Cloud security threat detection method and device, equipment and storage medium

Abstract

The invention provides a cloud security threat detection method and device, equipment and a storage medium, and the method comprises the steps: carrying out the preprocessing of a pre-obtained cloud security threat data set, and obtaining a first target cloud security threat data set; obtaining a cloud security threat detection coefficient corresponding to each target feature; removing a first feature in the target features according to the cloud security threat detection coefficient to obtain a second feature; removing third features in the second features according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set; and outputting a cloud security threat detection result. The data set in the embodiment of the invention improves the accuracy and efficiency of cloud security threat detection through feature simplification, and the output detection result is more reliable and accurate.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cloud security technology, and in particular to a cloud security threat detection method, apparatus, device, and storage medium. Background Art

[0002] With the rapid development of the Internet, various economic and livelihood activities have gradually shifted to the Internet, and the wave of enterprise digital transformation has intensified. As an important infrastructure for enterprise digital transformation, cloud computing has received attention from all walks of life and has been widely used in government affairs, transportation, medical care, finance and other fields. With the widespread migration of various industries to the cloud, the field of cloud security has also ushered in more challenges. Business systems on the cloud are increasingly being invaded by malicious attackers. With the upgrading of malicious attack technology, the means of attack are becoming more and more diverse. In order for the security protection system of an enterprise to accurately identify and properly handle these complex attack methods, it is necessary to simultaneously upgrade its threat detection technology.

[0003] In the related technology, network intrusion data is collected, features are extracted to construct a training set, the amount of data of types with less data volume is increased, and then an integrated learning method is used to combine multiple learners to make predictions on the data category to which the detection data belongs.

[0004] However, the above method does not screen the extracted features. Therefore, the acquired raw data has many feature dimensions and poor data expression ability, which is prone to dimensionality disaster, causing the algorithm's computational overhead to grow exponentially with the increase of data dimension. Using such raw data for training will seriously affect the accuracy of the detection results. Summary of the invention

[0005] Embodiments of the present application provide a cloud security threat detection method, apparatus, device, and storage medium.

[0006] In a first aspect, an embodiment of the present application provides a cloud security threat detection method, the method comprising:

[0007] Preprocessing the pre-acquired cloud security threat data set to obtain a first target cloud security threat data set, where the first target cloud security threat data set includes a target feature;

[0008] Obtaining cloud security threat detection coefficients corresponding to each of the target features;

[0009] Eliminating a first feature from the target feature according to the cloud security threat detection coefficient to obtain a second feature;

[0010] Eliminate the third feature in the second feature according to a preset value and a pre-built feature selection function, and obtain a second target cloud security threat data set;

[0011] Output the cloud security threat detection result corresponding to the second target cloud security threat data set.

[0012] Optionally, preprocessing the pre-acquired cloud security threat dataset to obtain the first target cloud security threat dataset includes:

[0013] Obtain cloud security threat datasets;

[0014] Determine whether there are missing values, and / or outliers in the features of the cloud security threat dataset;

[0015] If there are missing values ​​in the features of the cloud security threat dataset, fill or delete the missing values ​​with fixed values; and / or,

[0016] If there are outliers in the features of the cloud security threat data set, mean padding or deletion is performed on the outliers to obtain a first target cloud security threat data set.

[0017] Optionally, obtaining the cloud security threat detection coefficient corresponding to each of the target features includes:

[0018] The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each of the target features.

[0019] Optionally, removing the first feature from the target feature according to the cloud security threat detection coefficient to obtain the second feature includes:

[0020] Sorting each of the cloud security threat detection coefficients and outputting a bar graph of the correlation between the characteristic value and the cloud security threat detection;

[0021] A first feature to be eliminated from the target feature is determined according to the histogram to obtain a second feature.

[0022] Optionally, the removing a third feature from the second feature according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set includes:

[0023] The feature selection function is constructed by minimizing the residual sum of squares plus the penalty term of the preset minimum absolute shrinkage and selection operator algorithm;

[0024] The third feature in the second feature is eliminated according to a preset preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set.

