Network security event prediction method and device, electronic equipment, storage medium and program product

Abstract

The application discloses a network security event prediction method and device, electronic equipment, a storage medium and a program product. The method comprises the following steps: decomposing an original score matrix to obtain a base matrix and a coefficient matrix, wherein the original score matrix is constructed based on historical network security data, and the historical network security data comprises a plurality of network security events; acquiring new network security data, and determining an incremental matrix based on the new network security data; decomposing a matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; determining an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix; and predicting a target network security event from the plurality of network security events based on the incremental coefficient matrix. The above scheme can improve the efficiency of network security event prediction.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security event prediction method and device, electronic equipment, a storage medium and a program product. BACKGROUND

[0002] With the development of information technology and the Internet industry, network security problems are increasingly prominent, and various network attacks and security incidents occur frequently. It is necessary to use a network security policy recommendation model to predict the most likely network security event in the future and recommend a corresponding network security policy. The traditional network security policy recommendation model often needs to retrain the entire model when processing new data, which is inefficient. SUMMARY

[0003] To solve the problems in the related art, the embodiments of the present application provide a network security event prediction method and device, electronic equipment, a storage medium and a program product, which can improve the efficiency of network security event prediction.

[0004] The technical solutions of the embodiments of the present application are implemented as follows:

[0005] The embodiments of the present application provide a network security event prediction method, which comprises the following steps:

[0006] The original rating matrix is decomposed to obtain a base matrix and a coefficient matrix, wherein the original rating matrix is constructed based on historical network security data, and the historical network security data comprises a plurality of network security events;

[0007] New network security data is obtained, and an incremental matrix is determined based on the new network security data;

[0008] The matrix obtained by connecting the incremental matrix and the base matrix is decomposed to obtain an incremental base matrix;

[0009] Based on the incremental base matrix and the coefficient matrix, an incremental coefficient matrix is determined;

[0010] Based on the incremental coefficient matrix, a target network security event is predicted from the plurality of network security events.

[0011] The embodiments of the present application also provide a network security event prediction device, which comprises:

[0012] A first decomposition module is configured to decompose an original rating matrix to obtain a base matrix and a coefficient matrix, wherein the original rating matrix is constructed based on historical network security data, and the historical network security data comprises a plurality of network security events;

[0013] The increment matrix determination module is configured to acquire new network security data, and determine an increment matrix based on the new network security data.

[0014] The second decomposition module is configured to decompose a matrix connected by the increment matrix and the base matrix to obtain an increment base matrix.

[0015] The increment coefficient determination module is configured to determine an increment coefficient matrix based on the increment base matrix and the coefficient matrix.

[0016] The prediction module is configured to predict a target network security event from the plurality of network security events based on the increment coefficient matrix.

[0017] Embodiments of the present application further provide an electronic device, comprising a processor and a communication interface, wherein the processor is configured to perform the steps of any of the above methods.

[0018] The processor is configured to decompose an original rating matrix to obtain a base matrix and a coefficient matrix, wherein the original rating matrix is constructed based on historical network security data, the historical network security data comprising a plurality of network security events; acquire new network security data, and determine an increment matrix based on the new network security data; decompose a matrix connected by the increment matrix and the base matrix to obtain an increment base matrix; determine an increment coefficient matrix based on the increment base matrix and the coefficient matrix; and predict a target network security event from the plurality of network security events based on the increment coefficient matrix.

[0019] Embodiments of the present application further provide an electronic device, comprising a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to run the computer program to perform the steps of any of the above methods.

[0020] Embodiments of the present application further provide a storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the steps of any of the above methods.

[0021] Embodiments of the present application further provide a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the steps of any of the above methods.

[0022] In the network security event prediction method, apparatus, electronic device, storage medium and program product provided by the embodiments of the present application, the original score matrix constructed based on historical network security data is decomposed to obtain a base matrix and a coefficient matrix. After obtaining new network security data, the matrix obtained by connecting the incremental matrix corresponding to the new network security data and the base matrix is decomposed to obtain an incremental base matrix. Based on the incremental base matrix and the coefficient matrix, an incremental coefficient matrix is determined, and based on the incremental coefficient matrix, a target network security event is predicted from a plurality of network security events. Compared with the traditional method of retraining the entire score matrix, the embodiments of the present application only perform matrix processing on the newly added part of data, and the incremental matrix is combined with the existing base matrix for re-decomposition, thereby ensuring the dynamic updating of the coefficient matrix and improving the efficiency and accuracy of network security event prediction. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 The flowchart of the network security event prediction method of the embodiments of the present application Figure 1

[0024] Figure 2 The architecture diagram of the network security policy recommendation of the embodiments of the present application

[0025] Figure 3 The component structure diagram of the network security event prediction apparatus of the embodiments of the present application

[0026] Figure 4 The structure diagram of the electronic device of the embodiments of the present application DETAILED DESCRIPTION

[0027] The present application will be further described in detail below in combination with the drawings and embodiments.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terminology used in the description of the present application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application.

[0029] With the development of information technology and the Internet industry, information overload has become a challenge for people to process information. For users, how to quickly and accurately locate the content they need in exponentially growing resources is a very important and challenging thing. For network security administrators / personnel / manufacturers, how to present appropriate network security policies to different users / devices / modules in time so as to converge the security risk surface is also a difficult thing. The birth of the policy recommendation system greatly alleviates this difficulty.

[0030] ​Currently, user-defined behavior information is often used in a recommendation system to achieve different strategies for recommending to users, but the user's preferences usually change according to external environment. In addition, newly online devices / modules and strategy systems usually produce a cold start problem, that is, the system does not have enough information to push and match appropriate strategies. Since the data is constantly changing, the system is usually biased towards old data and difficult to have new improvements; and the user's preferences are also constantly changing, and the recommendation system may also be incorrectly labeled for the user's preferences. Therefore, a changing recommendation system is needed to cope with such changes.

[0031] But for a machine learning project, collect data, process data, train model, and then deploy the model to production. When the performance of the model starts to deteriorate, it is usually necessary to repeat this cycle from scratch. When changes occur, the model is updated with new data in full. However, the above solution is inefficient and has a huge impact on business areas that are critical to decisions based on current data.

[0032] Based on this, the embodiment of the application provides a network security event prediction method. In various embodiments of the application, an original score matrix is decomposed to obtain a base matrix and a coefficient matrix, wherein the original score matrix is constructed based on historical network security data, and the historical network security data includes a plurality of network security events; new network security data is obtained, and an incremental matrix is determined based on the new network security data; the matrix obtained by connecting the incremental matrix and the base matrix is decomposed to obtain an incremental base matrix; an incremental coefficient matrix is determined based on the incremental base matrix and the coefficient matrix; and a target network security event is predicted from the plurality of network security events based on the incremental coefficient matrix, thereby improving the efficiency of network security event prediction.

[0033] The application will be described in further detail below with reference to the accompanying drawings and embodiments.

[0034] The embodiment of the application provides a network security event prediction method, which is applied to an electronic device, and the electronic device includes a server and / or a terminal. The server can be deployed in the cloud (cloud server) or on the device side (edge server). Figure 1 The flowchart of the network security event prediction method of the embodiment of the application is shown in Figure 1 As shown in Figure 1 , it includes:

[0035] Step 101: decompose the original score matrix to obtain a base matrix and a coefficient matrix.

