Model generation method, information processing method and equipment

Abstract

The invention relates to a model generation method, an information processing method, equipment, a computer readable storage medium, a computer program product and a computer program. The method comprises the following steps: a first device receives one or more kth-layer sub-models; k is a positive integer; the first device determines a target model based on the one or more kth layer sub-models; the target model is used for detecting whether communication data of a mobile network is intrusion type data; and the first device sends the target model.

Description

Model generation method, information processing method and device Technical Field

[0001] The present application relates to the field of communications, and more specifically, to a model generation method, an information processing method, a device, a computer-readable storage medium, a computer program product, and a computer program. Background Art

[0002] With the rapid development of mobile internet and the widespread use of mobile devices, the number of applications running on mobile terminals has exploded, leading to an increasing number of network attacks and intrusions targeting mobile terminals. Therefore, accurately detecting intrusions on mobile networks has become a pressing issue.

[0003] Summary of the Invention

[0004] Embodiments of the present application provide a model generation method, an information processing method, a device, a computer-readable storage medium, a computer program product, and a computer program.

[0005] The present invention provides a model generation method, including:

[0006] The first device receives one or more k-th layer sub-models; k is a positive integer;

[0007] The first device determines a target model based on the one or more k-th layer sub-models; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data;

[0008] The first device sends the target model.

[0009] The present invention provides a model generation method, including:

[0010] The second device sends a k-th layer sub-model, where k is a positive integer; the k-th layer sub-model is used to determine the target model;

[0011] The second device receives a target model; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

[0012] The present invention provides an information processing method, including:

[0013] The electronic device receives communication data from the mobile network;

[0014] The electronic device inputs the communication data of the mobile network into a target model to obtain a detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein the target model is obtained based on the above method.

[0015] An embodiment of the present application provides a first device, including:

[0016] A first communication unit is configured to send a first wireless signal and receive a first reflected signal, wherein the first reflected signal is sent by the second device based on the first wireless signal;

[0017] The first processing unit is configured to generate a first key based on the reception strength of the first reflected signal.

[0018] An embodiment of the present application provides a second device, including:

[0019] A second communication unit, configured to receive a first wireless signal;

[0020] The second processing unit is configured to generate a second key based on the reception strength of the first wireless signal.

[0021] An embodiment of the present application provides a first device, including:

[0022] The first communication unit is configured to receive one or more k-th layer sub-models and send a target model; k is a positive integer;

[0023] The first processing unit is configured to determine a target model based on the one or more k-th layer sub-models; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

[0024] An embodiment of the present application provides a second device, including:

[0025] The second communication unit is used to send the k-th layer sub-model; k is a positive integer; the k-th layer sub-model is used to determine the target model; receive the target model; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

[0026] An embodiment of the present application provides an electronic device, including:

[0027] a third communication unit, configured to receive communication data from a mobile network;

[0028] The third processing unit is used to input the communication data of the mobile network into the target model to obtain the detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein, the target model is obtained based on the model generation method.

[0029] An embodiment of the present application provides a first device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and execute the computer program stored in the memory, so that the first device performs the above method.

[0030] An embodiment of the present application provides a second device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and execute the computer program stored in the memory, so that the second device executes the above method.

[0031] An embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory, so that the electronic device executes the above method.

[0032] The embodiment of the present application provides a chip for implementing the above method.

[0033] Specifically, the chip includes: a processor, which is used to call and run a computer program from a memory, so that a device equipped with the chip executes the above method.

[0034] An embodiment of the present application provides a computer-readable storage medium for storing a computer program, which enables a device to perform the above method when the computer program is executed by the device.

[0035] An embodiment of the present application provides a computer program product, including computer program instructions, which enable a computer to execute the above method.

[0036] An embodiment of the present application provides a computer program, which, when executed on a computer, enables the computer to execute the above method.

[0037] In the embodiment of the present application, a target model can be obtained by adopting a federated training method. Since the sub-models and the target model are generated on different devices respectively, the data security can be guaranteed in the process of obtaining the target model. Furthermore, since the target model is obtained based on the aggregation of multiple sub-models, the processing of the target model can be guaranteed to be more accurate, and the results of the communication data analysis of the mobile network based on the target model can be guaranteed to be more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] FIG1 is a schematic diagram of an application scenario according to an embodiment of the present application.

[0039] FIG2 is a flow chart of a model generation method according to an embodiment of the present application.

[0040] FIG3 is a second flow chart of a model generation method according to an embodiment of the present application.

[0041] FIG4 is a schematic diagram of a processing flow of model aggregation according to an embodiment of the present application.

[0042] FIG5 is a third flow chart of a model generation method according to an embodiment of the present application.

[0043] FIG6 is a schematic diagram of a processing flow for calculating accuracy according to an embodiment of the present application.

[0044] FIG7 is an exemplary flowchart of a model generation method according to an embodiment of the present application.

[0045] FIG8 is another exemplary flowchart of a model generation method according to an embodiment of the present application.

[0046] FIG9 is another exemplary flowchart of a model generation method according to an embodiment of the present application.

[0047] FIG10 is another exemplary flowchart of a model generation method according to an embodiment of the present application.

[0048] FIG11 is a schematic flowchart of an information processing method according to an embodiment of the present application.

[0049] FIG12 is a schematic diagram of a scenario combining model generation and information processing according to an embodiment of the present application.

[0050] FIG13 is a schematic block diagram of a first device according to an embodiment of the present application.

[0051] FIG14 is a schematic block diagram of a second device according to another embodiment of the present application.

[0052] FIG15 is a schematic block diagram of an electronic device according to another embodiment of the present application.

[0053] FIG16 is a schematic block diagram of a communication device according to an embodiment of the present application.

[0054] FIG17 is a schematic block diagram of a chip according to an embodiment of the present application.

[0055] FIG18 is a schematic block diagram of a communication system according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0057] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, Advanced Long Term Evolution (LTE-A) system, New Radio (NR) system, NR system evolution system, LTE on unlicensed spectrum (LTE-U) system, NR on unlicensed spectrum (NR-U) system, Non-Terrestrial Networks (NTN) system, Universal Mobile Telecommunication System (UMTS), Wireless Local Area Networks (WLAN), Wireless Fidelity (Wireless Fidelity) system. Fidelity, WiFi), fifth-generation communication (5th-Generation, 5G) system or other communication systems, etc.

[0058] Generally speaking, traditional communication systems support a limited number of connections and are easy to implement. However, with the development of communication technology, mobile communication systems will not only support traditional communications, but will also support, for example, device-to-device (D2D) communication, machine-to-machine (M2M) communication, machine-type communication (MTC), vehicle-to-vehicle (V2V) communication, or vehicle-to-everything (V2X) communication, etc. The embodiments of the present application can also be applied to these communication systems.

[0059] In one possible implementation, the communication system in the embodiment of the present application can be applied to a carrier aggregation (CA) scenario, a dual connectivity (DC) scenario, and a standalone (SA) networking scenario.

[0060] In one possible implementation, the communication system in the embodiment of the present application can be applied to an unlicensed spectrum, where the unlicensed spectrum can also be considered as a shared spectrum; or, the communication system in the embodiment of the present application can also be applied to an authorized spectrum, where the authorized spectrum can also be considered as an unshared spectrum.

[0061] The embodiments of the present application describe various embodiments in conjunction with network devices and terminal devices, wherein the terminal device may also be referred to as user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.

[0062] The terminal device can be a station (STAION, ST) in a WLAN, a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA) device, a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in a next-generation communication system such as an NR network, or a terminal device in a future evolved Public Land Mobile Network (PLMN) network, etc.

[0063] In an embodiment of the present application, the terminal device can be deployed on land, including indoors or outdoors, handheld, wearable or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.).

[0064] In an embodiment of the present application, the terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home, etc.

[0065] As an example and not a limitation, in the embodiment of the present application, the terminal device may also be a wearable device. Wearable devices may also be called wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also achieve powerful functions through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include those that are fully functional, large in size, and can achieve complete or partial functions without relying on smartphones, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various smart bracelets and smart jewelry for vital sign monitoring.

