Network security protection method and device and electronic equipment

Abstract

The invention provides a network security protection method and device and electronic equipment, and belongs to the technical field of data processing. The method comprises the following steps: inputting equipment flow data into a network threat identification model to obtain a network threat identification result output by the network threat identification model; the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are respectively trained based on a Tri-training algorithm; the main classifier carries out training based on an improved Tri-training algorithm, and when the main classifier is trained based on the improved Tri-training algorithm, training sample selection is carried out based on a prediction result of the first base classifier, a prediction result of the second base classifier and a prediction result of the main classifier; and determining a network security protection strategy based on the network threat identification result. The problem that intelligent and accurate identification and dynamic defense of network threats cannot be realized is solved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a network security protection method, a network security protection device, an electronic device, a machine-readable storage medium and a computer program product. Background Art

[0002] With the acceleration of the digital and intelligent transformation of the power industry, the power network has become an important part of the country's critical information infrastructure. However, the network security situation in the power industry is becoming increasingly severe, with frequent incidents such as hacker attacks, malware, and data leaks, which seriously threaten the stable operation of the power system and the security of power supply. The particularity of the power industry lies in its extremely high requirements for stability and reliability. Any network security incident may lead to power supply interruption, causing huge economic losses and social impact. Traditional network security protection measures in the power industry often rely on static defense rules and manual intervention, which are difficult to effectively respond to evolving network threats.

[0003] That is, existing network security protection methods are unable to achieve intelligent, accurate identification and dynamic defense against network threats. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a network security protection method, device and electronic device to solve the defect that the existing network security protection method cannot realize intelligent identification and dynamic defense of network threats.

[0005] In order to achieve the above object, an embodiment of the present invention provides a network security protection method, including:

[0006] Get device traffic data;

[0007] The device traffic data is input into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier and the prediction results of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification results of the first base classifier, the second base classifier and the main classifier;

[0008] A network security protection strategy is determined based on the network threat identification result.

[0009] Optionally, the main classifier of the network threat identification model is trained by the following steps:

[0010] Get the original training set;

[0011] Performing data preprocessing on all sample device flow data of the original training set to obtain a target training set;

[0012] Repeat the following steps until the preset end condition is reached:

[0013] Create three different sub-training sets from the target training set by bootstrapping;

[0014] Using the three sub-training sets to train the first base classifier, the second base classifier and the main classifier in a one-to-one training manner;

[0015] Using the first base classifier and the second base classifier to respectively predict the unlabeled sample device flow data in the main classifier, to obtain a first prediction result output by the first base classifier and a second prediction result output by the second base classifier;

[0016] Selecting training samples for a sub-training set of the main classifier based on the first prediction result, the second prediction result, and a third prediction result of the main classifier on unlabeled sample device traffic data;

[0017] The first base classifier, the second base classifier and the main classifier are retrained based on the updated three sub-training sets.

[0018] Optionally, the selecting training samples for the sub-training set of the main classifier based on the first prediction result, the second prediction result and the third prediction result of the main classifier on the unlabeled sample device traffic data includes:

[0019] When the first prediction result, the second prediction result and the third prediction result are all the same, marking the unlabeled sample device flow data based on the third prediction result, and adding the labeled sample device flow data to the sub-training set of the main classifier;

[0020] In the case where the first prediction result and the second prediction result are the same, the first prediction result and the second prediction result are different from the third prediction result respectively, and the prediction confidence of the third prediction result is higher than the prediction confidence of the first prediction result and the prediction confidence of the second prediction result respectively, abandoning adding the sample device traffic marked by the first prediction result or the second prediction result to the sub-training set of the main classifier;

[0021] When the first prediction result, the second prediction result and the third prediction result are all different, the unlabeled sample device traffic data in the main classifier is deleted.

[0022] Optionally, the data preprocessing of all sample device flow data of the original training set to obtain a target training set includes:

[0023] At least one operation of data cleaning, data conversion, data standardization and data normalization is performed on all sample device flow data of the original training set to obtain a target training set.

[0024] Optionally, after the step of determining a network security protection strategy based on the network threat identification result, the step further includes:

[0025] Determining a false positive rate or a false negative rate for the device flow data;

[0026] When the false alarm rate or the missed alarm rate is greater than a set threshold, model parameters of at least one model among the first base classifier, the second base classifier and the main classifier are adjusted.

