Security detection method and device, equipment and storage medium

Abstract

The invention discloses a security detection method, device and equipment and a storage medium, and the method comprises the steps: carrying out the feature extraction and standardization processing of network flow data to be detected, inputting the data to a target Gaussian mixture model, and outputting a security detection result; the target Gaussian mixture model is obtained by the following steps of: carrying out feature value extraction and standardization processing on each piece of network flow data to obtain a target standardization value; obtaining a peak value number based on a kernel density estimation method, and calculating an intra-cluster distance and an inter-cluster distance based on a current Gaussian distribution value; obtaining a target Gaussian distribution value based on the peak number, the intra-cluster distance, the inter-cluster distance and the adjustment parameter; and optimizing the Gaussian mixture model based on the target Gaussian distribution value and the target standardized value to obtain a target Gaussian mixture model. That is to say, the security detection of the to-be-detected network traffic data is realized based on the target Gaussian mixture model, so that the network security of the intelligent automobile and the normal use of the user are ensured.

Description

Technical Field

[0001] The present invention relates to the field of vehicle networking security technology, and in particular to a security detection method, device, equipment and storage medium. Background Art

[0002] With the booming development of the smart car industry, cars are gradually evolving towards automation, intelligence and networking. As a key component of the Internet of Vehicles, the security of the on-board card is directly related to the normal operation of the vehicle and the safety of the user. However, with the development of the Internet of Vehicles, the security threats faced by the on-board card are also increasing. Attackers can exploit network vulnerabilities to implement attacks such as remote control, data theft and denial of service, posing a serious threat to vehicle safety and user privacy.

[0003] Therefore, how to ensure the network security of smart cars and the normal use of users through security testing of on-board cards is an important issue that needs to be solved. Summary of the invention

[0004] The present invention provides a security detection method, device, equipment and storage medium to solve the problem in the prior art that the network security of smart cars and the normal use of users cannot be effectively guaranteed.

[0005] In a first aspect, the present application provides a security detection method, comprising:

[0006] Perform feature extraction and standardization processing on the acquired network traffic data to be detected to obtain the target standardized value to be detected;

[0007] Inputting the target standardized value to be detected into the target Gaussian mixture model, and outputting the safety detection result;

[0008] The target Gaussian mixture model is trained in the following way:

[0009] For each network traffic data in the training set, extracting features and normalizing the network traffic data to obtain a target normalized value;

[0010] The peak number of the target normalized value is obtained based on a kernel density estimation method, and the intra-cluster distance and the inter-cluster distance are calculated based on the current Gaussian distribution value and the target normalized value;

[0011] Adjusting the current Gaussian distribution value based on the peak quantity, the intra-cluster distance, the inter-cluster distance and a preset adjustment parameter to obtain a target Gaussian distribution value;

[0012] The pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target normalization value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

[0013] In a possible implementation manner, before extracting and normalizing the network traffic data to obtain a target normalized value, the method further includes:

[0014] Identify and delete abnormal values ​​of the network traffic data to obtain preprocessed network traffic data;

[0015] Based on the interpolation filling method or the mean filling method, the missing values ​​of the preprocessed network traffic data are filled.

[0016] In a possible implementation, the performing feature extraction and normalization processing on the network traffic data to obtain a target normalized value includes:

[0017] The first value obtained by multiplying the data packet size in the network traffic data by the preset unique hot encoding is used as a specific protocol characteristic value; the second value obtained by dividing the number of protocol switching times in the network traffic data by the total duration of the protocol connection is used as a protocol switching frequency characteristic value; the third value obtained by multiplying the data packet size in the network traffic data by the interval between packets is used as a traffic rate characteristic value; the fifth value obtained by dividing the number of authentication failures in the network traffic data by the fourth value is used as a failure rate weighted characteristic value, and the fourth value is the first sum of the total duration of the protocol connection and the preset value;

[0018] The specific protocol characteristic value, the protocol switching frequency characteristic value, the flow rate characteristic value and the failure rate weighted characteristic value are standardized with a mean of 0 and a standard deviation of 1, and the obtained standardized specific protocol characteristic value, protocol switching frequency characteristic value, flow rate characteristic value and failure rate weighted characteristic value are used as target standardized values;

[0019] Among them, the data packet size, the number of protocol switching times, the total duration of the protocol connection, the interval between packets and the number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

[0020] In a possible implementation, the calculating the intra-cluster distance based on the current Gaussian distribution value and the target normalized value includes:

[0021] Calculate the average value corresponding to each characteristic value included in the target standardized value, wherein each characteristic value includes a standardized specific protocol characteristic value, a protocol switching frequency characteristic value, a traffic rate characteristic value, and a failure rate weighted characteristic value;

[0022] For each average value, calculating a first absolute value of a difference between the average value and each value in a target eigenvalue, calculating a second sum of the first absolute values ​​obtained, and calculating a sixth value obtained by dividing the second sum by the amount of data of the target eigenvalue, wherein the target eigenvalue corresponds to the average value;

[0023] A seventh value obtained by dividing the sum of the obtained sixth values ​​and the current Gaussian distribution value is used as the intra-cluster distance.

[0024] In a possible implementation, the calculating the inter-cluster distance based on the current Gaussian distribution value and the target normalized value includes:

[0025] For every two average values ​​among the average values, calculate the second absolute value of the difference between the two average values, and calculate the third sum of the obtained second absolute values;

[0026] The product of the third sum and the eighth value is used as the inter-cluster distance, the eighth value is the ratio of the first ratio to the first difference, the first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

[0027] In a possible implementation, adjusting the current Gaussian distribution value based on the peak quantity, the intra-cluster distance, the inter-cluster distance, and a preset adjustment parameter to obtain a target Gaussian distribution value includes:

[0028] When the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, determine the target Gaussian distribution value as the fourth sum of the current Gaussian distribution value and 1;

[0029] Under the condition that the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the second difference between the current Gaussian distribution value and 1;

[0030] Under the condition that the number of peaks is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the current Gaussian distribution value;

[0031] When the number of peaks is less than or equal to the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0032] In a possible implementation, when the target Gaussian mixture model outputs a security detection result that is abnormal, the method further includes:

[0033] Send alarm signals to the security operation center and user operation page.