[0036] The original score matrix is constructed based on historical network security data, and the historical network security data includes a plurality of network security events.

[0037] In the embodiments of the present application, the historical network security data includes a plurality of network security events, and the plurality of network security events include network security events collected from each network device and user access behavior data obtained by the network security policy recommendation system. The network security events collected from each network device include policy hit type events and traffic bill type events. Therefore, the event types of the network security events include policy hit type, traffic bill type, and user access behavior type. Each network security event may involve different network devices and event types. Network devices or modules refer to various hardware devices and software components that have been deployed and are being used in the current network environment, responsible for communication, management, and security functions of the network. The policy hit type network security event refers to event data recorded by the network device or security device when executing the security policy, reflecting the actual execution and effect of the security policy. The traffic bill type network security event refers to detailed records of network traffic, including metadata of various network communications, used to analyze the patterns and abnormal behaviors of network traffic. The user access behavior type refers to the activity records of users in the network.

[0038] For example, the policy hit type network security event includes host controlled events, network attack events, harmful program information, malicious resource detection, malicious message detection, and disposal result records. The traffic bill type network security event includes occurrence time, protocol type, and Internet Protocol (IP) type. The user access behavior type network security event includes geographic information, continuous events, access categories, and mail information.

[0039] The number of rows of the original score matrix is the first number of network devices, and the number of columns is the number of network security events. Each row of the original score matrix is a network device, and each column is an event type of a network security event. Each element in the original score matrix represents a weight value of a network device for an event type, and the weight value represents the number or frequency of network security events of the event type occurring in the network device. Specifically, the weight value can be calculated in the following ways: directly counting the number of network security events detected by each network device on each event type, and determining the number as the weight value; or, according to the severity or importance of the network security event, giving different weights to each network security event, calculating the total weight, and determining the total weight as the weight value; or, calculating the frequency of network security events detected by each network device on each event type, i.e., the number of network security events detected per unit time, and determining the frequency as the weight value; or, normalizing the number or weight of network security events to obtain the weight value.

[0040] After the original score matrix is determined, the original score matrix can be decomposed based on a matrix decomposition algorithm to obtain a base matrix and a coefficient matrix. The matrix decomposition algorithm can be Singular Value Decomposition (SVD), Nonnegative Matrix Factorization (NMF), etc. Each element in the base matrix obtained after decomposition is used to represent the score or weight of each network device for each event type, and the number of rows of the base matrix is the first number of network devices, and the number of columns is the second number of event types. Each element in the coefficient matrix obtained after decomposition is used to represent the coefficient of each event type and each network security event, and the number of rows of the coefficient matrix is the second number of event types, and the number of columns is the number of network security events.

[0041] For example, Table 1 is the original score matrix A, Table 2 is the base matrix B obtained after decomposition, and Table 3 is the coefficient matrix C obtained after decomposition. The original score matrix A is decomposed to obtain two non-negative matrices B and C, which satisfy A≈BC, that is, A j =∑B i C ij , where B i is a row vector of the base matrix B, and C ij is a column vector corresponding to the corresponding row of B i in the coefficient matrix C.

[0042] Table 1 Original score matrix A

[0043]

[0044]

[0045] Table 2 Base matrix B

[0046]

[0047] Table 3 Coefficient matrix C

[0048]

[0049] Based on this, in an embodiment, the original score matrix can be determined by the following steps: obtaining historical network security data, the historical network security data including a plurality of network security events occurring at each network device, each network security event corresponding to an event type; constructing a first score matrix based on the first number of network devices and the second number of event types; determining a second score matrix based on the historical network security data; determining the difference between the second score matrix and the first score matrix as an error matrix; updating the second score matrix based on the error matrix to obtain an updated second score matrix; and determining the original score matrix based on the updated second score matrix.

[0050] Based on this, in an embodiment, a first score matrix is constructed based on a first number of network devices and a second number of event types, including: constructing a first row feature vector, the dimension of the first row feature vector being the first number; constructing a first column feature vector, the dimension of the first column feature vector being the second number; determining a transposed vector after transposing the first column feature vector; multiplying the first row feature vector and the transposed vector to obtain the first score matrix.

[0051] In the embodiment of the present application, after obtaining the historical network security data, the historical network security data is encoded to obtain encoded data. The encoding mode is not limited in the present application, for example, it can be one-hot encoding, label encoding, frequency encoding and embedding encoding, etc. A suitable encoding mode can be selected based on the data type in the historical network security data for encoding, for example, for the data containing time in the historical network security data, label encoding is adopted; for the frequency data such as host control frequency in the historical network security data, frequency encoding is adopted to map each category to its frequency of occurrence; for the unordered data in the historical network security data, one-hot encoding is adopted to obtain a binary vector; for the device fingerprint and other classification features with inherent correlation in the historical network security data, embedding encoding is adopted to map the data to a continuous vector space.

[0052] The first number of network devices and the second number of event types are obtained from the historical network security data. The encoded data is initialized to obtain the initialized first row feature vector PA i ∈R m*k , m is the number of rows of the first row feature vector, that is, the first number of network devices, k is the number of columns of the first row feature vector, and is a randomized value. The first row feature vector PA i is initialized, that is, a plurality of values are randomly selected or selected from a normal distribution to form an m-row k-column first row feature vector. The encoded data is initialized to obtain the initialized first column feature vector PA j ∈R n*k , n is the number of rows of the first column feature vector, that is, the second number of event types, k is the number of columns of the first column feature vector, and is a randomized value. The first column feature vector PA j is initialized, that is, a plurality of values are randomly selected or selected from a normal distribution to form an n-row k-column first column feature vector. The first column feature vector PA j is transposed to obtain a transposed vector PA j T The product of the first row feature vector and the transposed vector is determined as the first score matrix A pred = PA i × PA jT .

[0053] After constructing the first scoring matrix, a second scoring matrix is ​​determined based on historical cybersecurity data. The second scoring matrix has the same dimensions as the first scoring matrix, meaning it has the same number of rows and columns. Based on the encoded historical cybersecurity data, row feature vectors and column feature vectors are determined. The product of the transposes of these row and column feature vectors is used to determine the second scoring matrix A. pred `renew`, where each element in the second rating matrix represents the actual rating or weight of the i-th network device under the j-th event type. A loss function, such as mean squared error, is defined to measure the size of the error matrix `e`. The second rating matrix is ​​updated by minimizing the error matrix, resulting in the updated second rating matrix. Based on the gradient of the loss function, the second rating matrix `A` is made to... pred renew and the first rating matrix A pred To minimize the error matrix e between the two scores, the steps are as follows: Calculate the error matrix e = the second scoring matrix A. pred renew - First rating matrix A pred The second scoring matrix is ​​updated using the error matrix e. This update is based on the error matrix e and the row vector A in the first scoring matrix. predi and column vector A predj Update the row vector A of the second rating matrix. predi renew = A predi +a(e×A predi -γ×A predj ), where a is the learning rate and γ is the regularization parameter, both of which can be set according to actual conditions. Based on the error matrix e and the row vectors A in the first scoring matrix. predi and column vector A predj Update the column vector A of the second rating matrix. predj renew = A predj +a(e×A predj -γ×A predi Repeat the above steps until all historical network security data has been used to train the row and column vectors of the second scoring matrix, resulting in the updated second scoring matrix. Each element in the updated second scoring matrix represents the weight of a network device in a network security event for each event type. Since a weight of 0 may occur, the updated second scoring matrix cannot be directly used as the original scoring matrix.