[0025] Optionally, the outputting the cloud security threat detection result corresponding to the second target cloud security threat data set includes:

[0026] The second target cloud security threat data set is input into the boosting model, and a cloud security threat detection result corresponding to at least one algorithm integrated in the boosting model is output.

[0027] Optionally, inputting the second target cloud security threat data set into the boosting model, and outputting the cloud security threat detection result corresponding to at least one algorithm integrated in the boosting model includes:

[0028] Inputting the second target cloud security threat data set into the boosting model, and outputting the receiver operating characteristic curve and area under the curve value corresponding to each algorithm integrated in the boosting model;

[0029] Determine the target algorithm in the boosting model according to the receiver operating characteristic curve and the area under the curve value;

[0030] The cloud security threat detection result corresponding to the second target cloud security threat data set is outputted through the target algorithm.

[0031] In a second aspect, an embodiment of the present application provides a cloud security threat detection device, the device comprising:

[0032] A preprocessing module, configured to preprocess the pre-acquired cloud security threat data set to obtain a first target cloud security threat data set, wherein the first target cloud security threat data set includes a target feature;

[0033] An acquisition module, used to acquire a cloud security threat detection coefficient corresponding to each of the target features;

[0034] A first elimination module, configured to eliminate a first feature from the target feature according to the cloud security threat detection coefficient to obtain a second feature;

[0035] A second elimination module, configured to eliminate a third feature from the second feature according to a preset value and a pre-constructed feature selection function, to obtain a second target cloud security threat data set;

[0036] An output module is used to output a cloud security threat detection result corresponding to the second target cloud security threat data set.

[0037] Optionally, the preprocessing module includes:

[0038] A first preprocessing submodule is used to obtain a cloud security threat dataset;

[0039] A second preprocessing submodule, used to determine whether there are missing values ​​and / or abnormal values ​​in the features of the cloud security threat dataset;

[0040] A third preprocessing submodule is configured to fill or delete a missing value if there is a missing value in a feature in the cloud security threat dataset; and / or,

[0041] The fourth preprocessing submodule is configured to, if there are abnormal values ​​in the features of the cloud security threat data set, perform mean padding or deletion on the abnormal values ​​to obtain a first target cloud security threat data set.

[0042] Optionally, the acquisition module includes:

[0043] The first acquisition submodule is used to input the target features into the Pearson model and calculate the cloud security threat detection coefficient corresponding to each of the target features.

[0044] Optionally, the first rejection module includes:

[0045] A first elimination submodule, used for sorting each of the cloud security threat detection coefficients and outputting a histogram of the correlation between the characteristic value and the cloud security threat detection;

[0046] The second elimination submodule is used to determine the first feature to be eliminated from the target features according to the histogram to obtain the second feature.

[0047] Optionally, the second rejection module includes:

[0048] The third elimination submodule is used to construct a feature selection function by minimizing the residual sum of squares plus a penalty term of a preset minimum absolute shrinkage and selection operator algorithm;

[0049] The fourth elimination submodule is used to eliminate the third feature in the second feature according to a preset preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set.

[0050] Optionally, the output module includes:

[0051] The output submodule is used to input the second target cloud security threat data set into the enhancement model, and output the cloud security threat detection result corresponding to at least one algorithm integrated in the enhancement model.

[0052] Optionally, the output submodule includes:

[0053] A first output unit, configured to input the second target cloud security threat data set into a boosting model, and output a receiver operating characteristic curve and an area under the curve value corresponding to each algorithm integrated in the boosting model;

[0054] A second output unit, used to determine a target algorithm in the boosting model according to the receiver operating characteristic curve and the area under the curve value;

[0055] The third output unit is used to output the cloud security threat detection result corresponding to the second target cloud security threat data set through the target algorithm.

[0056] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the cloud security threat detection methods described above.

[0057] In a fourth aspect, an embodiment of the present application further provides a storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute any of the cloud security threat detection methods described above.

