A security detection method, apparatus, equipment and storage medium

Abstract

This invention discloses a security detection method, apparatus, device, and storage medium. The method involves extracting and standardizing network traffic data to be detected, then inputting the data into a target Gaussian mixture model (GMM), and outputting security detection results. Specifically, the target GMM is obtained through the following steps: feature value extraction and standardization are performed on each network traffic data point to obtain a target standardized value; the number of peak values ​​is obtained based on kernel density estimation, and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value; a target Gaussian distribution value is obtained based on the number of peak values, intra-cluster distance, inter-cluster distance, and adjustment parameters; and the GMM is optimized based on the target Gaussian distribution value and the target standardized value to obtain the final target GMM. In other words, this application uses a target GMM to achieve security detection of network traffic data to be detected, thereby ensuring the network security of intelligent vehicles and the normal use by users.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to a security detection method, device, equipment and storage medium. Background Technology

[0002] With the booming development of the intelligent vehicle industry, automobiles are gradually evolving towards automation, intelligence, and connectivity. As a key component of the Internet of Vehicles (IoV), the security of on-board cards (ITCs) directly affects the normal operation of vehicles and user safety. However, with the development of IoV, the security threats facing ITCs are also increasing. Attackers can exploit network vulnerabilities to carry out attacks such as remote control, data theft, and denial-of-service, posing serious threats to vehicle security and user privacy.

[0003] Therefore, how to ensure the network security of smart cars and the normal use by users through security testing of on-board cards is an important issue that urgently needs to be addressed. Summary of the Invention

[0004] This invention provides a security detection method, apparatus, device, and storage medium to solve the problem that existing technologies cannot effectively guarantee the network security of intelligent vehicles and the normal use by users.

[0005] Firstly, this application provides a security detection method, including:

[0006] Feature extraction and standardization are performed on the acquired network traffic data to be detected to obtain the target standardized value to be detected;

[0007] The standardized value of the target to be detected is input into the target Gaussian mixture model, and the security detection result is output.

[0008] The target Gaussian mixture model is trained in the following manner:

[0009] For each network traffic data point in the training set, feature value extraction and standardization are performed on the network traffic data to obtain the target standardized value;

[0010] The number of peak values ​​of the target standardized value is obtained based on the kernel density estimation method, and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value.

[0011] The current Gaussian distribution value is adjusted based on the number of peaks, the intra-cluster distance, the inter-cluster distance, and the preset adjustment parameters to obtain the target Gaussian distribution value.

[0012] The pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation, thus obtaining the target Gaussian mixture model.

[0013] In one possible implementation, before performing feature extraction and standardization on the network traffic data to obtain the target standardized value, the method further includes:

[0014] Identify and remove outliers from the network traffic data to obtain preprocessed network traffic data;

[0015] Missing values ​​are filled in the preprocessed network traffic data using interpolation or mean filling methods.

[0016] In one possible implementation, the step of performing feature extraction and standardization on the network traffic data to obtain a target standardized value includes:

[0017] The first value, obtained by multiplying the packet size in the network traffic data by a preset one-hot encoding, is used as a specific protocol feature value; the second value, obtained by dividing the number of protocol switching in the network traffic data by the total protocol connection duration, is used as a protocol switching frequency feature value; the third value, obtained by multiplying the packet size in the network traffic data by the inter-packet interval duration, is used as a traffic rate feature value; and the fifth value, obtained by dividing the number of authentication failures in the network traffic data by a fourth value, is used as a failure rate weighted feature value, wherein the fourth value is the sum of the total protocol connection duration and a preset value.

[0018] The specific protocol feature value, the protocol switching frequency feature value, the traffic rate feature value, and the failure rate weighted feature value are standardized with a mean of 0 and a standard deviation of 1. The standardized specific protocol feature value, protocol switching frequency feature value, traffic rate feature value, and failure rate weighted feature value are used as the target standardized value.

[0019] The data packet size, the number of protocol switching times, the total duration of the protocol connection, the packet interval duration, and the number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

[0020] In one possible implementation, calculating the intra-cluster distance based on the current Gaussian distribution value and the target normalized value includes:

[0021] Calculate the average value corresponding to each feature value included in the target standardized value, wherein each feature value includes a specific protocol feature value after standardization, a protocol switching frequency feature value, a traffic rate feature value, and a failure rate weighted feature value;

[0022] For each average value, calculate the first absolute value of the difference between the average value and each value in the target feature value, calculate the second sum of the first absolute values, and calculate the sixth value by dividing the second sum by the data amount of the target feature value, wherein the target feature value corresponds to the average value;

[0023] The seventh value, obtained by dividing the sum of the sixth values ​​by the current Gaussian distribution value, is the intra-cluster distance.

[0024] In one possible implementation, calculating the inter-cluster distance based on the current Gaussian distribution value and the target normalized value includes:

[0025] For every two averages, calculate the second absolute value of the difference between the two averages, and calculate the third sum of the second absolute values;

[0026] The product of the third sum and the eighth value is taken as the inter-cluster distance. The eighth value is the ratio of the first ratio to the first difference. The first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

[0027] In one possible implementation, adjusting the current Gaussian distribution value based on the number of peaks, the intra-cluster distance, the inter-cluster distance, and a preset adjustment parameter to obtain the target Gaussian distribution value includes:

[0028] If the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the fourth sum of the current Gaussian distribution value and 1.

[0029] If the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the second difference between the current Gaussian distribution value and 1.

[0030] If the number of peak values ​​is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0031] If the number of peak values ​​is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0032] In one possible implementation, if the target Gaussian mixture model outputs an abnormal security detection result, the method further includes:

[0033] Send alarm signals to the security operations center and user operation page.

[0034] Secondly, embodiments of this application also provide a security detection device, the device comprising:

[0035] The security detection unit is used to extract features and standardize the acquired network traffic data to be detected, so as to obtain the target standardized value to be detected; the target standardized value to be detected is input into the target Gaussian mixture model, and the security detection result is output.

