Network security protection method and device, computer device, storage medium and program product

Abstract

The application relates to a network security protection method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: establishing a network security situation prediction model, taking network security state data as input data of the network security situation prediction model, performing linear transpose transformation processing on the network security state data through a connection layer of the network security situation prediction model to obtain time mixed features, performing attention weighting processing on the time mixed features to obtain a key feature vector, processing the key feature vector through a network layer to obtain a network security situation feature vector, processing the network security situation feature vector and the key feature vector through a residual layer, and finally outputting a network security situation value. According to the network security situation value, a network security protection strategy is obtained. The method can accurately obtain the network security situation value, so that network security threats can be responded to in a timely manner, and network security can be effectively guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network security protection method and device, a computer device, a storage medium and a program product. BACKGROUND

[0002] Network security situation prediction (NSSP) is a core component of the active defense system. By using various advanced technologies to analyze network security-related data such as network traffic, it aims to predict network security states and abnormal behaviors. By identifying potential network attack patterns and abnormal behaviors in advance, it predicts the likelihood and severity of threats, thereby providing proactive intelligence support for active defense. Based on these prediction results, the active defense system can adjust protection strategies in real time, effectively deal with new attack threats, and ensure the safe operation of network systems.

[0003] However, due to the high complexity, dynamics and uncertainty of the data involved in network security situation, traditional prediction model methods are difficult to effectively capture key information and long-term dependencies, resulting in reduced accuracy of prediction results. SUMMARY

[0004] Therefore, it is necessary to provide a network security protection method, device, computer device, storage medium and program product capable of accurately predicting network security situation to solve the above technical problems.

[0005] In a first aspect, the present application provides a network security protection method, comprising:

[0006] establishing a network security situation prediction model;

[0007] inputting network security state data as input data of the network security situation prediction model, and outputting a network security situation; the network security situation prediction model comprises a connection layer, a network layer and a residual layer; the connection layer is used for performing linear transpose transformation processing on the network security state data to obtain time mixed features, and performing attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is used for processing the key feature vector to obtain a network security situation feature vector; and the residual layer is used for processing the network security situation feature vector and the key feature vector to obtain a network security situation value;

[0008] obtaining a network security protection strategy according to the network security situation value.

[0009] In one embodiment, the step of performing linear transpose transformation processing on the network security state data to obtain time mixed features comprises:

[0010] Batch normalization is performed on the network security state data to obtain normalized data.

[0011] Transpose processing is performed on the normalized data to obtain transposed data.

[0012] Time mixing processing is performed on the transposed data by using a piecewise linear function to obtain time mixed data.

[0013] Transpose processing is performed on the time mixed data to obtain time mixed features.

[0014] In one embodiment, the step of performing attention weighting processing on the time mixed features to obtain a key feature vector includes:

[0015] Linear transformation processing is performed on the time mixed features to obtain a query vector, a key vector, and a value vector.

[0016] An attention weight is obtained according to a dimension parameter of the query vector, the key vector, and the key vector.

[0017] Attention weighting processing is performed on the value vector according to the attention weight to obtain a key feature vector.

[0018] In one embodiment, the step of processing the key feature vector to obtain a network security posture feature includes:

[0019] Convolution processing is performed on the key feature vector by using a causal convolution layer to obtain a time feature vector.

[0020] Convolution processing is performed on the time feature vector by using a dilated convolution layer to obtain a network security posture feature vector.

[0021] In one embodiment, the step of processing the network security posture feature vector and the key feature vector to obtain a network security posture value includes:

[0022] A vector sum of the network security posture feature vector and the key feature vector is obtained.

[0023] The vector sum is processed by using an activation function to obtain the network security posture value; in a case where the vector sum is greater than 0, an output of the activation function is the vector sum; in a case where the vector sum is less than or equal to 0, the output of the activation function is a product of the vector sum and a preset constant; the preset constant is less than 1.

[0024] In one embodiment, the method further includes:

[0025] Key parameters of the network security posture prediction model are determined, and the key parameters are encoded to obtain a plurality of chromosome individuals.

[0026] The chromosome individuals are optimized by using a genetic algorithm.

[0027] In the case of meeting the target optimization condition, a target individual is determined from all current chromosome individuals, and a key parameter corresponding to the target individual is taken as a model parameter of the network security posture prediction model.