[0054] The embodiment of the application extracts information of network devices and event types from historical network security data, constructs a first scoring matrix and a second scoring matrix, and optimizes the second scoring matrix by minimizing an error matrix, so that the finally determined original scoring matrix has higher accuracy and improves the accuracy of subsequent network security event prediction.

[0055] Based on this, in an embodiment, the original scoring matrix is determined based on the updated second scoring matrix, including: obtaining, from the updated second scoring matrix, a first weight of a network security event of each network device for each event type; for each network device, when the first weight of the network security event of the network device for a target event type is zero, obtaining a preset positive parameter value, wherein the target event type is any one of the plurality of event types; and replacing the first weight of the network security event of the network device for the target event type in the second scoring matrix with the positive parameter value to obtain the original scoring matrix.

[0056] In the embodiment of the application, the updated second scoring matrix includes a plurality of elements, each element being used to represent a first weight of a network security event of each network device for each event type. Each first weight of the updated second scoring matrix is traversed, and when the first weight is 0, the first weight is replaced with a preset positive parameter value. It should be noted that the preset positive parameter value can be the same value, or can change with the network device or the event type. The positive parameter value is an integer set based on actual needs. For example, referring to Table 1, the first weight of the network device "virtual access network" for the event type "traffic bill type" is 0, and the positive parameter value 0.16 can be obtained, which is used to replace 0 to obtain the original scoring matrix. The first weight of the network device "switch" for the event type "security policy hit" is 0, and the positive parameter value 0.21 can be obtained, which is used to replace 0 to obtain the original scoring matrix.

[0057] The embodiment of the application solves the problem of zero abnormal weight in the original scoring matrix by replacing the first weight with the preset positive parameter value when the first weight is zero, thereby improving the accuracy and stability of subsequent matrix decomposition and event prediction.

[0058] Step 102: Obtain new network security data, and determine an incremental matrix based on the new network security data.

[0059] In the embodiments of the present application, after obtaining the original score matrix, the original score matrix can be applied to the actual network security running environment to obtain the newly added network security data in real time. The newly added network security data includes newly added network devices, event types, and network security events collected by the network devices compared with the historical network security data. The newly added network security data can be collected in real time from log files, security audit records, and data gateways. The incremental matrix has the same number of rows and columns as the base matrix. Each row of the incremental matrix is a newly added network device in the newly added network security data, and each column is a newly added event type. The process of determining the incremental matrix based on the newly added network security data is similar to the process of determining the second score matrix based on the historical network security data in the above embodiments, which will not be described here.

[0060] Step 103: decompose the matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix.

[0061] Here, the incremental matrix and the base matrix are connected to obtain a connected matrix. The connected matrix is decomposed to obtain an incremental base matrix. The specific process of decomposing the connected matrix can refer to the process of decomposing the original score matrix in the above embodiments, which will not be described here. The number of rows of the incremental base matrix is the sum of the first number of network devices in the historical network security data and the number of newly added network devices in the newly added network security data. The number of columns of the incremental base matrix is the sum of the second number of event types in the historical network security data and the number of newly added event types in the newly added network security data.

[0062] Step 104: determine an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix.

[0063] Based on this, in an embodiment, determining an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix includes: obtaining an initialized incremental coefficient matrix, the number of rows of the initialized incremental coefficient matrix is the third number of network devices, and the number of columns is the fourth number of network security events; multiplying the initialized incremental coefficient matrix and the incremental base matrix to obtain a product matrix; determining a loss value between the product matrix and the coefficient matrix; updating the initialized incremental coefficient matrix based on the loss value to obtain the incremental coefficient matrix.

[0064] In the embodiments of the present application, the third number of network devices is the sum of the first number of network devices in the historical network security data and the number of newly added network devices in the newly added network security data. The fourth number of network security events is the sum of the number of network security events in the historical network security data and the number of newly added network security events in the newly added network security data. For example, the third number is h and the fourth number is g, an incremental coefficient matrix with a shape of h x g is initialized, and the elements in the initialized incremental coefficient matrix are randomly valued. The initialized incremental coefficient matrix is multiplied by the incremental base matrix to obtain a product matrix. The loss value between the product matrix and the coefficient matrix is determined, and the initialized incremental coefficient matrix is updated by minimizing the loss value to obtain the incremental coefficient matrix. The process of determining the difference between the second score matrix and the first score matrix as the error matrix, updating the second score matrix by minimizing the error matrix to obtain the updated second score matrix is similar to the specific process in the above embodiments, which will not be described here.

[0065] In some embodiments, the matrix connected by the incremental matrix and the base matrix can also be iteratively trained using the optimization direction determined by the stochastic gradient descent algorithm. The specific process is similar to the updating process of the second score matrix. After the updated connected matrix is determined, the matrix decomposition algorithm is used to directly decompose the updated connected matrix to obtain the incremental base matrix and the incremental coefficient matrix. For example, Table 4 is the incremental coefficient matrix F.

[0066] Table 4 Incremental coefficient matrix F

[0067]

[0068] In the embodiments of the present application, the product matrix is obtained by multiplying the initialized incremental coefficient matrix and the incremental base matrix, the loss value is calculated, and the loss value is minimized using the optimization algorithm to finally obtain the incremental coefficient matrix. This process ensures that the incremental coefficient matrix can effectively reflect the influence of the newly added network security data and provides an accurate basis for subsequent network security event prediction.

[0069] Step 105: predicting a target network security event from the plurality of network security events based on the incremental coefficient matrix.

[0070] Here, the target network security event is the network security event with the highest occurrence probability in the future.

[0071] Based on this, in an embodiment, predicting a target network security event from the plurality of network security events based on the incremental coefficient matrix includes: obtaining, from the incremental coefficient matrix, a second weight of each event type for each network security event; and determining the network security event corresponding to the maximum second weight as the target network security event.

[0072] Each element in the increment coefficient matrix is used to represent a second weight of each event type for each network security event. Each row of the increment coefficient matrix is an event type, and each column is a network security event. For example, referring to Table 4, the maximum second weight is 0.81, which is in the first row and the first column of the increment coefficient matrix, i.e., the second weight of the event type "security policy hit" for the network security event "host controlled event". The network security event "host controlled event" is the target network security event. That is, the most likely network security event to occur is the host controlled event, and a policy can be issued for this to reduce the probability of the occurrence of the host controlled event.