[0036] The model training unit is used to extract and standardize the network traffic data for each network traffic data in the training set to obtain a target standardized value; obtain the number of peaks in the target standardized value based on the kernel density estimation method; and calculate the intra-cluster distance and inter-cluster distance based on the current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the number of peaks, the intra-cluster distance, the inter-cluster distance, and preset adjustment parameters to obtain the target Gaussian distribution value; and optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

[0037] Thirdly, embodiments of this application also provide a security detection device, including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the security detection method provided by the first method of embodiments of this application.

[0038] Fourthly, embodiments of this application also provide a computer storage medium storing a computer program, the computer program being used to cause a computer to execute the security detection method provided by the first method of embodiments of this application.

[0039] The beneficial effects of this invention are as follows:

[0040] This application provides a security detection method, apparatus, device, and storage medium. The method involves feature extraction and standardization of acquired network traffic data to be detected, yielding a target standardized value. This target standardized value is then input into a target Gaussian mixture model (Gaussian Mixture Model), outputting the security detection result. Specifically, the target Gaussian mixture model is trained as follows: for each network traffic data point in the training set, feature extraction and standardization are performed to obtain a target standardized value. The number of peak values ​​in the target standardized value is obtained using kernel density estimation, and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value. The current Gaussian distribution value is adjusted based on the number of peak values, intra-cluster distance, inter-cluster distance, and preset adjustment parameters to obtain the target Gaussian distribution value. The pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation, resulting in the target Gaussian mixture model. In other words, this application optimizes a pre-trained Gaussian mixture model based on network traffic data in the training set, thereby enabling security detection of network traffic data to be detected based on the target Gaussian mixture model, thus ensuring the network security of intelligent vehicles and normal user operation. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A schematic flowchart illustrating a security detection method provided in an embodiment of this application;

[0043] Figure 2 A flowchart illustrating a training method for a target Gaussian mixture model provided in an embodiment of this application;

[0044] Figure 3 A flowchart illustrating a method for calculating intra-cluster distance provided in an embodiment of this application;

[0045] Figure 4 A flowchart illustrating a method for calculating inter-cluster distance provided in an embodiment of this application;

[0046] Figure 5 A flowchart illustrating a method for determining a target Gaussian distribution value provided in an embodiment of this application;

[0047] Figure 6 This is a schematic diagram of the structure of a security detection device provided in an embodiment of this application;

[0048] Figure 7 This is a schematic diagram of the structure of a security detection device provided in an embodiment of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0050] It should be noted that the terms "comprising" and "having" and their variations used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0051] The terms "first" and "second" used in this document are for descriptive purposes only and should not be construed as implying relative importance or implicitly indicating the number of indicated technical features. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0052] The word “exemplary” as used below means “serving as an example, embodiment, or illustration.” Any embodiment illustrated as an “exemplary” need not be construed as superior to or better than other embodiments.

[0053] With the booming development of the intelligent vehicle industry, automobiles are gradually evolving towards automation, intelligence, and connectivity. As a key component of the Internet of Vehicles (IoV), the security of on-board cards (ITCs) directly affects the normal operation of vehicles and user safety. However, with the development of IoV, the security threats facing ITCs are also increasing. Attackers can exploit network vulnerabilities to carry out attacks such as remote control, data theft, and denial-of-service, posing serious threats to vehicle security and user privacy.

[0054] Therefore, how to ensure the network security of smart cars and the normal use by users through security testing of on-board cards is an important issue that urgently needs to be addressed.

[0055] Based on this, this application provides a security detection method. This method extracts features and standardizes the acquired network traffic data to be detected, obtaining a target standardized value. The target standardized value is then input into a target Gaussian mixture model (GMM), outputting a security detection result. Specifically, the target GMM is trained as follows: for each network traffic data point in the training set, feature values ​​are extracted and standardized to obtain a target standardized value; the number of peak values ​​in the target standardized value is obtained using kernel density estimation; and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value; the current Gaussian distribution value is adjusted based on the number of peak values, intra-cluster distance, inter-cluster distance, and preset adjustment parameters to obtain a target Gaussian distribution value; the pre-trained GMM is optimized based on the target Gaussian distribution value and the target standardized value until the GMM passes cross-validation, thus obtaining the target GMM. In other words, this application optimizes a pre-trained GMM based on network traffic data in the training set, thereby achieving security detection of network traffic data to be detected based on the target GMM, thereby ensuring the network security of intelligent vehicles and normal user operation.

[0056] For ease of understanding, the technical terms used in the embodiments of this application are explained below:

[0057] (1) A Gaussian Mixture Model (GMM) is a probabilistic model used to represent a mixture of multiple Gaussian distributions. The GMM assumes that data points are generated from multiple Gaussian distributions, and that these distributions collectively describe the overall structure of the data. Each Gaussian distribution has its own mean and covariance matrix, and each data point belongs to one of these components.

[0058] (2) On-board SIM card: An on-board SIM card is a dedicated SIM card embedded in a smart car for communication between the vehicle and external networks. On-board SIM cards are usually connected to the operator's mobile network (such as 4G, 5G) to support functions such as remote information services, data transmission, navigation, entertainment, remote diagnostics, vehicle control, and emergency rescue, thereby ensuring that the smart car can achieve continuous and stable data connection.

[0059] The present application will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0060] Figure 1 This is a flowchart illustrating a security detection method provided in an embodiment of this application, as shown below. Figure 1 As shown, a security detection method is provided for the implementation of this application, which specifically includes the following steps:

[0061] S101. Perform feature extraction and standardization on the acquired network traffic data to be detected to obtain the target standardized value to be detected;

[0062] Specifically, the network traffic data to be detected refers to the network traffic data exchanged between the vehicle-mounted card and the mobile network. This application periodically acquires the network traffic data to be detected from the vehicle-mounted card, and performs security checks on the acquired network traffic data to ensure the network security of the intelligent vehicle and the normal use by the user. The network activity recorded in the network traffic data to be detected includes packet size, protocol type, inter-packet interval duration, protocol connection duration, and number of authentication failures.