[0058] In an embodiment of the present application, a first target cloud security threat data set is obtained by preprocessing a pre-acquired cloud security threat data set, wherein the first target cloud security threat data set includes target features; cloud security threat detection coefficients corresponding to each of the target features are obtained; the first feature in the target feature is eliminated according to the cloud security threat detection coefficient to obtain a second feature; the third feature in the second feature is eliminated according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set; and the cloud security threat detection result corresponding to the second target cloud security threat data set is output. That is, in an embodiment of the present application, a first target data set including target features is obtained by preprocessing a pre-acquired cloud security threat data set, and the cloud security threat detection coefficient of each target feature is calculated. The irrelevant first feature is eliminated according to the detection coefficient to obtain the second feature. The redundant third feature in the second feature is further eliminated using the preset value and the feature selection function, and finally the second target cloud security threat data set is generated. This data set improves the accuracy and efficiency of cloud security threat detection by streamlining features, and the output detection results are more reliable and accurate.

[0059] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0061] Figure 1It is a flowchart of the steps of a cloud security threat detection method provided by an embodiment of the present application;

[0062] Figure 2 It is a device block diagram of a cloud security threat detection device provided in an embodiment of the present application;

[0063] Figure 3 is a structural diagram of an electronic device provided in an embodiment of the present application;

[0064] Figure 4 is a schematic diagram of an exemplary cloud security threat detection method provided in an embodiment of the present application;

[0065] Figure 5 is a schematic diagram of an exemplary feature and threat detection correlation provided in an embodiment of the present application;

[0066] Figure 6 1 is a schematic diagram comparing ROC curves of three exemplary Boosting models provided in an embodiment of the present application. DETAILED DESCRIPTION

[0067] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0068] It should be noted that in the embodiment of the present application, a cloud security threat detection method based on feature optimization and Boosting algorithm is proposed. Figure 4 As shown, the present invention is divided into data preprocessing, feature optimization, Boosting algorithm processing, and model evaluation. First, the collected security threat data is preprocessed, and the missing values ​​are filled with the mean or fixed value, and the abnormal values ​​with too large missing ratio are deleted in the whole column; then the data set after data preprocessing is divided into a test set and a training set, and the feature dimension of the training set is reduced using the Pearson correlation coefficient and the Lasso algorithm; the training set and the test set after dimension reduction are respectively brought into the Boosting ensemble learning LightGBM, XGBoost, and CatBoost algorithms for model training to obtain the prediction results.

[0069] Figure 1 is a flowchart of a cloud security threat detection method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0070] Step 101, preprocessing a pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset, where the first target cloud security threat dataset includes a target feature;

[0071] Further, the preprocessing of the pre-acquired cloud security threat data set to obtain the first target cloud security threat data set includes:

[0072] Obtain cloud security threat datasets;

[0073] Determine whether there are missing values, and / or outliers in the features of the cloud security threat dataset;

[0074] If there are missing values ​​in the features of the cloud security threat dataset, fill or delete the missing values ​​with fixed values; and / or,

[0075] If there are outliers in the features of the cloud security threat data set, mean padding or deletion is performed on the outliers to obtain a first target cloud security threat data set.

[0076] It should be noted that in the embodiments of the present application, first, it is necessary to collect cloud security threat data, that is, it is necessary to obtain a cloud security threat data set, wherein cloud security threat data has many sources, for example: security log collector: using a security log collector, you can collect security logs of various cloud platforms, applications, and network devices, including login records, access records, abnormal events, etc.; security equipment: deploying firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS) and other security equipment, you can collect network traffic data, attack events, abnormal behavior and other security threat data; security information and event management (SIEM) system: SIEM system can integrate various security data sources, analyze and report the data, to help organizations monitor and respond to cloud security threats; security compliance tools: security compliance tools can help organizations collect and analyze security data that complies with regulations and standards, including data protection, access control, identity authentication and other aspects of the data; security analysis tools: can help organizations conduct in-depth analysis of cloud security data, discover potential security threats and vulnerabilities, and provide real-time security threat intelligence.