[0073] The network security event prediction method provided by the embodiments of the present application decomposes the original score matrix constructed based on historical network security data to obtain a base matrix and a coefficient matrix. After obtaining new network security data, the matrix obtained by connecting the increment matrix corresponding to the new network security data and the base matrix is decomposed to obtain an increment base matrix. Based on the increment base matrix and the coefficient matrix, an increment coefficient matrix is determined, and based on the increment coefficient matrix, a target network security event is predicted from a plurality of network security events. Compared with the traditional method of retraining the entire score matrix, the embodiments of the present application only perform matrix processing on the newly added part of the data, and through the combination and decomposition of the increment matrix and the existing base matrix, the dynamic updating of the coefficient matrix is ensured, and the efficiency and accuracy of the network security event prediction are improved.

[0074] In an embodiment, the method provided by the embodiments of the present application further includes: obtaining a first network security policy corresponding to the target network security event; when detecting a second network security policy corresponding to the target network security event in the trust list, executing the second network security policy; and when not detecting the second network security policy corresponding to the target network security event in the trust list, executing the first network security policy.

[0075] Here, the target network security event is the most likely network security event predicted by the previous steps. From the pre-defined network security policy library, find the first network security policy corresponding to the target network security event. Obtain the specific content of the first network security policy, including but not limited to firewall rules, intrusion detection system configuration, security alert settings, etc. Network security policy refers to a series of rules and measures formulated to protect the network and its resources from unauthorized access, attacks and destruction. Network security policy can include: access control policy: defines the objects allowed to access resources and the access rights; firewall rules: define the network traffic allowed or prohibited through the firewall. Intrusion detection and prevention policy: defines how to detect and respond to potential intrusion behavior. Malware protection policy: defines how to detect and remove malware. Data encryption policy: defines how to encrypt sensitive data for transmission and storage. Log audit policy: defines how to record and audit network activity.

[0076] The trust list is a white list evasion mechanism list, containing verified, trusted and must be executed network security policies. In the trust list, find the second network security policy corresponding to the target network security event. If the second network security policy corresponding to the target network security event is detected in the trust list, execute the second network security policy. If the second network security policy corresponding to the target network security event is not detected in the trust list, execute the first network security policy obtained from the policy library.

[0077] For example, find the first network security policy corresponding to "malware infection" from the policy library, which includes: start anti-virus scan, isolate infected host, send alert notification to security administrator. Query the trust list and find that the trust list contains a second network security policy corresponding to "malware infection", which includes: start advanced anti-virus scan, isolate infected host and perform deep analysis, send alert notification to security administrator. Because the trust list contains a second network security policy corresponding to "malware infection", the second network security policy is executed.

[0078] The embodiments of the present application not only can predict the target network security event, but also can select the most suitable network security policy for execution according to the existing policy in the trust list or the pre-defined policy, ensuring that the most effective protection measures can be taken when facing different types of network security events, improving the security and response speed of the system.

[0079] The present application will be described below in conjunction with application examples.

[0080] The network security event prediction method provided by the embodiment of the application is a method for realizing network security policy recommendation update based on incremental matrix decomposition. Through the principle of fast incremental matrix decomposition, an incremental recommendation system is built by using implicit feedback and the principle of incremental stochastic gradient descent. The learning of the model in the incremental recommendation system on the incremental sample is equivalent to continuing to input the incremental sample for gradient descent on the basis of the original sample. The incremental recommendation system can adapt to changes in the external environment and data in an ideal case. Generally, the model can be updated only by inputting some incremental data, and the current state can be reflected.

[0081] The embodiment of the application relates to a method and device in the technical field of network security, and specifically describes a network security policy recommendation update method and device based on incremental matrix decomposition. The method analyzes and models the online feedback data and user behavior data in a network security policy recommendation system by using the incremental matrix decomposition technology, realizes accurate update of network security policies for online security devices / modules, and improves the accuracy and real-time performance of the system. Meanwhile, the characteristics of the incremental matrix decomposition avoid recalculation of full data, reduce the calculation cost, and improve the efficiency of the system.

[0082] The subject to which the embodiment of the application is applied is a device / software module. The data used is derived from the interfaced network and network security device, and the network traffic data of deep packet analysis, and is structured and needs to be serialized and normalized. The incremental matrix, implicit feedback, and stochastic gradient descent algorithm involved in the embodiment of the application are based on secondary analysis of abnormal items on the device / module / system side, and simultaneously use cross-dimension (network, security, and traffic) examples for logical design. The method provided by the embodiment of the application is specifically described below.

[0083] Step 1: Obtain non-sensitive data (policy hit data, traffic bill data) of the online network device / module, and user access behavior data (corresponding to the historical network security data in the above embodiment) obtained by the network security policy recommendation system.

[0084] The non-sensitive data refers to the data collected in the network device and module without involving personal privacy or sensitive information. These data are mainly used for detecting network status, detecting abnormal behavior, and evaluating the effectiveness of the security policy. The data type of the policy hit data can be seen from Table 5.

[0085] Table 5: Data type of policy hit data

[0086]

[0087]

[0088] Host controlled event: This data is collected mainly to detect the situation of botnets in the environment, so as to make a strategic response to the botnet; network attack event: This data is collected mainly to obtain event characteristic information of network attacks such as Distributed Denial of Service (DDoS), Structured Query Language (SQL) injection, Cross-Site Scripting (XSS), etc., so as to make a strategic response to external intrusion-type attacks; harmful program information: This data is collected mainly to obtain the activity of harmful programs such as Trojans, ransomware, etc., so as to make a strategic response to this type of attack; malicious resource detection: This data is collected mainly to collect detection and analysis data of resources such as websites, files, links, etc., so as to make a strategic response to this type of attack; malicious message detection: This data is collected mainly to obtain more original malicious or dangerous data packets (network messages) in network traffic from network boundaries, internal network devices or network security devices / capabilities, etc., for the strategic supplement of unknown threat detection; disposal result record: This data is collected mainly to obtain the processing data of various security capabilities (devices) for security events, to analyze the success rate and disposal measures / effects of event disposal, in order to recommend the strategic response mechanism of the negative feedback strategy; heartbeat information: This data is collected mainly to obtain the heartbeat data of various security capabilities, so as to detect the running state of the strategy recommendation update system; attack packet rate: This data is collected mainly to collect the original data of the rate at which attackers send malicious network data packets to target systems, so as to deeply aggregate attack behavior data such as attempting to occupy the network bandwidth of the target system, consuming system resources, causing system crashes or denial of service, etc.; Internet Protocol (IP) activity: This data is collected mainly to identify active network devices or users, in order to drive various security capabilities and detect potential abnormal behavior; danger level: Mainly obtain the attack danger information defined by each security capability, to assist the priority of the strategy update system; whether it is a proxy IP / network address translation IP (NAT IP): This data is collected mainly to optimize the mechanism for selecting disposal targets when issuing disposal strategies, and to strengthen the intensity and accuracy of blocking accurate source IPs.

[0089] The data type of the traffic bill data can be seen from Table 6.