[0063] Among them, packet size refers to the memory size of the data packet in network communication transmission; protocol type refers to the transmission protocol of the data packet, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and HTTP (Hypertext Transfer Protocol); packet interval duration refers to the interval between the transmission of two data packets; protocol connection duration refers to the session duration of each transmission protocol; and authentication failure count refers to the number of login authentication failures recorded by the vehicle card.

[0064] S102. Input the standardized value of the target to be detected into the target Gaussian mixture model and output the security detection result;

[0065] Specifically, a target Gaussian mixture model is used to perform security checks on the network traffic data to be detected. The log-likelihood value of the network traffic data to be detected is calculated. If the value of the log-likelihood value is greater than a preset threshold, the security detection result output by the target Gaussian mixture model is normal. If the value of the log-likelihood value is less than the preset threshold, the security detection result output by the target Gaussian mixture model is abnormal.

[0066] In this embodiment of the application, the target Gaussian mixture model is trained in the following manner, such as Figure 2 The diagram shown is a flowchart illustrating a training method for a target Gaussian mixture model provided in an embodiment of this application, including the following steps:

[0067] S201. For each network traffic data in the training set, feature value extraction and standardization are performed on the network traffic data to obtain the target standardized value.

[0068] It should be noted that before extracting feature values ​​and standardizing network traffic data, the received network traffic data also needs to be cleaned and organized. Specifically, by identifying and deleting outliers in the network traffic data, noisy data and invalid records are removed from the network traffic data, resulting in preprocessed network traffic data. Then, missing values ​​are filled in the preprocessed network traffic data based on interpolation or mean filling methods.

[0069] This application extracts and standardizes the cleaned and processed network traffic data to obtain a target standardized value, and then optimizes the pre-trained Gaussian mixture model based on the target standardized value. The specific implementation process for feature extraction and standardization is described below:

[0070] In one possible implementation, the first value obtained by multiplying the packet size in the network traffic data by a preset one-hot encoding is used as a specific protocol feature value; the specific protocol feature value is then standardized with a mean of 0 and a standard deviation of 1 to obtain a standardized specific protocol feature value.

[0071] In a specific embodiment, the data packet sizes of multiple preset duration windows are obtained. A one-hot encoding corresponding to the protocol type is determined by identifying the protocol type. The first value obtained by multiplying the data packet size by the corresponding one-hot encoding is used as a specific protocol feature value. For example, as shown in Table 1, this table contains network traffic data for four preset duration windows obtained in the current period.

[0072]

[0073] Table 1

[0074] As shown in Table 1, the one-hot encoding is (1,0,0) for TCP, (0,1,0) for UDP, and (0,0,1) for HTTP. Based on the packet size and corresponding one-hot encoding in Table 1, a specific protocol feature value is calculated, where the specific protocol feature value = packet size × one-hot encoding.

[0075] In other words, for the first preset duration window, the specific protocol feature value = 1500 × (1,0,0) = 1500; for the second preset duration window, the specific protocol feature value = 60 × (0,1,0) = 60; for the third preset duration window, the specific protocol feature value = 1200 × (1,0,0) = 1200; and for the fourth preset duration window, the specific protocol feature value = 1500 × (0,0,1) = 800.

[0076] The specific protocol feature value obtained is [1500, 60, 1200, 800].

[0077] Standardize the specific protocol feature values ​​with a mean of 0 and a standard deviation of 1 to obtain the standardized feature values. The formula for standardization is:

[0078]

[0079] Where x1 represents any eigenvalue of c in [1500, 60, 1200, 800], μ1 represents the average value of the eigenvalues ​​of a specific protocol in [1500, 60, 1200, 800], and δ1 represents the standard deviation of the eigenvalues ​​of a specific protocol in [1500, 60, 1200, 800]. The calculated values ​​are μ1 = 890 and δ1 = 539.72.

[0080] Therefore, based on μ1=890, δ1=539.72 and the standardization formula, the specific protocol characteristic value after standardization is calculated to be [1.133, -1.54, 0.575, -0.167].

[0081] The preset duration window can be 5 minutes. It should be noted that this application does not limit the number of preset duration windows included in the network traffic data. The number and duration of the preset duration windows are not limited by the application. The above-mentioned number and duration of preset duration windows are only one optional embodiment provided by this application.

[0082] In one possible implementation, the second value obtained by dividing the number of protocol switching times in the network traffic data by the total duration of the protocol connection is used as the protocol switching frequency feature value; the protocol switching frequency feature value is then standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized protocol switching frequency feature value.

[0083] In a specific embodiment, the number of protocol switching times and protocol connection durations for multiple preset duration windows are obtained. The total protocol connection duration is obtained by summing the protocol connection durations for each preset duration window. The second value, obtained by dividing the number of protocol switching times in the network traffic data by the total protocol connection duration, is used as the protocol switching frequency feature value. For example, the protocol sequence in the first preset duration window is from TCP to UDP, and from UDP to HTTP, meaning there are 2 protocol switching times in the first preset duration window; the protocol sequence in the second preset duration window is from UDP to TCP, from TCP to HTTP, and from HTTP to TCP, meaning there are 3 protocol switching times in the second preset duration window; the protocol sequence in the third preset duration window is from TCP to UDP, meaning there is 1 protocol switching time in the third preset duration window; and the protocol sequence in the fourth preset duration window is from HTTP to TCP, from TCP to UDP, and from UDP to HTTP, meaning there are 3 protocol switching times in the fourth preset duration window. For example, Table 2 shows the network traffic data for the four preset duration windows obtained in the current period.

[0084]

[0085] Table 2

[0086] As shown in Table 2, the protocol switching frequency occurs twice within the first preset duration window, with a connection duration of 180 seconds; three times within the second preset duration window, with a connection duration of 300 seconds; once within the third preset duration window, with a connection duration of 45 seconds; and three times within the fourth preset duration window, with a connection duration of 600 seconds. Based on the protocol switching frequency and connection duration in Table 2, a protocol switching frequency characteristic value is calculated, where: Protocol switching frequency characteristic value = Protocol switching frequency / Protocol connection duration.

