Host security risk assessment method and device and nonvolatile storage medium

Abstract

The invention discloses a host security risk assessment method and device and a nonvolatile storage medium. The method comprises the following steps: acquiring multi-dimensional host security data; structured processing is carried out on the host security data to obtain feature data of multiple dimensions, and the feature data of each dimension corresponds to one feature; the feature data of the multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, and one feature space corresponds to the feature data corresponding to one feature; and performing security risk assessment on the feature data in the plurality of feature spaces of the same dimension by using a risk assessment model to obtain an assessment result, the risk assessment model being used for performing security risk assessment on the host based on the feature data in the plurality of feature spaces. According to the method and the device, the technical problem of inaccurate evaluation result caused by neglecting the multi-source and multi-dimensional properties of a security problem due to the fact that a host security evaluation method in the related technology is often aimed at the security problem of a single type is solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method and device for evaluating host security risks and a non-volatile storage medium. Background Art

[0002] In the era of informatization and digital transformation, host security has become one of the most concerned issues for organizations and individuals. With the widespread application of technologies such as cloud computing, big data, and the Internet of Things, the complexity and diversity of the network environment are constantly increasing, and the host security risks are also showing a multi-source, multi-dimensional, and changeable trend. In the face of this challenge, building a network security system that comprehensively controls the security status of the entire network host, improves multi-dimensional risk detection capabilities, and optimizes the alarm handling mechanism has become an urgent need to ensure the stable operation of the information system, protect the security of data assets, and safeguard the rights and interests of users. In today's host servers, security involves multiple aspects, including physical environment security, operating system security, application security, and network attack security. These security issues are often complex and changeable, and require a combination of multiple means to protect them. However, the methods used in the host security assessment in related technologies often target a single type of security issue, while ignoring the multi-source and multi-dimensional nature of security issues, resulting in inaccurate assessment results.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a host security risk assessment method, device and non-volatile storage medium to at least solve the technical problem that host security assessment methods in related technologies often target a single type of security issue, but ignore the multi-source and multi-dimensional nature of security issues, resulting in inaccurate assessment results.

[0005] According to one aspect of an embodiment of the present application, a method for assessing host security risks is provided, including: obtaining multi-dimensional host security data; performing structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; mapping the feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; performing security risk assessment on the feature data in multiple feature spaces of the same dimension using a risk assessment model to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0006] In some embodiments of the present application, feature data of multiple dimensions are mapped to multiple feature spaces of the same dimension, including: performing dimensionality reduction processing on the feature data of multiple dimensions: performing de-averaging processing on the feature data of multiple dimensions; determining a covariance matrix based on the feature data of multiple dimensions after de-averaging; determining the eigenvalues ​​and eigenvectors of the covariance matrix; sorting the eigenvalues ​​from large to small, and constructing a feature space for the eigenvectors corresponding to the eigenvalues ​​with a preset number of digits in front; and mapping the feature data of multiple dimensions to the feature space corresponding to the feature data of each dimension.

[0007] In some embodiments of the present application, the method also includes: determining feature data containing garbled codes or empty characters in the feature space as incomplete data, and obtaining a ratio library, wherein the ratio library is used to store the ratio of each field in the feature data after dimensionality reduction processing under preset conditions, and the preset conditions refer to the situation where all fields of the feature data are complete data and there are no garbled codes or empty characters; and filling in the incomplete data fields based on the ratio library.

[0008] In some embodiments of the present application, the risk assessment model is trained in the following manner: obtaining a target sample set; dividing the target sample set to obtain a training set, a validation set, and a test set; inputting the training set into the initial risk assessment model for training, and adjusting the parameters of the initial risk assessment model based on the validation set to obtain a first risk assessment model; testing the first risk assessment model based on the test set; if the first risk assessment model passes the test, the first risk assessment model is tested as a risk assessment model. The model trained in this manner can more accurately assess host security risks, is applicable to various security assessment and early warning systems, and improves the response speed and accuracy of the system.

[0009] In some embodiments of the present application, before inputting the target sample set into the initial risk assessment model for training, the method also includes: determining the ratio of the number of positive samples to the number of negative samples stored in the first feature space in the target sample set, wherein the positive samples are used to represent samples generated when a security risk occurs to the host, and the negative samples are used to represent samples generated when no security risk occurs to the host, and the first feature space is the feature space corresponding to any one feature; when the ratio is less than a first preset threshold, iterating the following process until the ratio is equal to the first preset threshold: calculating a first similarity between each positive sample in the first feature space and other positive samples in the first feature space, and determining a first adjacent sample set based on the first similarity; constructing a first synthetic sample based on the first adjacent sample set, and storing the first synthetic sample as a positive sample in the first feature space.