[0077] Therefore, in order to facilitate those skilled in the art to understand the present application, the embodiment of the present application takes the security threat data set A collected from the Web application firewall and the server security guard as an example for subsequent analysis.

[0078] After obtaining the cloud security threat dataset A, it is necessary to preprocess the data therein, perform operations such as filling missing values ​​and deleting outliers on the obtained dataset A, and obtain the first target cloud security threat dataset A0, so that the data are in the same dimension and the data expression ability is improved.

[0079] Specifically, the processing of the data set is described in detail by taking cloud security threat data set A as an example. Data set A has as many as 26 data features, which are divided into 6 categories, including traffic features, user behavior features, statistical features, location features, attack features, and protection features.

[0080] First, missing value processing. Among the original 26 features of cloud security threat dataset A, 19 features contain missing values, and the missing value ratio of 6 features is more than 30%. Features with too large missing value ratios are directly deleted, and 2 features are filled with fixed values.

[0081] Second, outlier detection. Outliers are abnormal values ​​in a data set, which may be incorrect "dirty data" or correct abnormal data. After specific analysis, some features need to be processed by mean filling, and some data that cannot be processed should be deleted.

[0082] After processing missing values ​​and outliers, 18 feature variables are retained, totaling 3862 samples. As shown in Table 1, the target features in the cloud security threat data set A in the embodiment of the present application include the following data feature indicators to identify cloud security threat risks.

[0083] Table 1 Target feature indicators and descriptions in cloud security threat dataset A

[0084]

[0085]

[0086] Step 102, obtaining a cloud security threat detection coefficient corresponding to each of the target features;

[0087] Further, obtaining the cloud security threat detection coefficient corresponding to each of the target features includes:

[0088] The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each of the target features.

[0089] It should be noted that, in the embodiment of the present application, the Pearson coefficient is used to analyze the correlation between features and credit, and Lasso is used to extract features with high importance, perform feature selection, reduce data dimensions, reduce high-dimensional risks, and output the second target cloud security threat data set A1 after feature optimization.

[0090] Therefore, the first step is to use the Pearson coefficient to analyze the correlation between features and credit. Specifically, the Pearson coefficient has the characteristics of decentralization and normalization, and has excellent performance in reflecting the correlation between target values ​​and feature values. Therefore, it is widely used to measure the linear correlation of features. Its formula is as follows:

[0091]

[0092] In the above formula 1, variable x is the eigenvalue, variable y is the credit score, and the Pearson correlation coefficient is the covariance of the above two variables divided by the product of their standard deviations. The coefficient r(x,y) ranges from -1 to 1. The closer the value is to 1 or -1, the stronger the positive and negative correlation is, and the closer the value is to 0, the weaker the correlation is. The Pearson coefficient performs well in retaining preference features and can better reflect the linear correlation between features. Therefore, it is suitable for feature screening in credit evaluation.

[0093] Step 103: Eliminate the first feature in the target feature according to the cloud security threat detection coefficient to obtain the second feature;

[0094] Further, the removing the first feature from the target feature according to the cloud security threat detection coefficient to obtain the second feature includes:

[0095] Sorting each of the cloud security threat detection coefficients and outputting a bar graph of the correlation between the characteristic value and the cloud security threat detection;

[0096] A first feature to be eliminated from the target feature is determined according to the histogram to obtain a second feature.

[0097] like Figure 5 As shown, in order to reduce the feature dimension of the data set and improve the accuracy and efficiency of data analysis. The preprocessed feature variables are input into the Pearson model, the correlation coefficient between each feature and cloud security threat detection is calculated, and they are sorted and output as a bar chart of the correlation between feature values ​​and cloud security threat detection. From the figure, it can be found that some features have a low correlation with cloud security threat detection. These features are deleted and the remaining feature variables with a high correlation with cloud security threat detection are retained. This step eliminates the three low-correlation features A06, A11 and A08, and retains the remaining 15 features.