[0066] In an embodiment of the present application, the network device may be a device for communicating with a mobile device. The network device may be an access point (AP) in WLAN, a base station (BTS) in GSM or CDMA, a base station (NodeB, NB) in WCDMA, an evolved base station (eNB or eNodeB) in LTE, or a relay station or access point, or a vehicle-mounted device, a wearable device, and a network device (gNB) in an NR network, or a network device in a future evolved PLMN network or a network device in an NTN network, etc.

[0067] As an example and not a limitation, in an embodiment of the present application, the network device may have a mobile feature, for example, the network device may be a mobile device. Alternatively, the network device may be a satellite or a balloon station. For example, the satellite may be a low earth orbit (LEO) satellite, a medium earth orbit (MEO) satellite, a geostationary earth orbit (GEO) satellite, a high elliptical orbit (HEO) satellite, etc. Optionally, the network device may also be a base station set up in a location such as land or water.

[0068] In an embodiment of the present application, the network device can provide services for a cell, and the terminal device communicates with the network device through the transmission resources used by the cell (for example, frequency domain resources, or spectrum resources). The cell can be a cell corresponding to the network device (for example, a base station). The cell can belong to a macro base station or a base station corresponding to a small cell. The small cells here may include: metro cells, micro cells, pico cells, femto cells, etc. These small cells have the characteristics of small coverage and low transmission power, and are suitable for providing high-speed data transmission services.

[0069] FIG1 exemplarily illustrates a communication system 100. The communication system includes a network device 110 and two terminal devices 120. In one possible implementation, the communication system 100 may include multiple network devices 110, and each network device 110 may include a different number of terminal devices 120 within its coverage area, which is not limited in this embodiment of the present application.

[0070] In one possible implementation, the communication system 100 may further include other network entities such as a Mobility Management Entity (MME) and an Access and Mobility Management Function (AMF), which is not limited in this embodiment of the present application.

[0071] Among them, the network equipment may include access network equipment and core network equipment. That is, the wireless communication system also includes multiple core networks for communicating with the access network equipment. The access network equipment can be an evolutionary base station (evolutional node B, abbreviated as eNB or e-NodeB) macro base station, micro base station (also called "small base station"), pico base station, access point (AP), transmission point (TP) or new generation base station (new generation Node B, gNodeB), etc. in a long-term evolution (LTE) system, a next-generation (mobile communication system) (next radio, NR) system or an authorized auxiliary access long-term evolution (LAA-LTE) system.

[0072] It should be understood that in the embodiments of the present application, a device having a communication function in a network / system may be referred to as a communication device. Taking the communication system shown in Figure 1 as an example, the communication device may include a network device and a terminal device having a communication function. The network device and the terminal device may be specific devices in the embodiments of the present application and will not be described in detail here. The communication device may also include other devices in the communication system, such as a network controller, a mobility management entity, and other network entities, which are not limited in the embodiments of the present application.

[0073] It should be understood that the terms "system" and "network" are often used interchangeably herein. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " generally indicates that the related objects are in an "or" relationship.

[0074] It should be understood that the "indication" mentioned in the embodiments of this application can be a direct indication, an indirect indication, or an indication of an association. For example, "A indicates B" can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association between A and B.

[0075] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and being indicated, configuration and being configured, etc.

[0076] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following relevant technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all fall within the protection scope of the embodiments of the present application.

[0077] FIG2 is a schematic flow chart of a model generation method according to an embodiment of the present application. The method includes at least part of the following contents.

[0078] S210. The first device receives one or more k-th layer sub-models, where k is a positive integer.

[0079] S220. The first device determines a target model based on the one or more k-th layer sub-models; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data;

[0080] S230: The first device sends the target model.

[0081] FIG3 is a schematic flow chart of a model generation method according to an embodiment of the present application. The method includes at least part of the following contents.

[0082] S310. The second device sends a k-th layer sub-model, where k is a positive integer. The k-th layer sub-model is used to determine a target model.

[0083] S320: The second device receives a target model; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

[0084] In this embodiment, the first device and the second device may be different depending on the scenario.

[0085] Optionally, the first device may be a network device, and the second device may be a terminal device. Here, the number of the second devices may be one or more. It should also be noted that, when the first device is a network device and the second device is a terminal device, the downlink information transmitted from the first device to the second device may be carried by any one of a system broadcast message, RRC signaling, DCI, and MAC CE; and the uplink information transmitted from the second device to the first device may be carried by any one of RRC signaling and MAC CE.

[0086] The network device is one of the following: access network device, core network device, server.

[0087] In one example, the network device may be an access network device, such as a base station, gNB, eNB, etc.

[0088] In another example, applicable to a Local Breakout scenario, the network device in this scenario may be a core network device. Preferably, the core network device may be a packet data network gateway (PGW, PDN GateWay).

[0089] In another example, applicable to an Edge computing scenario, the network device in this scenario may be a server. Preferably, the server may be an Edge Application Server (EAS).

[0090] It should be understood that the above are only several possible exemplary descriptions of the first device being a network device. In actual processing, the first device may also be other types of network devices, but this embodiment does not list them all.

[0091] Optionally, the first device and the second device are both terminal devices, and the number of the second devices may be one or more. This embodiment does not limit the number of second devices. The first device may be able to communicate with one or more second devices, for example, the first device and the one or more second devices may be able to perform sidelink communication.

[0092] In this case, the first device may be a master node, and each of the one or more second devices may be a child node.

[0093] The first device may be a device selected as a master node from a plurality of terminal devices. The plurality of terminal devices may be all terminal devices within the coverage area of ​​the same first network device. The first network device may be a network device of a network in which the plurality of terminal devices reside, such as a base station in a network in which the plurality of terminal devices reside.

[0094] The process of selecting the first device from a plurality of terminal devices may be performed by the aforementioned first network device, and the method of selecting the first device (i.e., selecting the master node) may include: based on the performance information of each terminal device in the plurality of terminal devices, selecting a terminal device from the plurality of terminal devices as the master node, and the selected terminal device serves as the aforementioned first device.

[0095] The selecting, based on the performance information of each of the multiple terminal devices, a terminal device from the multiple terminal devices as the master node may be: selecting, based on the performance information of each of the multiple terminal devices, a terminal device with the best performance from the multiple terminal devices as the master node. If there are multiple terminal devices with the best performance among the multiple terminal devices, any one of the multiple terminal devices with the best performance may be selected as the master node.

[0096] Exemplarily, the performance information of the terminal device may include free memory and / or internal memory; further, the performance information of the terminal device may also include at least one of the following: the CPU model of the device, the operating system of the device. Among them, free memory may refer to the total amount of memory currently not occupied by the terminal device, and internal memory refers to the total memory capacity of the terminal device; both free memory and internal memory may be expressed in GB (Gigabyte). In this example, based on the performance information of each terminal device in the multiple terminal devices, a terminal device with the best performance is selected from the multiple terminal devices as the master node, which may be: based on the performance information of each terminal device in the multiple terminal devices, a terminal device with the largest free memory (or internal memory) is selected from the multiple terminal devices as the master node. Among them, if there are multiple terminal devices with the largest free memory (or internal memory), any one of the multiple terminal devices with the largest free memory (or internal memory) can be selected as the master node.

[0097] For example, if the number of terminal devices is 4, denoted as UE1, UE2, UE3 and UE4, the performance information of these 4 UEs can be shown in Table 1:

[0098]

[0099] Table 1

[0100] According to the performance information of the four UEs shown in Table 1, a UE1 with the largest free memory (or memory) can be selected from the multiple terminal devices as the master node.

[0101] The aforementioned first network device can send identity indication information to the first device, and the identity indication information can be used to indicate the first device as the master node of this processing; accordingly, after receiving the identity indication information, the first device can determine itself as the master node.

[0102] In addition, the first network device may further use one or more terminal devices other than the first device among the plurality of terminal devices as one or more second devices, and send master node indication information to each of the one or more second devices, where the master node indication information is used to inform the second device that the master node for this processing is the first device. The master node indication information may include at least one of an identifier associated with the first device, an IP address of the first device, and a port number of the first device.

[0103] Still taking the example of four terminal devices, denoted as UE1, UE2, UE3, and UE4, the IP addresses and port numbers of the four UEs may be as shown in Table 2:

[0104] Device name IP address: Port number UE1 192.168.0.1:8000 UE2 192.168.0.2:8000 UE3 192.168.0.3:8000 UE4 192.168.0.4:8000

[0105] Table 2

[0106] Here, the performance information of any terminal device may be carried by the terminal device and sent to the first network device through any one of RRC (Radio Resource Control) signaling, MAC (Media Access Control) CE (Control Element), etc. The aforementioned identity indication information and master node indication information may be carried through any one of a system broadcast message, DCI (Downlink Control Information), RRC signaling, and MAC CE.