[0027] Optionally, determining a network security protection strategy based on the network threat identification result includes:

[0028] Determine the network security protection policy corresponding to the network threat identification result based on the policy mapping relationship; wherein the policy mapping relationship includes network security protection policies corresponding to different network threat identification results, and the network security protection policy includes at least two of the access control policy, intrusion prevention policy, and data encryption policy.

[0029] On the other hand, an embodiment of the present invention further provides a network security protection device, including:

[0030] Acquisition module, used to obtain device flow data;

[0031] A prediction module, used for inputting the device traffic data into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction result of the first base classifier, the prediction result of the second base classifier and the prediction result of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification result of the first base classifier, the identification result of the second base classifier and the identification result of the main classifier;

[0032] A determination module is used to determine a network security protection strategy based on the network threat identification result.

[0033] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned network security protection method when executing the program.

[0034] On the other hand, the present invention also provides a machine-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned network security protection method is implemented.

[0035] On the other hand, the present invention also provides a computer program product, including a computer program, which implements the above-mentioned network security protection method when executed by a processor.

[0036] Through the above technical solution, the embodiment of the present invention identifies network threats to device traffic data based on the network threat identification model constructed by the first base classifier, the second base classifier and the main classifier. The main classifier selects training samples based on the prediction results of the first base classifier, the second base classifier and the main classifier during training based on the improved Tri-training algorithm, solving the problems of the original Tri-training algorithm that the sample mislabeling introduces noise and the decision-making method may affect the accuracy of the classification results. Therefore, the embodiment of the present invention dynamically analyzes the device traffic data based on the improved Tri-training algorithm (adaptive learning algorithm), and adjusts the network security protection strategy according to the network threat identification results, so as to realize intelligent, accurate identification and dynamic defense of network threats.

[0037] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0039] Figure 1 This is one of the flow charts of the network security protection method provided by the present invention;

[0040] Figure 2 This is the second flow chart of the network security protection method provided by the present invention;

[0041] Figure 3 It is a structural schematic diagram of the network security protection device provided by the present invention;

[0042] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0043] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0044] Method Embodiment

[0045] Please refer to Figure 1 , an embodiment of the present invention provides a network security protection method, including:

[0046] Step 100: Obtain device flow data.

[0047] The electronic device obtains device flow data, wherein the device flow data may include flow, IP address, CPU load, and communication bandwidth of the power equipment in the power industry.

[0048] Step 200: input the device traffic data into a network threat identification model to obtain a network threat identification result output by the network threat identification model.

[0049] The electronic device inputs the device traffic data into the network threat identification model to obtain the network threat identification result output by the network threat identification model. The network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier. The first base classifier, the second base classifier and the main classifier can select three classification algorithms with large differences, for example, the first base classifier selects the random forest algorithm (Random Forest, RF), the second base classifier selects the decision tree algorithm (Decision Tree, DT) and the main classifier selects the naive Bayes algorithm (NaivaBayes, NB).

[0050] The main purpose of training the network threat identification model is to select a suitable adaptive learning algorithm from the sub-dataset obtained from the original data set, and use the known device traffic data and normal behavior data to train the model. During the training process, the model will learn and identify the difference between normal behavior patterns and abnormal behavior patterns. With the increase of training data and the iterative optimization of the model, the recognition accuracy of the model will continue to improve, but the model is not static, but can be dynamically adjusted according to new network data and threat intelligence. When the network environment changes or new threats emerge, the system will retrain or fine-tune the model to adapt to these changes. Since network security incidents in the power industry may contain a large amount of unlabeled data, and relatively little accurately labeled data, this makes the Tri-training algorithm a suitable choice for adaptive learning algorithms. Based on this, the first base classifier and the second base classifier are trained based on the Tri-training algorithm respectively. Through this algorithm, unlabeled data can be more effectively utilized to improve the accuracy and real-time performance of network threat detection. In the embodiment of the present invention, the main classifier is trained based on the improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier, and the prediction results of the main classifier when training based on the improved Tri-training algorithm. The training samples of the main classifier are determined by combining the prediction results of the three classifiers to solve the problems of the original Tri-training algorithm that the sample mislabeling introduces noise and the decision-making method may lead to the accuracy of the classification results. The network threat identification result is obtained by calculating the weighted average of the identification results of the first base classifier, the second base classifier, and the main classifier. At the same time, in the final decision-making stage, different weighted values ​​are assigned to each classifier according to the strength of the classifier's learning ability to improve the accuracy of the decision.

