Network security protection method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a network security protection method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: establishing a network security situation prediction model, taking network security state data as input data of the network security situation prediction model, and carrying out linear transposition transformation processing on the network security state data through a connection layer of the network security situation prediction model to obtain time mixed features, the method comprises the following steps: acquiring a time mixed feature, performing attention weighting processing on the time mixed feature to obtain a key feature vector, processing the key feature vector through a network layer to obtain a network security situation feature vector, processing the network security situation feature vector and the key feature vector through a residual layer, and finally outputting to obtain a network security situation value. And obtaining a network security protection strategy according to the network security situation value. By adopting the method, the network security situation value can be accurately obtained, so that network security threats can be timely dealt with, and the network security is effectively guaranteed.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security protection method, apparatus, computer equipment, storage medium and program product. Background Art

[0002] As a core component of the active defense system, Network Security Situation Prediction (NSSP) uses various advanced technologies to conduct in-depth analysis of network traffic and other network security related data, aiming to predict network security status and abnormal behavior, and to predict the possibility and severity of threats by identifying potential network attack patterns and abnormal behaviors in advance, thereby providing forward-looking intelligence support for active defense. Based on these prediction results, the active defense system can adjust the protection strategy in real time, effectively respond to new attack threats, and ensure the safe operation of the network system.

[0003] However, due to the high complexity, dynamism and uncertainty of the data involved in the cybersecurity situation, traditional prediction model methods are difficult to effectively capture key information and long-term dependencies, resulting in reduced accuracy of prediction results. Summary of the invention

[0004] Based on this, it is necessary to provide a network security protection method, device, computer equipment, storage medium and program product that can accurately predict the network security situation in response to the above technical problems.

[0005] In a first aspect, the present application provides a network security protection method, comprising:

[0006] Establish a network security situation prediction model;

[0007] The network security status data is used as the input data of the network security situation prediction model, and the network security situation is output; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and the time mixed feature is subjected to attention weighting processing to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value;

[0008] Obtain network security protection strategies based on network security situation values.

[0009] In one embodiment, the step of performing a linear transposition transformation on the network security status data to obtain a time mixing feature includes:

[0010] Perform batch normalization processing on network security status data to obtain normalized data;

[0011] Transpose the normalized data to obtain transposed data;

[0012] Performing time mixing processing on the transposed data through a piecewise linear function to obtain time mixed data;

[0013] The time-mixed data is transposed to obtain the time-mixed features.

[0014] In one embodiment, the step of performing attention weighting processing on the temporal mixed features to obtain a key feature vector includes:

[0015] Perform linear transformation on the time-mixed features to obtain the query vector, key vector, and value vector;

[0016] Obtain the attention weight according to the query vector, key vector and dimension parameter of the key vector;

[0017] According to the attention weight, the value vector is subjected to attention weighting processing to obtain the key feature vector.

[0018] In one embodiment, the step of processing the key feature vector to obtain the network security situation feature includes:

[0019] The key feature vector is convolved through the causal convolution layer to obtain the temporal feature vector;

[0020] The time feature vector is convolved through the dilated convolution layer to obtain the network security situation feature vector.

[0021] In one embodiment, the step of processing the network security situation feature vector and the key feature vector to obtain the network security situation value includes:

[0022] Obtaining the vector sum of the network security situation feature vector and the key feature vector;

[0023] The vector sum is processed by an activation function to obtain a network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0024] In one embodiment, the method further comprises:

[0025] Determine the key parameters of the network security situation prediction model, encode the key parameters, and obtain multiple chromosome individuals;

[0026] Optimize chromosome individuals through genetic algorithms;

[0027] When the target optimization conditions are met, the target individual is determined from all current chromosome individuals, and the key parameters corresponding to the target individual are used as model parameters of the network security situation prediction model.