[0028] In a second aspect, the present application further provides a network security protection device, comprising:

[0029] a model establishing module, configured to establish a network security posture prediction model;

[0030] a security prediction module, configured to take network security state data as input data of the network security posture prediction model, and output a network security posture; the network security posture prediction model comprises a connection layer, a network layer and a residual layer; the connection layer is configured to perform linear transpose transformation processing on the network security state data to obtain time mixed features, and perform attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is configured to process the key feature vector to obtain a network security posture feature vector; and the residual layer is configured to process the network security posture feature vector and the key feature vector to obtain a network security posture value;

[0031] a security protection module, configured to obtain a network security protection strategy according to the network security posture value.

[0032] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the method steps of any one of the first aspect when executing the computer program.

[0033] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method steps of any one of the first aspect.

[0034] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the method steps of any one of the first aspect.

[0035] The network security protection method, device, computer device, storage medium and program product described above can accurately screen out key features through attention weighting processing of the connection layer, avoid interference of irrelevant information, mine deep security posture features through further processing of the network layer on the key feature vector, and guarantee stability and efficiency of model training through processing of the residual layer on the output of the network layer and the input of the model, so that the output network security posture value is more reliable, and the protection strategy can be dynamically adjusted according to the network security posture value, network security threats can be timely responded to, and network security can be effectively protected. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other related drawings can be obtained without creative labor on the basis of these drawings.

[0037] Figure 1 The application environment diagram of the network security protection method in an embodiment;

[0038] Figure 2 The flowchart of the network security protection method in an embodiment;

[0039] Figure 3 The structural diagram of the network security situation prediction model in an embodiment;

[0040] Figure 4 The flowchart of the genetic algorithm optimization parameter in an embodiment;

[0041] Figure 5 The structural block diagram of the network security protection device in an embodiment;

[0042] Figure 6 The internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present application more clear, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0044] The network security protection method provided by the embodiments of the present application can be applied to, for example Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. Among them, the terminal 102 is used to establish a network security posture prediction model, the network security state data is used as the input data of the network security posture prediction model, and the network security posture is output. According to the network security posture value, the network security protection strategy is obtained. Among them, the network security posture prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used for linear transpose transformation processing of the network security state data to obtain time mixed features, and attention weighting processing is performed on the time mixed features to obtain a key feature vector; the network layer is used for processing the key feature vector to obtain a network security posture feature vector; and the residual layer is used for processing the network security posture feature vector and the key feature vector to obtain a network security posture value. Among them, the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server 104 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In an exemplary embodiment, as shown in Figure 2 , a network security protection method is provided, and the method is applied to the terminal 102 in Figure 1 for example, including the following steps 202 to 206. Among them:

[0046] S202: Establish a network security posture prediction model.

[0047] Optionally, the network security posture is used to predict the possible state and future trend of the network through network historical data. Taking network traffic as an example, historical traffic data can show the time when the peak and valley of network traffic under normal circumstances appear, the main flow direction of traffic, etc. If it is found that the traffic suddenly increases at a certain moment, and this increase does not conform to any normal mode in the past (such as not caused by business peak), it may indicate that the network is threatened by threats such as DDoS (Distributed Denial of Service) attack. Through network security posture prediction, it can be known in advance whether the network may deviate from the safe operation track, so that corresponding measures can be taken before the threat comes, and the security of the network is guaranteed.

[0048] S204: The network security state data is taken as input data of a network security posture prediction model, and a network security posture is output; the network security posture prediction model comprises a connection layer, a network layer, and a residual layer; the connection layer is used for performing linear transpose transformation processing on the network security state data to obtain time mixed features, and performing attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is used for processing the key feature vector to obtain a network security posture feature vector; and the residual layer is used for processing the network security posture feature vector and the key feature vector to obtain a network security posture value.

[0049] Optionally, the collected network security state data is taken as input of the network security posture prediction model, wherein the network security state data comprises network normal behaviors, various network attacks (such as fuzzy attacks, port scanning, backdoor programs, denial-of-service attacks, vulnerability attacks, group password attacks, reconnaissance, malicious codes, worms, etc.), and a current network security posture value, wherein the current network security posture value is a comprehensive quantitative index for intuitively representing the security degree of the network at a certain time.

[0050] Specifically, for the input network security state data, first, linear transpose transformation processing is performed on the network security state data by the connection layer to reorganize and transform the original network security state data, thereby obtaining time mixed features, and then attention weighting processing is performed on the time mixed features. The attention mechanism can automatically focus on features that are more critical and influential for judging the network security posture, and highlight these important features through weighting, thereby obtaining a key feature vector.

[0051] Further, the network layer receives the key feature vector from the connection layer and further processes it, mines deep features that can reflect the network security posture through a series of complex operations and feature extraction operations, and finally outputs a network security posture feature vector.