[0107] Alternatively, the process of selecting the first device from a plurality of terminal devices may be performed by any terminal device. For example, a first device may be selected as the master node by any terminal device from a plurality of terminal devices, and the processing method is similar to the above. For example, a plurality of terminal devices may pre-negotiate to obtain a decision node, and the decision node may first obtain the performance information of each terminal device from the plurality of terminal devices, and select a master node from the plurality of terminal devices based on the performance information of each terminal device; send identity indication information to the master node, and send master node indication information to other nodes except the master node. Here, the content contained in the identity indication information and the master node indication information is the same as that in the above embodiment, and will not be repeated. The difference is that the identity indication information and the master node indication information are carried by a side link message, and the side link message may be any one of the following: a side link RRC message, a side link MAC CE, etc., which are not exhaustively listed here.

[0108] Through the above processing, it can be ensured that the first device is the device with the best performance, thereby ensuring that the model generation method provided by this embodiment is executed more efficiently.

[0109] After the first device (master node) and one or more second devices (sub-nodes) are selected based on the aforementioned process, the following process may also be performed: the first device sends a local data set to each second device.

[0110] Here, the first device sending the local dataset to each second device may include: if the first device does not train a local sub-model, the first device determining a local dataset to be used by each second device, and sending the local dataset of each second device to the corresponding second device. Alternatively, if the first device trains a local sub-model, the first device determines a local dataset to be used by itself and a local dataset to be used by each second device, and sending the local dataset of each second device to the corresponding second device.

[0111] The data contained in the local data sets sent to different second devices are at least partially different. Each local data set may include normal data and abnormal data; wherein, normal data refers to normal domain name data, and abnormal data refers to domain name generation algorithm (DGA) domain name data. For example, taking the number of multiple terminal devices as 4, represented by UE1, UE2, UE3 and UE4 as an example, if UE1 is the master node, 100,000 pieces of non-identical DGA domain name data and 100,000 pieces of non-identical normal domain name data are selected for each of the 4 UEs as the local data set of each UE.

[0112] Unless otherwise specified below, the local dataset refers to the local dataset stored by each device. For example, when the local dataset is mentioned in the description of the processing of the first device, unless otherwise specified, it refers to the local dataset stored by the first device itself. Similarly, when the local dataset is mentioned in the description of the processing of any second device, unless otherwise specified, it refers to the local dataset stored by the second device itself.

[0113] The aforementioned local dataset can be used to obtain a local training set and a local test set. That is, the local test set is part of the data in the local dataset; and the local training set is part of the data in the local dataset.

[0114] The local data set includes one or more sample data; wherein each of the one or more sample data includes: a label and a feature value indicating whether it is an intrusion behavior; or, each of the one or more sample data includes: a feature value of each sub-data in two sub-data, and a label indicating whether the two sub-data are of the same type.

[0115] Each second device may perform data preprocessing based on its own local data set, and obtain a local training set and a local test set based on the preprocessed local data set. Alternatively, the first device and each second device may perform data preprocessing based on their own local data set, and obtain a local training set and a local test set based on the preprocessed local data set.

[0116] Optionally, any device may perform data preprocessing by setting a label for each data item in the local data set to obtain each sample data item in the preprocessed local data set. The label that can be set for each data item is used to determine whether it is an intrusion behavior. For example, the label for each data item can be used to indicate whether the data item is normal data or abnormal data (or DGA domain name data). More specifically, the label can be an indicator value or descriptive information. For example, the descriptive information "attack" can be used to indicate that the data item is abnormal data (or intrusion-type data).

[0117] Any of the aforementioned devices is the first device or any of the second devices. Unless otherwise specified below, any device or each device mentioned refers to the first device or any of the second devices, and no repeated description is made.

[0118] For example, any sample data can include a label and a feature value. For example, any sample data can be represented as (f1, f2, f3, ..., f50; attack), where f1-f50 indicates there are 50 feature values ​​and attack is the label, which indicates an intrusion behavior.

[0119] Optionally, any device can preprocess data by pairing any two data items in the local dataset and assigning labels thereto, concatenating the domain names of the two paired data items, and using the concatenated data item as a sample data item in the preprocessed local dataset. All data items are processed using this method to obtain a preprocessed local dataset.

[0120] Pairing any two data points in the local dataset and assigning labels to them can be done by pairing any two data points in the local dataset (normal data and abnormal data) to obtain paired data; if the paired data points are of the same type, the corresponding label is set to the first value; otherwise, the label is set to the second value. In other words, a sample data set includes paired data points and a label; the label is used to indicate whether the paired data points are of the same type or heterogeneous type (i.e., different types of data).

[0121] Here, the same type of data refers to both normal data and both abnormal data; different types of data refers to one normal data and one abnormal data. The first value can be 0 and the second value can be 1, or vice versa. As long as the first value and the second value are different, they are within the scope of protection of this embodiment.

[0122] By pairing any two data points, the local dataset can be expanded. For example, if the local dataset initially contains four data points {a, b, c, d}, after pairing them, the dataset becomes {ab, ac, ad, bc, bd, cd}, for a total of six data points, thus completing the data filling process.

[0123] Using the data after the domain name is concatenated as sample data in the preprocessed local dataset may include: if the data after the domain name is concatenated is less than a specified length, padding the data to obtain data of the specified length; converting the data of the specified length into digital sequence sample data, and using the digital sequence sample data as sample data in the preprocessed local dataset. Alternatively, if the data after the domain name is concatenated is equal to the specified length, converting the data of the specified length into digital sequence sample data, and using the digital sequence sample data as sample data in the preprocessed local dataset.

[0124] The specified length can be set based on actual conditions, for example, 100. It should also be noted that if the length of the data after the concatenation of the beginning and end of a domain name is less than the specified length, a character is added between the paired domain names. This character can be set based on actual conditions, for example, α, or other characters, which are not exhaustive here.

[0125] Converting data of a specified length into digital sequence sample data may be based on a conversion dictionary. The conversion dictionary may be preset, and the content of the conversion dictionary preset in each device is the same. For example, the conversion dictionary may include numbers corresponding to each character or letter, such as the content of the conversion dictionary D is: {'a':1,'b':2,'c':3,'d':4,'e':5,'f':6,'g':7,'h':8,'i':9,'j':10,'k':11,'l':12,'m':13,'n':14,'o':15,'p':16,'q':17,'r':1 8,'s':19,'t':20,'u':21,'v':22,'w':23,'x':24,'y':25,'z':26,'-':27,'_':28,'1':29 ,'2':30,'3':31,'4':32,'5':33,'6':34,'7':35,'8':36,'9':37,'0':38,'.':39,'α':0}.

[0126] Obtaining a local training set and a local test set based on a preprocessed local data set may include: dividing all sample data of the preprocessed local data set to obtain a local training set and a local test set. Here, the division process may be based on a preset ratio, such as using 70% of the sample data as training samples for the local training set and using the remaining 30% of the sample data as test samples for the local test set; it should be understood that this is only an exemplary description, and the preset ratio can also be set according to actual conditions, such as 50% or other ratios, which are not limited here.

[0127] After the aforementioned processing is completed, each second device may start training the sub-model of the current layer.

[0128] When training the k-th layer sub-model, it needs to be performed based on the k-1th layer aggregate model. When k is equal to 1, the k-1th layer aggregate model (i.e., the 0th layer aggregate model) can be the preset initial sub-model. Since the training of the k-th layer sub-model can be any sub-model training, the following description only uses one training session and does not elaborate on each one.

[0129] The training of the k-th layer sub-model may include: inputting each training sample in the local training set into the k-1th layer aggregation model to obtain the output result of the k-1th layer aggregation model; determining the loss function based on the output result of the k-1th layer aggregation model and the label of the training sample, and updating the model parameters of the k-1th layer aggregation model based on the reverse conduction of the loss function. After completing the training of the k-1th layer aggregation model, the k-th layer sub-model is obtained. The condition for determining convergence may be that the number of sub-model training times reaches a preset number, which may be preset, such as 100 times, or more or less, and is not limited here.

