Network security event prediction method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses a network security event prediction method and device, electronic equipment, a storage medium and a program product, and the method comprises the steps: decomposing an original score matrix to obtain a basis matrix and a coefficient matrix, the original score matrix being constructed based on historical network security data, and the historical network security data comprising a plurality of network security events; acquiring newly added network security data, and determining an increment matrix based on the newly added network security data; decomposing a matrix formed by connecting the incremental matrix and the basis matrix to obtain an incremental basis matrix; determining an increment coefficient matrix based on the increment basis matrix and the coefficient matrix; and predicting a target network security event from the plurality of network security events based on the incremental coefficient matrix. According to the scheme, the network security event prediction efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security event prediction method, device, electronic device, storage medium and program product. Background Art

[0002] With the development of information technology and the Internet industry, network security issues have become increasingly prominent, and various network attacks and security incidents have occurred frequently. It is necessary to use a network security policy recommendation model to predict the most likely network security incidents in the future and recommend corresponding network security policies. Traditional network security policy recommendation models often need to retrain the entire model when processing new data, which is inefficient. Summary of the invention

[0003] To solve related technical problems, the embodiments of the present application provide a network security event prediction method, device, electronic device, storage medium and program product, which can improve the efficiency of network security event prediction.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present invention provides a method for predicting network security events, the method comprising:

[0006] Decomposing an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events;

[0007] Acquire new network security data, and determine an incremental matrix based on the new network security data;

[0008] Decomposing a matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix;

[0009] Determine an incremental coefficient matrix based on the incremental basis matrix and the coefficient matrix;

[0010] Based on the incremental coefficient matrix, a target network security event is predicted from the multiple network security events.

[0011] The present application also provides a network security event prediction device, the device comprising:

[0012] A first decomposition module is used to decompose an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events;

[0013] An incremental matrix determination module, used to obtain newly added network security data and determine an incremental matrix based on the newly added network security data;

[0014] A second decomposition module is used to decompose the matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix;

[0015] An incremental coefficient determination module, used for determining an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix;

[0016] A prediction module is used to predict a target network security event from the multiple network security events based on the incremental coefficient matrix.

[0017] The embodiment of the present application also provides an electronic device, including: a processor and a communication interface; wherein,

[0018] The processor is used to decompose an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events; obtain newly added network security data, and determine an incremental matrix based on the newly added network security data; decompose the matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; determine an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix; and predict a target network security event from the multiple network security events based on the incremental coefficient matrix.

[0019] An embodiment of the present application also provides an electronic device, including a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of any one of the above methods when running the computer program.

[0020] An embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0021] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0022] In the network security incident prediction method, device, electronic device, storage medium and program product provided by the embodiment of the present application, the original scoring matrix constructed by the historical network security data is decomposed to obtain the base matrix and the coefficient matrix. After obtaining the newly added network security data, the matrix obtained by connecting the incremental matrix corresponding to the newly added network security data with the base matrix can be decomposed to obtain the incremental base matrix. Based on the incremental base matrix and the coefficient matrix, the incremental coefficient matrix is ​​determined. Based on the incremental coefficient matrix, the target network security incident is predicted from multiple network security incidents. Compared with retraining the entire scoring matrix in the traditional method, the embodiment of the present application only performs matrix processing on part of the newly added data. By combining the incremental matrix with the existing base matrix and then decomposing it, the coefficient matrix is ​​dynamically updated, and the efficiency and accuracy of network security incident prediction are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The process diagram of the network security event prediction method of the present application embodiment is as follows: Figure 1 ;

[0024] Figure 2 A schematic diagram of the architecture recommended for the network security strategy of the embodiment of the present application;

[0025] Figure 3 A schematic diagram of the structure of a network security event prediction device according to an embodiment of the present application;

[0026] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0029] With the development of information technology and the Internet industry, information overload has become a challenge for people to process information. For users, how to quickly and accurately locate the content they need in the exponentially growing resources is a very important and challenging task. For network security authorities / personnel / manufacturers, how to present appropriate network security strategies to different users / devices / modules in a timely manner so as to converge security risks is also a difficult task. The birth of the strategy recommendation system has greatly alleviated this difficulty.

[0030] Currently, user-defined behavior information is often used in recommendation systems to recommend different strategies for users, but user preferences usually change according to the external environment. In addition, newly launched devices / modules and policy systems usually have cold start problems, that is, the system does not have enough information to push and match appropriate strategies. Since data is constantly changing, the system usually favors old data and is difficult to improve; and user preferences are constantly changing, and the recommendation system may also mislabel user preferences. Therefore, a changing recommendation system is needed to cope with such changes.

[0031] But for a machine learning project, data is collected, processed, a model is trained, and then deployed to production. When the performance of the model starts to deteriorate, this cycle usually needs to be repeated from the beginning. When changes occur, the model is fully updated with the new data. However, the above solution is inefficient and has a huge impact on business areas where decisions based on current data are critical.

[0032] Based on this, an embodiment of the present application proposes a network security incident prediction method. In each embodiment of the present application, the original scoring matrix is ​​decomposed to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security incidents; newly added network security data is obtained, and an incremental matrix is ​​determined based on the newly added network security data; the matrix obtained by connecting the incremental matrix and the base matrix is ​​decomposed to obtain an incremental base matrix; based on the incremental base matrix and the coefficient matrix, an incremental coefficient matrix is ​​determined; based on the incremental coefficient matrix, a target network security incident is predicted from multiple network security incidents, thereby improving the efficiency of network security incident prediction.

[0033] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0034] An embodiment of the present application provides a network security event prediction method, which is applied to an electronic device, where the electronic device includes a server and / or a terminal. The server can be deployed in the cloud (cloud server) or on the device side (edge ​​server). Figure 1 The process diagram of the network security event prediction method of the present application embodiment is as follows: Figure 1 ,like Figure 1 As shown, including:

[0035] Step 101: Decompose the original rating matrix to obtain a base matrix and a coefficient matrix.

[0036] Among them, the original scoring matrix is ​​constructed based on historical network security data, which includes multiple network security events.

[0037] In an embodiment of the present application, historical network security data includes multiple network security events, and the multiple network security events include network security events collected from each network device, and user access behavior data obtained by the network security policy recommendation system. Among them, the network security events collected on each network device include events of policy hit type and events of traffic bill type. Therefore, the event types of network security events include policy hit type, traffic bill type, and user access behavior type. Each network security event may involve different network devices and event types. Network devices or modules refer to various hardware devices and software components that have been deployed and are in use in the current network environment, responsible for the communication, management and security functions of the network. Network security events of policy hit type refer to event data recorded by network devices or security devices when executing security policies, reflecting the actual implementation and effect of security policies. Network security events of traffic bill type refer to detailed records of network traffic, including metadata of various network communications, which are used to analyze patterns and abnormal behaviors of network traffic. User access behavior type refers to records of user activities in the network.