[0052] Further, the residual layer processes the network security posture feature vector and the key feature vector obtained before, and through residual connection, can effectively solve the problem of gradient disappearance that may occur in a deep network, so that the model training is more stable and efficient, and after processing by the residual layer, the final network security posture value is obtained.

[0053] S206: Obtain a network security protection strategy according to the network security posture value.

[0054] Optionally, the network security posture value is a key basis for formulating a protection strategy. When the posture value is high, it indicates that the network is in a relatively safe state, and only the existing protection measures may need to be maintained and routine monitoring may be performed. When the posture value is low, it indicates that the network faces a high security risk, and a more powerful protection strategy needs to be taken. The formulation of the protection strategy is to ensure the safe operation of the network and is flexibly adjusted according to the dynamic changes of the network security posture value.

[0055] In the network security protection method described above, the attention weighting processing of the connection layer can accurately screen out key features and avoid interference from irrelevant information. The further processing of the key feature vector by the network layer can mine deep security posture features. The processing of the output of the network layer and the input of the model by the residual layer can ensure the stability and efficiency of model training, making the output network security posture value more reliable. Therefore, the protection strategy can be dynamically adjusted according to the network security posture value, network security threats can be responded to in a timely manner, and network security can be effectively protected.

[0056] In an exemplary embodiment, the step of performing linear transposition transformation processing on the network security state data to obtain time-mixed features includes: performing batch normalization processing on the network security state data to obtain normalized data; performing transposition processing on the normalized data to obtain transposed data; performing time-mixing processing on the transposed data by a piecewise linear function to obtain time-mixed data; and performing transposition processing on the time-mixed data to obtain time-mixed features.

[0057] Optionally, when processing network security state data, the data may come from different data sources, and the data distribution and scale may differ greatly. By normalizing each batch of data, the mean value of the data is close to 0 and the variance is close to 1. By batch normalization, these different types of data can be placed on a relatively uniform scale. After batch normalization, the data is transposed, where the transposition operation changes the dimension arrangement order of the data. For example, the original data is a matrix, the rows represent different samples, and the columns represent different features. After transposition, the roles of rows and columns are interchanged. After transposition, each feature can be better organized in the time dimension. After time-mixing processing by a piecewise linear function, the data is transposed again to restore the dimension of the data to a suitable dimension for subsequent processing.

[0058] Optionally, since network security state data often has time series characteristics, time-mixing processing by a piecewise linear function can effectively capture the change patterns of data in different time segments, and can fuse the data features at different time points to mine the potential rules of data in the time dimension. The piecewise linear function can divide the data into different segments according to time, and process the data in each segment according to a linear relationship.

[0059] In this embodiment, through batch normalization processing, the network security state data has better stability and consistency before inputting the model, and through time mixing processing of piecewise linear function, the time sequence characteristics in the network security state data can be more effectively mined, so as to realize accurate prediction of the network security situation.

[0060] In an exemplary embodiment, the step of attention weighting processing the key feature vector includes: performing linear transformation processing on the time mixed feature to obtain a query vector, a key vector and a value vector; obtaining an attention weight according to the dimensions of the query vector, the key vector and the key vector; and performing attention weighting processing on the value vector according to the attention weight to obtain the key feature vector.

[0061] Optionally, the linear transformation is a basic mathematical operation, in which the time mixed feature is mapped to different vector spaces through matrix multiplication, so as to obtain the query vector, the key vector and the value vector, which are essentially different representations of the original time mixed feature for subsequent attention calculation.

[0062] Further, the importance of each feature is determined by calculating the similarity between the query vector and the key vector, for example, the dot product (Dot-Product) or scaled dot product (Scaled-Dot-Product) method is usually used to calculate the attention weight, and after obtaining the attention weight, it is weighted and summed with the value vector, so as to obtain the key feature vector.

[0063] In this embodiment, through attention weighting processing, the key features in the network security state data can be automatically identified, and since the attention mechanism can dynamically adjust the attention weight according to the current time mixed feature, it can better adapt to the changes of different features at different time points, thereby improving the prediction accuracy.

[0064] In an exemplary embodiment, the step of processing the key feature vector to obtain the network security situation feature includes: performing convolution processing on the key feature vector through a causal convolution layer to obtain a time feature vector; and performing convolution processing on the time feature vector through a dilated convolution layer to obtain a network security situation feature vector.