[0051] Step 300: Determine a network security protection strategy based on the network threat identification result.

[0052] Specifically, the determination of the network security protection strategy based on the network threat identification result includes: determining the network security protection strategy corresponding to the network threat identification result based on the strategy mapping relationship. For example, when the electronic device detects that the network threat identification result is a network attack behavior, it automatically generates targeted defense strategies according to different strategy types in the network security protection strategy library, including but not limited to IP blocking, traffic speed limiting, content filtering, etc., and is responsible for deploying the generated strategies to firewalls, intrusion detection / prevention systems (IDS / IPS), security gateways and other security devices to achieve real-time protection and resist network attack behaviors. For example, pre-define a variety of network security protection strategies to provide basic defense measures for different types of attacks. According to the threat assessment results, select or combine the optimal defense strategy from a variety of network security protection strategies, and adjust the firewall rules, intrusion detection system parameters, etc. in real time. Through the feedback of execution and the actual results of network security events, the effectiveness of the strategy is evaluated, and the strategy generation algorithm is further optimized.

[0053] The policy mapping relationship includes network security protection policies corresponding to different network threat identification results. The network security protection policies include at least two of access control policies, intrusion prevention policies, and data encryption policies. In one embodiment, the network security protection policies include access control policies, intrusion prevention policies, and data encryption policies.

[0054] For example, if the network threat identification result is an IP address anomaly, it corresponds to the access control policy. If an IP address anomaly is found, such as an unauthorized IP address accessing sensitive information in the system, immediately enable the access control policy in the network security protection policy library, focus on monitoring or blocking the unauthorized IP address, and verify whether the system's password mechanism complies with the strong password policy and whether there is a risk of password brute force cracking. At the same time, focus on monitoring and analyzing the IP address, verify the device address with the same source as the source IP address, and confirm whether the source of the IP address is a normal unauthorized business. If so, report to the security administrator to lift the ban on the IP address, add it to the whitelist, and resume normal business operations; if not, add the IP address to the blacklist and no longer allow the IP address to access the system.

[0055] For example, if the network threat identification result is a Trojan virus attack, the corresponding intrusion prevention strategy is used. If a Trojan virus attack is found, the intrusion prevention strategy can deploy firewalls at key nodes of the power network to prevent illegal access from external networks and the spread of Trojan viruses. Firewalls can block incoming traffic and block any unauthorized content, thereby preventing unauthorized access. Alternatively, the intrusion prevention strategy can use antivirus software, which can be installed and regularly updated to detect and remove Trojan viruses in the system. Antivirus software can automatically identify Trojan virus data and automatically isolate or delete these viruses.

[0056] For example, if the network threat identification result is data eavesdropping, the corresponding data encryption policy will be used. If data eavesdropping is found, the data encryption policy can be used for storage encryption or encryption using a strong encryption algorithm. Storage encryption: Encrypt sensitive data stored in the power network to ensure that even if the data is stolen, it cannot be easily interpreted by unauthorized persons. Encrypt with a strong encryption algorithm: Select a proven strong encryption algorithm, such as AES (Advanced Encryption Standard), to improve data security.

[0057] The embodiment of the present invention identifies network threats on device traffic data based on a network threat identification model constructed based on the first base classifier, the second base classifier, and the main classifier. The main classifier selects training samples based on the prediction results of the first base classifier, the second base classifier, and the main classifier during training based on the improved Tri-training algorithm, solving the problems of the original Tri-training algorithm that the wrong labeling of samples introduces noise and the decision-making method may affect the accuracy of the classification results. Therefore, the embodiment of the present invention dynamically analyzes the device traffic data based on the improved Tri-training algorithm (adaptive learning algorithm), and adjusts the network security protection strategy according to the network threat identification results, so as to realize intelligent, accurate identification and dynamic defense of network threats.

[0058] In other aspects of the embodiments of the present invention, the first base classifier and the second base classifier are trained based on the Tri-training algorithm, respectively. That is, the training is performed by the following method:

[0059] Initial stage: Three different sub-datasets are created from the original dataset by bootstrap method. The original dataset includes traffic data of multiple sample devices.