[0130] The sub-model may include at least one of the following: one or more random forests, or one or more completely random forests. Preferably, the sub-model may include multiple random forests and multiple completely random forests. Furthermore, the number of the multiple random forests may be an even number, and the number of the multiple completely random forests may also be an even number.

[0131] In one case, the training sample of the aforementioned local training set is a single data, and the output result obtained at this time indicates whether the training sample is normal data or abnormal data; or, indicates whether the training sample is an intrusion behavior (or intrusion data).

[0132] In another case, the training samples of the aforementioned local training set are generated by paired data, and the pairing method has been explained in the aforementioned embodiment and will not be repeated here. In this case, the output result obtained indicates that the two data in the training sample are of the same type or different types. For example, if the aforementioned sub-model or aggregation model is a twin network, the paired data in the aforementioned training sample are respectively input into the two sub-networks in the twin network, and the output result is that the two data contained in the paired data in the training sample are the same or different. For example, the initial sub-model may include 2 random forests and 2 completely random forests; the initial sub-model may be a twin network, for example, the twin network is composed of two identical sub-networks, and each sub-network may include a random forest and / or a completely random forest.

[0133] Since random forests and / or completely random forests can also form twin networks in this solution, this can ensure better classification results and stronger generalization capabilities.

[0134] After each second device completes training of the k-th layer sub-model, the aforementioned S310 may be executed to send the k-th layer sub-model. The sending of the k-th layer sub-model may specifically include: the second device sending the k-th layer sub-model to the first device. The k-th layer sub-model may be represented in the format of a JSON string.

[0135] In the aforementioned S210, the first device receives one or more k-th layer sub-models, including: the first device receives the k-th layer sub-model sent by each second device in the one or more second devices. Correspondingly, in the aforementioned S230, the first device sends the target model, including: the first device sends the target model to each second device in the one or more second devices.

[0136] That is, a first device can communicate with one or more second devices simultaneously. In a preferred example, the number of the one or more second devices is greater than or equal to 2. In the one or more k-th layer sub-models, different k-th layer sub-models come from different second devices.

[0137] In a possible implementation, the first device determines the target model based on the one or more k-th layer sub-models, which may include: the first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models; and when the first device determines that the preset conditions are met based on the k-th layer aggregation model, the first device uses the k-th layer aggregation model as the target model.

[0138] When the first device sends the target model, the method further includes: the first device sending first indication information to each of the one or more second devices, the first indication information being used to indicate whether communication data of the mobile network is detected as intrusion-type data based on the target model. Correspondingly, when the second device receives the target model, the method further includes: the second device receiving first indication information, the first indication information being used to indicate whether communication data of the mobile network is detected as intrusion-type data based on the target model.

[0139] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0140] In addition, the method further includes: when the k-th layer aggregation model does not meet a preset condition, the first device sends the k-th layer aggregation model to each second device of the one or more second devices.

[0141] When the k-th layer aggregation model is sent to each of the one or more second devices, the method further includes: the first device sending second indication information to each of the one or more second devices, the second indication information being used to indicate generation of a k+1-th layer sub-model based on the k-th layer aggregation model. Accordingly, in the processing of the second device, the method further includes: the second device receiving the k-th layer aggregation model and second indication information, the second indication information being used to indicate generation of a k+1-th layer sub-model based on the k-th layer aggregation model.

[0142] Optionally, the first device does not perform sub-model training, and the first device only aggregates the k-th layer sub-models sent by each second device to obtain the k-th layer aggregate model.

[0143] The first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models, which may include: creating an empty k-th layer aggregation model, and then copying one or more k-th layer sub-models to the empty k-th layer aggregation model to generate the k-th layer aggregation model. Specifically, as shown in FIG4 , it may include:

[0144] S410: The first device loads the one or more k-th layer sub-models.

[0145] Specifically, the first device may sequentially load the k-th layer sub-models uploaded by each second device through the joblib.load() function, and store them in a local sub-model list.

[0146] S420: The first device initializes the k-th layer aggregation model.

[0147] Specifically, the first device may initialize the k-th layer aggregation model to a CascadeForestClassifier model; and synchronize the attribute-related parameters of the initialized k-th layer aggregation model with each k-th layer sub-model. Since the attribute-related parameters of each k-th layer sub-model should be the same, only the attribute-related parameters of any k-th layer sub-model may be synchronized with the k-th layer aggregation model.

[0148] In a preferred example, the aforementioned sub-model may include at least one of the following: one or more random forests, one or more complete random forests. Accordingly, the aforementioned attribute-related parameters may include at least one of the following: the number of random forests, the number of completely random forests, the maximum number of trees in each random forest, the maximum number of trees in each completely random forest, the maximum depth of trees, the number of layers k, and the like. Among them, the maximum number of trees in each random forest in a sub-model can be the same, that is, the maximum number of trees in each random forest is the same; the maximum number of trees in each completely random forest in a sub-model can be the same, that is, the maximum number of trees in each completely random forest is the same; the maximum depth of trees can be divided into the maximum depth of trees in random forests and the maximum depth of trees in completely random forests, and the two can be the same or different, which is not limited here.

[0149] S430: The first device copies the one or more k-th layer sub-models to obtain the k-th layer aggregation model.

[0150] The first device copies the one or more k-th layer sub-models, which may be that the first device copies the one or more k-th layer sub-models based on a preset format.

[0151] The preset format may include at least one of the following: a first preset format and a second preset format.

[0152] The first preset format is used when copying a random forest and includes at least one of the following: the number of layers k, the random forest number, and the model parameters of the random forest. For example, when copying any random forest, the following format can be used: Estimators [number of layers k - classifier number (i.e., random forest number) - random forest model parameters].

[0153] The second preset format can be used when copying a completely random forest and includes at least one of the following: the number of layers k, the sequence number of the completely random forest, and the model parameters of the completely random forest. For example, when copying any completely random forest, the following format can be used: Estimators [number of layers k - classifier sequence number (i.e., the sequence number of the completely random forest) - model parameters of the completely random forest].

[0154] After the first device obtains the k-th layer aggregation model, it determines whether the k-th layer aggregation model meets the preset conditions. If yes, the k-th layer aggregation model is used as the target model and the target model is sent to each second device in the one or more second devices.

[0155] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0156] It should be noted that the number of random forests included in the target model is the sum of the number of random forests included in multiple k-th layer sub-models. Similarly, the number of completely random forests included in the target model is the sum of the number of completely random forests included in multiple k-th layer sub-models.

[0157] Alternatively, when multiple k-th layer sub-models contain the same random forest and / or the same completely random forest, the first device may further perform deduplication processing on the same random forest and / or the same completely random forest. In this case, the number of random forests included in the target model is the sum of the number of random forests included in the multiple k-th layer sub-models after deduplication. Similarly, the number of completely random forests included in the target model is the sum of the number of completely random forests included in the multiple k-th layer sub-models after deduplication.

[0158] For example, referring to Figure 5, the first device is UE1, and the second device can be UE21 and UE22. As can be seen in Figure 5, UE1 interacts with two UEs (UE 21 and UE22), which may include UE21 and UE22 sending a layer 1 sub-model to UE1 respectively. UE1 aggregates the two received layer 1 sub-models to obtain a layer 1 aggregation model. When UE1 determines that the layer 1 aggregation model does not meet the preset conditions, it sends the layer 1 aggregation model to UE21 and UE22. UE21 and UE22 receive the layer 1 aggregation model and generate a layer 2 sub-model based on the layer 1 aggregation model respectively. This process is repeated until UE1 determines that it has obtained a target model and sends the target model to UE21 and UE22. UE21 and UE22 receive the target model accordingly. It should be understood that, for simplicity, Figure 5 only illustrates a procedural example diagram of UE1 and UE22. The processing of UE21 is similar to that of UE22, so it will not be repeated. It should also be understood that the UE1 in FIG. 5 may also be replaced by a network device, and the exemplary description will not be repeated.

[0159] Optionally, the first device performs sub-model training, and the first device aggregates to obtain a k-th layer aggregate model based on the k-th layer sub-model sent by each second device and the k-th layer local sub-model.

[0160] The method further includes: the first device generating a k-th layer local sub-model based on a local training set and a k-1-th layer aggregation model; the local training set is part of the local data set;

[0161] The first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models, including: the first device generates the k-th layer aggregation model based on the k-th layer local sub-model and the one or more k-th layer sub-models.