[0065] Optionally, the causal convolution is a special convolution operation that ensures that only past and current information is used in the convolution process to generate the output. In network security situation prediction, since the evolution of the network security state has a time sequence, in order to ensure that the model can predict the future situation based on the previous and current key features, when processing the data of each time step through the causal convolution, only the traffic features of the time step and the previous time step are considered, and the future information is not used. The output generated in this way conforms to the causal relationship of the time sequence. In the causal convolution layer, a convolution kernel slides in the time dimension of the key feature vector to perform a convolution operation. Each element of the convolution kernel is multiplied by the corresponding element of the key feature vector, and then the products are added to obtain a new output value. This process is repeated along the time dimension of the key feature vector to generate a new time sequence, i.e., a time feature vector.

[0066] Optionally, the dilated convolution refers to inserting some spaces between the elements of the convolution kernel, so that the convolution kernel can cover a larger receptive field without increasing the number of parameters. In network security situation prediction, the dilated convolution can capture the relationship between long-distance time sequence features. The dilated convolution layer also uses a convolution kernel to perform a convolution operation on the time feature vector. However, due to the characteristics of the dilated convolution, the convolution kernel can skip some elements to cover a wider time range. After dilated convolution processing, a network security situation feature vector is obtained, which integrates long-distance time sequence features and can more comprehensively reflect the overall characteristics of the network security situation.

[0067] In this embodiment, the causal convolution layer can fully utilize the time sequence information in the key feature vector to mine the pattern of the network security state changing over time, so that the model can better simulate the actual evolution process of the network security event. The dilated convolution layer enables the model to capture the relationship between long-distance time sequence features, thereby improving the accuracy and comprehensiveness of the prediction.

[0068] In one exemplary embodiment, the step of processing the network security situation feature vector and the key feature vector to obtain the network security situation value includes: obtaining the vector sum of the network security situation feature vector and the key feature vector; processing the vector sum through an activation function to obtain the network security situation value; wherein, in the case that the vector sum is greater than 0, the output of the activation function is the vector sum; in the case that the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; and the preset constant is less than 1.

[0069] Optionally, the network security posture feature vector and the key feature vector are added to obtain a new vector sum, and the two kinds of feature vectors obtained through different processing steps are fused. After obtaining the vector sum, processing is performed through an activation function, which will perform different operations according to the value of the vector sum. When the vector sum is greater than 0, the activation function directly outputs the vector sum, and when the vector sum is less than or equal to 0, the activation function multiplies the vector sum by a preset constant, which is a special processing of negative information, indicating that the network security posture may have some risks or problems, and by multiplying the vector sum by a constant less than 1, the value is further reduced to represent this unfavorable situation.

[0070] In this embodiment, by combining the information of the network security posture feature vector and the key feature vector and processing through the activation function, the security state of the network can be comprehensively evaluated, and the nonlinear processing of the activation function can better map the network security risk, thereby accurately predicting the network security posture.

[0071] In an exemplary embodiment, the method further comprises: determining key parameters of the network security posture prediction model, encoding the key parameters to obtain a plurality of chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and in the case of meeting a target optimization condition, determining a target individual from all current chromosome individuals, and taking the key parameters corresponding to the target individual as model parameters of the network security posture prediction model.

[0072] Optionally, the network security posture prediction model contains multiple parameters, which have an important influence on the performance and prediction results of the model. These key parameters are encoded to form a plurality of chromosome individuals. Taking binary encoding as an example, the value of each key parameter can be represented by a string of binary digits, and a plurality of key parameters combined together form a chromosome-like individual. These chromosome individuals represent different combinations of model parameters, just like different individuals in a biological population have different genetic combinations.

[0073] Further, the chromosome individuals are optimized through a genetic algorithm, which is an optimization algorithm simulating the process of natural selection and genetic evolution. It starts from an initial population of chromosome individuals, constantly generates new individuals through operations such as biological reproduction, crossover and mutation, and selects individuals with high fitness to remain, gradually optimizing the population. In the scenario of optimizing the parameters of the network security posture prediction model, the fitness is usually measured according to the accuracy, efficiency and other performance indicators of the model in predicting the network security posture. When a certain number of iterations is reached, the fitness of the population no longer improves significantly, or an individual meeting certain performance requirements is found, a target individual is selected from all current chromosome individuals, and the combination of key parameters corresponding to the target individual is the model parameter of the optimized network security posture prediction model.

[0074] In this embodiment, by using genetic algorithm to optimize the model parameters, extensive search can be performed in the parameter space to find the global optimal or near-global optimal parameter combination. When facing various types of network attacks and complex network traffic changes, the optimized model can more accurately predict the network security posture.