[0060] Classifier training: Three different classifiers are trained using these three sub-datasets.

[0061] Unlabeled Data Prediction: For each classifier, the remaining two classifiers will predict the class of the unlabeled data.

[0062] High confidence sample selection: If the prediction results of two classifiers for an unlabeled sample are consistent and the confidence of the prediction is higher than a certain threshold, then this sample and its predicted label are added to the training set of the third classifier.

[0063] Classifier update: Retrain the third classifier using the updated training set.

[0064] Iteration: The above process is repeated for the three classifiers in turn until a preset stopping condition is reached, such as model convergence or no more unlabeled data can increase the confidence.

[0065] The main classifier of the network threat identification model in the embodiment of the present invention is trained by the following steps:

[0066] Step 10: Get the original training set.

[0067] The electronic device obtains an original training set (or original data set). The original training set includes a large amount of sample device flow data. The sample device flow data is obtained based on the historical device flow data of the power company.

[0068] Step 20: preprocess all sample device flow data of the original training set to obtain a target training set.

[0069] The electronic device performs data preprocessing on all sample device flow data of the original training set to obtain a target training set. In the data preprocessing step, the embodiment of the present invention may include four aspects: data cleaning, data conversion, data standardization and data normalization. Data preprocessing can help the network security protection system of the electronic device to better explain the relationship between data in the process of collecting and analyzing sample device flow data, and reduce errors and errors in data analysis. For the power industry, the characteristics of its sample device flow data include non-digital characteristics, which will affect the quality of the data set and the accuracy and reliability of model training. Therefore, the data is preprocessed before model training to reduce errors and errors caused by subsequent data use. First, data cleaning is performed to eliminate the influence of abnormal data in the sample device flow data; secondly, the non-numerical data in the sample device flow data is converted into numerical values ​​to facilitate subsequent calculations; then the sample device flow data is standardized and normalized so that the preprocessed data is limited to a certain range, thereby eliminating the adverse effects caused by singular sample data.

[0070] The main function of data preprocessing is to monitor every device or equipment in the power industry system that needs to collect data for a period of time, collect network data packets from the equipment during the monitoring process, and process the collected results. In the embodiment of the present invention, based on the basic characteristics of the sample equipment flow data of the power enterprise with strong periodicity, timing and stability, data cleaning and screening can be performed in advance to improve the efficiency of data processing in the subsequent data processing process. Please refer to Figure 2 ,Data preprocessing mainly includes: data cleaning and screening; conversion of non-numerical features into digital features; data standardization and normalization.

[0071] (1) At the data cleaning and screening level, the sample equipment flow data of power enterprises has strong basic characteristics of periodicity, timing and stability. The frequency of changes in sample equipment flow data over a period of time can also reflect network behavior. For example, at a certain moment, the number of device access requests in the station increases sharply, which will trigger abnormal data flow in the device network, resulting in an increase in the frequency of device data flow at that moment, which is determined to be abnormal data flow of the device. This is to analyze the impact of network behavior on data flow from a macro perspective.

[0072] (2) From the perspective of converting non-numerical features into digital features, some non-numerical feature data in the original training set is not easy to calculate intuitively. It is necessary to encode the data labels and convert them into continuous numerical variables. The values ​​of discrete features can be expanded to Euclidean space by using onehot encoding. A certain value of the discrete feature corresponds to a certain point in the Euclidean space, making the distance calculation between features more reasonable.

[0073] (3) In terms of data standardization and normalization, in order to better train the model and eliminate the errors caused by the singular sample device flow data, it is necessary to standardize all the sample device flow data in the original training set so that each sample device flow data is normalized to the range of [0, 1]. The sample device flow data is standardized using the following formula (1), and the sample device flow data is normalized using formula (2).

[0074]

[0075] Among them, X ’ is the standardized data, X ’ ∈(X ’ min , X ’ max ); X is the flow data of sample equipment; X mean is the mean of the sample equipment flow data; σ is the standard deviation of the sample equipment flow data; X scaled is the normalized data; X scaled ∈(min, max), max is the maximum value of the mapping range, and min is the minimum value of the mapping range.

[0076] Repeat the following steps until the preset end condition is reached:

[0077] Step 30: Create three different sub-training sets from the target training set by bootstrapping.