[0162] In the aforementioned embodiment, when the first device distributes the local dataset, it has been explained that the first device can also obtain its own local training set and local test set. Therefore, the first device can also train a k-th local sub-model based on the local training set and the k-1-th layer aggregate model. The processing method for the first device to train the k-th local sub-model is the same as the processing method for the second device to train the k-th sub-model, and will not be repeated here.

[0163] The first device generates the k-th layer aggregate model based on the k-th layer local sub-model and the one or more k-th layer sub-models. This can be done by creating an empty k-th layer aggregate model, copying the one or more k-th layer sub-models and the k-th layer local sub-model to the empty k-th layer aggregate model, and generating the k-th layer aggregate model. This specific process can be the same as adding the k-th layer local sub-model process in S410 to S430, and is not further described here.

[0164] The aforementioned preset condition may include: the accuracy of the k-th layer aggregation model is greater than a first threshold value.

[0165] Alternatively, the preset condition includes: a difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model is less than a second threshold value.

[0166] The preset condition may be preset in the first device, or may be configured for the first device by the first network device. The preset condition, which is configured by the first network device for the first device, is particularly applicable to scenarios where the first device is a terminal device. In such scenarios, the first network device may specifically be an access network device of the network where the first device resides, for example, the first network device may be a serving base station (or serving gNB, serving eNB) of the first device.

[0167] The first threshold value can be set according to actual conditions, for example, 95%, 98%, or a larger or smaller value, which is not limited here. The second threshold value can also be set according to actual conditions, for example, 0.05%, 0.01%, or a larger or smaller value, which is not limited here.

[0168] At least one of the first threshold value and the second threshold value may be preset in the first device, or configured for the first device by the network device.

[0169] When at least one of the first threshold value and the second threshold value is configured by a network device for the first device, at least one of the first threshold value and the second threshold value may be carried by at least one of DCI, a system broadcast message, RRC signaling, and a MAC CE. The manner in which at least one of the first threshold value and the second threshold value is configured by the first network device for the first device is particularly applicable to a scenario in which the first device is a terminal device. In such a scenario, the first network device may specifically be an access network device of a network in which the first device is located.

[0170] Optionally, after the first device side aggregates to obtain the k-th layer aggregation model, if it is determined that the accuracy of the k-th layer aggregation model is greater than the first threshold value, the k-th layer aggregation model can be determined as the target model; otherwise, the k-th layer aggregation model is not the target model and k+1 training is required.

[0171] Optionally, after the first device side aggregates and obtains the k-th layer aggregation model, if it is determined that the accuracy of the k-th layer aggregation model and the difference between the accuracy of the k-1-th layer aggregation model are less than the second threshold value, the k-th layer aggregation model can be determined to be the target model; otherwise, the k-th layer aggregation model is not the target model and requires k+1-th training. It should be pointed out that in this method, the first device needs to save the accuracy of the k-1-th layer aggregation model; alternatively, the first device can save the k-1-th layer aggregation model and calculate the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model respectively when obtaining the k-th layer aggregation model.

[0172] The accuracy of the k-th layer aggregation model may be determined by the first device based on a local test set.

[0173] The first device determines the accuracy of the k-th layer aggregation model based on a local test set; the local test set includes one or more test data; each of the one or more test data includes a label and a feature value for determining whether the test data is intrusion data. The manner in which the first device obtains the local test set is the same as in the previous embodiment and is not further described.

[0174] Here, the processing method for determining the accuracy of the k-th layer aggregation model based on the local test set may be as shown in FIG6 , including:

[0175] S610: Input the feature values ​​of the test data in the local test set into the k-th layer aggregation model to obtain the prediction result output by the k-th layer aggregation model;

[0176] S620: Determine the proportion of correct classifications based on the labels of the test data and the prediction results, and use the proportion of correct classifications as the accuracy of the k-th layer aggregation model.

[0177] Specifically, the accuracy of classification can be evaluated through the confusion matrix, and the proportion of correct classifications can be calculated using the labels of the test data and the prediction results, that is, the accuracy of the k-th layer aggregation model. The specific calculation formula is as follows:

[0178]

[0179] Among them, ACC k is the accuracy of the k-th layer aggregation model; TP is a true positive example, that is, the actual value is 0 and the prediction is also 0; FP is a false positive example, that is, the actual value is 1 and the prediction is 0; TN is a true negative example, that is, the actual value is 1 and the prediction is also 1; FN is a false negative example, that is, the actual value is 0 and the prediction is 1.

[0180] It should be understood that the accuracy of the aforementioned k-th layer aggregation model can be calculated using a specified number of test data in the local test set; this specified number can be set based on actual conditions, such as all, 100, 80, etc. For example, if the local test set contains 200 test data, all of them can be used to calculate the accuracy of the k-th layer aggregation model, 150 of them can be randomly selected for this calculation of the accuracy of the k-th layer aggregation model, and so on. This is not an exhaustive list.

[0181] The aforementioned TP can be a specific number, for example, 50 out of 100 test data points were predicted to be normal data and were also labeled as normal data. The aforementioned TN can be a specific number, for example, 30 out of 100 test data points were predicted to be abnormal data and were also labeled as abnormal data. The aforementioned FP can be a specific number, for example, 10 out of 100 test data points were predicted to be normal data and were also labeled as abnormal data. The aforementioned FN can be a specific number, for example, 10 out of 100 test data points were predicted to be abnormal data and were also labeled as normal data. The final accuracy of the k-th layer aggregation model is 80%.

[0182] The above describes the calculation method for the accuracy of the k-th layer aggregation model. It should be understood that the calculation method for the accuracy of the k-1-th layer aggregation model is the same as that of the k-th layer aggregation model, so it will not be repeated.

[0183] Furthermore, the k+1th training is performed on each second device. The specific description is as follows:

[0184] The method may further include: the second device receiving a k-th layer aggregation model and second indication information, where the second indication information is used to indicate generating a k+1-th layer sub-model based on the k-th layer aggregation model.

[0185] The method also includes: the second device generates a k+1th layer sub-model based on the updated local training set and the kth layer aggregation model.

[0186] Before each second device performs the k+1th training, the method may further include:

[0187] The second device inputs the j-th training sample in the local training set into the k-th layer aggregation model to obtain a feature vector output by the k-th layer aggregation model; the local training set is part of the data in the local data set; j is a positive integer;

[0188] The second device randomly downsamples one or more training feature values ​​of the j-th training sample to obtain a processed training feature value of the j-th training sample;

[0189] The second device obtains the jth training sample of the updated local training set based on the training feature value of the processed jth training sample and the feature vector output by the kth layer aggregation model.

[0190] Here, the j-th training sample is any training sample in the local training set. Since the processing method for each training sample in the local training set is the same, they will not be described one by one.

[0191] Among them, randomly downsampling one or more training feature values ​​of the j-th training sample can reduce the correlation between input data features between adjacent layers.

[0192] Obtaining the jth training sample of the updated local training set based on the training feature value of the processed jth training sample and the feature vector output by the kth layer aggregation model may refer to: concatenating the training feature value of the processed jth training sample and the feature vector output by the kth layer aggregation model to obtain the jth training sample of the updated local training set. Concatenating may refer to concatenating the feature vector output by the kth layer aggregation model after the training feature value of the processed jth training sample.

[0193] The output result of the aforementioned k-th layer aggregation model is a class vector, and its format is consistent with the feature vector of the input data. If the k-th layer aggregation model is not the aggregation model obtained by the last training, it is necessary to splice the output class vector to the feature vector of the input data to generate a transformed feature vector, which is used to train the next layer of sub-models. Due to the differences in data sets in different scenarios, the number of sampling bits for random downsampling of training set features can be set independently according to the specific application scenario. The purpose of this processing is to obtain more local information of the data, increase the randomness of the input data, and thus increase the generalization ability of the model. When the model converges, its classification effect will be better.