[0075] In one exemplary embodiment, as shown in Figure 3 , Figure 3 is a structural diagram of a network security posture prediction model, wherein,

[0076] (1) Time mixing module, including: by linear transformation and dimension transposition operation on the input network security posture value. First, batch normalization is performed to stabilize the data distribution, making it more conducive to model learning. Then, the data is transposed in dimension to adapt to the full connection layer processing. The full connection layer performs nonlinear transformation on the data, and the activation function uses ReLU to enhance the expression ability of the model, extract the preliminary features of the data and realize the mixing of time and feature dimension. Among them, the network security posture value includes network normal behavior, fuzzy attack, port scanning, backdoor program, denial of service attack, vulnerability attack, group password attack, investigation, malicious code, worm and current network security posture value.

[0077] First, the model input is the original network security posture value, and the data shape is [Batch, Input Length, Channel], wherein Batch represents the batch size (B), Input Length represents the sequence length (L), and Channel represents the number of channels (C).

[0078] Let the input be , the result after batch normalization is: , the result after transposition is: , after time mixing processing by full connection layer, the activation function uses ReLU, and the processed result is: , and the result after transposition is the time mixing output: .

[0079] (2) Attention mechanism module, including: converting input data into query vector, key vector and value vector through linear transformation, and then calculating attention weight and weighted sum.

[0080] First, the attention mechanism module receives the output data of the time mixing module, and obtains the query vector , the key vector , and the value vector through linear transformation. The attention weight is calculated as: , wherein dk is the dimension of the key vector, and the final output is: .

[0081] (3) The TCN module includes: causal convolution, dilated convolution, and residual connection. Application of the causal convolution can effectively ensure that the situation information does not appear 'leakage' phenomenon from the future to the past, thereby ensuring the integrity of the data, and application of the dilated convolution can make the TCN have a larger receptive field with fewer layers, so that longer historical data can be received; the LeakyReLU activation function, Dropout and identity mapping network can effectively suppress the network overfitting phenomenon, thereby improving the learning speed and accuracy of the network. The residual connection helps to solve the gradient disappearance problem in the deep network, accelerates the model training, and the residual module output is composed of the network F and the input : wherein, , and the leakiness is a constant less than 1.

[0082] (4) The genetic algorithm parameter optimization module includes: coding, selection, crossover, mutation, and iterative optimization. Through iterative search of the optimal model parameter combination, the blindness and limitations of manual parameter adjustment are overcome, the performance and generalization ability of the prediction model are improved, and the model can better adapt to different network security situation value features.

[0083] For example, as shown in Figure 4 , FIG. 1 is a schematic diagram of genetic algorithm parameter optimization, mainly including the following steps: Figure 4 Coding: encode the key parameters in the prediction model, such as the TCN module convolution kernel size, the dilution rate, the number of attention heads in the attention mechanism module, and the dropout rate, to form a chromosome individual. The present application adopts real number coding, and for the TCN module convolution kernel size k, the dilution rate e, the number of attention heads n in the attention mechanism module, and the dropout rate r, they can be combined into a chromosome individual [k, e, n, r].

[0084] Selection: adopt a roulette wheel selection method and other selection strategies to select individuals with higher fitness from the current population as parents to participate in subsequent crossover and mutation operations. The selection probability p i of individual i is calculated by the formula:

[0085] where f i is the fitness value of the individual, and N is the population size. Crossover: perform crossover operation on the selected parent individuals to generate new child individuals. For two parent individuals

[0086] and , the crossover operation is performed to generate a new child individual , adopt single-point crossover, crossover in a random position to generate new individuals: and .

[0087] Mutation: the newly generated offspring individuals are subjected to mutation operation to increase the diversity of the population. For an individual , a mutation probability P m f or k is subjected to random mutation, such as f mutation to , wherein, is a value randomly generated within a certain range.

[0088] Iterative optimization: the above genetic operation process is repeatedly executed, and after several generations of evolution, the individuals in the population gradually converge to a better parameter combination. When the termination condition (the maximum number of iterations is reached or the fitness value reaches the preset threshold) is met, the parameter combination corresponding to the optimal individual is applied to the prediction model.

[0089] In this embodiment, through the attention weighting processing of the connection layer, the key features can be accurately screened out, and the interference of irrelevant information is avoided. Through the further processing of the key feature vectors by the network layer, deep security posture features can be mined. Through the processing of the output of the network layer and the input of the model by the residual layer, the stability and efficiency of model training can be guaranteed, so that the output network security posture value is more reliable. Therefore, the protection strategy can be dynamically adjusted according to the network security posture value, the network security threat can be timely responded to, and the network security can be effectively guaranteed.