[0090] Table 6 Data type of traffic bill data

[0091]

[0092]

[0093] Among them, the occurrence time is used to collect the time when the attack occurs, so as to compare with the time stamp, so as to quickly push the strategy change and negative feedback; Protocol type (Transmission Control Protocol (TCP / User Datagram Protocol (UDP)...) : Different network attacks may use specific protocols for propagation, and collecting this data helps to identify abnormal protocol use and find signs of possible attack activities; IP type: the value "0" represents the IP type as Internet Protocol version 4 (ipv4), and the value "1" represents Internet Protocol version 6 (ipv6). The 7 types of data such as IP type, source IPv4, source IPv6, source port, destination IPv4, destination IPv6 and destination port: mainly to restore the complete attack chain information, and also provide basis for the development of disposal strategy; The 5 types of data such as uplink traffic, downlink traffic, uplink packet, downlink packet and return status code: mainly to detect the traffic channel movement, to analyze the potential threat state, and to establish long-term detection situation for high-level persistent threat attacks and other types; The three types of data such as file name, file length and file MD5: mainly to compare the file data restored from the traffic, and to distinguish whether it matches the known malicious file information; The 5 types of data such as content length in Hypertext Transfer Protocol (HTTP) header, HTTP method (such as GET, POST, etc.), content type in HTTP header, and Uniform Resource Locator (url): indicate the content type of the request, and abnormal Content-Type may imply malicious file upload or injection attack; The specific pattern in URL path and parameter may be a sign of attack attempt, and by analyzing the path and parameter, attacks such as SQL injection or directory traversal can be detected.

[0094] Table 7 Data types of user access behavior data

[0095]

[0096]

[0097] Behavior occurrence time: refers to the specific time when a user or device performs an operation or behavior in the network, which can include logging in, accessing a specific URL, downloading a file, sending an email, etc. It is mainly used for security risk anomaly time correlation analysis and comparison with timestamps to quickly push policy changes and negative feedback; geographic information: mainly used for matching overseas and high-risk landmarks to qualitatively analyze related risk behaviors or define analysis areas; duration: this data is mainly used to reveal user activity patterns, analyze indicators of potential malicious scanning or bombing attacks, and detect fraud indicators for short-time fast operations; destination IP: mainly matches known threat source addresses, and restores complete attack chains and targets for handling policy execution; Host field: in the HTTP request header, the Host field specifies the domain name or IP address of the target host requested by the client. Collecting the Host field can help detect malicious domain names, such as attackers may use seemingly legitimate domain names, but by analyzing the Host field, activities related to known malicious domain names can be found. For example, some attackers may use CDN or proxy servers to hide their real IP addresses, and analyzing the Host field can help reveal this type of network activity; device fingerprint: device fingerprint is a unique identifier that identifies devices on the network, containing information about the device's hardware, software, and network characteristics. Collecting this data is mainly to identify unauthorized devices or devices with different trust levels, virtual devices, and anonymous proxy devices in the network; content (Content): indicates the type of requested content, such as abnormal Content-Type may indicate a malicious file upload or injection attack; URL: specific patterns in the URL path and parameters may be signs of attack attempts, and by analyzing the path and parameters, attacks such as SQL injection or directory traversal can be detected; access category: mainly used to identify user, device, application, and other types of access behavior to help develop different object policies; return status: includes HTTP status codes and return data size information, mainly used to analyze potential configuration errors, data leakage / misuse, etc. risks; login status: mainly includes login times, times, frequencies, etc. Information to analyze risks such as brute force cracking, account theft / illegal access; email information: mainly collects email attachments and links, email headers, etc. Information to analyze potential phishing / fraud, ransomware, etc. risks.

[0098] To facilitate calculation, after obtaining the above data, data digital encoding normalization output is performed using classification feature conversion, mainly including (1) one-hot encoding: encoding unordered data such as md5 into a binary vector; (2) label encoding: encoding ordered data such as time into an integer; (3) frequency encoding: encoding frequency data such as host control by mapping each category to its frequency of occurrence; (4) embedding encoding: encoding classification features with inherent correlations such as device fingerprints into continuous vector space.

[0099] Among them, one-hot encoding is suitable for categorical features, especially unordered nominal data, such as strategy hit data, etc. The encoding process mainly includes two steps: 1) identify categorical features: determine the categorical features in the data that need to be one-hot encoded; 2) encoding: for each categorical feature, create a new binary feature, where only one bit is set to 1, representing the value of the feature. For example: for geographic information data, if it only contains "A city", "B city" and "C city", one-hot encoding becomes [1, 0, 0] (A city), [0, 1, 0] (B city), [0, 0, 1] (C city). Label encoding is suitable for relatively ordered categorical features, such as time of occurrence, degree of limitation, etc. The encoding process mainly includes two steps: 1) identify ordered categorical features: select categorical features with obvious order for label encoding; 2) sorting and encoding: sort the categories according to the order, and then assign integer labels. For example: for the danger level field containing "low", "medium" and "high", label encoding may become 0 (low), 1 (medium), 2 (high). Frequency encoding: suitable for ordered or unordered categorical features, and want to preserve the order information of the categories, but do not want to introduce too many new features, such as IP-related field information, the encoding process mainly includes two steps: 1) calculate frequency: for each category, calculate its frequency in the data set; 2) replace: replace the category with its frequency value in the data set. Embedding encoding is suitable for high-base categorical features, such as text data or features with a large number of categories, mail header information, etc. The encoding process mainly includes two steps: 1) design of embedding layer: design an embedding layer for each categorical feature, and determine the dimension of the embedding vector; 2) learn embedding vector: during training, the model will learn the embedding vector corresponding to each category, such as for the mail header title, it can be mapped to a fixed length vector using embedding encoding. These vectors can be learned and optimized during training.

[0100] Step two, use implicit feedback and use incremental matrix decomposition technology to model the encoded data, build a rating matrix, and use weight distribution and results to perform recommended actions.

[0101] Incremental matrix decomposition is a method of decomposing a matrix into a low-rank matrix, which can effectively reduce the computational complexity. The principle of implicit feedback is to fit the zeros in the rating matrix, so that there is no 0 value in the matrix calculation to affect the result. Incremental matrix decomposition technology can dynamically update model parameters and learn the implicit features in the data. The specific steps for operating on the original matrix PA constructed based on the original data are as follows: 1) If the dimension of each row and column feature vector is regarded as a pre-set hyperparameter, the row feature vector PA i ∈R m*k(First row eigenvector in the above embodiment), column eigenvector PA j ∈R n*k (First column eigenvector in the above embodiment), where m is the docking capability item encoding weight value, n is the hit item / abnormal item encoding value, k is the dimension of the feature; 2) Calculate the initial prediction matrix: use the matrix PA to calculate the initial prediction score matrix A pred (First score matrix in the above embodiment), A pred = PA i * PA j T ; 3) Traverse new network security data (corresponding to the historical network security data in the above embodiment): when new network security data comes, convert A pred into the score data matrix A pred renew (the second score data in the above embodiment); 4) Update model parameters: based on the gradient of the loss function, so that the difference between A pred renew and A pred is minimized, the steps are implemented as follows: calculate the difference between the two matrices (corresponding to the error matrix in the above embodiment): e = A pred renew-A pred , and then optimize the A pred renew matrix: A predi renew = A predi + a (e*A predi -γ*A predj ), A predj renew = A predj + a (e*A predj -γ*A predi ), where a is the learning rate and γ is the regularization parameter; 5) Repeat steps 3) and 4) until all new network security data is processed, resulting in the original score matrix A.