[0087] In other words, for the first preset duration window, the protocol switching frequency characteristic value is 2 / 180 = 0.0111; for the second preset duration window, the protocol switching frequency characteristic value is 3 / 300 = 0.01; for the third preset duration window, the protocol switching frequency characteristic value is 1 / 45 = 0.0222; and for the fourth preset duration window, the protocol switching frequency characteristic value is 3 / 600 = 0.005.

[0088] The obtained protocol switching frequency characteristic value is [0.0111, 0.01, 0.0222, 0.005].

[0089] The protocol switching frequency characteristic values ​​are standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized protocol switching frequency characteristic values. The formula for standardization is:

[0090]

[0091] Where x2 represents any one of the protocol switching frequency characteristic values ​​in [0.0111, 0.01, 0.0222, 0.005], μ2 represents the average value of the protocol switching frequency characteristic values ​​in [0.0111, 0.01, 0.0222, 0.005], and δ2 represents the standard deviation of the protocol switching frequency characteristic values ​​in [0.0111, 0.01, 0.0222, 0.005]. The calculated values ​​are μ2 = 0.012 and δ2 = 0.0051.

[0092] Therefore, based on μ2=0.012, δ2=0.0051 and the standardization formula, the standardized protocol switching frequency characteristic value is calculated to be [-0.1544, -0.329, 1.601, -1.118].

[0093] In one possible implementation, the third value obtained by multiplying the packet size and inter-packet interval in the network traffic data is used as the traffic rate feature value; the traffic rate feature value is then standardized to have a mean of 0 and a standard deviation of 1, resulting in a standardized traffic rate feature value.

[0094] In a specific embodiment, the data packet size of a preset duration window is obtained, and the packet interval duration is determined by determining the interval duration between two data packet transmissions. For example, as shown in Table 3, the network traffic data of four preset duration windows obtained in the current period are as follows.

[0095]

[0096] Table 3

[0097] Based on the data packet size and inter-packet interval duration in Table 3, the flow rate characteristic value is calculated, where the flow rate characteristic value = data packet size × inter-packet interval duration.

[0098] In other words, for the first preset duration window, the flow rate characteristic value is 1500 × 0.01 = 15; for the second preset duration window, the flow rate characteristic value is 60 × 0.05 = 3; for the third preset duration window, the flow rate characteristic value is 1200 × 0.02 = 24; and for the fourth preset duration window, the flow rate characteristic value is 800 × 0.04 = 32.

[0099] The obtained flow rate characteristic value is [15,3,24,32].

[0100] The flow rate characteristic value is standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized flow rate characteristic value. The formula for standardization is:

[0101]

[0102] Where x3 represents any one of the flow rate characteristic values ​​in [15,3,24,32], μ3 represents the average value of the flow rate characteristic value in [15,3,24,32], and δ3 represents the standard deviation of the flow rate characteristic value in [15,3,24,32]. The calculated values ​​are μ3 = 18.5 and δ3 = 10.78.

[0103] Therefore, based on μ3 = 18.5, δ3 = 10.78 and the normalization formula, the normalized flow rate characteristic value is calculated to be [-0.302, -1.134, 0.474, 1.168].

[0104] In one possible implementation, the fifth value, obtained by dividing the number of authentication failures in the network traffic data by the fourth value, is used as the failure rate weighted feature value. This failure rate weighted feature value is then standardized to have a mean of 0 and a standard deviation of 1, resulting in a standardized failure rate weighted feature value. Here, the fourth value is the sum of the total protocol connection duration and a preset value.

[0105] In a specific embodiment, the number of authentication failures within multiple preset duration windows is obtained, and the total protocol connection duration is obtained by summing the durations of each protocol connection within the preset duration windows. The preset value can be 10. -6 The total connection duration of the protocol is multiplied by 10. -6 The first sum is used as the fourth value. The fifth value, obtained by dividing the number of authentication failures in the network traffic data by the fourth value, is used as the failure rate weighted feature value. The fourth value is obtained by summing a preset value with the total protocol connection duration to avoid division by zero. For example, as shown in Table 4, this table contains network traffic data for four preset duration windows obtained in the current period.

[0106]

[0107] Table 4

[0108] Based on the number of authentication failures and the fourth value in Table 4, the failure rate weighted feature value is calculated, where the failure rate weighted feature value = number of authentication failures / (total protocol connection time + 10) -6 ).

[0109] In other words, for the first preset duration window, the failure rate weighted feature value = 0 / (100+10) -6 =0, for the second preset duration window, the failure rate weighted feature value = 1 / (45+10) -6=0.0222, for the third preset duration window, the failure rate weighted feature value = 0 / (200+10) -6 =0, for the fourth preset duration window, the failure rate weighted feature value = 2 / (180+10) -6 = 0.0111.

[0110] The obtained flow rate characteristic value is [0, 0.0222, 0, 0.0111].

[0111] The failure rate weighted feature values ​​are standardized with a mean of 0 and a standard deviation of 1 to obtain the standardized failure rate weighted feature values. The formula for standardization is:

[0112]

[0113] Where x4 represents any one of the failure rate weighted eigenvalues ​​in [0, 0.0222, 0, 0.0111], μ4 represents the average of the failure rate weighted eigenvalues ​​in [0, 0.0222, 0, 0.0111], and δ4 represents the standard deviation of the failure rate weighted eigenvalues ​​in [0, 0.0222, 0, 0.0111]. The calculated values ​​are μ4 = 0.0083 and δ4 = 0.009.

[0114] Therefore, based on μ4 = 0.0083, δ4 = 0.009 and the standardization formula, the weighted characteristic value of the failure rate after standardization is calculated to be [-0.86, 1431, -0.86, 0.287].