[0090] It should be understood that, although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0091] Based on the same inventive concept, the embodiments of the present application also provide a network security protection device for implementing the above-mentioned network security protection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more network security protection device embodiments provided below can refer to the limitations of the network security protection method in the above text, which will not be repeated here.

[0092] In one example embodiment, as shown in Figure 5 a network security protection device is provided, comprising a model establishing module 10, a security prediction module 20 and a security protection module 30, wherein:

[0093] The model establishing module 10 is configured to establish a network security posture prediction model.

[0094] The security prediction module 20 is configured to input network security state data into the network security posture prediction model as input data, and output a network security posture. The network security posture prediction model comprises a connection layer, a network layer and a residual layer. The connection layer is configured to perform linear transposition transformation processing on the network security state data to obtain time mixed features, and perform attention weighting processing on the time mixed features to obtain a key feature vector. The network layer is configured to process the key feature vector to obtain a network security posture feature vector. The residual layer is configured to process the network security posture feature vector and the key feature vector to obtain a network security posture value.

[0095] The security protection module 30 is configured to obtain a network security protection strategy according to the network security posture value.

[0096] In one example embodiment, the security prediction module 20 is further configured to perform batch normalization processing on the network security state data to obtain normalized data, perform transposition processing on the normalized data to obtain transposed data, perform time mixing processing on the transposed data by a piecewise linear function to obtain time mixed data, and perform transposition processing on the time mixed data to obtain time mixed features.

[0097] In one example embodiment, the security prediction module 20 is further configured to perform linear transformation processing on the time mixed features to obtain a query vector, a key vector and a value vector, obtain attention weights according to dimensions of the query vector, the key vector and the key vector, and perform attention weighting processing on the value vector according to the attention weights to obtain a key feature vector.

[0098] In one example embodiment, the security prediction module 20 is further configured to perform convolution processing on the key feature vector by a causal convolution layer to obtain a time feature vector, and perform convolution processing on the time feature vector by a dilated convolution layer to obtain a network security posture feature vector.

[0099] In one example embodiment, the security prediction module 20 is further configured to obtain a vector sum of the network security posture feature vector and the key feature vector, and obtain a network security posture value by processing the vector sum by an activation function. In a case where the vector sum is greater than 0, an output of the activation function is the vector sum. In a case where the vector sum is less than or equal to 0, the output of the activation function is a product of the vector sum and a preset constant. The preset constant is less than 1.

[0100] In an example embodiment, the security prediction module 20 is further configured to determine key parameters of the network security posture prediction model, encode the key parameters to obtain a plurality of chromosome individuals, optimize the chromosome individuals through a genetic algorithm, and determine a target individual from all the chromosome individuals under the condition that a target optimization condition is met, and take the key parameters corresponding to the target individual as model parameters of the network security posture prediction model.

[0101] The modules in the network security protection device can be implemented by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the modules.

[0102] In an example embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in Figure 6 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, near field communication (NFC), or other technologies. The computer program is executed by the processor to implement a network security protection method. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball, or touchpad arranged on the shell of the computer device. The input device can also be an external keyboard, touchpad, or mouse, etc.

[0103] Those skilled in the art can understand that Figure 6The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0104] In one exemplary embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: establishing a network security posture prediction model; inputting network security state data as input data of the network security posture prediction model, and outputting a network security posture; the network security posture prediction model comprises a connection layer, a network layer and a residual layer; the connection layer is configured to perform linear transpose transformation processing on the network security state data to obtain time mixed features, and perform attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is configured to process the key feature vector to obtain a network security posture feature vector; the residual layer is configured to process the network security posture feature vector and the key feature vector to obtain a network security posture value; and a network security protection strategy is obtained according to the network security posture value.

[0105] In one embodiment, the linear transpose transformation processing on the network security state data to obtain time mixed features, involved by the processor when executing the computer program, comprises: performing batch normalization processing on the network security state data to obtain normalized data; performing transpose processing on the normalized data to obtain transposed data; performing time mixing processing on the transposed data by a piecewise linear function to obtain time mixed data; and performing transpose processing on the time mixed data to obtain the time mixed features.

[0106] In one embodiment, the attention weighting processing on the time mixed features to obtain a key feature vector, involved by the processor when executing the computer program, comprises: performing linear transformation processing on the time mixed features to obtain a query vector, a key vector and a value vector; obtaining an attention weight according to the query vector, the key vector and a dimension parameter of the key vector; and performing attention weighting processing on the value vector according to the attention weight to obtain the key feature vector.