[0038] For example, network security events of the policy hit type include host controlled events, network attack events, harmful program information, malicious resource detection, malicious message detection and disposal result records, etc. Network security events of the traffic bill type include occurrence time, protocol type and Internet Protocol (IP) type, etc. Network security events of the user access behavior type include geographic information, continuous events, access categories and email information, etc.

[0039] The number of rows of the original scoring matrix is ​​the first number of network devices, and the number of columns is the number of network security events. Each row of the original scoring matrix is ​​a network device, and each column is an event type of a network security event. Each element in the original scoring matrix represents the weight of a network device for an event type, and the weight represents the number or frequency of network security events of this event type that occur on the network device. Specifically, it can be calculated in the following ways: directly counting the number of network security events detected by each network device on each event type, and determining the number as the weight; or, according to the severity or importance of the network security event, assigning different weights to each network security event, calculating the total weight, and determining the total weight as the weight; or, calculating the frequency of network security events detected by each network device on each event type, that is, the number of network security events detected per unit time, and determining the frequency as the weight; or, normalizing the number or weight of network security events to obtain the weight.

[0040] After determining the original scoring matrix, the original scoring matrix can be decomposed based on a matrix decomposition algorithm to obtain a base matrix and a coefficient matrix. The matrix decomposition algorithm can be a singular value decomposition (SVD), a non-negative matrix factorization (NMF), etc. Each element in the base matrix obtained after decomposition is used to represent the score or weight of each network device for each event type. The number of rows of the base matrix is ​​the first number of network devices, and the number of columns is the second number of event types. Each element in the coefficient matrix obtained after decomposition is used to represent the coefficient of each event type and each network security event. The number of rows of the coefficient matrix is ​​the second number of event types, and the number of columns is the number of network security events.

[0041] For example, Table 1 is the original rating matrix A, Table 2 is the decomposed basis matrix B, and Table 3 is the decomposed coefficient matrix C. The original rating matrix A is decomposed into two non-negative matrixes B and C, satisfying A≈BC, that is, A j =∑B i C ij , where B i is the row vector of the basis matrix B, C ij is the coefficient matrix C corresponding to B i Column vector of corresponding rows.

[0042] Table 1 Original score matrix A

[0043]

[0044]

[0045] Table 2 Basis matrix B

[0046]

[0047] Table 3 Coefficient matrix C

[0048]

[0049] Based on this, in one embodiment, the original scoring matrix can be determined by the following steps: obtaining historical network security data, the historical network security data including multiple network security events occurring on each network device, each network security event corresponding to an event type; constructing a first scoring matrix based on a first number of network devices and a second number of event types; determining a second scoring matrix based on the historical network security data; determining the difference between the second scoring matrix and the first scoring matrix as an error matrix; updating the second scoring matrix based on the error matrix to obtain an updated second scoring matrix; and determining the original scoring matrix based on the updated second scoring matrix.

[0050] Based on this, in one embodiment, based on a first number of network devices and a second number of event types, a first scoring matrix is ​​constructed, including: constructing a first row of feature vectors, the dimension of the first row of feature vectors is the first number; constructing a first column of feature vectors, the dimension of the first column of feature vectors is the second number; determining a transposed vector after transposing the first column of feature vectors; and multiplying the first row of feature vectors and the transposed vector to obtain a first scoring matrix.

[0051] In an embodiment of the present application, after acquiring the historical network security data, the historical network security data is encoded to obtain the encoded data. The embodiment of the present application does not limit the encoding method, for example, it can be one-hot encoding, label encoding, frequency encoding, and embedded encoding. A suitable encoding method can be selected based on the data type in the historical network security data for encoding. For example, for the data containing time in the historical network security data, label encoding is used; for the frequency data such as the host controlled frequency in the historical network security data, frequency encoding is used to map each category to its frequency of occurrence; for the disordered data in the historical network security data, one-hot encoding is used to obtain a binary vector; for the classification features with intrinsic correlation such as device fingerprints in the historical network security data, embedded encoding is used to map the data to a continuous vector space.

[0052] Obtain the first number of network devices and the second number of event types from historical network security data. Perform initialization processing on the encoded data to obtain the initialized first row feature vector PA i ∈R m*k , m is the number of rows of the first row of feature vectors, that is, the first number of network devices, and k is the number of columns of the first row of feature vectors, which is a random value. Initialize and construct the first row of feature vectors PA i , that is, randomly select or select multiple values ​​from the normal distribution to form the first row of feature vectors with m rows and k columns. Initialize the encoded data to obtain the initialized first column feature vector PA j ∈R n*k , n is the number of rows in the first column of feature vectors, that is, the second number of event types, and k is the number of columns in the first column of feature vectors, which is a random value. Initialize and construct the first column of feature vectors PA j , that is, randomly select or select multiple values ​​from the normal distribution to form the first column of n rows and k columns of the eigenvector. j Transpose and get the transposed vector PA j T , the product of the first row of eigenvectors and the transposed vector is determined as the first scoring matrix A pred =PA i ×PA jT .

[0053] After constructing the first scoring matrix, a second scoring matrix is ​​determined based on the historical network security data. The dimension of the second scoring matrix is ​​the same as that of the first scoring matrix, that is, it has the same number of rows and columns. Based on the data encoded from the historical network security data, the row feature vector and the column feature vector are determined, and the product of the transposition of the row feature vector and the column feature vector is determined as the second scoring matrix A. pred renew, where each element in the second scoring matrix represents the actual score or weight of the i-th network device under the j-th event type. Define a loss function, such as mean square error, to measure the size of the error matrix e. Update the second scoring matrix by minimizing the error matrix to obtain an updated second scoring matrix. Based on the gradient of the loss function, the second scoring matrix A pred renew and the first scoring matrix A pred The error matrix e between them is minimized, and the steps are as follows: Calculate the error matrix e = the second scoring matrix A pred renew-first scoring matrix A pred , use the error matrix e to update the second scoring matrix. Wherein, based on the error matrix e, the row vector A in the first scoring matrix predi and column vector A predj , update the row vector A of the second scoring matrix predi renew=A predi +a(e×A predi -γ×A predj ), where a is the learning rate and γ is the regularization parameter, both of which can be set based on actual conditions. Based on the error matrix e, the row vector A in the first scoring matrix predi and column vector A predj , update the column vector A of the second scoring matrix predj renew=A predj +a(e×A predj -γ×A predi ). Repeat the above steps until all historical network security data are used to train the row vectors and column vectors of the second scoring matrix, and obtain the updated second scoring matrix. Each element in the updated second scoring matrix is ​​used to represent the weight of the network device in each event type for a network security event. Since the weight may be 0, the new second scoring matrix cannot be directly used as the original scoring matrix.