[0010] In some embodiments of the present application, the method also includes: when the ratio is greater than a first preset threshold, iterating the following process until the ratio is equal to the first preset threshold: calculating the second similarity between each negative sample in the first feature space and other negative samples in the first feature space, and determining a second adjacent sample set based on the second similarity; constructing a second synthetic sample based on the second adjacent sample set, and storing the second synthetic sample as a negative sample in the first feature space.

[0011] In some embodiments of the present application, a training set is input into an initial risk assessment model for training, and the parameters of the initial risk assessment model are adjusted based on a validation set to obtain a first risk assessment model, including: obtaining a candidate parameter set, wherein the candidate parameter set includes a candidate range of parameters and a combination of different parameters; iterating the following process until the candidate parameter set is traversed: using the training set to train an initial risk assessment model that selects a first preset parameter combination, and using the validation set to adjust the parameters of the initial risk assessment model, wherein the first preset parameter combination is any parameter combination in the candidate parameter set that has not been trained with the risk assessment model; determining performance indicators after the training is completed; determining a target parameter adjustment method based on the performance indicators determined in each iteration; and continuing to adjust the initial risk assessment model based on the target parameter adjustment method to obtain a first risk assessment model.

[0012] According to another aspect of an embodiment of the present application, a host security risk assessment device is also provided, including: an acquisition module, used to acquire multi-dimensional host security data; a structured processing module, used to perform structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; a mapping module, used to map the feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; a risk assessment module, used to perform security risk assessment on the feature data in multiple feature spaces of the same dimension using a risk assessment model to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned host security risk assessment method.

[0014] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including: a memory and a processor, the processor being used to run a program stored in the memory, wherein the above-mentioned host security risk assessment method is executed when the program is running.

[0015] According to another aspect of an embodiment of the present application, a computer program product is also provided, including computer instructions, which implement the above-mentioned host security risk assessment method when executed by a processor.

[0016] In an embodiment of the present application, a method is adopted to obtain multi-dimensional host security data; perform structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; map the feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; use a risk assessment model to perform security risk assessment on the feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces, by obtaining multi-dimensional host security data and performing structured processing to obtain feature data of multiple different dimensions, wherein the feature data of each dimension corresponds to one dimension, and then map these feature data to multiple different feature spaces of the same dimension, and finally use the risk assessment model to perform security risk assessment on the feature data of multiple different feature spaces to obtain an assessment result, thereby achieving the purpose of mapping data of different dimensions to the same dimension and performing security analysis and assessment, thereby achieving the technical effect of the host security assessment method for evaluating multi-dimensional security issues, thereby solving the technical problem that the host security assessment method in the related art often targets a single type of security issue, while ignoring the multi-source and multi-dimensional nature of the security issue, resulting in inaccurate assessment results. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a host security risk assessment method provided in an embodiment of the present application;

[0019] Figure 2 It is a flowchart of a method for evaluating host security risks provided in accordance with an embodiment of the present application;

[0020] Figure 3 is a structural schematic diagram of characteristic data provided according to an embodiment of the present application;

[0021] Figure 4 is a confusion matrix schematic diagram provided according to an embodiment of the present application;

[0022] Figure 5It is a flowchart of another host security risk assessment method provided according to an embodiment of the present application;

[0023] Figure 6 It is a structural schematic diagram of a host security risk assessment device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] In the related art, the security of the host server involves multiple aspects, including physical environment security, operating system security, application security, network attack security and other security issues of multiple dimensions. These security issues are often complex and changeable, and require a combination of multiple means to protect. There are related technologies that often use methods for host security assessment to target a single type of security issue, while ignoring the multi-source and multi-dimensional nature of security issues, resulting in inaccurate assessment results. In order to solve this problem, a relevant solution is provided in the embodiments of the present application, which is described in detail below.

[0028] According to an embodiment of the present application, an embodiment of a method for assessing host security risks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] The method embodiments provided in the embodiments of the present application can be executed in a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal for implementing a host security risk assessment method is shown. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0030] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the host security risk assessment method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned host security risk assessment method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0034] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for assessing host security risks. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] like Figure 2 FIG. 1 is a flow chart of a method for assessing host security risks according to an embodiment of the present application, including:

[0036] Step S202, obtaining multi-dimensional host security data, for example, obtaining multi-dimensional host security data collected by a host security management platform.