[0028] In a second aspect, the present application also provides a network security protection device, including:

[0029] Model building module, used to build a network security situation prediction model;

[0030] The security prediction module is used to use the network security status data as the input data of the network security situation prediction model, and output the network security situation; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time-mixed feature, and perform an attention-weighted process on the time-mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value;

[0031] The security protection module is used to obtain network security protection strategies based on the network security situation value.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method steps of any one of the first aspects are implemented.

[0033] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements any one of the method steps in the first aspect when the computer program is executed by a processor.

[0034] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which implements any one of the method steps in the first aspect when executed by a processor.

[0035] The above-mentioned network security protection method, device, computer equipment, storage medium and program product can accurately screen out key features and avoid interference from irrelevant information through attention weighted processing of the connection layer. Through further processing of key feature vectors by the network layer, deep-level security situation characteristics can be excavated. By processing the output of the network layer and the input of the model through the residual layer, the stability and efficiency of the model training can be guaranteed, and the output network security situation value can be made more reliable, so that the protection strategy can be dynamically adjusted according to the network security situation value, network security threats can be responded to in a timely manner, and network security can be effectively guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 An application environment diagram of a network security protection method in one embodiment;

[0038] Figure 2 A schematic diagram of a flow chart of a network security protection method in one embodiment;

[0039] Figure 3 A schematic diagram of the structure of a network security situation prediction model in one embodiment;

[0040] Figure 4 A schematic diagram of a process of optimizing parameters using a genetic algorithm in one embodiment;

[0041] Figure 5 is a structural block diagram of a network security protection device in one embodiment;

[0042] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The network security protection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 is used to establish a network security situation prediction model, use the network security status data as the input data of the network security situation prediction model, output the network security situation, and obtain the network security protection strategy according to the network security situation value. Among them, the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and perform an attention weighted processing on the time mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device may be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In an exemplary embodiment, Figure 2 As shown, a network security protection method is provided, which is applied to Figure 1 The terminal 102 in the example is used as an example to illustrate, including the following steps 202 to 206. Among them:

[0046] S202: Establish a network security situation prediction model.

[0047] Optionally, network security situation is used to predict the possible state and future trend of the network through historical network data. Taking network traffic as an example, historical traffic data can show the time when the peak and valley values ​​of network traffic occur under normal circumstances, the main flow direction of traffic, etc. If it is found that the traffic suddenly increases abnormally at a certain moment, and this increase does not conform to any previous normal pattern (such as not caused by business peak), this may indicate that the network is threatened by attacks such as DDoS (distributed denial of service). Through network security situation prediction, it is possible to know in advance whether the network may deviate from the track of safe operation, so as to take corresponding measures before the threat arrives to ensure the security of the network.

[0048] S204: Using the network security status data as input data of the network security situation prediction model, and outputting the network security situation; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and perform attention weighted processing on the time mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value.

[0049] Optionally, the collected network security status data is used as input to a network security situation prediction model, wherein the network security status data includes normal network behavior, various network attacks (such as fuzzy attacks, port scans, backdoor programs, denial of service attacks, vulnerability attacks, block cipher attacks, reconnaissance, malicious codes, worms, etc.), and a current network security situation value, wherein the current network security situation value is a comprehensive quantitative indicator used to intuitively represent the security level of the network at a specific moment.

[0050] Specifically, for the input network security status data, the linear transposition transformation is first performed through the connection layer to reorganize and transform the original network security status data to obtain time-mixed features, and then the time-mixed features are subjected to attention weighting processing. Among them, the attention mechanism can automatically focus on those features that are more critical and influential in judging the network security situation, highlight these important features in a weighted manner, and then obtain the key feature vector.

[0051] Furthermore, the network layer receives the key feature vectors from the connection layer and further processes them. Through a series of complex calculations and feature extraction operations, it digs out the deep-level features that can reflect the network security situation and finally outputs the network security situation feature vector.

[0052] Furthermore, the residual layer will simultaneously process the network security situation feature vector and the key feature vector obtained previously. Through the residual connection method, it can effectively solve problems such as gradient vanishing that may occur in deep networks, making model training more stable and efficient. After processing by the residual layer, the final network security situation value is obtained.