[0034] In a second aspect, an embodiment of the present application further provides a safety detection device, the device comprising:

[0035] The security detection unit is used to extract features and perform normalization processing on the acquired network traffic data to be detected to obtain a target normalized value to be detected; input the target normalized value to be detected into a target Gaussian mixture model to output a security detection result;

[0036] The model training unit is used to extract and standardize the network traffic data for each network traffic data in the training set to obtain a target standardized value; obtain the peak value of the target standardized value based on a kernel density estimation method, and calculate the intra-cluster distance and the inter-cluster distance based on a current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the peak value, the intra-cluster distance, the inter-cluster distance and preset adjustment parameters to obtain a target Gaussian distribution value; optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

[0037] In a third aspect, an embodiment of the present application also provides a security detection device, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security detection method provided by the first method of the embodiment of the present application.

[0038] In a fourth aspect, an embodiment of the present application further provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the security detection method provided by the first method of the embodiment of the present application.

[0039] The beneficial effects of the present invention are as follows:

[0040] The present application provides a security detection method, device, equipment and storage medium. The present application performs feature extraction and standardization processing on the acquired network traffic data to be detected to obtain the target standardized value to be detected; the target standardized value to be detected is input into the target Gaussian mixture model, and the security detection result is output; the target Gaussian mixture model is trained specifically in the following ways: for each network traffic data in the training set, the network traffic data is subjected to feature value extraction and standardization processing to obtain the target standardized value; the peak number of the target standardized value is obtained based on the kernel density estimation method, and the intra-cluster distance and the inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value; the current Gaussian distribution value is adjusted based on the peak number, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameters to obtain the target Gaussian distribution value; the pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes the cross-validation to obtain the target Gaussian mixture model. In other words, the present application optimizes the pre-trained Gaussian mixture model based on the network traffic data in the training set, thereby realizing the security detection of the network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of the smart car and the normal use of the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0042] Figure 1 A schematic diagram of a safety detection method provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of a flow chart of a method for training a target Gaussian mixture model provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a flow chart of a method for calculating intra-cluster distance provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of a flow chart of a method for calculating inter-cluster distance provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of a flow chart of a method for determining a target Gaussian distribution value provided in an embodiment of the present application;

[0047] Figure 6 A schematic diagram of the structure of a safety detection device provided in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the structure of a safety detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] It should be noted that the terms "including" and "having" and their variations involved in the documents of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] The terms "first" and "second" in this document are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "multiple" means two or more.

[0052] The word “exemplary” is used hereinafter to mean “serving as an example, example, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0053] With the booming development of the smart car industry, cars are gradually evolving towards automation, intelligence and networking. As a key component of the Internet of Vehicles, the security of the on-board card is directly related to the normal operation of the vehicle and the safety of the user. However, with the development of the Internet of Vehicles, the security threats faced by the on-board card are also increasing. Attackers can exploit network vulnerabilities to implement attacks such as remote control, data theft and denial of service, posing a serious threat to vehicle safety and user privacy.

[0054] Therefore, how to ensure the network security of smart cars and the normal use of users through security testing of on-board cards is an important issue that needs to be solved.

[0055] Based on this, the embodiment of the present application provides a security detection method, which extracts features and standardizes the acquired network traffic data to be detected to obtain a target standardized value to be detected; inputs the target standardized value to be detected into a target Gaussian mixture model, and outputs a security detection result; the target Gaussian mixture model is trained specifically in the following ways: for each network traffic data in the training set, the network traffic data is subjected to feature value extraction and standardization to obtain a target standardized value; the number of peaks of the target standardized value is obtained based on the kernel density estimation method, and the intra-cluster distance and the inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value; the current Gaussian distribution value is adjusted based on the peak number, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameters to obtain the target Gaussian distribution value; the pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model. In other words, the present application optimizes the pre-trained Gaussian mixture model based on the network traffic data in the training set, thereby realizing the security detection of the network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of the smart car and the normal use of the user.

[0056] For ease of understanding, the technical terms involved in the embodiments of the present application are explained as follows:

[0057] (1) Gaussian Mixture Model (GMM) is a probabilistic model used to represent a mixture of multiple Gaussian distributions. The Gaussian Mixture Model assumes that data points are generated from multiple Gaussian distributions, and these Gaussian distributions together describe the overall structure of the data. Each Gaussian distribution has its own mean and covariance matrix, and each data point belongs to one of these components.

[0058] (2) On-board card: An on-board card refers to a dedicated SIM card embedded in a smart car for the vehicle to communicate with external networks. The on-board card is usually connected to the operator's mobile network (such as 4G, 5G) to support functions such as telematics, data transmission, navigation, entertainment, remote diagnosis, vehicle control and emergency rescue, thereby ensuring that the smart car can achieve continuous and stable data connection.

[0059] The present application is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] Figure 1 A schematic diagram of a safety detection method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, a security detection method is provided for the implementation of this application, which specifically includes the following steps:

[0061] S101, extracting features and performing standardization processing on the acquired network traffic data to be detected to obtain a target standardized value to be detected;

[0062] Specifically, the network traffic data to be detected is the network traffic data of the on-board card interacting with the mobile network. In this application, the network traffic data to be detected of the on-board card is periodically obtained, and the obtained network traffic data to be detected is security-tested to ensure the network security of the smart car and the normal use of the user. The network record activities in the network traffic data to be detected include data packet size, protocol type, interval between packets, protocol connection duration, and number of authentication failures.