[0098] Step 104, removing the third feature from the second feature according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set;

[0099] Further, the removing the third feature from the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat data set includes:

[0100] The feature selection function is constructed by minimizing the residual sum of squares plus the penalty term of the preset minimum absolute shrinkage and selection operator algorithm;

[0101] The third feature in the second feature is eliminated according to a preset preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set.

[0102] The Lasso algorithm is a feature screening method based on the linear regression model. It can effectively prevent overfitting problems by screening and compressing variables to reduce feature dimensions. The Lasso algorithm uses the L1 paradigm to construct a penalty function. On the basis of minimizing the sum of squared errors of multivariate linear regression, it adds a penalty function to the regression coefficient and compresses the regression coefficient of variables with less correlation with the model results to 0, thereby deleting these feature variables and achieving the purpose of reducing feature dimensions.

[0103] The Lasso feature selection method is to minimize the residual sum of squares plus the penalty term of the L1 norm. The formula is as follows:

[0104]

[0105] Among them, x in the above formula 2 i represents the actual value of variable x for individual i; represents the estimated value of variable x for individual i; Represents the difference between the estimated value and the actual value; is the regression coefficient. λ is a pre-set non-negative number, and its size determines the selection ability of the algorithm. If λ is too large, no feature can be deleted. By setting λ to a suitable low value, the coefficient of the feature variable with low correlation with the class can be reduced to 0, thereby deleting these features, highlighting the features with strong correlation with the class, and realizing feature screening of the data set.

[0106] The Lasso algorithm adds the L1 normal function as a penalty term to compress the feature regression coefficients whose absolute values ​​are less than the threshold to 0, that is, ignore the contribution of these feature variables to the classification results, so these variables can be eliminated. In the Lasso algorithm, the size of λ determines the selection ability of the algorithm, so in this step, its size is fine-tuned to select the most appropriate value. The results of fine-tuning the parameter λ in Lasso are shown in Table 2.

[0107] Table 2 Comparison of the number of variables with different λ values

[0108] Number of variables 4 9 13 15 λ 0.01 0.005 0.0025 0.001

[0109] When λ is 0.01, the model is underfitting, and only 4 of the 15 feature variables are retained. After multiple tests of the training set and test set scores, the difference between the training set and the test set scores is low when λ is between 0.005 and 0.0025. When λ drops to 0.001, the difference between the training set and the test set scores is high, indicating overfitting. Therefore, this paper selects λ = 0.0025 for the experiment, and 13 samples are retained at this time.

[0110] Step 105: output the cloud security threat detection result corresponding to the second target cloud security threat data set.

[0111] Further, the outputting of the cloud security threat detection result corresponding to the second target cloud security threat data set includes:

[0112] The second target cloud security threat data set is input into the boosting model, and a cloud security threat detection result corresponding to at least one algorithm integrated in the boosting model is output.

[0113] Furthermore, the step of inputting the second target cloud security threat data set into the enhancement model and outputting the cloud security threat detection result corresponding to at least one algorithm integrated in the enhancement model includes:

[0114] Inputting the second target cloud security threat data set into the boosting model, and outputting the receiver operating characteristic curve and area under the curve value corresponding to each algorithm integrated in the boosting model;

[0115] Determine the target algorithm in the boosting model according to the receiver operating characteristic curve and the area under the curve value;

[0116] The cloud security threat detection result corresponding to the second target cloud security threat data set is outputted through the target algorithm.

[0117] It should be noted that in the embodiment of the present application, the second target cloud security threat data set A1 after feature processing is respectively brought into the Boosting ensemble learning LightGBM, XGBoost, and CatBoost algorithms for model evaluation, and the cloud security threat detection results based on feature optimization and Boosting algorithms are output.

[0118] The AUC value and ROC curve can still better reflect the prediction ability of the model when the sample data is unbalanced. Therefore, in order to quantify the quality of the model, the AUC value and ROC curve are used to evaluate the performance of the classifier.