[0102] Table 1 Original score matrix A

[0103]

[0104]

[0105] In Table 1, the matrix column docking capability refers to the network security policy recommendation system docking the existing network equipment (network equipment, security equipment, etc.). The security equipment can obtain security policy hit data, and the network equipment can obtain complete traffic bill data. User access data is directed in traffic data to obtain and analyze the aggregation based on five-tuple and asset information table. The number in the ith row and jth column of the matrix represents the number of abnormal hits of the ith docking capability on the jth docking data (implicit feedback after optimization).

[0106] Table 1 is defined as matrix A, and A is approximately decomposed into two non-negative matrices B and C, so that A≈BC, that is, A j =∑B i C ij , where B i is a row vector of matrix B, and C ij is a column vector corresponding to the corresponding row of B i . For easy understanding, B is defined as a capability matrix (base matrix), and C is defined as a data field category matrix (coefficient matrix), and Table 2 and Table 3 are obtained by decomposition.

[0107] Table 2 Capability Matrix B

[0108]

[0109] Table 3 Data Field Category Matrix C

[0110]

[0111]

[0112] The number of abnormal hits of each docking capability on each data field category is the frequency or importance of the abnormal event detected by each network device or security device (docking capability) in the network security policy recommendation system on a specific data field category. These weights reflect the abnormal detection results of the device on the specific data field category. The docking capability refers to various hardware devices and software components in the network, such as virtual access network, firewall, intrusion detection system, host security system, switch, router, and deep packet analysis device. The data field category refers to various features extracted from network traffic, user behavior, etc., such as security policy hit items (such as host controlled events, network attack events, harmful program information, etc.), traffic bill abnormal items (such as source IP, destination IP, source port, destination port, uplink traffic, downlink traffic, etc.), and user access behavior abnormal items (such as behavior occurrence time, geographic information, duration, destination IP, Host field, device fingerprint, etc.). The number of abnormal hits refers to the frequency or importance of the abnormal event detected by each docking capability on each data field category.

[0113] Then, according to the incremental matrix D, a new matrix E (incremental base matrix) is obtained by performing the decomposition operation of matrix A again on the matrix formed by connecting the matrix B obtained by decomposing the matrix A and the matrix D, and the optimization model is iteratively trained by the optimization direction determined by the stochastic gradient descent algorithm, that is, the model parameters are repeatedly updated until convergence, so as to achieve the purpose of optimizing the model, and the method is mainly used to expand the loss function. Then, a new incremental scoring coefficient matrix F (corresponding to the incremental coefficient matrix F in the above embodiment) is obtained by C≈EF, and F is as follows.

[0114] Table 4 incremental scoring coefficient matrix F

[0115]

[0116] As can be seen from the new incremental matrix F (corresponding to the incremental coefficient matrix in the above embodiment), the host controlled event has the largest weight close to 1 and is an event with a high probability of occurrence (corresponding to the target network security event in the above embodiment), so the policy recommendation direction can be determined, and the incremental policy is pushed according to the type.

[0117] Step three, updating the network security policy recommendation system according to the modeling result.

[0118] By using the characteristics of incremental matrix decomposition, only the new data (i.e. the decomposition process of the repeated matrix F) needs to be processed, and the full amount of data does not need to be calculated (without wasting the calculation result of the matrix A), so that the updating efficiency and real-time performance of the system can be improved, and the method can refer to the method of updating the model parameters in step two.

[0119] In addition, in actual network security management work, part of the security policy has a qualitative and strict requirement and cannot be easily modified. Therefore, the white list avoidance mechanism (corresponding to the trust list in the above embodiment) is also designed in the embodiment of the application, the specific implementation steps are as follows: 1) verification and screening: when the policy recommendation updating system attempts to issue an operation, the white list module checks the source address, user identity, application program, policy content and other information of the request; 2) white list matching: the policy recommendation updating system matches the information of the request with the rules in the white list. If the source address, user identity, application program, policy content and other information of the request match the rules in the white list, the request is not allowed to continue to be executed; 3) rule priority: if multiple white list rules match the same request, the system may determine the execution order according to the priority order of the rules or select the highest priority policy for execution. The rules with high priority usually cover the rules with low priority.

[0120] Figure 2 The architecture diagram of the network security policy recommendation of the embodiment of the application is shown in the following figure.Figure 2 Firstly, a data source including benchmark data and incremental data is obtained from a data grid. Data preprocessing is performed on the data source, and the process of data preprocessing includes matrix construction and implicit feedback to obtain a scoring matrix. Matrix calculation is performed based on data increment, and the scoring matrix is subjected to incremental circulation to output an incremental matrix model. The process of matrix calculation includes inner product of row vector and column vector, decomposition of the scoring matrix. In the calculation process, matrix model optimization is also needed, and the random gradient descent algorithm is used to iteratively update the model parameters to obtain the final output incremental matrix model. The strategy to be executed is obtained from the incremental matrix model, and after white list evasion detection, each security capability is output to the data gateway through a strategy execution interface (API).

[0121] The embodiment of the present application is a method for determining the accuracy of policy matching by using implicit feedback to correct abnormal 0 values in the network security policy scoring matrix, and is also a method for building an incremental recommendation module based on the principles of fast incremental matrix decomposition and incremental random gradient descent. The method relates to data utilization of a scoring matrix A, a capability matrix (base matrix) B, a data field category matrix (coefficient matrix) C, an incremental matrix D, an incremental base matrix E, and an incremental scoring coefficient matrix F, and determines the occurrence probability of a security event according to the weight of the security event in the incremental matrix F. The method is a network security policy recommendation updating method based on incremental matrix decomposition. The method analyzes and models the online feedback data and user behavior data in the network security policy recommendation system by using the incremental matrix decomposition technology, accurately updates the network security policy of the online security device / module, improves the accuracy and real-time performance of the system, avoids the recalculation of full data by using the characteristics of the incremental matrix decomposition, reduces the calculation cost, and improves the efficiency of the system.

[0122] The network security policy recommendation updating method and device based on incremental matrix decomposition provided by the embodiment have the following advantages: data application scene and algorithm innovation: based on policy hit data, traffic bill data, user behavior data and other data originally mainly used for security detection, the data are innovatively applied to the field of network security policy recommendation updating, and the security risk identification and response time point are further moved forward. In addition, the incremental matrix and other algorithms are innovatively improved to generate a multi-dimensional value matrix, so as to solve the problems of lag and low efficiency in the current security response and defense stage by relying on data and algorithms. Efficient updating: through the incremental matrix decomposition technology, only the newly added user behavior data / online updating data need to be processed, and the full amount of data does not need to be recalculated, so that the updating efficiency of the system is improved. Real-time: since the recalculation of the full amount of data is avoided, the system can quickly respond to the needs of users / online devices and modules, and provide real-time network security policy recommendation. Accuracy: the incremental matrix decomposition technology can accurately model the user behavior data / online data, and improve the accuracy of the network security policy recommendation system. Dynamic fusion of technology and management: in the actual network security management work, some security policies have qualitative and strict requirements and cannot be easily modified. When the policy updating algorithm of the scheme encounters such a situation, a white list avoidance setting can be made, and the advantages and disadvantages between the original policy setting and the qualitative requirements are pushed to the user for recommendation and updating.