[0063] Among them, the data packet size is the memory size of the data packet in the network communication transmission; the protocol type is the transmission protocol of the data packet, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol) and HTTP (Hypertext Transfer Protocol); the packet interval duration is the interval duration between the transmission of two data packets; the protocol connection duration refers to the duration of the session of each transmission protocol; the number of authentication failures refers to the number of login authentication failures recorded by the on-board card.

[0064] S102, inputting the target to-be-detected standardized value into the target Gaussian mixture model, and outputting the safety detection result;

[0065] Specifically, the target Gaussian mixture model is used to perform security detection on the network traffic data to be detected, and the logarithmic likelihood value of the network traffic data to be detected is calculated. When the value of the logarithmic likelihood value is greater than the preset threshold, the security detection result output by the target Gaussian mixture model is normal. When the value of the logarithmic likelihood value is less than the preset threshold, the security detection result output by the target Gaussian mixture model is abnormal.

[0066] In the embodiment of the present application, the target Gaussian mixture model is trained in the following manner: Figure 2 As shown, a flow chart of a method for training a target Gaussian mixture model provided in an embodiment of the present application includes the following steps:

[0067] S201, for each network traffic data in the training set, extracting characteristics and normalizing the network traffic data to obtain a target normalized value;

[0068] It should be noted that before extracting features and standardizing network traffic data, the received network traffic data needs to be cleaned and sorted. Specifically, by identifying and deleting outliers in the network traffic data, noise data and invalid records in the network traffic data are removed to obtain preprocessed network traffic data. Then, based on the interpolation filling method or the mean filling method, the missing values ​​of the preprocessed network traffic data are filled.

[0069] This application extracts and normalizes the cleaned and sorted network traffic data to obtain a target normalized value, and optimizes the pre-trained Gaussian mixture model based on the target normalized value. The specific implementation process of feature value extraction and normalization is described below:

[0070] In one possible implementation, a first value obtained by multiplying a data packet size in network traffic data by a preset unique hot encoding is used as a specific protocol feature value; the specific protocol feature value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized specific protocol feature value.

[0071] In a specific embodiment, the data packet sizes of multiple preset time windows are obtained, the one-hot encoding corresponding to the protocol type is determined by determining the protocol type, and the first value obtained by multiplying the data packet size by the corresponding one-hot encoding is used as the specific protocol feature value. For example, as shown in Table 1, the network traffic data of four preset time windows obtained in the current period are shown.

[0072]

[0073] Table 1

[0074] As shown in Table 1, when the protocol type is TCP, the corresponding one-hot encoding is (1, 0, 0), when the protocol type is UDP, the corresponding one-hot encoding is (0, 1, 0), and when the protocol type is HTTP, the corresponding one-hot encoding is (0, 0, 1). For the data packet size in Table 1 and the one-hot encoding corresponding to the data packet size, the specific protocol feature value is calculated, where the specific protocol feature value = data packet size × one-hot encoding.

[0075] That is to say, for the first preset duration window, the specific protocol characteristic value = 1500×(1,0,0) = 1500, for the second preset duration window, the specific protocol characteristic value = 60×(0,1,0) = 60, for the third preset duration window, the specific protocol characteristic value = 1200×(1,0,0) = 1200, and for the fourth preset duration window, the specific protocol characteristic value = 1500×(0,0,1) = 800.

[0076] That is, the specific protocol characteristic value obtained is [1500, 60, 1200, 800].

[0077] The specific protocol characteristic value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized specific protocol characteristic value. The formula for the standardized processing is:

[0078]

[0079] Among them, x1 represents that c is any eigenvalue in [1500, 60, 1200, 800], μ1 represents the average value of the specific protocol eigenvalue [1500, 60, 1200, 800], δ1 represents the standard deviation of the specific protocol eigenvalue [1500, 60, 1200, 800], and the calculated values ​​are μ1=890 and δ1=539.72.

[0080] Therefore, based on μ1=890, δ1=539.72 and the normalization processing formula, the specific protocol characteristic value after normalization is calculated to be [1.133, -1.54, 0.575, -0.167].

[0081] Among them, the duration of the preset duration window can be 5 minutes. It should be noted that this application does not limit the number of preset duration windows included in the network traffic data. This application does not limit the length of the preset duration windows. The number and duration of the above-mentioned preset duration windows are only an optional embodiment provided by this application.

[0082] In one possible implementation, the second value obtained by dividing the number of protocol switching times in the network traffic data by the total duration of the protocol connection is used as a protocol switching frequency characteristic value; the protocol switching frequency characteristic value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized protocol switching frequency characteristic value.

[0083] In a specific embodiment, the number of protocol switching times and protocol connection durations of multiple preset duration windows are obtained, and the total protocol connection duration is obtained by calculating the sum of the durations of each protocol connection in the preset duration window, and the second value obtained by dividing the number of protocol switching times in the network traffic data by the total protocol connection duration is used as the protocol switching frequency characteristic value. For example, the protocol sequence in the first preset duration window is switching from TCP to UDP, and from UDP to HTTP, that is, the number of protocol switching times in the first preset duration window is 2 times; the protocol sequence in the second preset duration window is switching from UDP to TCP, from TCP to HTTP, and from HTTP to TCP, that is, the number of protocol switching times in the second preset duration window is 3 times; the protocol sequence in the third preset duration window is switching from TCP to UDP, that is, the number of protocol switching times in the third preset duration window is 1 time; the protocol sequence in the fourth preset duration window is switching from HTTP to TCP, from TCP to UDP, and from UDP to HTTP, that is, the number of protocol switching times in the fourth preset duration window is 3 times. For example, as shown in Table 2, the network traffic data of four preset duration windows obtained in the current period are shown.