[0053] S206: Obtain a network security protection strategy according to the network security situation value.

[0054] Optionally, the network security situation value is the key basis for formulating protection strategies. When the situation value is high, it means that the network is in a relatively safe state, and it may only be necessary to maintain existing protection measures and conduct routine monitoring; when the situation value is low, it indicates that the network faces a higher security risk and needs to adopt a more powerful protection strategy. The formulation of the protection strategy is to ensure the safe operation of the network and is flexibly adjusted according to the dynamic changes of the network security situation value.

[0055] In the above network security protection method, through the attention weighted processing of the connection layer, the key features can be accurately screened out to avoid the interference of irrelevant information. Through the further processing of the key feature vectors by the network layer, the deep-level security situation characteristics can be excavated. By processing the output of the network layer and the input of the model through the residual layer, the stability and efficiency of the model training can be guaranteed, and the output network security situation value can be made more reliable, so that the protection strategy can be dynamically adjusted according to the network security situation value, network security threats can be responded to in a timely manner, and network security can be effectively guaranteed.

[0056] In an exemplary embodiment, the step of performing a linear transposition transformation on network security status data to obtain a time mixing feature includes: performing batch normalization processing on the network security status data to obtain normalized data; performing a transposition processing on the normalized data to obtain transposed data; performing a time mixing processing on the transposed data through a piecewise linear function to obtain time mixing data; and performing a transposition processing on the time mixing data to obtain a time mixing feature.

[0057] Optionally, when processing network security status data, these data may come from different data sources, and their data distribution and scale may vary greatly. By normalizing each batch of data, the mean of the data is close to 0 and the variance is close to 1. Through batch normalization, these different types of data can be placed on a relatively uniform scale. After batch normalization, the data is transposed, where the transposition operation changes the order of the data dimension arrangement. For example, the original data is a matrix, the rows represent different samples, and the columns represent different features. After transposition, the roles of rows and columns are swapped. After transposition, each feature can be better organized in the time dimension. After time mixing processing through piecewise linear functions, transposition is performed again to restore the data dimension to a suitable size for subsequent processing.

[0058] Alternatively, since network security status data often has the characteristics of time series, time mixing processing through piecewise linear functions can effectively capture the change pattern of data in different time segments, fuse the data features at different time points, and mine the potential laws of data in the time dimension. Among them, the piecewise linear function can divide the data into different segments according to time, and process the data according to the linear relationship in each segment.

[0059] In this embodiment, batch normalization processing is used to make the network security status data have better stability and consistency before being input into the model. The time mixing processing of piecewise linear functions can more effectively mine the time series characteristics in the network security status data, thereby achieving accurate prediction of the network security situation.

[0060] In an exemplary embodiment, the step of performing attention weighted processing on the time mixing features to obtain a key feature vector includes: performing linear transformation processing on the time mixing features to obtain a query vector, a key vector and a value vector; obtaining an attention weight based on the query vector, the key vector and the dimension parameters of the key vector; and performing attention weighted processing on the value vector based on the attention weight to obtain a key feature vector.

[0061] Optionally, linear transformation is a basic mathematical operation in which the temporal mixture features are mapped to different vector spaces through matrix multiplication to obtain query vector, key vector and value vector, which are essentially different representations of the original temporal mixture features for subsequent attention calculations.

[0062] Furthermore, the importance of each feature is determined by calculating the similarity between the query vector and the key vector. For example, the dot product (Dot - Product) or scaled dot product (Scaled - Dot - Product) method is usually used to calculate the attention weight. After the attention weight is obtained, it is weighted and summed with the value vector to obtain the key feature vector.

[0063] In this embodiment, through attention weighted processing, key features in network security status data can be automatically identified, and because the attention mechanism can dynamically adjust the attention weight according to the current time mixing characteristics, it can better adapt to the changes of different features at different time points, thereby improving the accuracy of the prediction.