[0037] Step S204, performing structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature.

[0038] The following is a specific embodiment: First, the acquired multi-dimensional host security data is cleaned, for example, duplicates are removed, missing values ​​are processed (for example, records containing missing values ​​are filled or deleted using the mean, median, mode), incorrect data formats are corrected, useless or irrelevant data fields are removed, etc. After data cleaning, the collected raw data is parsed into smaller components for easy understanding and processing. For example, key information is extracted from XML or JSON data, or information such as date, time, location, event, etc. in text records are extracted separately. According to the parsed information, corresponding fields are created and given meaningful names. These fields reflect the main components of the data, such as event type, timestamp, source IP, target IP, port number, etc. The extracted fields are standardized to ensure consistent data formats. For example, all date and time fields are converted to a unified format, text fields are converted to lowercase, extra spaces are removed, and numeric fields are converted to appropriate units. Non-numeric data (such as text, classification labels) are encoded as numeric data. For example, a classification feature is converted into multiple binary features using one-hot encoding, or a text feature is mapped to a number using label encoding. Integrate the processed data into a unified structure, such as a data table or database, ensuring that each record has a clear identifier and that all relevant information is included in the record.

[0039] Step S206 , mapping the feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature.

[0040] In the technical solution provided in step S206, there are many ways to implement mapping feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, for example, by using the principal component analysis (PCA) of the self-encoder to reduce the dimension, the feature data of multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, specifically: the feature data of multiple dimensions are reduced in dimension: the feature data of multiple dimensions are averaged; the covariance matrix is ​​determined based on the feature data of multiple dimensions after averaged processing; the eigenvalues ​​and eigenvectors of the covariance matrix are determined; the eigenvalues ​​are sorted from large to small, and the feature space is constructed for the eigenvectors corresponding to the eigenvalues ​​with the first preset number of digits; the feature data of multiple dimensions are mapped to the feature space corresponding to the feature data of each dimension. By reducing the dimension, not only the complexity of data processing is reduced, but also the training efficiency of the model is improved, which is particularly suitable for real-time monitoring and rapid response scenarios.

[0041] The following are specific embodiments:

[0042] First, the average value of the feature data is calculated for each dimension of features V1 to V12, and then the average value is subtracted from the feature data of each dimension. This step can eliminate the offset between features, centralize the data, and facilitate the subsequent calculation of the covariance matrix. Using the data after the average value is processed, the covariance matrix between all features is calculated. The covariance matrix is ​​a symmetric matrix, in which the covariance value of each pair of features reflects the linear relationship between them. The covariance matrix is ​​subjected to eigenvalue decomposition to obtain eigenvalues ​​(Eigenvalues) and corresponding eigenvectors (Eigenvectors). The eigenvalue represents the degree of variation along the direction of the eigenvector in the feature space, and the eigenvector indicates the main direction of change of the feature data. Sort the decomposed eigenvalues ​​from large to small, and select the largest k eigenvalues, where k is the number of features after the preset dimensionality reduction. The eigenvectors corresponding to these eigenvalues ​​will be used to construct the new feature space after dimensionality reduction. The eigenvectors corresponding to the selected k largest eigenvalues ​​are used as the row vectors of the matrix to construct the eigenvector matrix ev. This is essentially selecting the k directions with the most significant data changes as the new coordinate axes. Using the constructed eigenvector matrix ev, the feature data of multiple dimensions are mapped to this new k-dimensional feature space. This step is completed through matrix multiplication to obtain the feature representation after dimensionality reduction, and the features are scaled to the same specification. The feature data after dimensionality reduction can not only reduce the complexity of data processing, but also improve the training speed and prediction accuracy of the model. Especially when processing large-scale, high-dimensional data, it can significantly improve the efficiency of the algorithm. At the same time, because the dimensionality reduction process takes into account the correlation between features and the main direction of data change, the features after dimensionality reduction can still retain the key information of the data, which is suitable for real-time monitoring and rapid response scenarios such as risk assessment models. Figure 3 is a schematic diagram of a characteristic data structure provided according to an embodiment of the present application, such as Figure 3 The figure shows the multi-dimensional feature data scaled to the same specification. The features corresponding to the feature data of V1-V12 are shown in Table 1. Each feature corresponds to a security issue of one dimension. Class is used to map the final evaluation result, which is expressed as a probability value. The closer the evaluation result is to 1, the higher the security risk is, and the closer it is to 0, the lower the security risk is. Considering that there is a common correlation between features, and the risk of security incidents between features affects each other. Each feature (alarm type) is adjusted according to the preset weight according to the impact.

