Machine Learning Toolbox of the commercial mathematical software MATLAB produced by the United States MathWorks company is called. The specific Bayesian optimization method is introduced as follows:

[0249] The sample point function is selected to improve the current maximum f(x + ) value probability density value as the next new sampling query point, that is:

[0250] x t+1 =arg max(αPI(x))=arg max(P(f(x))≥(f(x + )+∈)) (47)

[0251] Where P(·) represents probability, ∈ is a small positive number, x + =arg max xi∈x1:t f(x i ), is the next optimization point selected by the current model, and x i is the position of the i-th query point.

[0252] Since the Gaussian process model is assumed in advance, the above formula can be further calculated as:

[0253]

[0254] Where Φ(·) represents the standard normal distribution cumulative distribution function.

[0255] To achieve the minimization of the distance between the target value and the maximum target value, the expected value is calculated as the basis for selecting the next sample query point, i.e.:

[0256]

[0257] where f is the real function, h t+1 is the posterior mean of the surrogate model at step t+1, is the training data.

[0258] Specifically, the expression of the final detection model is:

[0259]

[0260] D i represents the data set of the i-th step. The optimized data set.

[0261] Finally, by minimizing the evaluation query times, the next query sample point is intelligently selected by combining the active Gaussian model Bayesian optimization, and then the estimation of the objective function f(x) of the data point with the highest uncertainty is optimized until the convergence or stopping condition is met, i.e. the Bayesian optimization process is completed.

[0262] In combination with the above Bayesian optimization algorithm, the SMO solver is used to obtain the SVM objective function optimization iteration process as shown in Figure 7 .

[0263] As can be observed, the estimated minimum target value obtained by Bayesian optimization and search is almost consistent with the change of the minimum observed target value. Only in the 5th optimization iteration, the estimated target value jumps, and until the 31st iteration is completed, the minimum optimization target value of about 0.27 is finally obtained.

[0264] Similarly, the Bayesian optimization objective function model is obtained as shown in Figure 8 As can be observed, with the change of the optimization kernel scale and the box constraint, the target observation value and the model gradually converge, and the model mean also presents a nearly Gaussian distribution characteristic in the three-dimensional space.

[0265] The final Bayesian optimization model calculation result is shown in Table 1, and the results show that the optimal observation feasible point iteration number is 31, and after the model optimization, the iteration number only needs to be 22; and the target function values calculated are 0.27 and 0.26852 respectively, i.e. the estimation error is 0.15%.

[0266] In addition, after Bayesian optimization, the target function optimal feasible point estimation time is 29.132s, which is reduced by 6.54s compared with the optimal observation feasible point calculation time 35.672s, and the final SVM classification recognition accuracy is improved from 84.92% to 99.31%.

[0267] Table 1 is a Bayesian optimization SVM model calculation result table, and Table 1 is as follows:

[0268] Table 1 is a Bayesian optimization SVM model calculation result table

[0269]

[0270]

[0271] Other support vector machine algorithms such as linear SVM (LSVM), power SVM (PSVM), twin SVM (R-TWSVM) and Gaussian sample uncertainty SVM (SVM-GSU) detection accuracy results are shown in Table 2. Compared with the Bayesian optimization semantic analysis SVM based on the SMO solver described in this paper, the test accuracy calculation results of the related SVM and its improved model are not higher than 97%. Table 2 is an algorithm comparison table, and Table 2 is as follows:

[0272] Table 2 is an algorithm comparison table

[0273]

[0274] Therefore, compared with the existing similar SVM algorithm, the improved kernel function semantic analysis SVM model based on Bayesian optimization described in this paper not only has higher classification advantage in network security data detection accuracy, but also has better algorithm robustness in abnormal point recognition and complex interference environment.

[0275] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between each embodiment can be referred to each other.

[0276] The principles and implementation modes of the present application are described by applying specific examples in this paper. The above embodiment description is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A network security detection method based on improved SVM using text semantics, characterized in that, include: Obtain the text data to be detected; The text data to be detected is input into the final detection model to obtain the detection result; The final detection model is constructed as follows: An initial detection model was built based on SVM; Obtain cybersecurity-related data; The network security-related data is preprocessed to obtain preprocessed data; Feature extraction is performed on the preprocessed data to obtain a set of identification feature values; Training samples are constructed based on the identified feature set; Based on the Gaussian function, the kernel function of the initial detection model is improved to obtain the improved kernel function; The improved detection model is determined based on the improved kernel function; The parameters of the improved detection model are optimized using the Bayesian optimization algorithm to obtain the final detection model; The expression for the improved kernel function is: ； The expression for the improved detection model is: ； The expression for the final detection model is: ； in, Let A and σ be the first and second feature vectors of the input sample, respectively; let A and σ be the kernel function amplitude excitation and response adjustment parameters, respectively; and let w and b be the normal vector and sample space displacement, respectively. This represents the distance of each sample point to one side of the hyperplane. For Lagrange multipliers, This is the optimized dataset.

2. The network security detection method based on improved SVM with text semantics according to claim 1, characterized in that, The initial detection model built based on SVM includes: Determine the interval of the support vectors; The equivalent constraint model of the first constraint parameter is determined based on the expression of the first constraint parameter and the first constraint parameter expression. The first dual expression is obtained using the Lagrangian function and the equivalent constraint model. The equivalent dual expression of the initial detection model is obtained based on the first dual expression; The SMO algorithm is used to solve the equivalent dual expression and determine the soft-margin optimization expression; The initial detection model expression is determined based on the soft-interval optimization expression.

3. The network security detection method based on improved SVM with text semantics according to claim 1, characterized in that, The parameter expression of the initial detection model is: ； Where w and b are the normal vector and the sample space displacement, respectively. This represents the distance of each sample point to one side of the hyperplane. Let be a Lagrange multiplier, where i = 1, 2, 3, ..., m.

4. The network security detection method based on improved SVM with text semantics according to claim 1, characterized in that, The preprocessing of the network security-related data to obtain preprocessed data includes: The network security-related data is filtered to obtain filtered data; The filtered data is segmented into Chinese words to obtain segmented data; The segmented data is processed to remove stop words, resulting in preprocessed data.

5. A network security detection method based on improved SVM with textual semantics according to claim 1, characterized in that, Feature extraction is performed on the preprocessed data to obtain a set of identification feature values, including: The types of features to be extracted are determined using natural language processing techniques. These types of features include: word frequency features, inverse document frequency, TF-IDF, vocabulary density, syntactic complexity, sentiment polarity score, keyword density, context similarity, named entity recognition, and dependency depth. Based on the types of features extracted, feature extraction is performed on the preprocessed data to obtain a set of identification feature values.

6. A network security detection method based on improved SVM with text semantics according to claim 5, characterized in that, Constructing training samples based on the aforementioned feature set includes: Determine the preset feature types as training features; Anomalies are identified and removed based on the training features to obtain training samples.

Images