[0194] For example, the training feature value of the j-th training sample of the k-th layer aggregation model is helloworld, and the output result is 0. After splicing, the transformed feature helloworld0 is generated for the k+1-th layer training. However, if the transformed feature helloworld0 is directly used as input during the training of the k+1-th layer sub-model, it will be approximately the same as the feature of the j-th training sample input of the k-th layer, making the k+1-th layer sub-model and the k-th layer aggregation model almost the same. Therefore, it is necessary to first randomly downsample the feature helloworld of the j-th training sample, for example, randomly sample the hellorld string therein, and then splice it with the output result 0 of the k-th layer aggregation model. At this time, the transformed feature is hellorld0. If it is used for the training of the k+1-th layer sub-model, the k+1-th layer sub-model and the k-th layer aggregation model will not be the same.

[0195] It should be understood that the above description is for the training of the k+1th layer sub-model by the second device. If the first device also participates in the training of the local sub-model, the first device can also perform the same processing as the second device in the aforementioned embodiment, but no repetitive description is given.

[0196] The above method is exemplarily described with reference to FIG7 . Assuming that the first device is UE1, and the plurality of second devices are UE21, UE22, and UE23, that is, UE1 serves as the master node, and UE21 to UE23 serve as three child nodes, the above model generation method may include:

[0197] S710, UE21, UE22, and UE23 are trained to obtain the k-th layer sub-model respectively;

[0198] Before executing S710, the process may further include selecting a UE with the best idle performance from among multiple UEs in an area as a first device (UE1), i.e., a master node, and the remaining UEs as child nodes, i.e., second devices. The master node (UE1) will be responsible for the aggregation process. Selecting the mobile terminal with the best idle performance as the master node can reduce training time.

[0199] In addition, before executing S710 , UE1 , UE21 , UE22 , and UE23 may each perform pre-processing on a local data set. The specific processing method is the same as that in the above embodiment and will not be described in detail.

[0200] UE21, UE22, and UE23 are trained to obtain the k-th layer sub-model, and the specific method for each UE to train the k-th layer sub-model is the same as that in the aforementioned embodiment. It should be understood that since different UEs use their own local training sets for training, the model parameters of the k-th layer sub-models obtained by training different UEs may be different, thereby ensuring that the final target model can be applied to more scenarios and has higher accuracy.

[0201] S720, UE1 receives the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively, and UE1 aggregates the k-th layer sub-models uploaded by UE21, UE22, and UE23 respectively to obtain the k-th layer aggregated model.

[0202] S730 : UE1 determines the accuracy of the k-th layer aggregation model based on the local test set.

[0203] S740: UE1 determines whether the accuracy of the k-th layer aggregation model is greater than a first threshold. If so, execute S750; otherwise, execute S760.

[0204] S750, UE1 determines that the k-th layer aggregation model is the target model, sends the target model to UE21, UE22 and UE23, and sends a first indication information, wherein the first indication information is used to indicate whether the communication data of the mobile network detected based on the target model is an intrusion type of data; and ends the processing.

[0205] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0206] S760. UE1 sends the k-th layer aggregation model to UE21, UE22, and UE23, and sends second indication information; the second indication information is used to indicate generation of a k+1-th layer sub-model based on the k-th layer aggregation model;

[0207] In S770 , UE21 , UE22 , and UE23 set k equal to k+1 and return to execute S710 .

[0208] In another embodiment, after generating the k-th layer aggregation model, the method further includes: the first device sends the k-th layer aggregation model and third indication information; the third indication information is used to instruct each second device to calculate the accuracy reference value of the k-th layer aggregation model; the first device receives one or more accuracy reference values ​​corresponding to the k-th layer aggregation model; the first device uses the average value of the one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

[0209] In the processing of each second device, the method also includes: the second device receives the k-th layer aggregation model and third indication information, and the third indication information is used to indicate the calculation of the accuracy reference value of the k-th layer aggregation model; the second device determines the accuracy reference value of the k-th layer aggregation model based on a local test set; wherein the local test set is part of the data in the local data set; the second device sends the accuracy reference value of the k-th layer aggregation model.

[0210] Here, the processing method for the second device to determine the accuracy reference value of the k-th layer aggregation model based on the local test set is similar to the aforementioned processing method for determining the accuracy of the k-th layer aggregation model, except that each second device uses the final correct classification ratio as the accuracy reference value of the k-th layer aggregation model, which will not be repeated here.

[0211] In this way, after the first device obtains the k-th layer aggregation model, it sends the k-th layer aggregation model to each second device respectively, and each second device determines the accuracy reference value based on its own local test set; then, after receiving the accuracy reference value sent by each second device, the first device calculates the average value and uses the average value as the accuracy of the k-th layer aggregation model.

[0212] Optionally, in this manner, the first device may also calculate an accuracy reference value of the k-th layer aggregation model.

[0213] Specifically, the method further includes: the first device determining a local accuracy reference value of the k-th layer aggregation model based on a local test set; wherein the local test set is part of the data in the local data set;

[0214] The first device uses the average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model, including: the first device uses the local accuracy reference value of the k-th layer aggregation model and the average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model. Here, the method in which the first device calculates the local accuracy reference value is the same as the method in which the second device calculates the accuracy reference value, and is not repeated here.

[0215] In this way, each device can use its own local test set to calculate the accuracy reference value, so that a more accurate accuracy can be obtained in the end.

[0216] The above-mentioned method is exemplarily described with reference to FIG8 . Assuming that the first device is a network device, the plurality of second devices are UE21, UE22, and UE23, that is, UE1 is used as a master node, and UE21 to UE23 are used as three child nodes, the above-mentioned model generation method may include:

[0217] S810: The network device trains to obtain a k-th layer local sub-model, and UE21, UE22, and UE23 respectively train to obtain a k-th layer sub-model;

[0218] In addition, before executing S810, the network device, UE21, UE22, and UE23 can each perform local data set preprocessing. The specific processing method is the same as that in the previous embodiment and is not repeated here. The processing of training to obtain the k-th layer sub-model, specifically the method for each UE to train to obtain the k-th layer sub-model is the same as that in the previous embodiment.

[0219] S820. The network device receives the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively. The network device aggregates the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively and the k-th layer local sub-model to obtain the k-th layer aggregated model.

[0220] S830 : The network device sends the k-th layer aggregation model to UE21 , UE22 , and UE23 respectively.

[0221] S840. The network device determines a local accuracy reference value of the k-th layer aggregation model based on a local test set, and receives the accuracy reference values ​​of the k-th layer aggregation model sent by UE21, UE22, and UE23 respectively.

[0222] Among them, the processing of UE21, UE22, and UE23 may include: UE21, UE22, and UE23 respectively determine the accuracy reference value of the k-th layer aggregation model based on the local test set, and respectively send the accuracy reference value of the k-th layer aggregation model to the network device.

[0223] Taking UE21 as an example, UE21 receives a layer k aggregation model and third indication information, where the third indication information indicates the calculation of a reference accuracy value for the layer k aggregation model. UE21 determines the reference accuracy value for the layer k aggregation model based on a local test set. UE21 then sends the reference accuracy value for the layer k aggregation model to a network device. It should be understood that the specific processing for UE22 and UE23 is the same as that for UE21, and therefore is not further described.

[0224] S850: The network device uses the average of the local accuracy reference value and the accuracy reference values ​​of the k-th layer aggregation model sent respectively by UE21, UE22, and UE23 as the accuracy of the k-th layer aggregation model.

[0225] S860: The network device determines whether the accuracy of the k-th layer aggregation model is greater than a first threshold. If so, execute S870; otherwise, execute S880.

[0226] S870. The network device determines that the k-th layer aggregation model is the target model, sends the target model to UE21, UE22 and UE23, and sends a first indication message, wherein the first indication message is used to indicate whether the communication data of the mobile network detected based on the target model is an intrusion type of data; and ends the processing.

[0227] S880. The network device sends the k-th layer aggregation model to UE21, UE22, and UE23, and sends second indication information; the second indication information is used to instruct to generate a k+1-th layer sub-model based on the k-th layer aggregation model;

[0228] S890 , the network device, UE21 , UE22 , and UE23 set k equal to k+1, and return to execute S810 .

[0229] In another possible embodiment, the first device determines the target model based on the one or more k-th layer sub-models, which may include: the first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models; and when the first device determines that the preset conditions are met based on the k-th layer aggregation model and the k-1-th layer aggregation model, the first device uses the k-1-th layer aggregation model as the target model.