[0043] Y=w1V1+w2V2+......+w n V n ,

[0044] Among them, Y represents the sum of weighted features, w i Represents feature V iThe weight value of (i is 1-n).

[0045] Table 1

[0046] V1 Host high-risk vulnerabilities V2 Moderate vulnerability on host V3 Abnormal login alarm V4 User change behavior V5 Key file changes V6 Bounce Connection Behavior V7 Abnormal resource usage V8 Port Change Behavior V9 Abnormal connection behavior V10 Scheduled task changes V11 Log clearing behavior V12 Malicious files

[0047] It should be noted that after dimensionality reduction, feature data mapped to different feature spaces may have anomalies such as empty characters or garbled characters. For such anomalies, the following methods can be used to handle them: feature data with garbled characters or empty characters in the feature space is determined as incomplete data, and a ratio library is obtained, where the ratio library is used to store the ratio of each field in the feature data after dimensionality reduction under preset conditions, where the preset condition means that all fields of the feature data are complete data, and there are no garbled characters or empty characters; fill in the incomplete data fields based on the ratio library. This method can effectively handle missing values ​​in the data, improve the integrity of the data and the accuracy of the model, and is particularly suitable for environments with low data quality.

[0048] The following are specific embodiments:

[0049] In terms of data quality, data feature processing algorithms are applied to process data with garbled or empty characters, and feature data with garbled or empty characters in the feature space are determined as incomplete data. For this type of data, the normal data distribution (data distribution without any abnormalities) is first counted and stored in the ratio library, and then the empty characters and garbled characters are filled with normal data according to probability. For example: under normal circumstances, the probability of field content A is 50%, the probability of B is 30%, and the probability of C is 20%. The incomplete data A, B, and C are filled according to the above ratios.

[0050] Step S208, using the risk assessment model to perform security risk assessment on the feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0051] In the technical solution provided in step S208, the risk assessment model is trained in the following manner: obtaining a target sample set; dividing the target sample set to obtain a training set, a validation set, and a test set; inputting the training set into the initial risk assessment model for training, and adjusting the parameters of the initial risk assessment model based on the validation set to obtain a first risk assessment model; testing the first risk assessment model based on the test set; and if the first risk assessment model passes the test, testing the first risk assessment model as a risk assessment model. The model trained in this manner can more accurately assess host security risks, is applicable to various security assessment and early warning systems, and improves the response speed and accuracy of the system.

[0052] The training set is input into the initial risk assessment model for training, and the parameters of the initial risk assessment model are adjusted based on the validation set to obtain the first risk assessment model. There are many ways to implement the method, for example: obtaining a candidate parameter set, wherein the candidate parameter set includes a candidate range of parameters and a combination of different parameters; iterating the following process until the candidate parameter set is traversed: using the training set to train the initial risk assessment model that selects the first preset parameter combination, and using the validation set to adjust the parameters of the initial risk assessment model, wherein the first preset parameter combination is any parameter combination in the candidate parameter set that has not been trained for the risk assessment model; determining the performance indicators after the training is completed; determining the target parameter adjustment method based on the performance indicators determined in each iteration; and continuing to adjust the initial risk assessment model based on the target parameter adjustment method to obtain the first risk assessment model.

[0053] It should be noted that before the target sample set is input into the initial risk assessment model for training in the above step, it is necessary to ensure that the number of positive samples and negative samples in the target sample set is equal, so as to improve the generalization ability and prediction accuracy of the model. For example, the number of positive samples and negative samples in the target sample set can be equalized in the following manner: determine the ratio of the number of positive samples to the number of negative samples stored in the first feature space of the target sample set, wherein the positive sample is used to represent the sample generated when the host has a security risk, and the negative sample is used to represent the sample generated when the host has no security risk, and the first feature space is the feature space corresponding to any one feature; when the ratio is less than the first preset threshold, iterate the following process until the ratio is equal to the first preset threshold: calculate the first similarity between each positive sample in the first feature space and other positive samples in the first feature space, and determine the first adjacent sample set based on the first similarity; construct a first synthetic sample based on the first adjacent sample set, and store the first synthetic sample as a positive sample in the first feature space. When the ratio is greater than the first preset threshold, the following process is iterated until the ratio is equal to the first preset threshold: calculate the second similarity between each negative sample in the first feature space and other negative samples in the first feature space, determine the second adjacent sample set based on the second similarity; construct a second synthetic sample based on the second adjacent sample set, and store the second synthetic sample as a negative sample in the first feature space. In this way, the balance of the positive and negative sample ratios during model training can be ensured, avoiding the excessive bias of the model towards a certain type of sample during prediction, improving the fairness and effectiveness of the model, and being suitable for various data security analysis and prediction scenarios.