[0115] In summary, the target standardized values ​​obtained from network traffic data in this application include standardized specific protocol characteristic values, protocol switching frequency characteristic values, traffic rate characteristic values, and failure rate weighted characteristic values.

[0116] It should be noted that the packet size, number of protocol switching, total protocol connection duration, packet interval duration, and number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

[0117] S202. Based on the kernel density estimation method, the number of peak values ​​of the target standardized value is obtained, and based on the current Gaussian distribution value and the target standardized value, the intra-cluster distance and inter-cluster distance are calculated.

[0118] In one possible implementation, the peak number P of the target normalized value is calculated based on the packet size and kernel density estimation method in network traffic data.

[0119] In one possible implementation, such as Figure 3The diagram shown is a flowchart illustrating a method for calculating intra-cluster distance according to an embodiment of this application. The steps are as follows:

[0120] S301. Calculate the average value corresponding to each feature value included in the target standardized value, wherein each feature value includes a specific protocol feature value after standardization, a protocol switching frequency feature value, a traffic rate feature value, and a failure rate weighted feature value;

[0121] S302. For each average value, calculate the first absolute value of the difference between the average value and each value in the target feature value, calculate the second sum of the first absolute values, and calculate the sixth value obtained by dividing the second sum by the amount of data of the target feature value, wherein the target feature value corresponds to the average value.

[0122] S303. The seventh value obtained by dividing the sum of the sixth values ​​by the current Gaussian distribution value is used as the intra-cluster distance.

[0123] Optionally, taking standardized specific protocol characteristic values, protocol switching frequency characteristic values, traffic rate characteristic values, and failure rate weighted characteristic values ​​as examples, the calculation process of intra-cluster distance is described in detail below. The intra-cluster distance can be determined using the following formula:

[0124]

[0125] Among them, D intra The eigenvalue represents the intra-cluster distance, and K represents the current Gaussian distribution value. Since there are 4 eigenvalues ​​after standardization in this application, the current Gaussian distribution value K is 4. i The amount of data in the target feature value Ci, where Ci represents the target feature value, x represents a value in the target feature value, and μ i The average value corresponding to the target feature value.

[0126] Optionally, taking the standardized specific protocol feature value C1 as an example, calculate the average value μ1 corresponding to each feature value included in the target standardized value. If it is known that the standardized specific protocol feature value is [1.133, -1.54, 0.575, -0.167], then the average value μ1 is 0.00025.

[0127] For the average value μ1 = 0.00025, calculate the absolute value of the difference between each value in the standardized protocol feature values ​​and the average value μ1 = 0.00025. Specifically, calculate the first absolute value of the difference between x = 1.133 and μ1 = 0.00025: 1.13275; the first absolute value of the difference between x = -1.54 and μ1 = 0.00025: 1.54025; the first absolute value of the difference between x = 0.575 and μ1 = 0.00025: 0.57475; and the first absolute value of the difference between x = -0.167 and μ1 = 0.00025: 0.16725. The second sum of the calculated first absolute values ​​is 3.415. Calculate the sixth value by dividing the second sum of 3.415 by the amount of data in the target feature value. Since the amount of data in the specific protocol feature value after standardization is 4, the sixth value = 3.415 / 4 = 0.85375.

[0128] Optionally, if the sixth value of the standardized protocol characteristic value C1 is A1, the sixth value of the standardized protocol switching frequency characteristic value C2 is A2, the sixth value of the standardized traffic rate characteristic value C3 is A3, and the sixth value of the standardized failure rate weighted characteristic value C4 is A4.

[0129] Since the intra-cluster distance is the sum of the sixth value divided by the current Gaussian distribution value, that is, intra-cluster distance = (sum of the sixth value) / current Gaussian distribution value = (A1 + A2 + A3 + A4) / 4.

[0130] In one possible implementation, such as Figure 4 The diagram shown is a flowchart illustrating a method for calculating inter-cluster distance according to an embodiment of this application. The steps are as follows:

[0131] S401. For every two averages, calculate the second absolute value of the difference between the two averages, and calculate the third sum of the second absolute values.

[0132] S402. The product of the third sum and the eighth value is used as the inter-cluster distance. The eighth value is the ratio of the first ratio to the first difference. The first ratio is the ratio of 2 to the current Gaussian distribution value. The first difference is the difference between the current Gaussian distribution value and 1.

[0133] Optionally, taking standardized specific protocol characteristic values, protocol switching frequency characteristic values, traffic rate characteristic values, and failure rate weighted characteristic values ​​as examples, the calculation process of inter-cluster distance is described in detail below. The inter-cluster distance can be determined using the following formula:

[0134]

[0135] Among them, D interThe distance between clusters is represented by K, which represents the current Gaussian distribution value. Since there are 4 eigenvalues ​​after standardization in this application, the current Gaussian distribution value K is 4. i The average value, μ, represents the value corresponding to the target feature value. j It represents the average value corresponding to another target feature value.

[0136] For example, if the average value of a specific protocol characteristic C1 after standardization is B1, the average value of a protocol switching frequency characteristic C2 after standardization is B2, the average value of a traffic rate characteristic C3 after standardization is B3, and the average value of a failure rate weighted characteristic C4 after standardization is B4.

[0137] For each pair of averages B1, B2, B3, and B4, calculate the second absolute value of the difference between the two averages. That is, calculate |B1-B2|, |B1-B3|, |B1-B4|, |B2-B3|, |B2-B4|, and |B3-B4| respectively. Take the sum of the calculated |B1-B2|, |B1-B3|, |B1-B4|, |B2-B3|, |B2-B4|, and |B3-B4| as the third sum.