[0054] The embodiment of the present application extracts information about network devices and event types from historical network security data, constructs a first scoring matrix and a second scoring matrix, and optimizes the second scoring matrix by minimizing the error matrix. The final original scoring matrix has higher accuracy, thereby improving the accuracy of subsequent network security event predictions.

[0055] Based on this, in one embodiment, based on the updated second scoring matrix, the original scoring matrix is ​​determined, including: obtaining the first weight of each network device for each event type of network security event from the updated second scoring matrix; for each network device, when the first weight of the network device for the network security event of the target event type is zero, obtaining a preset positive parameter value, wherein the target event type is any one of a plurality of event types; replacing the first weight of the network device for the network security event of the target event type in the second scoring matrix based on the positive parameter value to obtain the original scoring matrix.

[0056] In an embodiment of the present application, the updated second scoring matrix includes a plurality of elements, each element being used to represent the first weight of each network device for each event type of network security event. Each first weight of the updated second scoring weight is traversed, and when the first weight is 0, the first weight is replaced with a preset positive parameter value. It should be noted that the preset positive parameter values ​​can all be the same value, or they can change with the network device or event type. The positive parameter value is an integer set by itself based on actual needs. For example, referring to Table 1, the first weight of the network device "virtual access network" for the event type "traffic call list type" is 0, and a positive parameter value of 0.16 can be obtained, and 0.16 is replaced by 0 to obtain the original scoring matrix. The first weight of the network device "switch" for the event type "security policy hit" is 0, and a positive parameter value of 0.21 can be obtained, and 0.21 is replaced by 0 to obtain the original scoring matrix.

[0057] The embodiment of the present application solves the problem of abnormal weight values ​​of zero in the original scoring matrix by replacing the first weight value with a preset positive parameter value when the first weight value is zero, thereby improving the accuracy and stability of subsequent matrix decomposition and event prediction.

[0058] Step 102: Acquire newly added network security data, and determine an incremental matrix based on the newly added network security data.

[0059] In an embodiment of the present application, after obtaining the original scoring matrix, the original scoring matrix can be applied to the actual network security operating environment to obtain new network security data in real time. The new network security data includes new network devices, event types, and network security events collected by network devices compared to historical network security data. New network security data can be collected in real time from log files, security audit records, and data gateways. The incremental matrix has the same number of rows and columns as the base matrix, and each row of the incremental matrix is ​​a new network device in the new network security data, and each column is a new event type. The process of determining the incremental matrix based on the new network security data is similar to the process of determining the second scoring matrix based on the historical network security data in the above embodiment, and will not be described here.

[0060] Step 103: Decompose the matrix obtained by concatenating the incremental matrix and the base matrix to obtain the incremental base matrix.

[0061] Here, the incremental matrix and the base matrix are connected to obtain a connected matrix. The connected matrix is ​​decomposed to obtain an incremental base matrix. The specific process of decomposing the connected matrix can refer to the process of decomposing the original scoring matrix in the above embodiment, which will not be described here. The number of rows of the incremental base matrix is ​​the sum of the first number of network devices in the historical network security data and the number of newly added network devices in the newly added network security data. The number of columns of the incremental base matrix is ​​the sum of the second number of event types in the historical network security data and the number of newly added event types in the newly added network security data.

[0062] Step 104: Determine an incremental coefficient matrix based on the incremental basis matrix and the coefficient matrix.

[0063] Based on this, in one embodiment, based on the incremental base matrix and the coefficient matrix, an incremental coefficient matrix is ​​determined, including: obtaining an initialized incremental coefficient matrix, the number of rows of the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; multiplying the initialized incremental coefficient matrix with the incremental base matrix to obtain a product matrix; determining a loss value between the product matrix and the coefficient matrix; and updating the initialized incremental coefficient matrix based on the loss value to obtain an incremental coefficient matrix.

[0064] In an embodiment of the present application, the third number of network devices is the sum of the first number of network devices in the historical network security data and the number of newly added network devices in the newly added network security data. The fourth number of network security events is the sum of the number of network security events in the historical network security data and the number of newly added network security events in the newly added network security data. Exemplarily, the third number is h and the fourth number is g, then an incremental coefficient matrix of shape h×g is initialized, and the elements in the initialized incremental coefficient matrix are all randomly taken. The initialized incremental coefficient matrix is ​​multiplied by the incremental basis matrix to obtain a product matrix. The process of determining the loss value between the product matrix and the coefficient matrix, updating the initialized incremental coefficient matrix by minimizing the loss value, and obtaining the incremental coefficient matrix is ​​similar to the specific process of determining the difference between the second scoring matrix and the first scoring matrix as the error matrix, and updating the second scoring matrix by minimizing the error matrix to obtain the updated second scoring matrix in the above embodiment, and will not be described here.

[0065] In some embodiments, the matrix after the incremental matrix is ​​connected to the base matrix can also be iteratively trained using the optimization direction determined by the stochastic gradient descent algorithm. The specific process is the same as the update process type of the second scoring matrix. After determining the updated connected matrix, the updated connected matrix is ​​directly decomposed using a matrix decomposition algorithm to obtain an incremental base matrix and an incremental coefficient matrix. Exemplarily, Table 4 is the incremental coefficient matrix F.

[0066] Table 4 Incremental coefficient matrix F

[0067]

[0068] The embodiment of the present application obtains a product matrix by multiplying the initialized incremental coefficient matrix with the incremental basis matrix, calculates the loss value, and uses an optimization algorithm to minimize the loss value to finally obtain the incremental coefficient matrix. This process ensures that the incremental coefficient matrix can effectively reflect the impact of the newly added network security data, and provides an accurate basis for subsequent network security event predictions.

[0069] Step 105: Predict a target network security event from multiple network security events based on the incremental coefficient matrix.

[0070] Here, the target network security event is the network security event with the highest probability of occurrence in the future.

[0071] Based on this, in one embodiment, based on the incremental coefficient matrix, a target network security event is predicted from multiple network security events, including: obtaining the second weight of each event type for each network security event from the incremental coefficient matrix; and determining the network security event corresponding to the maximum second weight as the target network security event.

[0072] Each element in the incremental coefficient matrix is ​​used to represent the second weight of each event type for each network security event. Each row of the incremental coefficient matrix is ​​an event type, and each column is a network security event. For example, referring to Table 4, the maximum second weight is 0.81, which belongs to the first row and first column in the incremental coefficient matrix, that is, the second weight of the event type "security policy hit" for the network security event "host controlled event". The network security event "host controlled event" is the target network security event. That is to say, it is predicted that the most likely network security event is the host controlled event, and policies can be issued for this to reduce the probability of host controlled events.