[0054] The following are specific embodiments:

[0055] The initial risk assessment model (e.g., a logistic regression model) scales the validation results to between 0 and 1 based on sigmoid multivariate linear regression, for example, by the following formula:

[0056] Among them, f(x) represents the function output, x represents the input value (i.e., feature data), and e represents a constant.

[0057] At the same time, regularization is introduced into the initial risk assessment model to prevent overfitting, increase the robustness of the model, and improve the generalization and promotion capabilities: for example, through the following formula:

[0058] in, represents the penalty value, α represents the learning rate, Indicates accumulation, |w i | represents the i-th eigenvalue, J0 represents the loss function of linear regression, and J represents the result of loss value + penalty value.

[0059] The loss function J0 of linear regression is expressed by the following formula:

[0060]

[0061] Among them, h θ (x (i) ) represents the predicted value of the ith item, y (i) Represents the true value of the i-th item, true value - predicted value = loss value.

[0062] Because the positive samples and negative samples in the target sample set present a large sample imbalance, such data has an unreliable impact on model learning. By using the nearest neighbor rule (if most of the K most similar (i.e., nearest) samples of a sample in the feature space belong to a certain category, then the sample also belongs to this category, and the Euclidean distance is used to measure the similarity between samples), new data is created so that positive samples account for 50.00% and negative samples account for 50.00%. For example, the ratio of the number of positive samples to the number of negative samples stored in the first feature space in the target sample set is determined. When the ratio is less than a first preset threshold (e.g., 1), it means that there are fewer positive samples. Then, the adjacent sample set of the positive sample is determined by calculating the similarity between the positive samples. Based on this adjacent sample set, a synthesis method is used (e.g., for each pair of selected adjacent samples, a new synthetic sample is created by interpolation or a method based on statistical distribution) to generate a new first synthetic sample as a positive sample, and then the synthetic sample is added to the positive sample set until the ratio of positive and negative samples reaches the preset threshold. If there are fewer negative samples (i.e., the ratio is greater than a preset threshold), the similarity between the negative samples is calculated, the adjacent sample set of the negative sample is determined, a new second synthetic sample is synthesized as a negative sample, and added to the negative sample set until the ratio of positive to negative samples reaches the preset threshold.

[0063] On the basis of 50% positive samples and 50% negative samples, the target sample set is input into the initial risk assessment model for training: the target sample set is divided into 3 parts: training set, validation set and test set, the model is learned in the training set, parameters are tuned on the validation set, and finally tested on the test set. The grid search method is used to tune the parameters (specifically hyperparameters, such as learning rate, regularization strength, network structure, etc.) on the validation set. By constructing a candidate parameter set, and then traversing all possible parameter combinations, the initial risk assessment model is trained for each combination and its performance is evaluated, and the performance indicators are recorded after each training. Performance evaluation is usually carried out in a cross-validation manner to ensure the reliability and generalization ability of the evaluation results. Cross-validation is a method for evaluating model performance and stability. It divides the data set into several equal subsets and then repeatedly uses these subsets for training and validation. In each cycle, one subset is used as a validation set, and the remaining subsets are combined as training sets. Through multiple iterations, the model is trained and evaluated on different combinations of training sets and validation sets. Finally, the performance indicators (including but not limited to accuracy, recall rate, F1 score, etc.) on all validation sets after training are summarized. After the iteration, statistics such as the mean or median of these performance indicators are calculated to evaluate the overall performance of the model and determine the target parameter adjustment method. The target parameter adjustment method is the parameter combination with the best performance in the predefined parameter candidate range and combination method during the model training process. Based on the target parameter adjustment method, the final hyperparameter adjustment is continued to be made to the initial risk assessment model to obtain the first risk assessment model. When the first risk model passes the test set test, the training is completed. Specifically, the above steps are implemented through the grid search cross validation (GridSearchCV) method. First, the candidate parameter set is obtained, and the defined parameter grid and model instance (that is, the initial risk assessment model that uses the training set to select the first preset parameter combination) are passed to the GridSearchCV method. At the same time, the number of cross-validation folds is specified. The GridSearchCV method automatically traverses all combinations in the parameter grid (that is, traversal of the candidate parameter set). In each cycle, cross-validation is used to evaluate the model performance, determine the performance indicators after the training is completed, and finally determine the target parameter adjustment method and the target parameters.