[0138] Calculate the inter-cluster distance as the product of the third sum and the eighth value, where the eighth value is... Since K is known to be 4, the eighth value is... In other words,

[0139] In this embodiment, after obtaining the number of peak values, intra-cluster distance, and inter-cluster distance, the current Gaussian distribution value is adjusted based on these values ​​to obtain a target Gaussian distribution value. Then, the pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target normalized value. The process of determining the target Gaussian distribution value is explained below:

[0140] S203. Adjust the current Gaussian distribution value based on the number of peaks, intra-cluster distance, inter-cluster distance, and preset adjustment parameters to obtain the target Gaussian distribution value;

[0141] In one possible implementation, such as Figure 5 The diagram shown is a flowchart illustrating a method for determining a target Gaussian distribution value according to an embodiment of this application. The specific steps are as follows:

[0142] S501. Determine whether the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter. If yes, execute S502; otherwise, execute S503.

[0143] S502. Determine the target Gaussian distribution value as the fourth sum of the current Gaussian distribution value and 1.

[0144] S503. Determine whether the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter. If yes, execute S504; otherwise, execute S505.

[0145] S504. Determine the target Gaussian distribution value as the second difference between the current Gaussian distribution value and 1.

[0146] S505. Determine the target Gaussian distribution value as the current Gaussian distribution value.

[0147] In a specific embodiment, if the number of peak values ​​is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the fourth sum of the current Gaussian distribution value and 1; if the number of peak values ​​is less than or equal to the current Gaussian distribution value and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the second difference between the current Gaussian distribution value and 1; if the number of peak values ​​is greater than the current Gaussian distribution value and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value; if the number of peak values ​​is less than or equal to the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0148] For example, if the current Gaussian distribution value K is 4, the calculated number of peaks P is 3, and the calculated intra-cluster distance D... intra The calculated inter-cluster distance D is 0.5. inter The value is 0.7, and the preset adjustment parameter a is 2. Calculations show that P = 3 < K = 4, and D... inter =0.7 < 2 × D intra The product of 1 and 1 means that the target Gaussian distribution value is the current Gaussian distribution value, which means that the target Gaussian distribution value is 4.

[0149] For example, if the current Gaussian distribution value K is 4, the calculated number of peaks P is 5, and the calculated intra-cluster distance D... intra The calculated inter-cluster distance D is 0.5. inter The value is 0.7, and the preset adjustment parameter a is 2. Calculations show that P = 5 > K = 4, and D... inter =0.7 < 2 × D intra The product of 1 and 1 is the fourth sum of the current Gaussian distribution value and 1, which means the target Gaussian distribution value is 5.

[0150] For example, if the current Gaussian distribution value K is 4, the calculated number of peaks P is 3, and the calculated intra-cluster distance D... intra The calculated inter-cluster distance D is 0.3. inter The value is 0.7, and the preset adjustment parameter a is 2. Calculations show that P = 3 < K = 4, and D... inter =0.7>2×D intra The product of 0.6 means that the target Gaussian distribution value is the second difference between the current Gaussian distribution value and 1, which means the target Gaussian distribution value is 3.

[0151] S204. Optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

[0152] In a specific embodiment, the Gaussian mixture model pre-trained based on the obtained target Gaussian distribution value and target standardized value is optimized. The optimized Gaussian mixture model is evaluated based on cross-validation or an independent validation set until the Gaussian mixture model passes cross-validation. Thus, based on the target Gaussian mixture model, the security detection of the network traffic data to be detected is achieved, thereby ensuring the network security of intelligent vehicles and the normal use by users.

[0153] It should be noted that the log-likelihood value of the network traffic data to be detected is calculated by the target Gaussian mixture model. If the value of the log-likelihood value is greater than the preset threshold, the security detection result output by the target Gaussian mixture model is normal. If the value of the log-likelihood value is less than the preset threshold, the security detection result output by the target Gaussian mixture model is abnormal.

[0154] If the target Gaussian mixture model outputs an abnormal security detection result, the system will also send an alarm signal to the security operations center and the user interface. This alarm signal is used to notify the security operations center of abnormal network traffic data, isolate the abnormal on-board unit (HSIM), and alert the user via the user interface.

[0155] Based on the same inventive concept, this application also provides a security detection device, which is similar in principle to the above-described security detection method. Details that are repeated will not be repeated here. Figure 6 The diagram shown is a structural schematic of a security detection device provided in an embodiment of this application, comprising:

[0156] The security detection unit 601 is used to perform feature extraction and standardization processing on the acquired network traffic data to be detected, to obtain the target standardized value to be detected; the target standardized value to be detected is input into the target Gaussian mixture model, and the security detection result is output.

[0157] The model training unit 602 is used to extract and standardize the network traffic data for each network traffic data in the training set to obtain the target standardized value; obtain the number of peaks of the target standardized value based on the kernel density estimation method; and calculate the intra-cluster distance and inter-cluster distance based on the current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the number of peaks, intra-cluster distance, inter-cluster distance and preset adjustment parameters to obtain the target Gaussian distribution value; and optimize the pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation to obtain the target Gaussian mixture model.

[0158] This application provides a security detection method and apparatus. The method involves extracting features and standardizing acquired network traffic data to obtain a target standardized value. This target standardized value is then input into a target Gaussian mixture model (Gaussian Mixture Model), which outputs the security detection result. Specifically, the target Gaussian mixture model is trained as follows: for each network traffic data point in the training set, feature values ​​are extracted and standardized to obtain a target standardized value; the number of peak values ​​in the target standardized value is obtained using kernel density estimation; and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value; the current Gaussian distribution value is adjusted based on the number of peak values, intra-cluster distance, inter-cluster distance, and preset adjustment parameters to obtain the target Gaussian distribution value; and the pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation, thus obtaining the target Gaussian mixture model. In other words, this application optimizes a pre-trained Gaussian mixture model based on network traffic data in the training set, thereby achieving security detection of network traffic data to be detected based on the target Gaussian mixture model, thereby ensuring the network security of intelligent vehicles and the normal use by users.

[0159] In one possible implementation, the model training unit 602 described above is specifically used for:

[0160] Identify and remove outliers from the network traffic data to obtain preprocessed network traffic data;

[0161] Missing values ​​are filled in the preprocessed network traffic data using interpolation or mean filling methods.