[0064] In an exemplary embodiment, the step of processing the key feature vector to obtain the network security situation feature includes: convolving the key feature vector through a causal convolution layer to obtain a time feature vector; and convolving the time feature vector through an expanded convolution layer to obtain a network security situation feature vector.

[0065] Optionally, causal convolution is a special convolution operation that ensures that only information from the past and current moments is used to generate output during the convolution process. In network security situation prediction, since the evolution of network security status is time-ordered, in order to ensure that the model can predict future situations based on previous and current key features, when processing the data of each time step through causal convolution, only the traffic characteristics of the time step and the previous time step will be considered, and no future information will be used, so that the generated output conforms to the causal relationship of the time series. In the causal convolution layer, a convolution operation is performed by sliding a convolution kernel on the time dimension of the key feature vector, where each element of the convolution kernel is multiplied by the corresponding element of the key feature vector, and then the products are added to obtain a new output value. This process is repeated along the time dimension of the key feature vector to generate a new time series, namely, the time feature vector.

[0066] Optionally, dilated convolution means inserting some spaces between the elements of the convolution kernel so that the convolution kernel can cover a larger receptive field without increasing the number of parameters. In network security situation prediction, the relationship between long-distance time series features can be captured through dilated convolution. Among them, the dilated convolution layer also uses a convolution kernel to perform convolution operations on the time feature vector, but due to the characteristics of dilated convolution, the convolution kernel can skip some elements, thereby covering a wider time range. After dilated convolution processing, the network security situation feature vector is obtained. This vector integrates the long-distance time series features and can more comprehensively reflect the overall characteristics of the network security situation.

[0067] In this embodiment, through the causal convolution layer, the time series information in the key feature vector can be fully utilized to explore the pattern of changes in network security status over time, so that the model can better simulate the actual evolution process of network security events. By expanding the convolution layer, the model can capture long-distance time series feature relationships, thereby improving the accuracy and comprehensiveness of the prediction.

[0068] In an exemplary embodiment, the step of processing a network security situation feature vector and a key feature vector to obtain a network security situation value includes: obtaining the vector sum of the network security situation feature vector and the key feature vector; processing the vector sum through an activation function to obtain the network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0069] Optionally, the network security situation feature vector and the key feature vector are added to obtain a new vector sum, and the two feature vectors obtained by different processing steps are fused. After the vector sum is obtained, it is processed by an activation function, and the activation function performs different operations according to the value of the vector sum. When the vector sum is greater than 0, the activation function directly outputs the vector sum. When the vector sum is less than or equal to 0, the activation function multiplies the vector sum by a preset constant. This is a special treatment of negative information, indicating that there may be some risks or problems in the network security situation. By multiplying the vector sum by a constant less than 1, its value is further reduced to indicate this unfavorable situation.

[0070] In this embodiment, by combining the information of the network security situation feature vector and the key feature vector and processing through the activation function, the security status of the network can be comprehensively evaluated. The nonlinear processing of the activation function can better map the network security risks, thereby accurately predicting the network security situation.

[0071] In an exemplary embodiment, the method also includes: determining key parameters of a network security situation prediction model, encoding the key parameters to obtain multiple chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and determining a target individual from all current chromosome individuals when target optimization conditions are met, and using the key parameters corresponding to the target individual as model parameters of the network security situation prediction model.

[0072] Optionally, the network security situation prediction model contains multiple parameters, which have an important impact on the performance of the model and the prediction results. These key parameters are encoded to form multiple chromosome individuals. Taking binary encoding as an example, the value of each key parameter can be represented by a string of binary digits. Multiple key parameters are combined together to form a chromosome-like individual. These chromosome individuals represent different possible combinations of model parameters, just like different individuals in a biological population have different gene combinations.