[0073] The network security incident prediction method provided by the embodiment of the present application decomposes the original scoring matrix constructed by the historical network security data to obtain the base matrix and the coefficient matrix. After obtaining the newly added network security data, the matrix obtained by connecting the incremental matrix corresponding to the newly added network security data with the base matrix can be decomposed to obtain the incremental base matrix. Based on the incremental base matrix and the coefficient matrix, the incremental coefficient matrix is ​​determined. Based on the incremental coefficient matrix, the target network security incident is predicted from multiple network security incidents. Compared with the traditional method of retraining the entire scoring matrix, the embodiment of the present application only performs matrix processing on part of the newly added data. By combining the incremental matrix with the existing base matrix and then decomposing it, the coefficient matrix is ​​dynamically updated, and the efficiency and accuracy of network security incident prediction are improved.

[0074] In one embodiment, the method provided by the embodiment of the present application also includes: obtaining a first network security policy corresponding to the target network security event; when a second network security policy corresponding to the target network security event is detected in the trust list, executing the second network security policy; when the second network security policy corresponding to the target network security event is not detected in the trust list, executing the first network security policy.

[0075] Here, the target network security event is the most likely network security event predicted by the previous steps. From the predefined network security policy library, find the first network security policy corresponding to the target network security event. Obtain the specific content of the first network security policy, including but not limited to firewall rules, intrusion detection system configuration, security alarm settings, etc. Network security policy refers to a series of rules and measures formulated to protect the network and its resources from unauthorized access, attack and destruction. Network security policies may include: Access control policy: defines the objects allowed to access resources and the access permissions; Firewall rules: defines whether network traffic is allowed or prohibited to pass through the firewall. Intrusion detection and prevention policy: defines how to detect and respond to potential intrusions. Malware protection policy: defines how to detect and remove malware. Data encryption policy: defines how to encrypt, transmit and store sensitive data. Log audit policy: defines how to record and audit network activities.

[0076] The trust list is a whitelist avoidance mechanism list, which contains verified, trusted, and must-be-executed network security policies. The second network security policy corresponding to the target network security event is searched in the trust list. If the second network security policy corresponding to the target network security event is detected in the trust list, the second network security policy is executed. If the second network security policy corresponding to the target network security event is not detected in the trust list, the first network security policy obtained from the policy library is executed.

[0077] Exemplarily, a first network security policy corresponding to "malware infection" is found in the policy library, and the content includes: starting anti-virus scanning, isolating infected hosts, and sending an alarm notification to the security administrator. The trust list is queried, and it is found that the trust list contains a second network security policy corresponding to "malware infection", and the content includes: starting advanced anti-virus scanning, isolating infected hosts and performing in-depth analysis, and sending an alarm notification to the security administrator. Since the second network security policy corresponding to "malware infection" exists in the trust list, the second network security policy is executed.

[0078] The embodiments of the present application can not only predict target network security events, but also select the most appropriate network security policy for execution based on existing policies or predefined policies in the trust list, thereby ensuring that the most effective protection measures can be taken when facing different types of network security events, thereby improving the security and response speed of the system.

[0079] The present application is described below in conjunction with application examples.

[0080] The network security incident prediction method provided in the embodiment of the present application is a method for updating network security policy recommendations based on incremental matrix decomposition. Through the principle of fast incremental matrix decomposition, an incremental recommendation system is built using implicit feedback and incremental random gradient descent principles. The learning of incremental samples by the model in the incremental recommendation system is equivalent to continuing to input incremental samples for gradient descent based on the original samples. Ideally, the incremental recommendation system can adapt to changes in the external environment and data. Usually, the model can be updated and the current state can be reflected only by the input of some incremental data.

[0081] The embodiment of the present application relates to a method and device in the field of network security technology, and specifically describes a network security policy recommendation and update method and device based on incremental matrix decomposition. The method uses incremental matrix decomposition technology to analyze and model the existing network feedback data and user behavior data in the network security policy recommendation system, so as to accurately update the network security policy of the existing network security equipment / module and improve the accuracy and real-time performance of the system. At the same time, through the characteristics of incremental matrix decomposition, the recalculation of the full amount of data is avoided, the calculation cost is reduced, and the efficiency of the system is improved.

[0082] The subject of the application of the embodiment of the present application is the device / software module, and the data used comes from the network flow data of the docked network and network security equipment and deep packet analysis, and is structured and needs to be serialized and normalized. The incremental matrix, implicit feedback, and stochastic gradient descent algorithm involved in the embodiment of the present application are abnormal items based on secondary analysis of the device / module / system end, and the logic design is carried out with the help of cross-dimensional (network, security, traffic) examples. The method provided in the embodiment of the present application is described in detail below.

[0083] Step 1: Obtain non-sensitive data of existing network devices / modules (policy hit data, traffic bill data) and user access behavior data obtained by the network security policy recommendation system (corresponding to the historical network security data in the above embodiment).

[0084] Among them, non-sensitive data refers to data collected in network devices and modules that does not involve personal privacy or sensitive information. This data is mainly used to detect network status, detect abnormal behavior, and evaluate the effectiveness of security policies. The data type of policy hit data can be seen in Table 5.

[0085] Table 5 Data types of strategy hit data

[0086]

[0087]

[0088] Host controlled events: This data is collected mainly to detect the situation of botnets in the environment, so as to make strategic responses to botnets; Network attack events: This data is collected mainly to obtain event feature information of network attacks such as Distributed Denial of Service (DDoS), Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), etc., so as to make strategic responses to external intrusion attacks; Harmful program information: This data is collected mainly to obtain the activities of harmful programs such as Trojans and ransomware, so as to make strategic responses to this type of attack; Malicious resource detection: This data is collected mainly to collect detection and analysis data of resources such as websites, files, links, etc., so as to make strategic responses to this type of attack; Malicious message detection: This data is collected mainly to obtain relatively original malicious or dangerous data packets (network messages) in network traffic from network boundaries, internal network devices or network security devices / capabilities, etc., for supplementary detection of unknown threats. The purpose of collecting this data is to obtain the processing data of security incidents by various security capabilities (equipment), analyze the success rate of incident handling and the handling measures / effects, and provide a policy response mechanism for the negative feedback policy recommendation system. Heartbeat information: The purpose of collecting this data is to obtain the heartbeat data of various security capabilities, so that the policy recommendation update system can detect its operating status. Attack packet rate: The purpose of collecting this data is to collect the original data of the rate at which the attacker sends malicious network data packets to the target system, so as to facilitate the in-depth aggregation of attack behavior data such as attempts to occupy the network bandwidth of the target system, consume system resources, cause system crashes or denial of service, etc. Internet Protocol (IP) activity: The purpose of collecting this data is to identify active network devices or users to drive various security capabilities and detect potential abnormal behaviors. Danger level: The purpose is to obtain the attack risk level information defined by each security capability, which is used to assist the priority of the policy update system. Whether it is a proxy IP / Network Address Translation IP (NAT IP): The purpose of collecting this data is to optimize the mechanism for selecting the disposal target when issuing disposal strategies, and to strengthen the intensity and accuracy of blocking the precise source IP.