[0162] In one possible implementation, the model training unit 602 described above is specifically used for:

[0163] The first value, obtained by multiplying the packet size in the network traffic data by a preset one-hot encoding, is used as a specific protocol feature value; the second value, obtained by dividing the number of protocol switching in the network traffic data by the total protocol connection duration, is used as a protocol switching frequency feature value; the third value, obtained by multiplying the packet size in the network traffic data by the inter-packet interval duration, is used as a traffic rate feature value; and the fifth value, obtained by dividing the number of authentication failures in the network traffic data by a fourth value, is used as a failure rate weighted feature value, wherein the fourth value is the sum of the total protocol connection duration and a preset value.

[0164] The specific protocol feature value, the protocol switching frequency feature value, the traffic rate feature value, and the failure rate weighted feature value are standardized with a mean of 0 and a standard deviation of 1. The standardized specific protocol feature value, protocol switching frequency feature value, traffic rate feature value, and failure rate weighted feature value are used as the target standardized value.

[0165] The data packet size, the number of protocol switching times, the total duration of the protocol connection, the packet interval duration, and the number of authentication failures are obtained within a preset duration window, and the network traffic data includes data from at least two preset duration windows.

[0166] In one possible implementation, the model training unit 602 described above is specifically used for:

[0167] Calculate the average value corresponding to each feature value included in the target standardized value, wherein each feature value includes a specific protocol feature value after standardization, a protocol switching frequency feature value, a traffic rate feature value, and a failure rate weighted feature value;

[0168] For each average value, calculate the first absolute value of the difference between the average value and each value in the target feature value, calculate the second sum of the first absolute values, and calculate the sixth value by dividing the second sum by the data amount of the target feature value, wherein the target feature value corresponds to the average value;

[0169] The seventh value, obtained by dividing the sum of the sixth values ​​by the current Gaussian distribution value, is the intra-cluster distance.

[0170] In one possible implementation, the model training unit 602 described above is specifically used for:

[0171] For every two averages, calculate the second absolute value of the difference between the two averages, and calculate the third sum of the second absolute values;

[0172] The product of the third sum and the eighth value is taken as the inter-cluster distance. The eighth value is the ratio of the first ratio to the first difference. The first ratio is the ratio of 2 to the current Gaussian distribution value, and the first difference is the difference between the current Gaussian distribution value and 1.

[0173] In one possible implementation, the model training unit 602 described above is specifically used for:

[0174] If the number of peaks is greater than the current Gaussian distribution value and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the fourth sum of the current Gaussian distribution value and 1.

[0175] If the number of peaks is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the second difference between the current Gaussian distribution value and 1.

[0176] If the number of peak values ​​is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0177] If the number of peak values ​​is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is less than the product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

[0178] In one possible implementation, the model training unit 602 described above is specifically used for:

[0179] Send alarm signals to the security operations center and user operation page.

[0180] Based on the same inventive concept, this application also provides a security detection device, which is similar in principle to the above-mentioned security detection method, and the repeated parts will not be described again.

[0181] like Figure 7 The diagram shown is a structural schematic of a security detection device provided in an embodiment of this application. The device includes at least one processor 701 and a memory 702 communicatively connected to the at least one processor. In this embodiment, the memory 702 stores instructions that can be executed by the at least one processor 701. The instructions are executed by the at least one processor 701 to enable the at least one processor 701 to perform the security detection method described in the above embodiment.

[0182] The processor 701 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 701 is used to implement the security detection method described above when it invokes a computer program stored in the memory 702.

[0183] In one possible design, memory 702 can be volatile memory, such as random-access memory (RAM); memory 702 can also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 702 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. Memory 702 can be a combination of the above-mentioned memories.

[0184] This application embodiment does not limit the specific connection medium between the memory 702 and the processor 701 described above. This application embodiment... Figure 7 The memory 702 and the processor 701 are connected via a bus 703, and the bus 703 is in Figure 7 The connections between other components are shown in bold lines only and are not intended to be limiting. The 703 bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0185] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a security detection method described above.

[0186] In some possible implementations, various aspects of the security detection method provided in this application can also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in a security detection method according to various exemplary embodiments of this application as described above.

[0187] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0188] This application provides a security detection method, apparatus, device, and storage medium. The method involves feature extraction and standardization of acquired network traffic data to be detected, yielding a target standardized value. This target standardized value is then input into a target Gaussian mixture model (Gaussian Mixture Model), outputting the security detection result. Specifically, the target Gaussian mixture model is trained as follows: for each network traffic data point in the training set, feature extraction and standardization are performed to obtain a target standardized value. The number of peak values ​​in the target standardized value is obtained using kernel density estimation, and the intra-cluster distance and inter-cluster distance are calculated based on the current Gaussian distribution value and the target standardized value. The current Gaussian distribution value is adjusted based on the number of peak values, intra-cluster distance, inter-cluster distance, and preset adjustment parameters to obtain the target Gaussian distribution value. The pre-trained Gaussian mixture model is optimized based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation, resulting in the target Gaussian mixture model. In other words, this application optimizes a pre-trained Gaussian mixture model based on network traffic data in the training set, thereby enabling security detection of network traffic data to be detected based on the target Gaussian mixture model, thus ensuring the network security of intelligent vehicles and normal user operation.

[0189] The present application has been described above with reference to block diagrams and / or flowcharts illustrating methods, apparatus (systems), and / or computer program products according to embodiments of the present application. It should be understood that a block of a block diagram and / or flowchart, as well as combinations of blocks of block diagrams and / or flowcharts, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, and / or other programmable data processing means to produce a machine, such that the instructions, executable via the computer processor and / or other programmable data processing means, create methods for implementing the functions / actions specified in the blocks of the block diagrams and / or flowcharts.