[0107] In one embodiment, the processing on the key feature vector to obtain a network security posture feature, involved by the processor when executing the computer program, comprises: performing convolution processing on the key feature vector by a causal convolution layer to obtain a time feature vector; and performing convolution processing on the time feature vector by a dilated convolution layer to obtain a network security posture feature vector.

[0108] In one embodiment, the processor, when executing the computer program, involves processing the network security posture feature vector and the key feature vector to obtain the network security posture value, including: obtaining the vector sum of the network security posture feature vector and the key feature vector; processing the vector sum through an activation function to obtain the network security posture value; wherein, in the case that the vector sum is greater than 0, the output of the activation function is the vector sum; in the case that the vector sum is less than or equal to 0, the output of the activation function is the product of the vector sum and a preset constant; the preset constant is less than 1.

[0109] In one embodiment, the processor, when executing the computer program, also implements the following steps: determining the key parameters of the network security posture prediction model, encoding the key parameters to obtain a plurality of chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; in the case that the target optimization condition is met, determining a target individual from all current chromosome individuals, and taking the key parameters corresponding to the target individual as the model parameters of the network security posture prediction model.

[0110] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program, when executed by a processor, implements the following steps: establishing a network security posture prediction model; taking network security state data as input data of the network security posture prediction model to output a network security posture; the network security posture prediction model includes a connection layer, a network layer and a residual layer; the connection layer is used for performing linear transpose transformation processing on the network security state data to obtain time mixed features, and performing attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is used for processing the key feature vector to obtain a network security posture feature vector; the residual layer is used for processing the network security posture feature vector and the key feature vector to obtain a network security posture value; and according to the network security posture value, obtaining a network security protection strategy.

[0111] In one embodiment, the processor, when executing the computer program, involves performing linear transpose transformation processing on the network security state data to obtain time mixed features, including: performing batch normalization processing on the network security state data to obtain normalized data; performing transpose processing on the normalized data to obtain transposed data; performing time mixing processing on the transposed data through a piecewise linear function to obtain time mixed data; and performing transpose processing on the time mixed data to obtain the time mixed features.

[0112] In an embodiment, the computer program, when executed by the processor, involves attention weighting processing on the time mixed features to obtain the key feature vector, including: performing linear transformation processing on the time mixed features to obtain a query vector, a key vector and a value vector; obtaining an attention weight according to the query vector, the key vector and a dimension parameter of the key vector; and performing attention weighting processing on the value vector according to the attention weight to obtain the key feature vector.

[0113] In an embodiment, the computer program, when executed by the processor, involves processing on the key feature vector to obtain the network security posture feature, including: performing convolution processing on the key feature vector through a causal convolution layer to obtain a time feature vector; and performing convolution processing on the time feature vector through a dilated convolution layer to obtain a network security posture feature vector.

[0114] In an embodiment, the computer program, when executed by the processor, involves processing on the network security posture feature vector and the key feature vector to obtain the network security posture value, including: obtaining a vector sum of the network security posture feature vector and the key feature vector; and processing the vector sum through an activation function to obtain the network security posture value; wherein, in a case where the vector sum is greater than 0, an output of the activation function is the vector sum; in a case where the vector sum is less than or equal to 0, the output of the activation function is a product of the vector sum and a preset constant; and the preset constant is less than 1.

[0115] In an embodiment, the computer program, when executed by the processor, further implements the following steps: determining a key parameter of the network security posture prediction model, encoding the key parameter to obtain a plurality of chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; and in a case where a target optimization condition is met, determining a target individual from all current chromosome individuals, and taking the key parameter corresponding to the target individual as a model parameter of the network security posture prediction model.

[0116] In an embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the following steps: establishing a network security posture prediction model; taking network security state data as input data of the network security posture prediction model to output a network security posture; the network security posture prediction model including a connection layer, a network layer and a residual layer; the connection layer is configured to perform linear transposed transformation processing on the network security state data to obtain time mixed features, and perform attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is configured to process the key feature vector to obtain a network security posture feature vector; and the residual layer is configured to process the network security posture feature vector and the key feature vector to obtain a network security posture value; and according to the network security posture value, obtaining a network security protection strategy.

[0117] In an embodiment, the computer program, when executed by the processor, involves linear transposition transformation processing on the network security state data to obtain time mixing features, including: performing batch normalization processing on the network security state data to obtain normalized data; performing transposition processing on the normalized data to obtain transposed data; performing time mixing processing on the transposed data through a piecewise linear function to obtain time mixing data; and performing transposition processing on the time mixing data to obtain the time mixing features.