[0064] The present application embodiment also provides a confusion matrix schematic diagram, such as Figure 4 As shown, Figure 4The recall metric and confusion matrix of the model on the test dataset are provided. The recall metric is used to characterize the accuracy of the risk assessment model. Under this test set, the recall metric in the testing dataset of the risk assessment model after parameter tuning is 0.9031855419992265. The confusion matrix provides a more detailed comparison between the model prediction results and the actual results, where the horizontal axis represents the predicted label and the vertical axis represents the true label. The numbers in the matrix represent the number of samples with different label combinations. For example, Figure 2 The 55397, 1447, 5507, and 51375 in the figure represent the number of actual positive samples verified as positive samples, actual positive samples verified as negative samples, actual negative samples verified as positive samples, and actual negative samples verified as negative samples, respectively, as shown in Table 2 below:

[0065]

[0066] The true value is positive (positive sample), the number that the risk assessment model considers to be positive (True Positive = TP), TP = 53397 in the figure; the true value is positive, the number that the risk assessment model evaluates to be negative (negative samples) (False Negative = FN), FN = 1447 in the figure; the true value is negative, the number that the risk assessment model evaluates to be positive (False Positive = FP), FP = 5507 in the figure; the true value is negative, the number that the model considers to be negative (True Negative = TN), TN = 51375 in the figure. TP represents the number of samples whose true values ​​are positive and whose risk assessment model evaluates them as negative. FN represents the number of samples whose true values ​​are negative and whose risk assessment model evaluates them as positive. Substituting this into the formula, we can get a recall rate of 0.9031855419992265. The confusion matrix helps evaluate the accuracy and stability of the model, especially when dealing with unbalanced data sets, such as when the normal cases far outnumber the abnormal cases in the host security risk data.

[0067] The present application embodiment also provides a flowchart of another method for evaluating host security risks, such as Figure 5 As shown, Figure 5The content describes the logic and algorithm flow of the risk assessment model method. The weighted logistic regression algorithm involved in the risk assessment model in the embodiment of the present application first continues with algorithm selection, logistic regression: in the scenario analysis stage, determine the algorithm that best suits the current problem. Logistic regression (Logistic Regression) is selected as the algorithm core of this method. It is used to predict the probability of an event occurring and is very suitable for solving the binary classification problem of host security risks. Alternative options: Random Forest (Random Forest) is also listed as one of the algorithm alternatives. It is an integrated learning method that improves the accuracy and stability of the model by combining the prediction results of multiple decision trees. Although logistic regression is preferred in this method, random forest provides another perspective and alternative solutions, especially when dealing with high-dimensional features and nonlinear relationships. Then, missing value processing and data standardization are performed (i.e., the host security data is structured as mentioned above to obtain feature data of multiple dimensions), feature engineering steps, feature data of multiple dimensions are processed through feature derivation, feature selection and feature scaling (i.e., the feature data of multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, and features V1-V12 are scaled to the same specification); by dealing with sample imbalance, feature weighting and classifier training, a combination of cross-validation and grid search is used in model evaluation and optimization to tune the model parameters, and finally a performance evaluation is performed (i.e., the training set is input into the initial risk assessment model for training, and the parameters of the initial risk assessment model are adjusted based on the validation set).

[0068] The present application embodiment provides a host security risk assessment device, such as Figure 6 As shown, including:

[0069] The acquisition module 602 is used to acquire multi-dimensional host security data.

[0070] The structured processing module 604 is used to perform structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature.

[0071] The mapping module 606 is used to map the feature data of multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature.

[0072] The mapping module 606 is also used to perform dimensionality reduction processing on feature data of multiple dimensions: perform de-averaging processing on feature data of multiple dimensions; determine the covariance matrix based on the feature data of multiple dimensions after de-averaging; determine the eigenvalues ​​and eigenvectors of the covariance matrix; sort the eigenvalues ​​from large to small, and construct a feature space for the eigenvectors corresponding to the eigenvalues ​​with a preset number of digits in front; map the feature data of multiple dimensions to the feature space corresponding to the feature data of each dimension.