[0190] Accordingly, this application can also be implemented using hardware and / or software (including firmware, resident software, microcode, etc.). Furthermore, this application can take the form of a computer program product on a computer-usable or computer-readable storage medium, having computer-usable or computer-readable program code implemented in the medium for use by or in conjunction with an instruction execution system. In the context of this application, a computer-usable or computer-readable medium can be any medium that can contain, store, communicate, transmit, or deliver a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0191] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A security detection method characterized by, The method comprises: performing feature extraction and standardization processing on the obtained network traffic data to be detected to obtain target standardization values to be detected; inputting the target standardization values to be detected into a target Gaussian mixture model to output a security detection result; wherein the target Gaussian mixture model is obtained by the following method: for each network traffic data in the training set, performing feature value extraction and standardization processing on the network traffic data to obtain target standardization values; based on a kernel density estimation method, obtaining the number of peaks of the target standardization values, and based on the current Gaussian distribution value and the target standardization values, calculating the intra-cluster distance and the inter-cluster distance; based on the number of peaks, the intra-cluster distance, the inter-cluster distance and a preset adjustment parameter, adjusting the current Gaussian distribution value to obtain a target Gaussian distribution value; based on the target Gaussian distribution value and the target standardization values, optimizing a pre-trained Gaussian mixture model until the Gaussian mixture model passes cross-validation, to obtain the target Gaussian mixture model.

2. The method of claim 1, wherein, Before the network traffic data is subjected to feature value extraction and standardization processing to obtain target standardization values, the method further comprises: identifying and deleting outliers of the network traffic data to obtain preprocessed network traffic data; based on an interpolation filling method or a mean filling method, filling missing values in the preprocessed network traffic data.

3. The method of claim 1, wherein, The feature extraction and standardization processing of the network traffic data to obtain target standardization values comprises: multiplying a data packet size in the network traffic data by a preset one-hot encoding to obtain a first value as a specific protocol feature value; dividing a protocol switching frequency in the network traffic data by a protocol connection total time length to obtain a second value as a protocol switching frequency feature value; multiplying the data packet size in the network traffic data by an inter-packet interval time length to obtain a third value as a flow rate feature value; dividing a number of authentication failures in the network traffic data by a fourth value to obtain a fifth value as a failure rate weighted feature value, the fourth value being a first sum of the protocol connection total time length and a preset value; performing standardization processing on the specific protocol feature value, the protocol switching frequency feature value, the flow rate feature value and the failure rate weighted feature value with a mean value of 0 and a standard deviation of 1, and obtaining the specific protocol feature value, the protocol switching frequency feature value, the flow rate feature value and the failure rate weighted feature value after standardization processing as target standardization values; wherein the data packet size, the protocol switching frequency, the protocol connection total time length, the inter-packet interval time length and the number of authentication failures are obtained within a preset time window, and the network traffic data comprises data of at least two preset time windows.

4. The method of claim 3, wherein, The calculation of the intra-cluster distance based on the current Gaussian distribution value and the target standardization values comprises: calculating an average value corresponding to each feature value included in the target standardization values, wherein each feature value comprises a specific protocol feature value, a protocol switching frequency feature value, a flow rate feature value and a failure rate weighted feature value after standardization processing; For each average value, a first absolute value of a difference between the average value and each value in the target feature value is calculated, a second sum value of the calculated first absolute values is calculated, and a sixth value obtained by dividing the second sum value by a data amount of the target feature value is calculated, wherein the target feature value corresponds to the average value; A seventh value obtained by dividing a sum value of the obtained sixth values by the current Gaussian distribution value is taken as the intra-cluster distance.

5. The method of claim 4, wherein, The inter-cluster distance is calculated based on the current Gaussian distribution value and the target standardized value, and includes: For each two average values in the average values, a second absolute value of a difference between the two average values is calculated, and a third sum value of the calculated second absolute values is calculated; A product of the third sum value and an eighth value is taken as the inter-cluster distance, the eighth value being a ratio of a first ratio value to a first difference value, the first ratio value being a ratio of 2 to the current Gaussian distribution value, and the first difference value being a difference between the current Gaussian distribution value and 1.

6. The method of claim 1, wherein, The current Gaussian distribution value is adjusted based on the peak value quantity, the intra-cluster distance, the inter-cluster distance, and a preset adjustment parameter to obtain a target Gaussian distribution value, and includes: In a case where the peak value quantity is greater than the current Gaussian distribution value, and the inter-cluster distance is less than a product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be a fourth sum value of the current Gaussian distribution value and 1; In a case where the peak value quantity is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to a product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be a second difference value of the current Gaussian distribution value and 1; In a case where the peak value quantity is greater than the current Gaussian distribution value, and the inter-cluster distance is greater than or equal to a product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value; In a case where the peak value quantity is less than or equal to the current Gaussian distribution value, and the inter-cluster distance is less than a product of the intra-cluster distance and the adjustment parameter, the target Gaussian distribution value is determined to be the current Gaussian distribution value.

7. The method according to any one of claims 1 to 6, characterized in that, In a case where the safety detection result output by the target Gaussian mixture model is abnormal, further comprising: Sending an alarm signal to a security operation center and a user operation page.

8. A safety detection apparatus characterized by comprising: The apparatus includes: A safety detection unit configured to perform feature extraction and standardization processing on acquired network traffic data to be detected to obtain a target standardized value to be detected, and input the target standardized value to be detected into a target Gaussian mixture model to output a safety detection result. The model training unit is configured to, for each network traffic data in the training set, perform feature value extraction and standardization processing on the network traffic data to obtain a target standardized value; obtain a peak value number of the target standardized value based on a kernel density estimation method, and calculate an intra-cluster distance and an inter-cluster distance based on a current Gaussian distribution value and the target standardized value; adjust the current Gaussian distribution value based on the peak value number, the intra-cluster distance, the inter-cluster distance, and a preset adjustment parameter to obtain a target Gaussian distribution value; and optimize a pre-trained Gaussian mixture model based on the target Gaussian distribution value and the target standardized value until the Gaussian mixture model passes cross-validation, thereby obtaining the target Gaussian mixture model.

9. A safety detection apparatus, characterized by, The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method in any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the method in any one of claims 1-7.

Images