[0078] The electronic device creates three different sub-training sets from the target training set by bootstrapping, that is, the electronic device creates three different sub-training sets from the target training set by random sampling with replacement, to obtain a first sub-training set, a second sub-training set, and a third sub-training set.

[0079] Step 40: Train the first base classifier, the second base classifier and the main classifier using the three sub-training sets in a one-to-one training manner.

[0080] For example, the electronic device trains a first base classifier through a first sub-training set, trains a second base classifier through a second sub-training set, and then trains a main classifier through a third sub-training set.

[0081] Since different base classifiers determine the performance of the final classifier, and since some redundant features are removed in the data preprocessing stage, Naive Bayes has better performance when the correlation between features is small. Therefore, the embodiment of the present invention selects Naive Bayes (NB) as the classification algorithm of the main classifier.

[0082] Step 50: Use the first base classifier and the second base classifier to predict the unlabeled sample device flow data in the main classifier respectively, and obtain a first prediction result output by the first base classifier and a second prediction result output by the second base classifier.

[0083] The electronic device uses the first base classifier and the second base classifier to predict the sample device traffic data without labels in the main classifier, respectively, to obtain a first prediction result output by the first base classifier and a second prediction result output by the second base classifier.

[0084] Step 60: selecting training samples for the sub-training set of the main classifier based on the first prediction result, the second prediction result and the third prediction result of the main classifier on the unlabeled sample device flow data;

[0085] Specifically, the selecting training samples for the sub-training set of the main classifier based on the first prediction result, the second prediction result, and the third prediction result of the main classifier on the unlabeled sample device flow data includes:

[0086] When the first prediction result, the second prediction result and the third prediction result are all the same, the unlabeled sample device traffic data is labeled based on the third prediction result, and the labeled sample device traffic data is added to the sub-training set of the main classifier.

[0087] In the case where the first prediction result and the second prediction result are the same, the first prediction result and the second prediction result are different from the third prediction result respectively, and the prediction confidence of the third prediction result is higher than the prediction confidence of the first prediction result and the prediction confidence of the second prediction result respectively, abandoning adding the sample device traffic marked by the first prediction result or the second prediction result to the sub-training set of the main classifier;

[0088] When the first prediction result, the second prediction result and the third prediction result are all different, the unlabeled sample device traffic data in the main classifier is deleted.

[0089] In the embodiment of the present invention, a pseudo label (third prediction result) is attached to the unlabeled sample device flow data with the same prediction results of the three classifiers, and then placed in the sub-training set of the main classifier. In the case where the first prediction result and the second prediction result are the same, the first prediction result and the second prediction result are respectively different from the third prediction result, and the prediction confidence of the third prediction result is respectively higher than the prediction confidence of the first prediction result and the prediction confidence of the second prediction result, the sample device flow marked by the first prediction result or the second prediction result is abandoned to be added to the sub-training set of the main classifier. At this time, the first prediction result or the second prediction result may not be as accurate as the classification result of the main classifier. At this time, the sample device flow marked by the first prediction result or the second prediction result is abandoned to be added to the sub-training set of the main classifier. The embodiment of the present invention solves the problem of sample error labeling introducing noise and the decision-making method that may lead to the accuracy of the classification result in the original Tri-training algorithm. For the unlabeled sample device flow data with different prediction results of the three classifiers, it is judged that the data itself is abnormal at this time, and it is directly discarded at this time.

[0090] Therefore, the present invention combines the first prediction result, the second prediction result and the third prediction result of the main classifier on the unlabeled sample device flow data to select training samples for the sub-training set of the main classifier, thereby reducing the noise introduced by the incorrect labeling of samples in the original Tri-training algorithm and the problem of the accuracy of the classification results that may be caused by the decision-making method.

[0091] Step 70: retrain the first base classifier, the second base classifier and the main classifier based on the updated three sub-training sets.

[0092] The electronic device retrains the first base classifier, the second base classifier and the main classifier based on the updated three sub-training sets.

[0093] In other aspects of the embodiments of the present invention, after step 300, the step of determining a network security protection strategy based on the network threat identification result, the following steps are further included:

[0094] Step 400: Determine the false alarm rate or missed alarm rate of the device flow data.

[0095] Step 500: When the false alarm rate or the missed alarm rate is greater than a set threshold, adjust model parameters of at least one model among the first base classifier, the second base classifier and the main classifier.