[0230] In this embodiment, if the k-th layer aggregation model and the k-1-th layer aggregation model determine that the preset conditions are met, the k-1-th layer aggregation model is used as the target model. In other words, the first device always stores the k-1-th layer aggregation model, which is the previous layer aggregation model. Only if the k-th layer aggregation model and the k-1-th layer aggregation model determine that the preset conditions are not met, the first device discards or deletes the k-1-th layer aggregation model.

[0231] In addition, the method further includes: when the k-th layer aggregation model does not meet a preset condition, the first device sends the k-th layer aggregation model to each second device of the one or more second devices.

[0232] When the first device sends the target model, the method further includes: the first device sending first indication information to each of the one or more second devices, the first indication information being used to indicate whether communication data of the mobile network is detected as intrusion-type data based on the target model. Correspondingly, when the second device receives the target model, the method further includes: the second device receiving first indication information, the first indication information being used to indicate whether communication data of the mobile network is detected as intrusion-type data based on the target model.

[0233] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0234] It should be noted that if the k-1th layer aggregation model is the target model, the number of random forests contained in the target model is the sum of the number of random forests contained in multiple k-1th layer sub-models. Similarly, the number of completely random forests contained in the target model is the sum of the number of completely random forests contained in multiple k-1th layer sub-models.

[0235] Alternatively, when multiple k-1 layer sub-models contain the same random forest and / or the same completely random forest, the first device can also deduplicate the same random forest and / or the same completely random forest. In this case, the number of random forests contained in the target model is the sum of the deduplicated number of random forests contained in multiple k-1 layer sub-models. Similarly, the number of completely random forests contained in the target model is the sum of the deduplicated number of completely random forests contained in multiple k-1 layer sub-models.

[0236] When sending the k-th layer aggregation model to each second device in the one or more second devices, the method also includes: the first device sends second indication information to each second device in the one or more second devices, and the second indication information is used to indicate the generation of the k+1-th layer sub-model based on the k-th layer aggregation model.

[0237] Optionally, the first device does not perform sub-model training. Instead, the first device aggregates the k-th layer sub-models sent by each second device to obtain a k-th layer aggregate model. The first device also saves the k-1-th layer aggregate model. The process of generating the k-th layer aggregate model based on the one or more k-th layer sub-models by the first device is the same as in the previous embodiment and is not repeated here.

[0238] Optionally, the first device performs sub-model training. Based on the k-th layer sub-model and the k-th layer local sub-model sent by each second device, the first device aggregates to obtain a k-th layer aggregate model. The first device also saves the k-1-th layer aggregate model. The first device generates the k-th layer local sub-model in the same manner as in the previous embodiment and is not further described.

[0239] The aforementioned preset condition may include: the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model is less than a second threshold value.

[0240] In one embodiment, the accuracy of the k-th layer aggregation model can be determined by the first device based on a local test set.

[0241] The manner in which the first device determines the accuracy of the k-th layer aggregation model based on the local test set is the same as that in the aforementioned embodiment. The difference from the aforementioned embodiment is that the first device saves the k-1-th layer aggregation model and the accuracy of the k-1-th layer aggregation model at the same time.

[0242] Furthermore, the process of performing the k+1th training on each second device is the same as that in the above embodiment and will not be described repeatedly.

[0243] The above-mentioned method is exemplarily described with reference to FIG9 . Assuming that the first device is UE1, and the plurality of second devices are UE21, UE22, and UE23, that is, UE1 serves as the master node, and UE21 to UE23 serve as three child nodes, the above-mentioned model generation method may include:

[0244] S910, UE21, UE22, and UE23 are trained to obtain the k-th layer sub-model respectively;

[0245] S920, UE1 receives the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively, and UE1 aggregates the k-th layer sub-models uploaded by UE21, UE22, and UE23 respectively to obtain the k-th layer aggregated model.

[0246] S930. UE1 determines the accuracy of the k-th layer aggregation model based on the local test set.

[0247] S940 : UE1 calculates the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model.

[0248] S950 , UE1 determines whether the difference is less than a second threshold value. If so, execute S960 ; otherwise, execute S970 .

[0249] For example, the accuracy of the k-th layer aggregation model is expressed as Acc k , the accuracy of the k-1 layer aggregation model is expressed as Acc k-1, the difference between the two can be expressed as Acc k -Acc k-1 The second threshold value is t, then S950 is to determine Acc k -Acc k-1 Is it less than t?

[0250] S960, UE1 determines that the k-1th layer aggregation model is the target model, sends the target model to UE21, UE22 and UE23, and sends a first indication information, wherein the first indication information is used to indicate whether the communication data of the mobile network detected based on the target model is an intrusion type of data; and ends the processing.

[0251] S970. UE1 sends the k-th layer aggregation model to UE21, UE22, and UE23, and sends second indication information; the second indication information is used to instruct to generate a k+1-th layer sub-model based on the k-th layer aggregation model;

[0252] S980 , UE21 , UE22 and UE23 set k equal to k+1 and return to execute S910 .

[0253] In another embodiment, after generating the k-th layer aggregation model, the method further includes: the first device sends the k-th layer aggregation model and third indication information; the third indication information is used to instruct each second device to calculate the accuracy reference value of the k-th layer aggregation model; the first device receives one or more accuracy reference values ​​corresponding to the k-th layer aggregation model; the first device uses the average value of the one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

[0254] In the processing of each second device, the method also includes: the second device receives the k-th layer aggregation model and third indication information, and the third indication information is used to indicate the calculation of the accuracy reference value of the k-th layer aggregation model; the second device determines the accuracy reference value of the k-th layer aggregation model based on the local test set; and the second device sends the accuracy reference value of the k-th layer aggregation model.

[0255] Here, the processing method of the second device to determine the accuracy reference value of the k-th layer aggregation model based on the local test set is similar to the processing method of the aforementioned embodiment, except that each second device uses the final correct classification ratio as the accuracy reference value of the k-th layer aggregation model, which will not be repeated here.

[0256] In this way, after the first device obtains the k-th layer aggregation model, it sends the k-th layer aggregation model to each second device respectively, and each second device determines the accuracy reference value based on its own local test set; then, after receiving the accuracy reference value sent by each second device, the first device calculates the average value and uses the average value as the accuracy of the k-th layer aggregation model.

[0257] Optionally, in this manner, the first device may also calculate an accuracy reference value of the k-th layer aggregation model.

[0258] Specifically, the method further includes: the first device determining a local accuracy reference value of the k-th layer aggregation model based on a local test set; wherein the local test set includes one or more test data; each of the one or more test data includes: a label indicating whether it is an intrusion behavior, and one or more test feature values;

[0259] The first device uses the average value of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model, including: the first device uses the local accuracy reference value of the k-th layer aggregation model and the average value of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model. Here, the way the first device calculates the local accuracy reference value is the same as the way the aforementioned second device calculates the accuracy reference value, and will not be repeated. In this way, each device can use its own local test set to calculate the accuracy reference value, so that the final accuracy can be more accurate.

[0260] The above-mentioned method is exemplarily described with reference to FIG10 . Assuming that the first device is a network device, the plurality of second devices are UE21, UE22, and UE23, that is, UE1 is used as a master node, and UE21 to UE23 are used as three child nodes, the above-mentioned model generation method may include:

[0261] S1001, the network device trains to obtain the k-th layer local sub-model, and UE21, UE22 and UE23 respectively train to obtain the k-th layer sub-model;

[0262] S1002. The network device receives the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively. The network device aggregates the k-th layer sub-model uploaded by UE21, UE22, and UE23 respectively and the k-th layer local sub-model to obtain the k-th layer aggregated model.

[0263] S1003 . The network device sends the k-th layer aggregation model to UE21 , UE22 , and UE23 respectively.

[0264] S1004. The network device determines a local accuracy reference value of the k-th layer aggregation model based on a local test set, and receives the accuracy reference values ​​of the k-th layer aggregation model sent by UE21, UE22, and UE23 respectively.

[0265] Among them, the processing of UE21, UE22, and UE23 may include: UE21, UE22, and UE23 respectively determine the accuracy reference value of the k-th layer aggregation model based on the local test set, and respectively send the accuracy reference value of the k-th layer aggregation model to the network device.

[0266] S1005 . The network device uses the average of the local accuracy reference value and the accuracy reference values ​​of the k-th layer aggregation model sent respectively by UE21 , UE22 , and UE23 as the accuracy of the k-th layer aggregation model.

[0267] S1006: The network device calculates the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model.