[0119] Among them, ROC curve (Receiver Operating Characteristic Curve): This is a graphical tool for evaluating the performance of classification models. The ROC curve shows the performance of the model at different thresholds by plotting the relationship between the True Positive Rate (TPR) and the False Positive Rate (FPR).

[0120] AUC value (Area Under the Curve): The AUC value is the area under the ROC curve, which is used to quantify the overall performance of the model. The AUC value ranges from 0 to 1, and the larger the value, the better the classification performance of the model.

[0121] The confusion matrix is ​​mainly used to compare the classification results and the real information of the instance. It can comprehensively reflect the performance of the model. The confusion matrix is ​​shown in Table 3 below.

[0122] Table 3 Confusion matrix

[0123]

[0124] In Table 3, TP represents the number of samples that are actually good and predicted to be good, FN represents the number of samples that are actually good and predicted to be bad, FP represents the number of samples that are actually bad and predicted to be good, and TN represents the number of samples that are actually bad and predicted to be bad.

[0125] Among them, TPR = TP / (TP+FN) is called the true positive rate, which describes the proportion of correctly predicted positive instances to all true positive instances. FPR = FP / (FP+TN) is called the false positive rate, which calculates the proportion of negative instances predicted as positive instances to all true negative instances.

[0126] The ROC curve is a curve with the FPR false positive rate as the horizontal axis and the TPR true positive rate as the vertical axis. The AUC value is the area enclosed by the ROC curve and the X-axis. The closer the ROC curve is to the upper left corner of the coordinate axis, the better the performance of the model, that is, the larger the AUC value, the better.

[0127] In order to reflect the role of Boosting ensemble learning algorithm in cloud security threat detection, XGBoost, CatBoost, and LightGBM based on Boosting ensemble learning algorithm are introduced, and the five-fold crossover algorithm is used to train the data set to reduce the impact of randomness on the classification results. The results are shown in Table 4.

[0128] Table 4 Comparison of AUC values ​​of three boosting models

[0129]

[0130] In order to more intuitively compare the training effects of the three models, the ROC curve comparison chart is used to present them, such as Figure 6 As shown in the figure, the closer the curve is to the upper left, the better the model classification effect. XGBoost is at the top of the figure, with the best training effect; while the ROC curve of LightGBM is at the bottom, with the worst result among the three models.

[0131] In an embodiment of the present application, a first target cloud security threat data set is obtained by preprocessing a pre-acquired cloud security threat data set, wherein the first target cloud security threat data set includes target features; cloud security threat detection coefficients corresponding to each of the target features are obtained; the first feature in the target feature is eliminated according to the cloud security threat detection coefficient to obtain a second feature; the third feature in the second feature is eliminated according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set; and the cloud security threat detection result corresponding to the second target cloud security threat data set is output. That is, in an embodiment of the present application, a first target data set including target features is obtained by preprocessing a pre-acquired cloud security threat data set, and the cloud security threat detection coefficient of each target feature is calculated. The irrelevant first feature is eliminated according to the detection coefficient to obtain the second feature. The redundant third feature in the second feature is further eliminated using the preset value and the feature selection function, and finally the second target cloud security threat data set is generated. This data set improves the accuracy and efficiency of cloud security threat detection by streamlining features, and the output detection results are more reliable and accurate.

[0132] Figure 2 is a device block diagram of a cloud security threat detection device provided by an embodiment of the present application, such as Figure 2 As shown, the device comprises:

[0133] A preprocessing module 201 is used to preprocess the pre-acquired cloud security threat data set to obtain a first target cloud security threat data set, where the first target cloud security threat data set includes a target feature;

[0134] An acquisition module 202 is used to acquire a cloud security threat detection coefficient corresponding to each of the target features;

[0135] A first elimination module 203, configured to eliminate a first feature from the target feature according to the cloud security threat detection coefficient to obtain a second feature;

[0136] A second elimination module 204, configured to eliminate the third feature in the second feature according to a preset value and a pre-constructed feature selection function, to obtain a second target cloud security threat data set;

[0137] The output module 205 is used to output the cloud security threat detection result corresponding to the second target cloud security threat data set.