[0118] In an embodiment, the computer program, when executed by the processor, involves attention weighting processing on the time mixing features to obtain a key feature vector, including: performing linear transformation processing on the time mixing features to obtain a query vector, a key vector, and a value vector; obtaining an attention weight according to the query vector, the key vector, and a dimension parameter of the key vector; and performing attention weighting processing on the value vector according to the attention weight to obtain the key feature vector.

[0119] In an embodiment, the computer program, when executed by the processor, involves processing on the key feature vector to obtain a network security posture feature, including: performing convolution processing on the key feature vector through a causal convolution layer to obtain a time feature vector; and performing convolution processing on the time feature vector through a dilated convolution layer to obtain a network security posture feature vector.

[0120] In an embodiment, the computer program, when executed by the processor, involves processing on the network security posture feature vector and the key feature vector to obtain a network security posture value, including: obtaining a vector sum of the network security posture feature vector and the key feature vector; and processing the vector sum through an activation function to obtain the network security posture value; wherein, in a case where the vector sum is greater than 0, an output of the activation function is the vector sum; in a case where the vector sum is less than or equal to 0, the output of the activation function is a product of the vector sum and a preset constant; and the preset constant is less than 1.

[0121] In an embodiment, the computer program, when executed by the processor, further implements the following steps: determining a key parameter of the network security posture prediction model, encoding the key parameter to obtain a plurality of chromosome individuals; optimizing the chromosome individuals through a genetic algorithm; in a case where a target optimization condition is met, determining a target individual from all current chromosome individuals, and taking the key parameter corresponding to the target individual as a model parameter of the network security posture prediction model.

[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0123] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0124] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A network security protection method characterized by, The method comprises: establishing a network security posture prediction model; inputting network security state data into the network security posture prediction model as input data, and outputting a network security posture; the network security posture prediction model comprises a connection layer, a network layer and a residual layer; the connection layer is used for performing linear transposition transformation processing on the network security state data to obtain time mixed features, and performing attention weighting processing on the time mixed features to obtain a key feature vector; the network layer is used for processing the key feature vector to obtain a network security posture feature vector; and the residual layer is used for processing the network security posture feature vector and the key feature vector to obtain a network security posture value; obtaining a network security protection strategy according to the network security posture value.

2. The method of claim 1, wherein, The linear transposition transformation processing on the network security state data to obtain time mixed features comprises: performing batch normalization processing on the network security state data to obtain normalized data; performing transposition processing on the normalized data to obtain transposed data; performing time mixing processing on the transposed data by using a piecewise linear function to obtain time mixed data; performing transposition processing on the time mixed data to obtain time mixed features.

3. The method of claim 1, wherein, The attention weighting processing on the time mixed features to obtain a key feature vector comprises: performing linear transformation processing on the time mixed features to obtain a query vector, a key vector and a value vector; obtaining attention weights according to the query vector, the key vector and a dimension parameter of the key vector; performing attention weighting processing on the value vector according to the attention weights to obtain a key feature vector.

4. The method of claim 1, wherein, The processing on the key feature vector to obtain a network security posture feature comprises: performing convolution processing on the key feature vector by using a causal convolution layer to obtain a time feature vector; performing convolution processing on the time feature vector by using a dilated convolution layer to obtain a network security posture feature vector.

5. The method of claim 1, wherein, The processing on the network security posture feature vector and the key feature vector to obtain a network security posture value comprises: obtaining a vector sum of the network security posture feature vector and the key feature vector; processing the vector sum by using an activation function to obtain a network security posture value; wherein, in a case where the vector sum is greater than 0, an output of the activation function is the vector sum; in a case where the vector sum is less than or equal to 0, the output of the activation function is a product of the vector sum and a preset constant; and the preset constant is less than 1.

6. The method of claim 1, wherein, The method further comprises: determining key parameters of the network security posture prediction model, encoding the key parameters to obtain a plurality of chromosome individuals; optimizing the chromosome individuals by using a genetic algorithm; in a case where a target optimization condition is met, determining a target individual from all current chromosome individuals, and taking the key parameters corresponding to the target individual as model parameters of the network security posture prediction model.

7. A network security device, comprising: The device comprises: a model establishing module configured to establish a network security posture prediction model; The security prediction module is configured to input network security state data into the network security posture prediction model as input data, and output a network security posture. The security protection module is configured to obtain a network security protection strategy according to the network security posture value.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

Images