[0084]

[0085] Table 2

[0086] As shown in Table 2, the number of protocol switching in the first preset duration window is 2 times, and the protocol connection duration is 180; the number of protocol switching in the second preset duration window is 3 times, and the protocol connection duration is 300; the number of protocol switching in the third preset duration window is 1 time, and the protocol connection duration is 45; the number of protocol switching in the fourth preset duration window is 3 times, and the protocol connection duration is 600. For the number of protocol switching and the protocol connection duration in Table 2, the protocol switching frequency characteristic value is calculated, where the protocol switching frequency characteristic value = protocol switching number / protocol connection duration.

[0087] That is to say, for the first preset time window, the protocol switching frequency characteristic value = 2 / 180 = 0.0111, for the second preset time window, the protocol switching frequency characteristic value = 3 / 300 = 0.01, for the third preset time window, the protocol switching frequency characteristic value = 1 / 45 = 0.0222, and for the fourth preset time window, the protocol switching frequency characteristic value = 3 / 600 = 0.005.

[0088] That is, the obtained protocol switching frequency characteristic value is [0.0111, 0.01, 0.0222, 0.005].

[0089] The protocol switching frequency characteristic value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized protocol switching frequency characteristic value. The formula for the standardized processing is:

[0090]

[0091] Among them, x2 represents any characteristic value of the protocol switching frequency characteristic value in [0.0111, 0.01, 0.0222, 0.005], μ2 represents the average value of the protocol switching frequency characteristic value in [0.0111, 0.01, 0.0222, 0.005], δ2 represents the standard deviation of the protocol switching frequency characteristic value in [0.0111, 0.01, 0.0222, 0.005], and it is calculated that μ2=0.012, δ2=0.0051.

[0092] Therefore, based on μ2=0.012, δ2=0.0051 and the normalization processing formula, the protocol switching frequency characteristic value after normalization is calculated to be [-0.1544, -0.329, 1.601, -1.118].

[0093] In a possible implementation, a third value obtained by multiplying the packet size and the packet interval duration in the network traffic data is used as a traffic rate characteristic value; the traffic rate characteristic value is standardized with a row mean of 0 and a standard deviation of 1 to obtain a standardized traffic rate characteristic value.

[0094] In a specific embodiment, the data packet size of a preset time window is obtained, and the inter-packet interval is determined by determining the interval between the transmission of two data packets. For example, as shown in Table 3, network traffic data of four preset time windows obtained in the current period.

[0095]

[0096] Table 3

[0097] With respect to the data packet size and the interval between packets in Table 3, the characteristic value of the flow rate is calculated, where the characteristic value of the flow rate = data packet size × the interval between packets.

[0098] That is to say, for the first preset time window, the flow rate characteristic value = 1500×0.01=15, for the second preset time window, the flow rate characteristic value = 60×0.05=3, for the third preset time window, the flow rate characteristic value = 1200×0.02=24, for the fourth preset time window, the flow rate characteristic value = 800×0.04=32.

[0099] That is, the obtained traffic rate characteristic value is [15, 3, 24, 32].

[0100] The flow rate characteristic value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized flow rate characteristic value. The formula for the standardized processing is:

[0101]

[0102] Among them, x3 represents the flow rate characteristic value as any one of [15, 3, 24, 32], μ3 represents the average value of the flow rate characteristic value [15, 3, 24, 32], δ3 represents the standard deviation of the flow rate characteristic value [15, 3, 24, 32], and it is calculated that μ3 = 18.5 and δ3 = 10.78.

[0103] Therefore, based on μ3=18.5, δ3=10.78 and the normalization formula, the normalized flow rate characteristic value is calculated to be [-0.302, -1.134, 0.474, 1.168].

[0104] In a possible implementation, a fifth value obtained by dividing the number of authentication failures in the network traffic data by the fourth value is used as a weighted characteristic value of the failure rate, and the weighted characteristic value of the failure rate is standardized with a mean of 0 and a standard deviation of 1 to obtain a weighted characteristic value of the failure rate after the standardized processing. The fourth value is the first sum of the total duration of the protocol connection and the preset value.

[0105] In a specific embodiment, the number of authentication failures in multiple preset time windows is obtained, and the total protocol connection duration is obtained by calculating the sum of the protocol connection durations in each preset time window. The preset value may be 10 -6 , the total duration of the protocol connection and 10 -6 The first sum of the values ​​is used as the fourth value. The fifth value obtained by dividing the number of authentication failures in the network traffic data by the fourth value is used as the weighted characteristic value of the failure rate. Among them, the sum of the preset value and the total duration of the protocol connection is used as the fourth value to avoid the situation where the divisor is 0. For example, as shown in Table 4, the network traffic data of four preset duration windows obtained in the current period are shown.

[0106]

[0107] Table 4

[0108] For the number of authentication failures and the fourth value in Table 4, the failure rate weighted characteristic value is calculated, where the failure rate weighted characteristic value = the number of authentication failures / (the total duration of the protocol connection + 10 -6 ).

[0109] That is to say, for the first preset time window, the failure rate weighted characteristic value = 0 / (100+10 -6 )=0, for the second preset time window, the failure rate weighted characteristic value=1 / (45+10 -6)=0.0222, for the third preset time window, the failure rate weighted characteristic value=0 / (200+10 -6 )=0, for the fourth preset time window, the failure rate weighted characteristic value=2 / (180+10 -6 )=0.0111.

[0110] That is, the obtained flow rate characteristic value is [0, 0.0222, 0, 0.0111].

[0111] The weighted eigenvalue of the failure rate is standardized with a mean of 0 and a standard deviation of 1 to obtain the weighted eigenvalue of the failure rate after the standardized processing. The formula for the standardized processing is:

[0112]

[0113] Among them, x4 represents the weighted eigenvalue of the failure rate as any eigenvalue in [0, 0.0222, 0, 0.0111], μ4 represents the average value of the weighted eigenvalue of the failure rate in [0, 0.0222, 0, 0.0111], δ4 represents the standard deviation of the weighted eigenvalue of the failure rate in [0, 0.0222, 0, 0.0111], and it is calculated that μ4 = 0.0083, δ4 = 0.009.