[0089] The data type of traffic bill data can be found in Table 6.

[0090] Table 6 Data types of traffic bill data

[0091]

[0092]

[0093] Among them, occurrence time: used to collect the time when the attack occurred, so as to compare it with the timestamp, so as to quickly push policy changes and negative feedback; protocol type (Transmission Control Protocol (TCP / User Datagram Protocol (UDP)...): different network attacks may use specific protocols to spread. By collecting this data, it is helpful to identify abnormal protocol usage and find signs of possible attack activities; IP type: the value "0" represents the IP type of Internet Protocol version 4 (IPv4), and the value "1" represents Internet Protocol version 4 (IPv6). 6, ipv6). 7 types of data, including ip type, source IPv4, source IPv6, source port, destination IPv4, destination IPv6 and destination port: mainly to restore the complete attack chain information and provide a basis for the formulation of disposal strategies; 5 types of data, including upstream traffic, downstream traffic, upstream data packets, downstream data packets and return status code: mainly to detect changes in traffic channels to analyze potential threat status and establish long-term detection status for types such as advanced persistent threat attacks; 3 types of data, including file name, file length and file MD5: mainly to compare the file data restored from the traffic to identify whether it matches the known malicious file information; content length in the Hypertext Transfer Protocol (HTTP) header, HTTP method (such as GET, POST, etc.), content type in the HTTP header, and Uniform Resource Locator (Uniform Resource Locator) Locator, url, etc.: Indicates the content type of the request. For example, an abnormal Content-Type may indicate a malicious file upload or injection attack. Specific patterns in the URL path and parameters may be signs of an attack attempt. By analyzing the path and parameters, attacks such as SQL injection or directory traversal can be detected.

[0094] Table 7 Data types of user access behavior data

[0095]

[0096]

[0097] Behavior occurrence time: refers to the specific time when a user or device performs an operation or behavior on the network. These behaviors may include logging in, accessing a specific URL, downloading a file, sending an email, etc. It is mainly used to analyze the time correlation of security risk anomalies and compare them with timestamps in order to quickly push policy changes and provide negative feedback. Geographic information: It is mainly used to match overseas and high-risk area identifiers to qualitatively identify relevant risk behaviors or define analysis areas. Duration: This data is mainly used to reveal patterns of user activities, analyze indicators of potential malicious scanning or blasting attacks, and fraud detection indicators of short-term and fast operations. Destination IP: It is mainly used to match known threat source addresses, and restore the complete attack chain and define the execution target based on the disposal strategy. Host field: In the HTTP request header, the Host field specifies the domain name or IP address of the target host requested by the client. Collecting the Host field can help detect malicious domain names. For example, attackers may use seemingly legitimate domain names, but by analyzing the Host field, activities related to known malicious domain names can be discovered. For example, some attackers may use CDN or proxy servers to hide their real IP addresses. Analyzing the Host field can help reveal this type of network activity. Device fingerprint: Device fingerprint is a unique identifier that identifies a device on the network. It contains information about the device's hardware, software, and network characteristics. This data is collected mainly to identify the activities of unauthorized devices or devices of different trust levels, virtual devices, and anonymous proxy devices in the network; Content: indicates the content type of the request, such as an abnormal Content-Type may indicate a malicious file upload or injection attack; URL: specific patterns in the URL path and parameters may be signs of an attack attempt. By analyzing the path and parameters, attacks such as SQL injection or directory traversal can be detected; Access category: mainly used to identify multiple types of access behaviors such as users, devices, and applications to help formulate different object policies; Return status: includes HTTP status code and return data size information, mainly used to analyze potential configuration errors, data leakage / abuse and other risks; Login status: mainly includes login times, time, frequency and other information, used to analyze the risks of brute force cracking, account theft / illegal access; Email information: mainly collects email attachments and links, email headers and other information, used to analyze potential phishing / fraud, ransomware and other risks.

[0098] In order to facilitate calculation, after obtaining the above data, classification feature transformation is used to digitally encode the data and normalize the output. The main methods are: (1) one-hot encoding: encoding disordered data such as md5 into a binary vector; (2) label encoding: encoding ordered data such as time into integers; (3) frequency encoding: encoding frequency data such as host control, mapping each category to its frequency of occurrence; (4) embedded encoding: mapping classification feature encodings with intrinsic correlations such as device fingerprints to continuous vector space.

[0099] Among them, one-hot encoding is suitable for categorical features, especially unordered nominal data, such as strategy hit data. The encoding process mainly includes two steps: 1) Identify categorical features: determine the categorical features that need to be one-hot encoded in the data; 2) Encoding: For each categorical feature, create a new binary feature in which only one bit is set to 1, indicating the value of the feature. For example, for geographic information data, if it only contains "City A", "City B" and "City C", it becomes [1, 0, 0] (City A), [0, 1, 0] (City B), [0, 0, 1] (City C) after one-hot encoding. Label encoding is suitable for relatively ordered categorical features, such as occurrence time, restrictive level and other data. The encoding process mainly includes two steps: 1) Identify ordered categorical features: select categorical features with obvious order for label encoding; 2) Sorting and encoding: sort the categories in order and then assign integer labels. For example, for the danger level field containing "low", "medium" and "high", the labels may become 0 (low), 1 (medium), and 2 (high) after encoding. Frequency encoding: It is suitable for ordered or unordered categorical features, and you want to retain the order information of the categories, but you do not want to introduce too many new features, such as IP-related field information. The encoding process mainly includes two steps: 1) Calculate frequency: For each category, calculate its frequency of occurrence in the data set; 2) Replace: Replace the category with its frequency value in the data set. Embedding encoding is suitable for high-cardinality categorical features, such as text data or features with a large number of categories, email header information, etc. The encoding process mainly includes two steps: 1) Design of embedding layer: Design an embedding layer for each categorical feature and determine the dimension of the embedding vector; 2) Learn embedding vector: During the training process, the model will learn the embedding vector corresponding to each category. For example, for the email header title, embedding encoding can be used to map it to a fixed-length vector, which can be learned and optimized during training.

[0100] Step 2: Use implicit feedback and incremental matrix factorization technology to model the encoded data, construct a scoring matrix, and use the weight distribution and results to perform recommended actions.