[0073] Furthermore, the chromosome individuals are optimized by genetic algorithms. Genetic algorithms are an optimization algorithm that simulates natural selection and genetic evolution processes. Starting from the initial chromosome individual population, new individuals are continuously generated by simulating biological reproduction, crossover and mutation operations, and individuals with high fitness are selected to be retained, and the population is gradually optimized. In the scenario of network security situation prediction model parameter optimization, fitness is usually measured based on performance indicators such as the accuracy and efficiency of the model's prediction of network security situation. When a certain number of iterations is reached, the fitness of the population is no longer significantly improved, or an individual that meets specific performance requirements is found, a target individual is selected from all current chromosome individuals, and the key parameter combination corresponding to the target individual is the model parameter of the optimized network security situation prediction model.

[0074] In this embodiment, by using a genetic algorithm to optimize the model parameters, an extensive search can be performed in the parameter space to find the global optimal or near-global optimal parameter combination. When facing various types of network attacks and complex network traffic changes, the optimized model can more accurately predict the network security situation.

[0075] In an exemplary embodiment, Figure 3 As shown, Figure 3 This is a schematic diagram of the network security situation prediction model, where:

[0076] (1) The time mixing module includes: performing linear transformation and dimension transposition operations on the input network security situation value. First, batch normalization is performed to stabilize the data distribution, making it more conducive to model learning. Then the data is dimensionally transposed to adapt to the fully connected layer processing. The fully connected layer performs nonlinear transformation on the data, and the activation function uses ReLU to enhance the expression ability of the model, extract the preliminary features of the data and realize the mixing of time and feature dimensions. Among them, the network security situation value includes normal network behavior, fuzzy attack, port scanning, backdoor program, denial of service attack, vulnerability attack, block cipher attack, reconnaissance, malicious code, worm and current network security situation value.

[0077] First, the model input is the original network security situation value, and the data shape is [Batch, Input Length, Channel], where Batch represents the batch size (B), Input Length represents the sequence length (L), and Channel represents the number of channels (C).

[0078] Assume the input is , the result after batch normalization is: , the result after transposition is: , after the time mixing processing of the fully connected layer, the activation function uses ReLU, and the result after processing is: , and then the result after transposition is the time mixed output: .

[0079] (2) Attention mechanism module, including: converting input data into query vector, key vector and value vector through linear transformation, and then calculating attention weight and performing weighted summation.

[0080] First, the attention mechanism module receives the output data of the time mixing module and obtains the query vector through linear transformation , the key vector , value vector , the attention weight is calculated as: , where dk is the dimension of the key vector, and the final output is: .

[0081] (3) TCN module, including: causal convolution, dilated convolution and residual connection. The application of causal convolution can effectively ensure that the situation information does not "leak" from the future to the past, thereby ensuring the integrity of the data, while the application of dilated convolution can enable TCN to have a larger receptive field with fewer layers, thereby receiving longer historical data; LeakyReLU activation function, Dropout and identity mapping network can effectively suppress network overfitting, thereby improving the learning speed and accuracy of the network. Residual connection helps to solve the gradient vanishing problem in deep networks and accelerate model training. The residual module output By network F and input composition: ,in, , leakiness is a constant less than 1.

[0082] (4) Genetic algorithm parameter optimization module, including: encoding, selection, crossover, mutation and iterative optimization. By iteratively searching for the optimal model parameter combination, the blindness and limitations of manual parameter adjustment are overcome, the performance and generalization ability of the prediction model are improved, and the model can better adapt to different network security situation value characteristics.

[0083] For example, Figure 4 As shown, Figure 4 This is a schematic diagram of genetic algorithm parameter optimization, which mainly includes the following steps:

[0084] Encoding: Encode the key parameters in the prediction model, such as the convolution kernel size and dilation rate of the TCN module, the number of attention heads in the attention mechanism module, and dropout trate, to form a chromosome individual. The present invention uses real number encoding. For the convolution kernel size k of the TCN module, the dilation rate e, the number of attention heads in the attention mechanism module n, and the dropout trate r, they can be combined into a chromosome individual [k, e, n, r].

[0085] Selection: Use selection strategies such as roulette wheel selection to select individuals with higher fitness from the current population as parents to participate in subsequent crossover and mutation operations. The selection probability p of individual i is i Calculation formula: , where f i is the fitness value of an individual, and N is the population size.