[0138] Optionally, the preprocessing module includes:

[0139] A first preprocessing submodule, used to obtain a cloud security threat dataset;

[0140] A second preprocessing submodule, used to determine whether there are missing values ​​and / or abnormal values ​​in the features of the cloud security threat dataset;

[0141] A third preprocessing submodule is configured to fill or delete a missing value if there is a missing value in a feature in the cloud security threat dataset; and / or,

[0142] The fourth preprocessing submodule is configured to, if there are abnormal values ​​in the features of the cloud security threat data set, perform mean padding or deletion on the abnormal values ​​to obtain a first target cloud security threat data set.

[0143] Optionally, the acquisition module includes:

[0144] The first acquisition submodule is used to input the target features into the Pearson model and calculate the cloud security threat detection coefficient corresponding to each of the target features.

[0145] Optionally, the first rejection module includes:

[0146] A first elimination submodule, used for sorting each of the cloud security threat detection coefficients and outputting a histogram of the correlation between the characteristic value and the cloud security threat detection;

[0147] The second elimination submodule is used to determine the first feature to be eliminated from the target features according to the histogram to obtain the second feature.

[0148] Optionally, the second rejection module includes:

[0149] The third elimination submodule is used to construct a feature selection function by minimizing the residual sum of squares plus a penalty term of a preset minimum absolute shrinkage and selection operator algorithm;

[0150] The fourth elimination submodule is used to eliminate the third feature in the second feature according to a preset preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set.

[0151] Optionally, the output module includes:

[0152] The output submodule is used to input the second target cloud security threat data set into the enhancement model, and output the cloud security threat detection result corresponding to at least one algorithm integrated in the enhancement model.

[0153] Optionally, the output submodule includes:

[0154] A first output unit, configured to input the second target cloud security threat data set into a boosting model, and output a receiver operating characteristic curve and an area under the curve value corresponding to each algorithm integrated in the boosting model;

[0155] A second output unit, used to determine a target algorithm in the boosting model according to the receiver operating characteristic curve and the area under the curve value;

[0156] The third output unit is used to output the cloud security threat detection result corresponding to the second target cloud security threat data set through the target algorithm.

[0157] In an embodiment of the present application, a first target cloud security threat data set is obtained by preprocessing a pre-acquired cloud security threat data set, wherein the first target cloud security threat data set includes target features; cloud security threat detection coefficients corresponding to each of the target features are obtained; the first feature in the target feature is eliminated according to the cloud security threat detection coefficient to obtain a second feature; the third feature in the second feature is eliminated according to a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set; and the cloud security threat detection result corresponding to the second target cloud security threat data set is output. That is, in an embodiment of the present application, a first target data set including target features is obtained by preprocessing a pre-acquired cloud security threat data set, and the cloud security threat detection coefficient of each target feature is calculated. The irrelevant first feature is eliminated according to the detection coefficient to obtain the second feature. The redundant third feature in the second feature is further eliminated using the preset value and the feature selection function, and finally the second target cloud security threat data set is generated. This data set improves the accuracy and efficiency of cloud security threat detection by streamlining features, and the output detection results are more reliable and accurate.

[0158] Figure 3 This is a structural diagram of an electronic device M00 provided in an embodiment of the present application. In the figure, the electronic device M00 includes a processor M01 and a memory M02. The electronic device includes: a processor; a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the cloud security threat detection methods described above, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0159] In an embodiment of the present application, the memory M02 can be used to store software programs and various data. The memory M02 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory M02 may include a volatile memory or a non-volatile memory, or the memory x09 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory M02 in the embodiment of the present application includes but is not limited to these and any other suitable types of memories.

[0160] The processor M01 may include one or more processing units; optionally, the processor M01 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor M01.