[0101] Incremental matrix decomposition is a method to decompose a matrix into a low-rank matrix, which can effectively reduce the computational complexity. The implicit feedback principle fits the zeros in the score matrix so that zero values ​​do not appear when doing matrix calculations and affect the results. Incremental matrix decomposition technology can dynamically update model parameters and learn implicit features in the data. For example, the specific steps for operating the original matrix PA constructed based on the original data are as follows: 1) If the dimensions of each row and column feature vector are regarded as pre-set hyperparameters, the row feature vector PA i ∈R m*k(corresponding to the first row of eigenvectors in the above embodiment), column eigenvector PA j ∈R n*k (corresponding to the first column of feature vectors in the above embodiment), where m is the encoding weight value of the docking capability item, n is the encoding value of the hit item / abnormal item, and k is the dimension of the feature; 2) Calculate the initial prediction matrix: Use the matrix PA to calculate the initial prediction score matrix A pred (corresponding to the first scoring matrix in the above embodiment), A pred =PA i *PA j T ; 3) traverse the new network security data (corresponding to the historical network security data in the above embodiment): when new network security data arrives, A pred Convert to score data matrix A pred renew (corresponding to the second scoring data in the above embodiment); 4) Update model parameters: based on the gradient of the loss function, make A pred Renew and A pred The difference between them is minimized, and the steps are as follows: Calculate the difference between the two matrices (corresponding to the error matrix in the above embodiment): e = A pred renew-A pred , and then optimize A pred Renew matrix: A predi renew=A predi +a(e*A predi -γ*A predj ), A predj renew=A predj +a(e*A predj -γ*A predi ), where a is the learning rate and γ is the regularization parameter; 5) Repeat steps 3) and 4) until all new network security data are processed and the original scoring matrix A is obtained.

[0102] Table 1 Original score matrix A

[0103]

[0104]

[0105] In Table 1, the matrix column docking capability refers to the existing network equipment (network equipment, security equipment, etc.) docked by the network security policy recommendation system. Security policy hit data can be obtained through security equipment, and complete traffic call data can be obtained through network equipment. User access data is obtained and merged in the traffic data based on the five-tuple and asset information table. The number in the i-th row and j-th column of the matrix represents the weight of the number of abnormal hits of the i-th docking capability on the j-th docking data (after implicit feedback optimization).

[0106] Define the matrix in Table 1 as matrix A, and decompose A approximately into two non-negative matrices B and C, so that A≈BC, that is, A j =∑B i C ij , where B i is the row vector of matrix B, C ij For B i The column vector of the corresponding row. For ease of understanding, define B as the capability matrix (base matrix), and define C as the data field category matrix (coefficient matrix), and decompose to obtain Table 2 and Table 3.

[0107] Table 2 Capability Matrix B

[0108]

[0109] Table 3 Data field category matrix C

[0110]

[0111]

[0112] The number of abnormal hits of each docking capability on each data field category refers to the frequency or importance of abnormal events detected by each network device or security device (docked capability) on a specific data field category in the network security policy recommendation system. These weights reflect the abnormal detection results of the device on a specific data field category. Docked capabilities refer to various hardware devices and software components in the network, such as: virtual access network, firewall, intrusion detection system, host security system, switch, router, deep packet analysis device. Data field category refers to various features extracted from network traffic, user behavior and other data, such as: security policy hit items (such as host controlled events, network attack events, harmful program information, etc.), traffic call abnormal items (such as source IP, destination IP, source port, destination port, upstream traffic, downstream traffic, etc.), user access behavior abnormal items (such as behavior occurrence time, geographic information, duration, destination IP, Host field, device fingerprint, etc.). The number of abnormal hits weight refers to the frequency or importance of abnormal events detected by each docking capability on each data field category.

[0113] Then, according to the incremental matrix D, the matrix A is decomposed again by connecting the matrix B obtained by decomposing the matrix A and the matrix D to obtain the matrix A, and the new matrix E (incremental basis matrix) is obtained, and the optimization model is iteratively trained in the optimization direction determined by the stochastic gradient descent algorithm, that is, the model parameters are repeatedly updated until convergence, so as to achieve the purpose of optimizing the model. This method is mainly expanded by the use of the loss function. Then, through C≈EF, a new incremental scoring coefficient matrix F (corresponding to the incremental coefficient matrix F in the above embodiment) is obtained, and F is obtained as follows.

[0114] Table 4 Incremental rating coefficient matrix F

[0115]

[0116] It can be seen from the newly added incremental matrix F (corresponding to the incremental coefficient matrix in the above embodiment) that the weight of the host controlled event is the largest and close to 1, which is an event with a high probability of occurrence (corresponding to the target network security event in the above embodiment). Therefore, the policy recommendation direction can be determined and the incremental policy can be pushed according to the type.

[0117] Step three: Update the network security policy recommendation system based on the modeling results.

[0118] By utilizing the characteristics of incremental matrix decomposition, only the newly added data (i.e., repeating the decomposition process of matrix F) needs to be processed without recalculating the full data (without wasting the calculation results of matrix A). This can improve the update efficiency and real-time performance of the system. The method can refer to the method of updating model parameters in step 2.

[0119] In addition, in actual network security management work, some security policies have qualitative and strict requirements and cannot be easily modified. Therefore, the embodiment of the present application also completes the design of a whitelist avoidance mechanism (corresponding to the trust list in the above embodiment), realizes the release of specific policy changes and realizes the push of comparison information. The specific implementation steps are as follows: 1) Verification and screening: When the policy recommendation update system attempts to issue a certain operation, the whitelist module will check the source address, user identity, application, policy content and other information of the request; 2) Whitelist matching: The policy recommendation update system matches the information of the request with the rules in the whitelist. If the source address, user identity, application policy content and other information of the request match the rules in the whitelist, the request is not allowed to continue to execute; 3) Rule priority: If multiple whitelist rules match the same request, the system may determine the execution order according to the priority order of the rules or select the highest priority policy for execution. Rules with high priority usually override rules with low priority.

[0120] Figure 2 This is a schematic diagram of the network security strategy recommended by the present application embodiment. Figure 2 First, obtain the data source from the data grid, which includes baseline data and incremental data. Perform data preprocessing on the data source, and the data preprocessing process includes matrix construction and implicit feedback to obtain a scoring matrix. Perform matrix calculation based on data increments, perform incremental loops on the scoring matrix, and output an incremental matrix model. The matrix calculation process includes the inner product of row vectors and column vectors, and the decomposition of the scoring matrix. During the calculation process, it is also necessary to optimize the matrix model, and use the stochastic gradient descent algorithm to iteratively update the model parameters to obtain the final output incremental matrix model. Obtain the policy to be executed from the incremental matrix model, and after evading detection through the whitelist, output each security capability to the data gateway through the policy execution interface (Application Programming Interface, API).

[0121] The embodiment of the present application is a method for determining the accuracy of policy matching by using implicit feedback, correcting abnormal 0 values ​​of a network security policy scoring matrix by implicit feedback, and also a method for building an incremental recommendation module by the principle of fast incremental matrix decomposition and the principle of incremental random gradient descent, a method for utilizing data of a scoring matrix A, a capability matrix (base matrix) B, a data field category matrix (coefficient matrix) C, an incremental matrix D, an incremental base matrix E, and an incremental scoring coefficient matrix F, and determining the probability of occurrence of security events according to the weights occupied by the security events in the newly added incremental matrix F; a network security policy recommendation and update method based on incremental matrix decomposition, which analyzes and models the existing network feedback data and user behavior data in the network security policy recommendation system by using incremental matrix decomposition technology, realizes accurate updating of network security policies for existing network security devices / modules, improves the accuracy and real-time performance of the system, and at the same time, through the characteristics of incremental matrix decomposition, avoids recalculation of the full amount of data, reduces computing costs, and improves system efficiency.