[0096] Please refer to Figure 2 , the embodiment of the present invention also includes feedback optimization after the strategy is generated and the strategy is issued and executed. In the embodiment of the present invention, the protection effect of the network security protection method of the electronic device is evaluated regularly (for example, once a week) (characterized by key indicators such as false alarm rate and missed alarm rate). According to the protection effect, when the false alarm rate or the missed alarm rate is greater than the set threshold, it means that the false alarm rate and missed alarm rate are high at this time, and it is necessary to adjust the parameters, structure or training method of at least one model in the first base classifier, the second base classifier and the main classifier, which can improve the overall performance and adaptability of the system. For example, the learning rate of each classifier in the first base classifier, the second base classifier and the main classifier can be adjusted to find the optimal learning rate value. Or add a regularization term to the loss function of the first base classifier, the second base classifier and the main classifier. The regularization term penalizes the parameters of the model, thereby limiting the complexity of the model.

[0097] In other embodiments, during the policy execution process, the electronic device needs to record the operation log of the network security protection system that executes the network security protection method, including policy execution, threat detection, defense measures, etc. After the policy is executed, the log of the network security protection system is audited and analyzed regularly to find potential problems and improvement points. At the same time, the execution effect of the network security protection strategy is evaluated, including indicators such as defense success rate and false alarm rate, and user feedback and opinions are collected to understand the performance and problems of the strategy in practical applications. According to the effect evaluation and user feedback, the network security protection strategy is optimized and improved to improve the accuracy and adaptability of the strategy, and the optimized strategy is tested and verified again. Through continuous trial and error and feedback to adjust the strategy generation algorithm, the system's adaptive ability and defense effect are improved to ensure its effectiveness and stability in practical applications. In addition, the electronic device can also dynamically adjust the threshold of anomaly detection based on historical data and model prediction results to balance the false alarm rate and missed alarm rate. By using the network threat identification model to perform behavioral analysis on real-time device traffic data, abnormal traffic or behavior that deviates from the normal behavior pattern is identified, and the identified abnormal traffic is further analyzed to evaluate its potential threat level and predict possible attack types and attack paths.

[0098] The electronic device of the embodiment of the present invention collects and analyzes the device flow data, uses the deep learning framework to train and improve the model of the Tri-training algorithm (adaptive learning algorithm), and dynamically adjusts the network security protection strategy according to the real-time device flow data. Through the continuous optimization process of data analysis and strategy generation, network security protection for the power industry is achieved. By targeting the unique characteristics of the power industry data, according to its periodic data and fixed flow direction, the data is preprocessed in the stage of collecting device flow data to improve the analysis efficiency.

[0099] The embodiment of the present invention optimizes the traditional network security protection method. First, an original training set (or original data set) is established for the unique characteristics of the data flow of the equipment of the power enterprise. By digitizing and normalizing the equipment flow data of the collected object, the equipment flow data flow can be observed and compared more intuitively. At the same time, the labeled data and the unlabeled data are passed to the Tri-training algorithm for model training, and the Tri-training algorithm is improved by combining the training sample evaluation method and weighted decision-making of the prediction results of the three classifiers to enhance its iteration effect and final decision-making ability, laying a solid foundation for the next step of network security protection. In summary, the embodiment of the present invention can analyze the multi-dimensional information such as equipment flow data, equipment status, user behavior, etc. in the power network in real time, use advanced machine learning algorithms for deep learning, automatically adapt to the dynamic changes of the network environment, and timely discover and prevent potential security threats. The network security protection method of the power industry based on the adaptive learning algorithm of the embodiment of the present invention realizes the intelligentization, automation and dynamicization of network security protection by deeply integrating machine learning technology and network security protection concepts. The method has significant advantages in improving network security protection capabilities, reducing security risks, and reducing the burden of operation and maintenance, and provides strong support for building a more secure, reliable and efficient network environment.