[0114] Therefore, based on μ4=0.0083, δ4=0.009 and the normalization processing formula, the weighted eigenvalue of the failure rate after normalization is calculated to be [-0.86, 1431., -0.86, 0.287].

[0115] In summary, the target standardized values ​​obtained by the present application based on network traffic data include the standardized specific protocol characteristic values, protocol switching frequency characteristic values, traffic rate characteristic values ​​and failure rate weighted characteristic values.

[0116] It should be noted that the data packet size, number of protocol switching times, total protocol connection time, inter-packet interval time and number of authentication failures are obtained within a preset time window, and the network traffic data includes data from at least two preset time windows.

[0117] S202, obtaining the peak number of the target standardized value based on a kernel density estimation method, and calculating the intra-cluster distance and the inter-cluster distance based on the current Gaussian distribution value and the target standardized value;

[0118] In a possible implementation, based on the data packet size in the network traffic data and a kernel density estimation method, the peak number P of the target normalized value is calculated.

[0119] In a possible implementation, Figure 3FIG. 1 is a flow chart of a method for calculating the intra-cluster distance provided in an embodiment of the present application, and the steps are as follows:

[0120] S301, calculating the average value corresponding to each characteristic value included in the target standardized value, wherein each characteristic value includes a standardized specific protocol characteristic value, a protocol switching frequency characteristic value, a traffic rate characteristic value, and a failure rate weighted characteristic value;

[0121] S302, for each average value, calculating a first absolute value of the difference between the average value and each value in the target eigenvalue, calculating a second sum of the first absolute values ​​obtained, and calculating a sixth value obtained by dividing the second sum by the amount of data of the target eigenvalue, wherein the target eigenvalue corresponds to the average value;

[0122] S303 : Taking a seventh value obtained by dividing the sum of the obtained sixth values ​​and the current Gaussian distribution value as the intra-cluster distance.

[0123] Optionally, taking the standardized specific protocol characteristic value, protocol switching frequency characteristic value, traffic rate characteristic value and failure rate weighted characteristic value as an example, the calculation process of the intra-cluster distance is described in detail below. The intra-cluster distance can be determined using the following formula:

[0124]

[0125] Among them, D intra represents the distance within the cluster, and K represents the current Gaussian distribution value. Since the number of eigenvalues ​​after standardization in this application is 4, the current Gaussian distribution value K is 4. N i Represents the amount of data in the target eigenvalue Ci, Ci represents the target eigenvalue, x represents a value in the target eigenvalue, μ i Characterizes the average value corresponding to the target feature value.

[0126] Optionally, taking the specific protocol characteristic value C1 after standardization as an example, calculate the average value μ1 corresponding to each characteristic value included in the target standardized value. If it is known that the specific protocol characteristic value after standardization is [1.133, -1.54, 0.575, -0.167], the average value μ1 is 0.00025.

[0127] For the average value μ1=0.00025, the absolute value of the difference between each value in the normalized specific protocol characteristic value and the average value μ1=0.00025 is calculated, that is, the first absolute value 1.13275 of the difference between x=1.133 and μ1=0.00025, the first absolute value 1.54025 of the difference between x=-1.54 and μ1=0.00025, the first absolute value 0.57475 of the difference between x=0.575 and μ1=0.00025, and the first absolute value 0.16725 of the difference between x=-0.167 and μ1=0.00025 are calculated respectively. The second sum of the calculated first absolute values ​​is 3.415. The sixth value obtained by dividing the second sum 3.415 by the data amount of the target eigenvalue is calculated. Since the data amount in the normalized specific protocol eigenvalue is 4, the sixth value=3.415 / 4=0.85375.

[0128] Optionally, if the sixth numerical value of the standardized specific protocol characteristic value C1 is A1, the sixth numerical value of the standardized protocol switching frequency characteristic value C2 is A2, the sixth numerical value of the standardized traffic rate characteristic value C3 is A3, the sixth numerical value of the standardized failure rate weighted characteristic value C4 is A4.

[0129] Since the intra-cluster distance is the value obtained by dividing the sum of the sixth values ​​by the current Gaussian distribution value, that is, the intra-cluster distance=(sum of the sixth values) / current Gaussian distribution value=(A1+A2+A3+A4) / 4.

[0130] In a possible implementation, Figure 4 FIG. 1 is a flow chart of a method for calculating inter-cluster distance provided in an embodiment of the present application, and the steps are as follows:

[0131] S401, for every two average values ​​among the average values, calculating the second absolute value of the difference between the two average values, and calculating the third sum of the obtained second absolute values;

[0132] S402: taking the product of the third sum and the eighth value as the inter-cluster distance, the eighth value is the ratio of the first ratio to the first difference, the first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

[0133] Optionally, taking the standardized specific protocol characteristic value, protocol switching frequency characteristic value, traffic rate characteristic value and failure rate weighted characteristic value as an example, the calculation process of the inter-cluster distance is described in detail below. The inter-cluster distance can be determined using the following formula:

[0134]

[0135] Among them, D interμ represents the distance between clusters, and K represents the current Gaussian distribution value. Since the number of eigenvalues ​​after standardization in this application is 4, the current Gaussian distribution value K is 4. i Represents the average value corresponding to the target eigenvalue, μ j Characterizes the average value corresponding to another target feature value.

[0136] For example, if it is known that the average value of the standardized specific protocol characteristic value C1 is B1, the average value of the standardized protocol switching frequency characteristic value C2 is B2, the average value of the standardized traffic rate characteristic value C3 is B3, and the average value of the standardized failure rate weighted characteristic value C4 is B4.