[0122] The network security policy recommendation and update method and device based on incremental matrix decomposition provided in the embodiment of the present application have the following advantages: Data application scenarios and algorithm innovation: Based on policy hit data, traffic call data, user behavior data and other data that were originally mainly used for security detection, they are innovatively applied to the field of network security policy recommendation and update, and the security risk identification and response time point are further advanced. In addition, the incremental matrix and other algorithms are innovatively improved to realize the generation of multi-dimensional value matrix, and the lag and low efficiency of the current security response and defense stage are solved by relying on data and algorithms. Efficient update: Through the incremental matrix decomposition technology, only the newly added user behavior data / existing network update data needs to be processed without recalculating the full amount of data, thereby improving the update efficiency of the system. Real-time: Since the recalculation of the full amount of data is avoided, the system can quickly respond to the needs of users / online devices and modules, and provide real-time network security policy recommendations. Accuracy: The incremental matrix decomposition technology can accurately model user behavior data / existing network data, improving the accuracy of the network security policy recommendation system. Dynamic integration of technology and management: In actual network security management, some security policies have qualitative and strict requirements that cannot be easily modified. When encountering such a situation, the policy update algorithm of this solution can perform whitelist avoidance settings and push recommendations to users to update the pros and cons between the original policy settings and the qualitative requirements.

[0123] With the implementation of relevant network security laws and regulations such as the Level Protection Law and the Data Security Law, the network security market has embarked on a fast-growing track. In the early stage, users promoted the construction of relevant security mainly based on the stacking of single equipment / product capabilities to meet compliance requirements. However, as the relevant requirements gradually became more detailed and users found that there were too many devices and it was impossible to unify the policy view in the actual use of security effectiveness, resulting in low efficiency and security risks that could not be converged. Therefore, users from all walks of life began to explore how to activate existing security capabilities and reduce their own repetitive work, and network security policy recommendation update systems / capabilities began to become the user's choice for security procurement in the next stage. The embodiments of the present application are highly consistent with user needs in terms of relevant security requirements, and have a huge commercial market in industries that require network security, such as operators, government affairs, finance, transportation, and energy.

[0124] In order to implement the network security event prediction method of the embodiment of the present application, the embodiment of the present application also provides a network security event prediction device, Figure 3 Schematic diagram of the structure of the network security event prediction device according to the embodiment of the present application. Figure 3 As shown, the network security event prediction device includes:

[0125] A first decomposition module 601 is used to decompose an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events;

[0126] An incremental matrix determination module 602 is used to obtain newly added network security data and determine an incremental matrix based on the newly added network security data;

[0127] The second decomposition module 603 is used to decompose the matrix obtained by concatenating the incremental matrix and the base matrix to obtain the incremental base matrix;

[0128] An incremental coefficient determination module 604 is used to determine an incremental coefficient matrix based on an incremental base matrix and a coefficient matrix;

[0129] The prediction module 605 is used to predict a target network security event from multiple network security events based on the incremental coefficient matrix.

[0130] In one embodiment, the network security event prediction device also includes a scoring matrix determination module, which is used to obtain historical network security data, the historical network security data including multiple network security events occurring in each network device, each network security event corresponding to an event type; construct a first scoring matrix based on a first number of network devices and a second number of event types; determine a second scoring matrix based on the historical network security data; determine the difference between the second scoring matrix and the first scoring matrix as an error matrix; update the second scoring matrix based on the error matrix to obtain an updated second scoring matrix; and determine the original scoring matrix based on the updated second scoring matrix.

[0131] In one embodiment, the matrix determination module is also used to construct a first row of feature vectors, the dimension of the first row of feature vectors is a first number; construct a first column of feature vectors, the dimension of the first column of feature vectors is a second number; determine the transposed vector after the first column of feature vectors are transposed; multiply the first row of feature vectors and the transposed vector to obtain a first scoring matrix.

[0132] In one embodiment, the scoring matrix determination module is also used to obtain the first weight of each network device for each event type of network security event from the updated second scoring matrix; for each network device, when the first weight of the network device for the network security event of the target event type is zero, obtain a preset positive parameter value, wherein the target event type is any one of multiple event types; replace the first weight of the network device for the network security event of the target event type in the second scoring matrix based on the positive parameter value to obtain the original scoring matrix.

[0133] In one embodiment, the incremental coefficient determination module 604 is also used to obtain an initialized incremental coefficient matrix, the number of rows of the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; multiply the initialized incremental coefficient matrix with the incremental basis matrix to obtain a product matrix; determine the loss value between the product matrix and the coefficient matrix; and update the initialized incremental coefficient matrix based on the loss value to obtain the incremental coefficient matrix.

[0134] In one embodiment, the prediction module 605 is further used to obtain the second weight of each event type for each network security event from the incremental coefficient matrix; and determine the network security event corresponding to the maximum second weight as the target network security event.

[0135] In one embodiment, the network security event prediction device also includes a security policy determination module, which is used to obtain a first network security policy corresponding to a target network security event; when a second network security policy corresponding to the target network security event is detected in a trust list, the second network security policy is executed; when the second network security policy corresponding to the target network security event is not detected in the trust list, the first network security policy is executed.

[0136] In actual application, the first decomposition module 601, the incremental matrix determination module 602, the second decomposition module 603, the incremental coefficient determination module 604, the prediction module 605, the scoring matrix determination module and the security policy determination module can be implemented by a processor in the network security event prediction device.

[0137] It should be noted that: the network security event prediction device provided in the above embodiment only uses the division of the above program modules as an example when predicting network security events. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the network security event prediction device provided in the above embodiment and the network security event prediction method embodiment belong to the same concept. The specific implementation process is detailed in the network security event prediction method embodiment, which will not be repeated here.

[0138] Based on the hardware implementation of the above program modules, and in order to implement a network security event prediction method provided in an embodiment of the present application, an embodiment of the present application further provides an electronic device, such as Figure 4 As shown, the electronic device 700 includes:

[0139] Communication interface 701, capable of exchanging information with other network nodes;

[0140] The processor 702 is connected to the communication interface 701 to implement information exchange with other network nodes, and is used to execute the method provided by one or more technical solutions when running a computer program. The computer program is stored in the memory 703.

[0141] Specifically, the processor 702 is used to decompose the original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events; obtain newly added network security data, and determine an incremental matrix based on the newly added network security data; decompose the matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; determine an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix; and predict a target network security event from multiple network security events based on the incremental coefficient matrix.