[0086] Crossover: Perform a crossover operation on the selected parent individuals to generate new offspring individuals. and , using single-point crossover, crossover is performed at a random position to generate new individuals: and .

[0087] Mutation: Perform mutation operations on newly generated offspring individuals to increase the diversity of the population. , with a certain mutation probability P m Randomly mutate f or k, such as f mutates to ,in, Is a randomly generated value within a certain range.

[0088] Iterative optimization: Repeat the above genetic operation process continuously, and after several generations of evolution, the individuals in the population gradually converge to a better parameter combination. When the termination condition is met (the maximum number of iterations is reached or the fitness value reaches the preset threshold), the parameter combination corresponding to the optimal individual is applied to the prediction model.

[0089] In this embodiment, through the attention weighted processing of the connection layer, key features can be accurately screened out to avoid interference from irrelevant information. Through further processing of the key feature vectors by the network layer, deep-level security situation characteristics can be excavated. By processing the output of the network layer and the input of the model through the residual layer, the stability and efficiency of the model training can be guaranteed, and the output network security situation value can be made more reliable, so that the protection strategy can be dynamically adjusted according to the network security situation value, network security threats can be responded to in a timely manner, and network security can be effectively guaranteed.

[0090] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0091] Based on the same inventive concept, the embodiment of the present application also provides a network security protection device for implementing the network security protection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network security protection device embodiments provided below can refer to the limitations on the network security protection method above, and will not be repeated here.

[0092] In an exemplary embodiment, Figure 5 As shown, a network security protection device is provided, comprising: a model building module 10, a security prediction module 20 and a security protection module 30, wherein:

[0093] The model building module 10 is used to build a network security situation prediction model.

[0094] The security prediction module 20 is used to use the network security status data as the input data of the network security situation prediction model, and output the network security situation; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and perform attention weighted processing on the time mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value.

[0095] The security protection module 30 is used to obtain a network security protection strategy according to the network security situation value.

[0096] In an exemplary embodiment, the security prediction module 20 is also used to perform batch normalization processing on the network security status data to obtain normalized data; transpose the normalized data to obtain transposed data; perform time mixing processing on the transposed data through a piecewise linear function to obtain time mixing data; and transpose the time mixing data to obtain time mixing features.

[0097] In an exemplary embodiment, the security prediction module 20 is also used to perform linear transformation processing on the time mixing features to obtain a query vector, a key vector and a value vector; obtain an attention weight based on the query vector, the key vector and the dimensional parameters of the key vector; and perform attention weighted processing on the value vector based on the attention weight to obtain a key feature vector.

[0098] In an exemplary embodiment, the security prediction module 20 is also used to convolve the key feature vector through a causal convolution layer to obtain a time feature vector; and convolve the time feature vector through an expanded convolution layer to obtain a network security situation feature vector.

[0099] In an exemplary embodiment, the security prediction module 20 is also used to obtain the vector sum of the network security situation feature vector and the key feature vector; the vector sum is processed by an activation function to obtain a network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0100] In an exemplary embodiment, the security prediction module 20 is also used to determine the key parameters of the network security situation prediction model, encode the key parameters to obtain multiple chromosome individuals; optimize the chromosome individuals through a genetic algorithm; when the target optimization conditions are met, determine the target individual from all current chromosome individuals, and use the key parameters corresponding to the target individual as the model parameters of the network security situation prediction model.

[0101] Each module in the above network security protection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0102] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a network security protection method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0103] Those skilled in the art will understand that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0104] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: establishing a network security situation prediction model; using network security status data as input data of the network security situation prediction model, and outputting a network security situation; the network security situation prediction model includes a connection layer, a network layer, and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time-mixed feature, and perform attention-weighted processing on the time-mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value; and according to the network security situation value, a network security protection strategy is obtained.