[0137] For every two average values ​​of B1, B2, B3 and B4 in the average values, calculate the second absolute value of the difference between the two average values, that is, calculate |B1-B2|, |B1-B3|, |B1-B4|, |B2-B3|, |B2-B4|, |B3-B4| respectively, and take the sum of |B1-B2|, |B1-B3|, |B1-B4|, |B2-B3|, |B2-B4|, |B3-B4| as the third sum.

[0138] Calculate the product of the third sum and the eighth value as the inter-cluster distance, where the eighth value is Since K is known to be 4, the eighth value is That is to say,

[0139] In the embodiment of the present application, after obtaining the number of peaks, the intra-cluster distance, and the inter-cluster distance, the current Gaussian distribution value is adjusted based on the number of peaks, the intra-cluster distance, and the inter-cluster distance to obtain the target Gaussian distribution value, thereby optimizing the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target normalized value. The following is an explanation of the process of determining the target Gaussian distribution value:

[0140] S203, adjusting the current Gaussian distribution value based on the peak quantity, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameters to obtain a target Gaussian distribution value;

[0141] In a possible implementation, Figure 5 FIG. 1 is a flow chart of a method for determining a target Gaussian distribution value provided in an embodiment of the present application, and the specific steps are as follows:

[0142] S501, determine whether the number of peaks is greater than the current Gaussian distribution value, and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter. If so, execute S502, otherwise, execute S503;

[0143] S502, determining that the target Gaussian distribution value is the fourth sum of the current Gaussian distribution value and 1;

[0144] S503, determine whether the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter. If so, execute S504; otherwise, execute S505;

[0145] S504, determining that the target Gaussian distribution value is a second difference between the current Gaussian distribution value and 1;

[0146] S505: Determine the target Gaussian distribution value as the current Gaussian distribution value.

[0147] In a specific embodiment, when the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the fourth sum of the current Gaussian distribution value and 1; when the number of peaks is less than or equal to the current Gaussian distribution value and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the second difference between the current Gaussian distribution value and 1; when the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value; when the number of peaks is less than or equal to the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0148] For example, if the current Gaussian distribution value K is 4, the calculated peak number P is 3, and the calculated intra-cluster distance D is intra is 0.5, and the calculated inter-cluster distance D inter is 0.7, and the preset adjustment parameter a is 2. By calculation, we get P = 3 < K = 4, and D inter =0.7<2×D intra The product of 1, that is, the target Gaussian distribution value is the current Gaussian distribution value, that is, the target Gaussian distribution value is 4.

[0149] For example, if the current Gaussian distribution value K is 4, the calculated peak number P is 5, and the calculated intra-cluster distance D is intra is 0.5, and the calculated inter-cluster distance D inter is 0.7, and the preset adjustment parameter a is 2. By calculation, we get P=5>K=4, and D inter =0.7<2×D intra The product of 1, that is, the target Gaussian distribution value is the fourth sum of the current Gaussian distribution value and 1, that is, the target Gaussian distribution value is 5.

[0150] For example, if the current Gaussian distribution value K is 4, the calculated peak number P is 3, and the calculated intra-cluster distance D is intra is 0.3, and the calculated inter-cluster distance D inter is 0.7, and the preset adjustment parameter a is 2. By calculation, we get P = 3 < K = 4, and D inter =0.7>2×D intra The product of 0.6, that is, the target Gaussian distribution value is the second difference between the current Gaussian distribution value and 1, that is, the target Gaussian distribution value is 3.

[0151] S204, optimizing the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target normalization value until the Gaussian mixture model passes cross validation to obtain a target Gaussian mixture model.

[0152] In a specific embodiment, a Gaussian mixture model pre-trained according to the obtained target Gaussian distribution value and target normalization value is optimized, and the optimized Gaussian mixture model is evaluated based on cross-validation or an independent validation set until the Gaussian mixture model passes the cross-validation, thereby achieving security detection of the network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of the smart car and the normal use of the user.

[0153] It should be noted that the log-likelihood value of the network traffic data to be detected is calculated by the target Gaussian mixture model. When the value of the log-likelihood value is greater than the preset threshold, the security detection result output by the target Gaussian mixture model is normal. When the value of the log-likelihood value is less than the preset threshold, the security detection result output by the target Gaussian mixture model is abnormal.

[0154] When the target Gaussian mixture model outputs an abnormal security detection result, it also includes: sending an alarm signal to the security operation center and the user operation page. The alarm signal is used to notify the security operation center of the existence of abnormal network traffic data, isolate the abnormal vehicle card, and send an alarm signal to the user operation page to remind the user.

[0155] Based on the same inventive concept, the embodiment of the present application further provides a safety detection device, the principle of which is similar to that of the above-mentioned safety detection method, and the repetitive parts will not be repeated. Figure 6 FIG. 1 is a schematic diagram of a safety detection device provided in an embodiment of the present application, comprising:

[0156] The security detection unit 601 is used to extract features and perform normalization processing on the acquired network traffic data to be detected to obtain a target normalized value to be detected; input the target normalized value to be detected into a target Gaussian mixture model, and output a security detection result;

[0157] The model training unit 602 is used to extract the characteristic values ​​and standardize the network traffic data for each network traffic data in the training set to obtain the target standardized value; obtain the peak value of the target standardized value based on the kernel density estimation method, and calculate the intra-cluster distance and the inter-cluster distance based on the current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the peak value, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameters to obtain the target Gaussian distribution value; optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes the cross-validation to obtain the target Gaussian mixture model.