[0161] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned cloud security threat detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0162] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0163] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned cloud security threat detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0164] It should be understood that the chip involved in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0165] An embodiment of the present application also provides a storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the cloud security threat detection methods described above.

[0166] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned cloud security threat detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0167] An embodiment of the present application also provides a vehicle, which includes the cloud security threat detection device as described above.

[0168] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0169] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0170] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A cloud security threat detection method, characterized in that: The method comprises: Preprocessing the pre-acquired cloud security threat data set to obtain a first target cloud security threat data set, where the first target cloud security threat data set includes target features; Obtaining cloud security threat detection coefficients corresponding to each of the target features; Eliminating a first feature from the target feature according to the cloud security threat detection coefficient to obtain a second feature; Eliminate the third feature in the second feature according to a preset value and a pre-built feature selection function, and obtain a second target cloud security threat data set; Output the cloud security threat detection result corresponding to the second target cloud security threat data set.

2. The method according to claim 1, characterized in that The preprocessing of the pre-acquired cloud security threat dataset to obtain the first target cloud security threat dataset includes: Obtain cloud security threat datasets; Determine whether there are missing values, and / or outliers in the features of the cloud security threat dataset; If there are missing values ​​in the features of the cloud security threat dataset, fill or delete the missing values ​​with fixed values; and / or, If there are outliers in the features of the cloud security threat data set, mean padding or deletion is performed on the outliers to obtain a first target cloud security threat data set.

3. The method according to claim 1, characterized in that The step of obtaining the cloud security threat detection coefficient corresponding to each of the target features includes: The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each of the target features.

4. The method according to claim 1, characterized in that: Eliminating the first feature in the target feature according to the cloud security threat detection coefficient to obtain the second feature includes: Sorting each of the cloud security threat detection coefficients and outputting a bar graph of the correlation between the characteristic value and the cloud security threat detection; A first feature to be eliminated from the target feature is determined according to the histogram to obtain a second feature.

5. The method according to claim 1, characterized in that The step of eliminating the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat data set includes: The feature selection function is constructed by minimizing the residual sum of squares plus the penalty term of the preset minimum absolute shrinkage and selection operator algorithm; The third feature in the second feature is eliminated according to a preset preset value and a pre-constructed feature selection function to obtain a second target cloud security threat data set.

6. The method according to claim 1, characterized in that Outputting the cloud security threat detection result corresponding to the second target cloud security threat data set includes: The second target cloud security threat data set is input into the boosting model, and a cloud security threat detection result corresponding to at least one algorithm integrated in the boosting model is output.

7. The method according to claim 6, characterized in that The step of inputting the second target cloud security threat data set into the boosting model and outputting the cloud security threat detection result corresponding to at least one algorithm integrated in the boosting model comprises: Inputting the second target cloud security threat data set into the boosting model, and outputting the receiver operating characteristic curve and area under the curve value corresponding to each algorithm integrated in the boosting model; Determine the target algorithm in the boosting model according to the receiver operating characteristic curve and the area under the curve value; The cloud security threat detection result corresponding to the second target cloud security threat data set is outputted through the target algorithm.

8. A cloud security threat detection device, characterized in that: The device comprises: A preprocessing module, configured to preprocess the pre-acquired cloud security threat data set to obtain a first target cloud security threat data set, wherein the first target cloud security threat data set includes a target feature; An acquisition module, used to acquire a cloud security threat detection coefficient corresponding to each of the target features; A first elimination module, configured to eliminate a first feature from the target feature according to the cloud security threat detection coefficient to obtain a second feature; A second elimination module, configured to eliminate a third feature from the second feature according to a preset value and a pre-constructed feature selection function, to obtain a second target cloud security threat data set; An output module is used to output a cloud security threat detection result corresponding to the second target cloud security threat data set.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the cloud security threat detection method as described in any one of claims 1-7.

10. A computer storage medium, a readable storage medium, for storing a program, characterized in that: When the program is executed by a processor, the cloud security threat detection method as described in any one of claims 1-7 is implemented.

Images