[0100] Device Embodiment

[0101] Please refer to Figure 3 On the other hand, an embodiment of the present invention further provides a network security protection device, including:

[0102] The acquisition module 301 is used to acquire device flow data;

[0103] The prediction module 302 is used to input the device traffic data into the network threat identification model to obtain the network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on the first base classifier, the second base classifier and the main classifier; the first base classifier and the second base classifier are trained based on the Tri-training algorithm respectively; the main classifier is trained based on the improved Tri-training algorithm, and the main classifier selects training samples based on the prediction result of the first base classifier, the prediction result of the second base classifier and the prediction result of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating the weighted average of the identification result of the first base classifier, the identification result of the second base classifier and the identification result of the main classifier;

[0104] The determination module 303 is used to determine a network security protection strategy based on the network threat identification result.

[0105] Optionally, the main classifier of the network threat identification model is trained by the following steps:

[0106] Get the original training set;

[0107] Performing data preprocessing on all sample device flow data of the original training set to obtain a target training set;

[0108] Repeat the following steps until the preset end condition is reached:

[0109] Create three different sub-training sets from the target training set by bootstrapping;

[0110] Using the three sub-training sets to train the first base classifier, the second base classifier and the main classifier in a one-to-one training manner;

[0111] Using the first base classifier and the second base classifier to respectively predict the unlabeled sample device flow data in the main classifier, to obtain a first prediction result output by the first base classifier and a second prediction result output by the second base classifier;

[0112] Selecting training samples for a sub-training set of the main classifier based on the first prediction result, the second prediction result, and a third prediction result of the main classifier on unlabeled sample device traffic data;

[0113] The first base classifier, the second base classifier and the main classifier are retrained based on the updated three sub-training sets.

[0114] Optionally, the selecting training samples for the sub-training set of the main classifier based on the first prediction result, the second prediction result and the third prediction result of the main classifier on the unlabeled sample device traffic data includes:

[0115] When the first prediction result, the second prediction result and the third prediction result are all the same, marking the unlabeled sample device flow data based on the third prediction result, and adding the labeled sample device flow data to the sub-training set of the main classifier;

[0116] In the case where the first prediction result and the second prediction result are the same, the first prediction result and the second prediction result are different from the third prediction result respectively, and the prediction confidence of the third prediction result is higher than the prediction confidence of the first prediction result and the prediction confidence of the second prediction result respectively, abandoning adding the sample device traffic marked by the first prediction result or the second prediction result to the sub-training set of the main classifier;

[0117] When the first prediction result, the second prediction result and the third prediction result are all different, the unlabeled sample device traffic data in the main classifier is deleted.

[0118] Optionally, the data preprocessing of all sample device flow data of the original training set to obtain a target training set includes:

[0119] At least one operation of data cleaning, data conversion, data standardization and data normalization is performed on all sample device flow data of the original training set to obtain a target training set.

[0120] Optionally, the device further comprises:

[0121] A second determination module is used to determine the false alarm rate or missed alarm rate of the device flow data;

[0122] An adjustment module is used to adjust model parameters of at least one model among the first base classifier, the second base classifier and the main classifier when the false alarm rate or the missed alarm rate is greater than a set threshold.

[0123] Optionally, determining a network security protection strategy based on the network threat identification result includes:

[0124] Determine the network security protection policy corresponding to the network threat identification result based on the policy mapping relationship; wherein the policy mapping relationship includes network security protection policies corresponding to different network threat identification results, and the network security protection policy includes at least two of the access control policy, intrusion prevention policy, and data encryption policy.

[0125] The network security protection device includes a processor and a memory. The acquisition module 301, prediction module 302 and determination module 303 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0126] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0127] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0128] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor (processor) 410, a communication interface (Communications Interface) 420, a memory (memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call the logic instructions in the memory 430 to execute the network security protection method, which includes: obtaining device traffic data; inputting the device traffic data into the network threat identification model to obtain the network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on the Tri-training algorithm respectively; the main classifier is trained based on the improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier and the prediction results of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating the weighted average of the identification results of the first base classifier, the identification results of the second base classifier and the identification results of the main classifier; and determining the network security protection strategy based on the network threat identification result.

[0129] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0130] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a machine-readable storage medium. When the computer program is executed by a processor, the computer can execute a network security protection method, which includes: obtaining device traffic data; inputting the device traffic data into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm, respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier and the prediction results of the main classifier when training based on the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification results of the first base classifier, the identification results of the second base classifier and the identification results of the main classifier; and determining a network security protection strategy based on the network threat identification result.