[0123] With the implementation of relevant network security laws and regulations such as level protection and data security law, the network security market has entered a rapid growth track. In the early stage, users implement the construction of relevant security mainly based on the stacking of single device / product capabilities to meet the compliance requirements. However, as the relevant requirements are gradually refined and users find in the actual security efficiency that too many devices cannot unify the strategy view, leading to low efficiency and the inability to converge security risks, etc. Therefore, users in various industries begin to explore how to activate existing security capabilities and reduce their repetitive work, and the network security policy recommendation updating system / ability has become the choice of users in the next stage of security procurement. The embodiment of the present application is highly consistent with the user demand in the relevant security requirements, and has a huge commercial market in industries such as operators, government affairs, finance, transportation and energy that require network security.

[0124] In order to realize the network security event prediction method of the embodiment of the present application, the embodiment of the present application further provides a network security event prediction device, Figure 3 The composition structure diagram of the network security event prediction device of the embodiment of the present application is shown in Figure 3 The network security event prediction device comprises:

[0125] The first decomposition module 601 is configured to decompose an original score matrix to obtain a base matrix and a coefficient matrix, wherein the original score matrix is constructed based on historical network security data, and the historical network security data comprises a plurality of network security events;

[0126] The incremental matrix determination module 602 is configured to obtain new network security data, and determine an incremental matrix based on the new network security data.

[0127] The second decomposition module 603 is configured to decompose a matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix.

[0128] The incremental coefficient determination module 604 is configured to determine an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix.

[0129] The prediction module 605 is configured to predict a target network security event from the plurality of network security events based on the incremental coefficient matrix.

[0130] In an embodiment, the network security event prediction apparatus further comprises a score matrix determination module configured to obtain historical network security data, wherein the historical network security data comprises a plurality of network security events occurring at each network device, and each network security event corresponds to an event type; construct a first score matrix based on a first number of network devices and a second number of event types; determine a second score matrix based on the historical network security data; determine an error matrix based on a difference between the second score matrix and the first score matrix; update the second score matrix based on the error matrix to obtain an updated second score matrix; and determine the original score matrix based on the updated second score matrix.

[0131] In an embodiment, the score matrix determination module is further configured to construct a first row feature vector, wherein the first row feature vector has a dimension of the first number; construct a first column feature vector, wherein the first column feature vector has a dimension of the second number; determine a transposed vector obtained by transposing the first column feature vector; and multiply the first row feature vector and the transposed vector to obtain the first score matrix.

[0132] In an embodiment, the score matrix determination module is further configured to obtain, from the updated second score matrix, a first weight value of a network security event of each network device for each event type; obtain a preset positive parameter value when the first weight value of the network security event of the network device for a target event type is zero, wherein the target event type is any one of the plurality of event types; and replace the first weight value of the network security event of the network device for the target event type in the second score matrix with the positive parameter value to obtain the original score matrix.

[0133] In an embodiment, the increment coefficient determination module 604 is further configured to obtain an initialized increment coefficient matrix, the initialized increment coefficient matrix having a third quantity of rows and a fourth quantity of columns, the third quantity being the number of network devices, and the fourth quantity being the number of network security events; multiply the initialized increment coefficient matrix and the increment base matrix to obtain a product matrix; determine a loss value between the product matrix and the coefficient matrix; and update the initialized increment coefficient matrix based on the loss value to obtain the increment coefficient matrix.

[0134] In an embodiment, the prediction module 605 is further configured to obtain, from the increment coefficient matrix, a second weight value of each event type for each network security event; and determine a network security event corresponding to a maximum second weight value as a target network security event.

[0135] In an embodiment, the network security event prediction apparatus further includes a security policy determination module configured to obtain a first network security policy corresponding to the target network security event; execute a second network security policy when detecting the second network security policy corresponding to the target network security event in a trust list; and execute the first network security policy when not detecting the second network security policy corresponding to the target network security event in the trust list.

[0136] In actual application, the first decomposition module 601, the increment matrix determination module 602, the second decomposition module 603, the increment coefficient determination module 604, the prediction module 605, the score matrix determination module, and the security policy determination module can be implemented by a processor in the network security event prediction apparatus.

[0137] It should be noted that the network security event prediction apparatus provided in the above embodiments is only used for example to illustrate the division of the above program modules, and in actual application, the above processes can be completed by different program modules according to needs, that is, the internal structure of the apparatus is divided into different program modules to complete all or part of the above processes. In addition, the network security event prediction apparatus and the network security event prediction method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the network security event prediction method embodiments, which will not be repeated here.

[0138] Based on the hardware implementation of the above program modules, and in order to implement the network security event prediction method provided in the embodiments of the present application, the embodiments of the present application further provide an electronic device, as shown in Figure 4 The electronic device 700 includes:

[0139] a communication interface 701 capable of information interaction with other network nodes;

[0140] The processor 702 is connected with the communication interface 701 to realize information interaction with other network nodes, and is used for running a computer program to execute the method provided by one or more of the above technical solutions. The computer program is stored in the memory 703.

[0141] Specifically, the processor 702 is configured to decompose an original score matrix to obtain a base matrix and a coefficient matrix, wherein the original score matrix is constructed based on historical network security data, and the historical network security data includes a plurality of network security events; obtain new network security data, and determine an incremental matrix based on the new network security data; decompose a matrix obtained by connecting the incremental matrix and the base matrix to obtain an incremental base matrix; determine an incremental coefficient matrix based on the incremental base matrix and the coefficient matrix; and predict a target network security event from the plurality of network security events based on the incremental coefficient matrix.

[0142] In an embodiment, the processor 702 is further configured to obtain historical network security data, wherein the historical network security data includes a plurality of network security events occurring at each network device, and each network security event corresponds to an event type; construct a first score matrix based on a first number of network devices and a second number of event types; determine a second score matrix based on the historical network security data; determine an error matrix based on a difference between the second score matrix and the first score matrix; update the second score matrix based on the error matrix to obtain an updated second score matrix; and determine the original score matrix based on the updated second score matrix.

[0143] In an embodiment, the processor 702 is further configured to construct a first row feature vector, wherein the first row feature vector has a dimension of the first number; construct a first column feature vector, wherein the first column feature vector has a dimension of the second number; determine a transposed vector obtained by transposing the first column feature vector; and multiply the first row feature vector and the transposed vector to obtain the first score matrix.

[0144] In an embodiment, the processor 702 is further configured to obtain, from the updated second score matrix, a first weight value of a network security event of each network device for each event type; for each network device, when the first weight value of the network security event of the network device for a target event type is zero, obtain a preset positive parameter value, wherein the target event type is any one of the plurality of event types; and replace, based on the positive parameter value, the first weight value of the network security event of the network device for the target event type in the second score matrix to obtain the original score matrix.

[0145] In an embodiment, the processor 702 is further configured to obtain an initialized incremental coefficient matrix, a row number of the initialized incremental coefficient matrix being a third number of network devices, and a column number being a fourth number of network security events; multiply the initialized incremental coefficient matrix and the incremental basis matrix to obtain a product matrix; determine a loss value between the product matrix and the coefficient matrix; update the initialized incremental coefficient matrix based on the loss value to obtain the incremental coefficient matrix.