[0073] The mapping module 606 is also used to determine the feature data with garbled codes or empty characters in the feature space as incomplete data, and obtain a ratio library, wherein the ratio library is used to store the ratio of each field in the feature data after dimensionality reduction processing under preset conditions, and the preset conditions refer to that all fields of the feature data are complete data, and there are no garbled codes or empty characters; the incomplete data fields are filled based on the ratio library.

[0074] The risk assessment module 608 is used to use a risk assessment model to perform security risk assessment on feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0075] The risk assessment module 608 is also used to obtain a target sample set; divide the target sample set to obtain a training set, a validation set, and a test set; input the training set into the initial risk assessment model for training, and adjust the parameters of the initial risk assessment model based on the validation set to obtain a first risk assessment model; test the first risk assessment model based on the test set; if the first risk assessment model passes the test, the first risk assessment model is tested as a risk assessment model. The model trained in this way can more accurately assess the host security risk, is applicable to various security assessment and early warning systems, and improves the response speed and accuracy of the system.

[0076] The risk assessment module 608 is also used to determine the ratio of the number of positive samples to the number of negative samples stored in the first feature space in the target sample set, wherein the positive sample is used to represent the sample generated when the host has a security risk, and the negative sample is used to represent the sample generated when the host has no security risk, and the first feature space is the feature space corresponding to any one feature; when the ratio is less than the first preset threshold, iterate the following process until the ratio is equal to the first preset threshold: calculate the first similarity between each positive sample in the first feature space and other positive samples in the first feature space, and determine the first adjacent sample set based on the first similarity; construct a first synthetic sample based on the first adjacent sample set, and store the first synthetic sample as a positive sample in the first feature space. When the ratio is greater than the first preset threshold, iterate the following process until the ratio is equal to the first preset threshold: calculate the second similarity between each negative sample in the first feature space and other negative samples in the first feature space, and determine the second adjacent sample set based on the second similarity; construct a second synthetic sample based on the second adjacent sample set, and store the second synthetic sample as a negative sample in the first feature space.

[0077] The risk assessment module 608 is also used to obtain a candidate parameter set, wherein the candidate parameter set includes a candidate range of parameters and combinations of different parameters; iterate the following process until the traversal of the candidate parameter set is completed: use the training set to train the initial risk assessment model that selects the first preset parameter combination, and use the verification set to adjust the parameters of the initial risk assessment model, wherein the first preset parameter combination is any parameter combination in the candidate parameter set that has not been trained for the risk assessment model; determine the performance indicator after the training is completed; determine the target parameter adjustment method based on the performance indicator determined in each iteration; continue to adjust the initial risk assessment model based on the target parameter adjustment method to obtain a first risk assessment model.

[0078] It should be noted that Figure 6 The host security risk assessment device shown is used to perform Figure 2 The host security risk assessment method shown is therefore Figure 2 The relevant explanations in the host security risk assessment method in also apply to the host security risk assessment device, and will not be repeated here.

[0079] It should be noted that the various modules in the above-mentioned host security risk assessment device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0080] The embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above host security risk assessment method. For example, multi-dimensional host security data is obtained; structured processing is performed on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; the feature data of multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; a risk assessment model is used to perform security risk assessment on the feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0081] The embodiment of the present application also provides an electronic device, the electronic device includes a processor, the processor is used to run a program, wherein the above host security risk assessment method is executed when the program is running. For example, multi-dimensional host security data is obtained; the host security data is structured to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; the feature data of multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; a risk assessment model is used to perform a security risk assessment on the feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform a security risk assessment on the host based on the feature data in multiple feature spaces.

[0082] According to another aspect of the embodiment of the present application, a computer program product is also provided, including a computer program, which implements the above host security risk assessment method when executed by a processor. For example, multi-dimensional host security data is obtained; the host security data is structured to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; the feature data of multiple dimensions are mapped to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to feature data corresponding to one feature; a risk assessment model is used to perform security risk assessment on the feature data in multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in multiple feature spaces.

[0083] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0084] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0087] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0088] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for evaluating host security risk, characterized in that: include: Obtain multi-dimensional host security data; Performing structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; Mapping the feature data of the multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to the feature data corresponding to one feature; A risk assessment model is used to perform security risk assessment on the feature data in the multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in the multiple feature spaces.