[0158] The present application provides a security detection method and device, which obtains a target standardized value to be detected by extracting features and standardizing the acquired network traffic data to be detected; inputs the target standardized value to be detected into a target Gaussian mixture model, and outputs a security detection result; and specifically trains the target Gaussian mixture model in the following manner: for each network traffic data in the training set, extracts features and standardizes the network traffic data to obtain a target standardized value; obtains the number of peaks of the target standardized value based on the kernel density estimation method, and calculates the intra-cluster distance and inter-cluster distance based on the current Gaussian distribution value and the target standardized value; adjusts the current Gaussian distribution value based on the peak number, intra-cluster distance, inter-cluster distance and preset adjustment parameters to obtain the target Gaussian distribution value; optimizes the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model. In other words, the present application optimizes the pre-trained Gaussian mixture model based on the network traffic data in the training set, thereby realizing security detection of the network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of the smart car and the normal use of the user.

[0159] In a possible implementation manner, the model training unit 602 is specifically used to:

[0160] Identify and delete abnormal values ​​of the network traffic data to obtain preprocessed network traffic data;

[0161] Based on the interpolation filling method or the mean filling method, the missing values ​​of the preprocessed network traffic data are filled.

[0162] In a possible implementation manner, the model training unit 602 is specifically used to:

[0163] The first value obtained by multiplying the data packet size in the network traffic data by the preset unique hot encoding is used as a specific protocol characteristic value; the second value obtained by dividing the number of protocol switching times in the network traffic data by the total duration of the protocol connection is used as a protocol switching frequency characteristic value; the third value obtained by multiplying the data packet size in the network traffic data by the interval between packets is used as a traffic rate characteristic value; the fifth value obtained by dividing the number of authentication failures in the network traffic data by the fourth value is used as a failure rate weighted characteristic value, and the fourth value is the first sum of the total duration of the protocol connection and the preset value;

[0164] The specific protocol characteristic value, the protocol switching frequency characteristic value, the flow rate characteristic value and the failure rate weighted characteristic value are standardized with a mean of 0 and a standard deviation of 1, and the obtained standardized specific protocol characteristic value, protocol switching frequency characteristic value, flow rate characteristic value and failure rate weighted characteristic value are used as target standardized values;

[0165] Among them, the data packet size, the number of protocol switching times, the total duration of the protocol connection, the interval between packets and the number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

[0166] In a possible implementation manner, the model training unit 602 is specifically used to:

[0167] Calculate the average value corresponding to each characteristic value included in the target standardized value, wherein each characteristic value includes a standardized specific protocol characteristic value, a protocol switching frequency characteristic value, a traffic rate characteristic value, and a failure rate weighted characteristic value;

[0168] For each average value, calculating a first absolute value of a difference between the average value and each value in a target eigenvalue, calculating a second sum of the first absolute values ​​obtained, and calculating a sixth value obtained by dividing the second sum by the amount of data of the target eigenvalue, wherein the target eigenvalue corresponds to the average value;

[0169] A seventh value obtained by dividing the sum of the obtained sixth values ​​and the current Gaussian distribution value is used as the intra-cluster distance.

[0170] In a possible implementation manner, the model training unit 602 is specifically used to:

[0171] For every two average values ​​among the average values, calculate the second absolute value of the difference between the two average values, and calculate the third sum of the obtained second absolute values;

[0172] The product of the third sum and the eighth value is used as the inter-cluster distance, the eighth value is the ratio of the first ratio to the first difference, the first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

[0173] In a possible implementation manner, the model training unit 602 is specifically used to:

[0174] When the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, determine the target Gaussian distribution value as the fourth sum of the current Gaussian distribution value and 1;

[0175] Under the condition that the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the second difference between the current Gaussian distribution value and 1;

[0176] Under the condition that the number of peaks is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the current Gaussian distribution value;

[0177] When the number of peaks is less than or equal to the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0178] In a possible implementation manner, the model training unit 602 is specifically used to:

[0179] Send alarm signals to the security operation center and user operation page.

[0180] Based on the same inventive concept, an embodiment of the present application also provides a safety detection device, the principle of which is similar to that of the above-mentioned safety detection method, and the repeated parts will not be repeated.

[0181] like Figure 7 As shown, it is a structural schematic diagram of a security detection device provided in an embodiment of the present application, and the device includes at least one processor 701; and a memory 702 that is communicatively connected to the at least one processor; in the embodiment of the present application, the memory 702 stores instructions that can be executed by the at least one processor 701, and the instructions are executed by the at least one processor 701 so that the at least one processor 701 can execute the security detection method in the above-mentioned embodiment.

[0182] The processor 701 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 701 is used to implement the security detection method in the above embodiment when calling the computer program stored in the memory 702.

[0183] In one possible design, the memory 702 may be a volatile memory, such as a random-access memory (RAM); the memory 702 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), or the memory 702 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 702 may be a combination of the above memories.

[0184] The specific connection medium between the memory 702 and the processor 701 is not limited in the embodiment of the present application. Figure 7 In the embodiment, the memory 702 and the processor 701 are connected via a bus 703. The bus 703 is connected to the processor 701 via a bus 703. Figure 7 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. Bus 703 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0185] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a security detection method discussed above.

[0186] In some possible implementations, various aspects of a security detection method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a security detection method according to various exemplary implementations of the present application described above in this specification.

[0187] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0188] The present application provides a security detection method, device, equipment and storage medium. The present application performs feature extraction and standardization processing on the acquired network traffic data to be detected to obtain the target standardized value to be detected; the target standardized value to be detected is input into the target Gaussian mixture model, and the security detection result is output; the target Gaussian mixture model is trained specifically in the following ways: for each network traffic data in the training set, the network traffic data is subjected to feature value extraction and standardization processing to obtain the target standardized value; the peak number of the target standardized value is obtained based on the kernel density estimation method, and the intra-cluster distance and the inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value; the current Gaussian distribution value is adjusted based on the peak number, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameters to obtain the target Gaussian distribution value; the pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes the cross-validation to obtain the target Gaussian mixture model. In other words, the present application optimizes the pre-trained Gaussian mixture model based on the network traffic data in the training set, thereby realizing the security detection of the network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of the smart car and the normal use of the user.