[0146] In an embodiment, the processor 702 is further configured to obtain, from the incremental coefficient matrix, a second weight value of each event type for each network security event; and determine a network security event corresponding to a maximum second weight value as a target network security event.

[0147] In an embodiment, the processor 702 is further configured to obtain a first network security policy corresponding to the target network security event; execute a second network security policy when detecting the second network security policy corresponding to the target network security event in the trust list; and execute the first network security policy when not detecting the second network security policy corresponding to the target network security event in the trust list.

[0148] It should be noted that the specific processing process of the processor 702 can be understood with reference to the above method.

[0149] Of course, in actual application, various components in the electronic device 700 are coupled together through the bus system 704. It can be understood that the bus system 704 is used to realize the connection and communication between the components. The bus system 704 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 704 in the Figure 4 .

[0150] The memory 703 in the embodiment of the application is used to store various types of data to support the operation of the electronic device 700. Examples of these data include any computer programs used for operation on the electronic device 700.

[0151] The method disclosed in the embodiments of the present application can be applied to the processor 702 or implemented by the processor 702. The processor 702 can be an integrated circuit chip having a signal processing capability. In the implementation process, each step of the above method can be completed by an integrated logic circuit or an instruction in a software form of the processor 702. The processor 702 can be a general processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor 702 can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly implemented or executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, and the storage medium is located in the memory 703. The processor 702 reads the information in the memory 703 and combines the hardware to complete the steps of the above method.

[0152] In the exemplary embodiments, the electronic device 700 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, micro controllers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the above-described methods.

[0153] It can be understood that the memory 703 of the embodiments of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 703 described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memories.

[0154] In the example embodiments, the embodiments of the present application also provide an electronic device, comprising a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the computer program, and perform the steps of any of the above methods.

[0155] The embodiments of the present application also provide a storage medium, i.e., a computer storage medium, specifically a computer readable storage medium, such as the memory 703 for storing a computer program, which can be executed by the processor 702 of the electronic device 700 to complete the steps of the above method. The computer readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0156] The embodiments of the present application also provide a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any of the above methods.

[0157] It should be noted that "first", "second", etc. are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. In this paper, the term "and / or" is only a description of the association between the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. In addition, the term "one or more" in this paper means any combination of any one or more of the plurality of at least two, for example, including one or more of A, B, C, which can represent any one or at least two or more elements selected from the set consisting of A, B and C.

[0158] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0159] The above is only a preferred embodiment of the present application, and is not intended to limit the protection scope of the present application.

Claims

1. A method for predicting network security incidents, characterized in that, The method includes: A second scoring matrix is ​​determined based on historical network security data, which includes multiple network security events that occur on each network device, and each network security event corresponds to an event type. Based on the network device and the event type, the second scoring matrix is ​​updated to obtain the updated second scoring matrix; Based on the updated second rating matrix, the original rating matrix is ​​determined; The step of determining the original scoring matrix based on the updated second scoring matrix includes: replacing the first weights that are zero in the updated second scoring matrix with preset positive parameter values ​​to obtain the original scoring matrix, wherein the first weights are the weights of the network device for network security events of the event type; The original scoring matrix is ​​decomposed to obtain the basis matrix and the coefficient matrix; Acquire new network security data and determine an incremental matrix based on the new network security data; The matrix obtained by concatenating the incremental matrix and the basis matrix is ​​decomposed to obtain the incremental basis matrix; Obtain an initialized incremental coefficient matrix, wherein the number of rows in the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; The product matrix is ​​obtained by multiplying the initialized increment coefficient matrix with the increment basis matrix. Determine the loss value between the product matrix and the coefficient matrix; The initial incremental coefficient matrix is ​​updated based on the loss value to obtain the incremental coefficient matrix; From the incremental coefficient matrix, obtain the second weight for each event type for each network security event; The network security event corresponding to the largest second weight is identified as the target network security event.

2. The method according to claim 1, characterized in that, The step of updating the second scoring matrix based on the network device and the event type to obtain the updated second scoring matrix includes: A first scoring matrix is ​​constructed based on the first number of network devices and the second number of event types; The difference between the second rating matrix and the first rating matrix is ​​determined as the error matrix; Based on the error matrix, the second scoring matrix is ​​updated to obtain the updated second scoring matrix.

3. The method according to claim 2, characterized in that, The construction of the first scoring matrix based on the first number of network devices and the second number of event types includes: Construct the first row of feature vectors, where the dimension of the first row of feature vectors is the first number; Construct a first column feature vector, the dimension of which is the second number; Determine the transpose vector of the first column of feature vectors; The first scoring matrix is ​​obtained by multiplying the first row feature vector and the transpose vector.

4. The method according to claim 1, characterized in that, The step of determining the original rating matrix based on the updated second rating matrix includes: From the updated second scoring matrix, obtain the first weight of each network device for each network security event of each event type; For each of the network devices, when the first weight of the network device for a network security event of the target event type is zero, a preset positive parameter value is obtained, wherein the target event type is any one of the multiple event types; The original scoring matrix is ​​obtained by replacing the first weight of the network device for the network security event of the target event type in the updated second scoring matrix with the positive parameter value.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Obtain the first network security policy corresponding to the target network security event; When a second network security policy corresponding to the target network security event is detected in the trust list, the second network security policy is executed; If no second network security policy corresponding to the target network security event is detected in the trust list, the first network security policy is executed.

6. A network security incident prediction device, characterized in that, The device includes: The scoring matrix determination module is used to determine a second scoring matrix based on historical network security data, the historical network security data including multiple network security events occurring on each network device, each network security event corresponding to an event type; update the second scoring matrix based on the network device and the event type to obtain an updated second scoring matrix; determine an original scoring matrix based on the updated second scoring matrix; and further be used to replace the first weights that are zero in the updated second scoring matrix with preset positive parameter values ​​to obtain the original scoring matrix, where the first weights are the weights of the network device for network security events of the event type. The first decomposition module is used to decompose the original scoring matrix to obtain a basis matrix and a coefficient matrix; An incremental matrix determination module is used to acquire newly added network security data and determine an incremental matrix based on the newly added network security data; The second decomposition module is used to decompose the matrix after connecting the incremental matrix and the basis matrix to obtain the incremental basis matrix. An incremental coefficient determination module is used to obtain an initialized incremental coefficient matrix, wherein the number of rows in the initialized incremental coefficient matrix is ​​the third number of network devices, and the number of columns is the fourth number of network security events; multiply the initialized incremental coefficient matrix with the incremental basis matrix to obtain a product matrix; determine the loss value between the product matrix and the coefficient matrix; and update the initialized incremental coefficient matrix based on the loss value to obtain an incremental coefficient matrix. The prediction module is used to obtain a second weight for each event type for each network security event from the incremental coefficient matrix; and to determine the network security event corresponding to the largest second weight as the target network security event.

7. An electronic device, characterized in that, This includes a processor and memory for storing computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 5.

8. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images