2. The method according to claim 1, characterized in that Mapping the feature data of the multiple dimensions to multiple feature spaces of the same dimension includes: Perform dimensionality reduction processing on the feature data of the multiple dimensions: Performing a mean value processing on the feature data of the multiple dimensions; Determine a covariance matrix based on the feature data of the multiple dimensions after the average value processing; Determining eigenvalues ​​and eigenvectors of the covariance matrix; The eigenvalues ​​are sorted from large to small, and the eigenvalue space is constructed for the eigenvectors corresponding to the eigenvalues ​​with the first preset number of digits; The feature data of the multiple dimensions are mapped to the feature space corresponding to the feature data of each dimension.

3. The method according to claim 2, characterized in that The method further comprises: Determine the feature data containing garbled characters or empty characters in the feature space as incomplete data, Obtaining a ratio library, wherein the ratio library is used to store the ratio of each field in the feature data after the dimensionality reduction process under a preset condition, wherein the preset condition refers to that all fields of the feature data are complete data without garbled characters or empty characters; The incomplete data is field filled based on the ratio library.

4. The method according to claim 1, characterized in that: The risk assessment model is trained in the following way: Obtain a target sample set; Dividing the target sample set into a training set, a validation set and a test set; Inputting the training set into an initial risk assessment model for training, and adjusting the parameters of the initial risk assessment model based on the validation set to obtain a first risk assessment model; Testing the first risk assessment model based on the test set; In the case where the first risk assessment model passes the test, the first risk assessment model is tested as the risk assessment model.

5. The method according to claim 4, characterized in that Before inputting the target sample set into the initial risk assessment model for training, the method further includes: Determine a ratio of the number of positive samples to the number of negative samples stored in the first feature space in the target sample set, wherein the positive samples are used to represent samples generated when a security risk occurs to the host, and the negative samples are used to represent samples generated when no security risk occurs to the host, and the first feature space is a feature space corresponding to any one of the features; When the ratio is less than a first preset threshold, iterate the following process until the ratio is equal to the first preset threshold: Calculating a first similarity between each positive sample in the first feature space and other positive samples in the first feature space, and determining a first adjacent sample set based on the first similarity; A first synthetic sample is constructed based on the first adjacent sample set, and the first synthetic sample is stored in the first feature space as a positive sample.

6. The method according to claim 5, characterized in that The method further includes: when the ratio is greater than the first preset threshold, iterating the following process until the ratio is equal to the first preset threshold: Calculating a second similarity between each negative sample in the first feature space and other negative samples in the first feature space, and determining a second adjacent sample set based on the second similarity; A second synthetic sample is constructed based on the second adjacent sample set, and the second synthetic sample is stored in the first feature space as a negative sample.

7. The method according to claim 4, characterized in that The training set is input into the initial risk assessment model for training, and the parameters of the initial risk assessment model are adjusted based on the validation set to obtain a first risk assessment model, including: Acquire a candidate parameter set, wherein the candidate parameter set includes a candidate range of parameters and a combination of different parameters; Iterate the following process until the traversal of the candidate parameter set is completed: use the training set to train the initial risk assessment model that selects the first preset parameter combination, and use the validation set to adjust the parameters of the initial risk assessment model, wherein the first preset parameter combination is any parameter combination in the candidate parameter set that has not been trained for the risk assessment model; determine the performance indicator after the training is completed; Determining a target parameter adjustment method based on the performance indicator determined in each iteration; The initial risk assessment model is further adjusted based on the target parameter adjustment method to obtain the first risk assessment model.

8. A host security risk assessment device, characterized in that: include: The acquisition module is used to obtain multi-dimensional host security data; A structured processing module, used for performing structured processing on the host security data to obtain feature data of multiple dimensions, wherein the feature data of each dimension corresponds to a feature; A mapping module, used for mapping the feature data of the multiple dimensions to multiple feature spaces belonging to the same dimension, wherein one feature space corresponds to the feature data corresponding to one feature; The risk assessment module is used to use a risk assessment model to perform security risk assessment on the feature data in the multiple feature spaces of the same dimension to obtain an assessment result, wherein the risk assessment model is used to perform security risk assessment on the host based on the feature data in the multiple feature spaces.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the host security risk assessment method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program, when running, executes the host security risk assessment method described in any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the host security risk assessment method described in any one of claims 1 to 7 is implemented.

Images