[0189] The present application is described above with reference to the block diagrams and / or flow charts showing the methods, devices (systems) and / or computer program products according to the embodiments of the present application. It should be understood that a block of the block diagram and / or flow chart diagram and a combination of blocks of the block diagram and / or flow chart diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer and / or other programmable data processing device to produce a machine, so that the instructions executed by the computer processor and / or other programmable data processing device create a method for implementing the functions / actions specified in the block diagram and / or flow chart block.

[0190] Accordingly, the present application may also be implemented with hardware and / or software (including firmware, resident software, microcode, etc.). Furthermore, the present application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium, for use by an instruction execution system or in conjunction with an instruction execution system. In the context of the present application, a computer-usable or computer-readable medium may be any medium that may contain, store, communicate, transmit, or convey a program for use by an instruction execution system, device, or apparatus, or in conjunction with an instruction execution system, device, or apparatus.

[0191] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A safety detection method, characterized in that: The method comprises: Perform feature extraction and standardization processing on the acquired network traffic data to be detected to obtain the target standardized value to be detected; Inputting the target standardized value to be detected into the target Gaussian mixture model, and outputting the safety detection result; The target Gaussian mixture model is trained in the following way: For each network traffic data in the training set, extracting features and normalizing the network traffic data to obtain a target normalized value; The peak number of the target normalized value is obtained based on a kernel density estimation method, and the intra-cluster distance and the inter-cluster distance are calculated based on the current Gaussian distribution value and the target normalized value; Adjusting the current Gaussian distribution value based on the peak quantity, the intra-cluster distance, the inter-cluster distance and a preset adjustment parameter to obtain a target Gaussian distribution value; The pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target normalization value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

2. The method according to claim 1, characterized in that Before extracting and normalizing the network traffic data to obtain a target normalized value, the method further includes: Identify and delete abnormal values ​​of the network traffic data to obtain preprocessed network traffic data; Based on the interpolation filling method or the mean filling method, the missing values ​​of the preprocessed network traffic data are filled.

3. The method according to claim 1, characterized in that The feature extraction and standardization processing of the network traffic data to obtain a target standardized value includes: The first value obtained by multiplying the data packet size in the network traffic data by the preset unique hot encoding is used as a specific protocol characteristic value; the second value obtained by dividing the number of protocol switching times in the network traffic data by the total duration of the protocol connection is used as a protocol switching frequency characteristic value; the third value obtained by multiplying the data packet size in the network traffic data by the interval between packets is used as a traffic rate characteristic value; the fifth value obtained by dividing the number of authentication failures in the network traffic data by the fourth value is used as a failure rate weighted characteristic value, and the fourth value is the first sum of the total duration of the protocol connection and the preset value; The specific protocol characteristic value, the protocol switching frequency characteristic value, the flow rate characteristic value and the failure rate weighted characteristic value are standardized with a mean of 0 and a standard deviation of 1, and the obtained standardized specific protocol characteristic value, protocol switching frequency characteristic value, flow rate characteristic value and failure rate weighted characteristic value are used as target standardized values; Among them, the data packet size, the number of protocol switching times, the total duration of the protocol connection, the interval between packets and the number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

4. The method according to claim 3, characterized in that The calculating the intra-cluster distance based on the current Gaussian distribution value and the target normalized value includes: Calculate the average value corresponding to each characteristic value included in the target standardized value, wherein each characteristic value includes a standardized specific protocol characteristic value, a protocol switching frequency characteristic value, a traffic rate characteristic value, and a failure rate weighted characteristic value; For each average value, calculating a first absolute value of a difference between the average value and each value in a target eigenvalue, calculating a second sum of the first absolute values ​​obtained, and calculating a sixth value obtained by dividing the second sum by the amount of data of the target eigenvalue, wherein the target eigenvalue corresponds to the average value; A seventh value obtained by dividing the sum of the obtained sixth values ​​and the current Gaussian distribution value is used as the intra-cluster distance.

5. The method according to claim 4, characterized in that The calculating the inter-cluster distance based on the current Gaussian distribution value and the target normalized value includes: For every two average values ​​among the average values, calculate the second absolute value of the difference between the two average values, and calculate the third sum of the obtained second absolute values; The product of the third sum and the eighth value is used as the inter-cluster distance, the eighth value is the ratio of the first ratio to the first difference, the first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

6. The method according to claim 1, characterized in that The adjusting the current Gaussian distribution value based on the peak quantity, the intra-cluster distance, the inter-cluster distance and the preset adjustment parameter to obtain the target Gaussian distribution value includes: When the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, determine the target Gaussian distribution value as the fourth sum of the current Gaussian distribution value and 1; Under the condition that the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the second difference between the current Gaussian distribution value and 1; Under the condition that the number of peaks is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, determining the target Gaussian distribution value to be the current Gaussian distribution value; When the number of peaks is less than or equal to the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

7. The method according to any one of claims 1 to 6, characterized in that: When the target Gaussian mixture model outputs a security detection result that is abnormal, the method further includes: Send alarm signals to the security operation center and user operation page.

8. A safety detection device, characterized in that: The device comprises: The security detection unit is used to extract features and perform normalization processing on the acquired network traffic data to be detected to obtain a target normalized value to be detected; input the target normalized value to be detected into a target Gaussian mixture model to output a security detection result; The model training unit is used to extract and standardize the network traffic data for each network traffic data in the training set to obtain a target standardized value; obtain the peak value of the target standardized value based on a kernel density estimation method, and calculate the intra-cluster distance and the inter-cluster distance based on a current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the peak value, the intra-cluster distance, the inter-cluster distance and preset adjustment parameters to obtain a target Gaussian distribution value; optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

9. A safety detection device, characterized in that: The invention comprises at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program for causing a computer to execute the method according to any one of claims 1 to 7.

Images