[0105] In one embodiment, when a processor executes a computer program, linear transposition transformation processing is performed on network security status data to obtain time mixing features, including: batch normalization processing is performed on the network security status data to obtain normalized data; transposition processing is performed on the normalized data to obtain transposed data; time mixing processing is performed on the transposed data through a piecewise linear function to obtain time mixing data; and transposition processing is performed on the time mixing data to obtain time mixing features.

[0106] In one embodiment, when a processor executes a computer program, attention-weighted processing is performed on the time-mixed features to obtain a key feature vector, including: linear transformation processing is performed on the time-mixed features to obtain a query vector, a key vector, and a value vector; attention weights are obtained based on the query vector, the key vector, and the dimension parameters of the key vector; and attention-weighted processing is performed on the value vector based on the attention weights to obtain a key feature vector.

[0107] In one embodiment, when a processor executes a computer program, the key feature vector is processed to obtain network security situation characteristics, including: convolution processing of the key feature vector through a causal convolution layer to obtain a time feature vector; convolution processing of the time feature vector through an expanded convolution layer to obtain a network security situation feature vector.

[0108] In one embodiment, the processing of the network security situation feature vector and the key feature vector involved in the execution of the computer program by the processor to obtain the network security situation value includes: obtaining the vector sum of the network security situation feature vector and the key feature vector; processing the vector sum through an activation function to obtain the network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0109] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining key parameters of the network security situation prediction model, encoding the key parameters, and obtaining multiple chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and when the target optimization conditions are met, determining the target individual from all current chromosome individuals, and using the key parameters corresponding to the target individual as the model parameters of the network security situation prediction model.

[0110] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: establishing a network security situation prediction model; using network security status data as input data of the network security situation prediction model, and outputting a network security situation; the network security situation prediction model includes a connection layer, a network layer, and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time-mixed feature, and perform attention-weighted processing on the time-mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value; and according to the network security situation value, a network security protection strategy is obtained.

[0111] In one embodiment, when a computer program is executed by a processor, linear transposition transformation processing is performed on network security status data to obtain time mixing features, including: batch normalization processing is performed on the network security status data to obtain normalized data; transposition processing is performed on the normalized data to obtain transposed data; time mixing processing is performed on the transposed data through a piecewise linear function to obtain time mixing data; and transposition processing is performed on the time mixing data to obtain time mixing features.

[0112] In one embodiment, when a computer program is executed by a processor, attention-weighted processing is performed on the time-mixed features to obtain a key feature vector, including: linear transformation processing is performed on the time-mixed features to obtain a query vector, a key vector, and a value vector; attention weights are obtained based on the query vector, the key vector, and the dimension parameters of the key vector; and attention-weighted processing is performed on the value vector based on the attention weights to obtain a key feature vector.

[0113] In one embodiment, when a computer program is executed by a processor, the key feature vector is processed to obtain network security situation characteristics, including: convolution processing of the key feature vector through a causal convolution layer to obtain a time feature vector; convolution processing of the time feature vector through an expanded convolution layer to obtain a network security situation feature vector.

[0114] In one embodiment, when a computer program is executed by a processor, the processing of a network security situation feature vector and a key feature vector to obtain a network security situation value includes: obtaining the vector sum of the network security situation feature vector and the key feature vector; processing the vector sum through an activation function to obtain a network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0115] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining key parameters of the network security situation prediction model, encoding the key parameters, and obtaining multiple chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and determining the target individual from all current chromosome individuals when the target optimization conditions are met, and using the key parameters corresponding to the target individual as the model parameters of the network security situation prediction model.

[0116] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: establishing a network security situation prediction model; using network security status data as input data of the network security situation prediction model, and outputting a network security situation; the network security situation prediction model includes a connection layer, a network layer, and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time-mixed feature, and perform attention-weighted processing on the time-mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value; and according to the network security situation value, a network security protection strategy is obtained.

[0117] In one embodiment, when a computer program is executed by a processor, linear transposition transformation processing is performed on network security status data to obtain time mixing features, including: batch normalization processing is performed on the network security status data to obtain normalized data; transposition processing is performed on the normalized data to obtain transposed data; time mixing processing is performed on the transposed data through a piecewise linear function to obtain time mixing data; and transposition processing is performed on the time mixing data to obtain time mixing features.