[0131] On the other hand, the present invention also provides a machine-readable storage medium having a computer program stored thereon, which is implemented by a processor to execute a network security protection method, the method comprising: obtaining device traffic data; inputting the device traffic data into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm, respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier and the prediction results of the main classifier when trained based on the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification results of the first base classifier, the identification results of the second base classifier and the identification results of the main classifier; and determining a network security protection strategy based on the network threat identification result.

[0132] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0133] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security protection method, characterized in that: include: Get device traffic data; The device traffic data is input into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction results of the first base classifier, the prediction results of the second base classifier and the prediction results of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification results of the first base classifier, the second base classifier and the main classifier; A network security protection strategy is determined based on the network threat identification result.

2. The network security protection method according to claim 1, characterized in that: The main classifier of the network threat identification model is trained by the following steps: Get the original training set; Performing data preprocessing on all sample device flow data of the original training set to obtain a target training set; Repeat the following steps until the preset end condition is reached: Create three different sub-training sets from the target training set by bootstrapping; Using the three sub-training sets to train the first base classifier, the second base classifier and the main classifier in a one-to-one training manner; Using the first base classifier and the second base classifier to respectively predict the unlabeled sample device flow data in the main classifier, to obtain a first prediction result output by the first base classifier and a second prediction result output by the second base classifier; Selecting training samples for a sub-training set of the main classifier based on the first prediction result, the second prediction result, and a third prediction result of the main classifier on unlabeled sample device traffic data; The first base classifier, the second base classifier and the main classifier are retrained based on the three updated sub-training sets.

3. The network security protection method according to claim 2, characterized in that: The selecting training samples for the sub-training set of the main classifier based on the first prediction result, the second prediction result and the third prediction result of the main classifier on the unlabeled sample device flow data includes: When the first prediction result, the second prediction result and the third prediction result are all the same, marking the unlabeled sample device flow data based on the third prediction result, and adding the labeled sample device flow data to the sub-training set of the main classifier; In the case where the first prediction result and the second prediction result are the same, the first prediction result and the second prediction result are different from the third prediction result respectively, and the prediction confidence of the third prediction result is higher than the prediction confidence of the first prediction result and the prediction confidence of the second prediction result respectively, abandoning adding the sample device traffic marked by the first prediction result or the second prediction result to the sub-training set of the main classifier; When the first prediction result, the second prediction result and the third prediction result are all different, the unlabeled sample device traffic data in the main classifier is deleted.

4. The network security protection method according to claim 2, characterized in that: The data preprocessing of all sample device flow data of the original training set to obtain a target training set includes: At least one operation of data cleaning, data conversion, data standardization and data normalization is performed on all sample device flow data of the original training set to obtain a target training set.

5. The network security protection method according to claim 1, characterized in that: After the step of determining the network security protection strategy based on the network threat identification result, the method further includes: Determining a false positive rate or a false negative rate for the device flow data; When the false alarm rate or the missed alarm rate is greater than a set threshold, model parameters of at least one model among the first base classifier, the second base classifier and the main classifier are adjusted.

6. The network security protection method according to claim 1, characterized in that: Determining a network security protection strategy based on the network threat identification result includes: Determine the network security protection policy corresponding to the network threat identification result based on the policy mapping relationship; wherein the policy mapping relationship includes network security protection policies corresponding to different network threat identification results, and the network security protection policy includes at least two of the access control policy, intrusion prevention policy, and data encryption policy.

7. A network security protection device, characterized in that: include: Acquisition module, used to obtain device flow data; A prediction module, used for inputting the device traffic data into a network threat identification model to obtain a network threat identification result output by the network threat identification model; wherein the network threat identification model is constructed based on a first base classifier, a second base classifier and a main classifier; the first base classifier and the second base classifier are trained based on a Tri-training algorithm respectively; the main classifier is trained based on an improved Tri-training algorithm, and the main classifier selects training samples based on the prediction result of the first base classifier, the prediction result of the second base classifier and the prediction result of the main classifier when training the improved Tri-training algorithm; the network threat identification result is obtained by calculating a weighted average of the identification result of the first base classifier, the identification result of the second base classifier and the identification result of the main classifier; A determination module is used to determine a network security protection strategy based on the network threat identification result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the network security protection method described in any one of claims 1 to 6 is implemented.

9. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security protection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network security protection method according to any one of claims 1 to 6 is implemented.

Images