[0142] In one embodiment, the processor 702 is further used to obtain historical network security data, the historical network security data including multiple network security events occurring in each network device, each network security event corresponding to an event type; construct a first scoring matrix based on a first number of network devices and a second number of event types; determine a second scoring matrix based on the historical network security data; determine the difference between the second scoring matrix and the first scoring matrix as an error matrix; update the second scoring matrix based on the error matrix to obtain an updated second scoring matrix; and determine the original scoring matrix based on the updated second scoring matrix.

[0143] In one embodiment, the processor 702 is further used to construct a first row of feature vectors, the dimension of the first row of feature vectors is a first number; construct a first column of feature vectors, the dimension of the first column of feature vectors is a second number; determine a transposed vector after transposing the first column of feature vectors; and multiply the first row of feature vectors and the transposed vector to obtain a first scoring matrix.

[0144] In one embodiment, the processor 702 is further used to obtain a first weight of each network device for each event type of network security event from the updated second scoring matrix; for each network device, when the first weight of the network device for the network security event of the target event type is zero, obtain a preset positive parameter value, wherein the target event type is any one of multiple event types; replace the first weight of the network device for the network security event of the target event type in the second scoring matrix based on the positive parameter value to obtain the original scoring matrix.

[0145] In one embodiment, the processor 702 is also used to obtain an initialized incremental coefficient matrix, the number of rows of the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; multiply the initialized incremental coefficient matrix with the incremental basis matrix to obtain a product matrix; determine the loss value between the product matrix and the coefficient matrix; and update the initialized incremental coefficient matrix based on the loss value to obtain the incremental coefficient matrix.

[0146] In one embodiment, the processor 702 is further configured to obtain, from the incremental coefficient matrix, a second weight of each event type for each network security event; and determine the network security event corresponding to the maximum second weight as the target network security event.

[0147] In one embodiment, the processor 702 is also used to obtain a first network security policy corresponding to the target network security event; when a second network security policy corresponding to the target network security event is detected in the trust list, the second network security policy is executed; when the second network security policy corresponding to the target network security event is not detected in the trust list, the first network security policy is executed.

[0148] It should be noted that the specific processing process of the processor 702 can be understood by referring to the above method.

[0149] Of course, in actual application, the various components in the electronic device 700 are coupled together through the bus system 704. It is understandable that the bus system 704 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 4 Various buses are labeled as bus system 704 .

[0150] The memory 703 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 700. Examples of such data include: any computer program used to operate on the electronic device 700.

[0151] The method disclosed in the above embodiment of the present application can be applied to the processor 702, or implemented by the processor 702. The processor 702 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 702 or an instruction in the form of software. The above-mentioned processor 702 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 702 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 703, and the processor 702 reads the information in the memory 703 and completes the steps of the above method in combination with its hardware.

[0152] In an exemplary embodiment, the electronic device 700 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0153] It can be understood that the memory 703 of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 703 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0154] In an exemplary embodiment, the embodiment of the present application further provides an electronic device, including a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of any of the above methods when running the computer program.

[0155] The embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a memory 703 storing a computer program, and the computer program can be executed by a processor 702 of an electronic device 700 to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0156] An embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

[0157] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. The term "and / or" herein is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "one or more" herein represents any combination of at least two of any one or more of a plurality of items. For example, including one or more of A, B, and C can represent including any one or at least two or more elements selected from the set consisting of A, B, and C.

[0158] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0159] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A network security incident prediction method, characterized in that: The method comprises: Decomposing an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events; Acquire new network security data, and determine an incremental matrix based on the new network security data; Decomposing a matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; Determine an incremental coefficient matrix based on the incremental basis matrix and the coefficient matrix; Based on the incremental coefficient matrix, a target network security event is predicted from the multiple network security events.

2. The method according to claim 1, characterized in that The method further comprises: Acquire the historical network security data, wherein the historical network security data includes a plurality of network security events occurring on each network device, each of the network security events corresponding to an event type; constructing a first scoring matrix based on the first number of the network devices and the second number of the event types; determining a second scoring matrix based on the historical network security data; Determine the difference between the second scoring matrix and the first scoring matrix as an error matrix; Based on the error matrix, updating the second scoring matrix to obtain an updated second scoring matrix; The original scoring matrix is ​​determined based on the updated second scoring matrix.

3. The method according to claim 2, characterized in that The constructing a first scoring matrix based on the first number of the network devices and the second number of the event types includes: Constructing a first row of feature vectors, where the dimension of the first row of feature vectors is the first number; Constructing a first column of feature vectors, wherein the dimension of the first column of feature vectors is the second number; Determine a transposed vector after transposing the first column of eigenvectors; The first row of feature vectors and the transposed vector are multiplied to obtain the first scoring matrix.

4. The method according to claim 2, characterized in that: The determining the original scoring matrix based on the updated second scoring matrix includes: Obtaining, from the updated second scoring matrix, a first weight of each network device for a network security event of each event type; For each network device, when a first weight of a network security event of a target event type of the network device is zero, obtaining a preset positive parameter value, wherein the target event type is any one of the multiple event types; The first weight of the network security event of the network device for the target event type in the second scoring matrix is ​​replaced based on the positive parameter value to obtain the original scoring matrix.

5. The method according to claim 1, characterized in that The step of determining an incremental coefficient matrix based on the incremental basis matrix and the coefficient matrix comprises: Obtain an initialized incremental coefficient matrix, wherein the number of rows of the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; Multiplying the initialized incremental coefficient matrix with the incremental basis matrix to obtain a product matrix; determining a loss value between the product matrix and the coefficient matrix; The initialized incremental coefficient matrix is ​​updated based on the loss value to obtain the incremental coefficient matrix.

6. The method according to claim 1, characterized in that The step of predicting a target network security event from the plurality of network security events based on the incremental coefficient matrix includes: Obtaining, from the incremental coefficient matrix, a second weight value for each event type for each network security event; The network security event corresponding to the largest second weight is determined as the target network security event.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtaining a first network security policy corresponding to the target network security event; When a second network security policy corresponding to the target network security event is detected in the trust list, executing the second network security policy; When the second network security policy corresponding to the target network security event is not detected in the trust list, the first network security policy is executed.

8. A network security event prediction device, characterized in that: The device comprises: A first decomposition module is used to decompose an original scoring matrix to obtain a base matrix and a coefficient matrix, wherein the original scoring matrix is ​​constructed based on historical network security data, and the historical network security data includes multiple network security events; An incremental matrix determination module, used to obtain newly added network security data and determine an incremental matrix based on the newly added network security data; A second decomposition module is used to decompose the matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; An incremental coefficient determination module, used for determining an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix; A prediction module is used to predict a target network security event from the multiple network security events based on the incremental coefficient matrix.

9. An electronic device, characterized in that: comprising a processor and a memory for storing a computer program capable of being executed on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that The computer program implements the steps of the method according to any one of claims 1 to 7 when executed by a processor.

Images