[0118] In one embodiment, when a computer program is executed by a processor, attention-weighted processing is performed on the time-mixed features to obtain a key feature vector, including: linear transformation processing is performed on the time-mixed features to obtain a query vector, a key vector, and a value vector; attention weights are obtained based on the query vector, the key vector, and the dimension parameters of the key vector; and attention-weighted processing is performed on the value vector based on the attention weights to obtain a key feature vector.

[0119] In one embodiment, when a computer program is executed by a processor, the key feature vector is processed to obtain network security situation characteristics, including: convolution processing of the key feature vector through a causal convolution layer to obtain a time feature vector; convolution processing of the time feature vector through an expanded convolution layer to obtain a network security situation feature vector.

[0120] In one embodiment, when a computer program is executed by a processor, the processing of a network security situation feature vector and a key feature vector to obtain a network security situation value includes: obtaining the vector sum of the network security situation feature vector and the key feature vector; processing the vector sum through an activation function to obtain a network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0121] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining key parameters of the network security situation prediction model, encoding the key parameters, and obtaining multiple chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and determining the target individual from all current chromosome individuals when the target optimization conditions are met, and using the key parameters corresponding to the target individual as the model parameters of the network security situation prediction model.

[0122] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security protection method, characterized in that: The method comprises: Establish a network security situation prediction model; The network security status data is used as the input data of the network security situation prediction model, and the network security situation is output; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and perform an attention weighted process on the time mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value; A network security protection strategy is obtained according to the network security situation value.

2. The method according to claim 1, characterized in that The network security status data is subjected to a linear transposition transformation process to obtain a time mixing feature, including: Performing batch normalization processing on the network security status data to obtain normalized data; Transposing the normalized data to obtain transposed data; Performing time mixing processing on the transposed data by a piecewise linear function to obtain time mixing data; The time mixing data is transposed to obtain a time mixing feature.

3. The method according to claim 1, characterized in that The time mixture feature is subjected to attention weighting processing to obtain a key feature vector, including: Performing linear transformation processing on the time mixing feature to obtain a query vector, a key vector and a value vector; Obtaining an attention weight according to the query vector, the key vector, and a dimension parameter of the key vector; According to the attention weight, attention weighted processing is performed on the value vector to obtain a key feature vector.

4. The method according to claim 1, characterized in that The key feature vector is processed to obtain network security situation features, including: Convolutionally processing the key feature vector through a causal convolution layer to obtain a time feature vector; The time feature vector is convolved by an expanded convolution layer to obtain a network security situation feature vector.

5. The method according to claim 1, characterized in that Processing the network security situation feature vector and the key feature vector to obtain a network security situation value includes: Obtaining a vector sum of the network security situation feature vector and the key feature vector; The vector sum is processed by an activation function to obtain a network security situation value; wherein, when the vector sum is greater than 0, the output of the activation function is the vector sum; when the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

6. The method according to claim 1, characterized in that The method further comprises: Determine key parameters of the network security situation prediction model, encode the key parameters, and obtain multiple chromosome individuals; Optimizing the chromosome individuals by genetic algorithm; When the target optimization conditions are met, the target individual is determined from all current chromosome individuals, and the key parameters corresponding to the target individual are used as model parameters of the network security situation prediction model.

7. A network security protection device, characterized in that: The device comprises: Model building module, used to build a network security situation prediction model; A security prediction module is used to use network security status data as input data of the network security situation prediction model, and output a network security situation; the network security situation prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used to perform a linear transposition transformation on the network security status data to obtain a time mixed feature, and perform an attention weighted process on the time mixed feature to obtain a key feature vector; the network layer is used to process the key feature vector to obtain a network security situation feature vector; the residual layer is used to process the network security situation feature vector and the key feature vector to obtain a network security situation value; The security protection module is used to obtain a network security protection strategy according to the network security situation value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images