[0268] S1007. The network device determines whether the difference is less than a second threshold. If so, execute S1008; otherwise, execute S1009.

[0269] S1008. The network device determines that the k-1 layer aggregation model is the target model, sends the target model to UE21, UE22 and UE23, and sends a first indication information, wherein the first indication information is used to indicate whether the communication data of the mobile network detected based on the target model is an intrusion type of data; and ends the processing.

[0270] S1009. The network device sends the k-th layer aggregation model to UE21, UE22, and UE23, and sends second indication information; the second indication information is used to instruct to generate a k+1-th layer sub-model based on the k-th layer aggregation model;

[0271] S1010 , the network device, UE21 , UE22 and UE23 set k equal to k+1 and return to execute S1001 .

[0272] By adopting the above scheme, the target model can be obtained by means of federated training. Since the sub-models and the target model are generated on different devices respectively, the data security can be guaranteed in the process of obtaining the target model. Furthermore, since the target model is obtained based on the aggregation of multiple sub-models, the processing of the target model can be guaranteed to be more accurate, and the results of the communication data analysis of the mobile network based on the target model can be guaranteed to be more accurate.

[0273] In addition, the model used in the aforementioned scheme is random forest and / or completely random forest. Compared with other types of neural networks, its advantages are as follows: it is trained in other types of deep learning models, and linear parameters such as gradients in the model are transferred and updated. However, if an attacker disguises himself as a child node to participate in federated learning, the gradient after each round of aggregation can be obtained, and then combined with the gradient of the attacker's local sub-model, the local data information of other child node participants can be successfully deduced by calculating the difference, or using multivariate expressions to fit and adjust and iterate multiple times, thereby realizing label inference attacks. This scheme uses random forest and / or completely random forest as models. Random forest and / or completely random forest are composed of multiple decision trees, and the decision tree completes the classification in a voting-like manner by outputting a class vector and selecting the maximum value in the class vector. For example, in a binary classification task, the class vector of [category A, category B] may be [0.3, 0.7] or [0.1, 0.9]. However, no matter which class vector the model outputs, the final classification result will be category A. Therefore, even if the attacker obtains the classification result, he cannot combine his own data to infer the specific probability in the class vector before classification, and therefore cannot infer the local data information of other child node participants, thereby effectively avoiding label inference attacks.

[0274] FIG11 is a schematic flow chart of an information processing method according to an embodiment of the present application. The method includes at least part of the following contents.

[0275] S1110. The electronic device receives communication data from a mobile network.

[0276] S1120. The electronic device inputs the communication data of the mobile network into a target model to obtain a detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein the target model is obtained based on a model generation method.

[0277] In this embodiment, the electronic device may be the first device or the second device in the aforementioned model generation method. The description of the first device or the second device is the same as that of the aforementioned model generation method and is not repeated here. Alternatively, the electronic device may be a device other than the aforementioned first device and the second device. In this case, before executing S1110, the electronic device may receive the aforementioned target model from either the first device or the second device in advance.

[0278] The communication data of the aforementioned mobile network can be carried by any signaling (or message, or information, or signal) in the mobile network, such as RRC signaling, MAC CE, DCI, system broadcast message, side link message, etc., which are not exhaustive here.

[0279] The electronic device inputs the communication data of the mobile network into a target model to obtain a detection result output by the target model, including:

[0280] The electronic device converts the communication data of the mobile network into a digital sequence;

[0281] The electronic device inputs the digital sequence into the target model to obtain a detection result output by the target model.

[0282] Here, the method of converting the communication data of the mobile network into a digital sequence may be to convert the communication data of the mobile network into a digital sequence based on a conversion dictionary. The conversion dictionary may be preset. For example, the conversion dictionary may include numbers corresponding to each character or letter. For example, the content of the conversion dictionary D is: {'a':1,'b':2,'c':3,'d':4,'e':5,'f':6,'g':7,'h':8,'i':9,'j':10,'k':11,'l':12,'m':13,'n':14,'o':15,'p':16,'q':17}. 7,'r':18,'s':19,'t':20,'u':21,'v':22,'w':23,'x':24,'y':25,'z':26,'-':27,'_':28,'1 ':29,'2':30,'3':31,'4':32,'5':33,'6':34,'7':35,'8':36,'9':37,'0':38,'.':39,'α':0}.

[0283] In one embodiment, during the training process of the aforementioned target model, each training sample in the local training set used is a single data, and its label can be used to indicate whether the data is normal data or abnormal data (or DGA domain data).

[0284] When the target model trained in this manner executes S1120, the input information may be a digital sequence converted from the communication data of the mobile network. The detection result obtained by the target model can directly indicate whether the communication data of the mobile network is an intrusion type of data.

[0285] In another embodiment, the electronic device inputs the digital sequence into the target model to obtain a detection result output by the target model, including:

[0286] The electronic device inputs the digital sequence and the abnormal data into the target model to obtain a detection result output by the target model; wherein the detection result is used to indicate whether the digital sequence and the abnormal data are of the same type.

[0287] During the training process of the aforementioned target model, each training sample in the local training set used is paired data. When the paired data are homogeneous data, the label is used to indicate whether the paired data are homogeneous data or heterogeneous data.

[0288] When executing S1120, the target model trained in this manner converts the currently received mobile network communication data into a digital sequence, pairs it with the abnormal data, and uses the paired data as input information. Here, the abnormal data can be a digital sequence converted from an abnormal domain name. The abnormal domain name can be a DGA domain name.

[0289] The method further includes: if the detection result indicates that the digital sequence and the abnormal data are of the same type, the electronic device determining that the communication data of the mobile network is intrusion-type data;

[0290] And / or, when the detection result indicates that the digital sequence and the abnormal data are not the same type of data, the electronic device determines that the communication data of the mobile network is normal data.

[0291] Optionally, the number of abnormal domain names may be one or more; that is, the number of abnormal data may also be one or more. Accordingly, the electronic device inputs the digital sequence and the abnormal data into the target model to obtain a detection result output by the target model, which may be: the electronic device inputs the digital sequence and the i-th abnormal data into the target model to obtain the i-th detection result output by the target model. Here, i is a positive integer. Here, the i-th abnormal data is any one of the one or more abnormal data.

[0292] Furthermore, the method may further include: determining whether there are any remaining abnormal data; if so, inputting the digital sequence and the (i+1)th abnormal data into the target model to obtain the (i+1)th detection result output by the target model; and if not, determining that the detection is complete. The (i+1)th abnormal data is any one of the remaining abnormal data.

[0293] The processing by the electronic device may further include: if any one of the multiple detection results indicates that the digital sequence and the abnormal data are of the same type, the electronic device determining that the communication data of the mobile network is intrusion-type data. And / or if all of the multiple detection results indicate that the digital sequence and the abnormal data are not of the same type, the electronic device determining that the communication data of the mobile network is normal data.

[0294] In conjunction with Figure 12, the aforementioned model generation method and information processing method are exemplarily described: first, federated training can be performed on the first device and the second device to generate a target model, wherein the first device can be used as the master node and the second device can be a child node. In the model generation illustrated on the left side of Figure 12, the number of child nodes is 3 as an example, represented as child node 1, child node 2, and child node 3 respectively. After the master node and the three child nodes on the left side of Figure 12 complete the processing, the target model is obtained, and then the information processing shown on the right side of Figure 12 can be performed. The information processing shown on the right side of Figure 12 can be performed by an electronic device, which can be any device on the left side of Figure 12. In the process illustrated on the right side of Figure 12, the communication data of the mobile network can be received first, and the communication data of the mobile network can be input into the target model to obtain the detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data.

[0295] By adopting the above scheme, the target model can be obtained by federated training. Since the target model is obtained by aggregating multiple sub-models, the processing of the target model can be guaranteed to be more accurate, and the results of the communication data analysis of the mobile network based on the target model can be guaranteed to be more accurate.

[0296] FIG13 is a schematic diagram of the composition structure of a first device according to an embodiment of the present application, including:

[0297] The first communication unit 1310 is configured to receive one or more k-th layer sub-models and send a target model; k is a positive integer;

[0298] The first processing unit 1320 is configured to determine a target model based on the one or more k-th layer sub-models; the target model is used to detect whether the communication data of the mobile network is intrusion-type data.

[0299] The first communication unit is configured to receive a k-th layer sub-model sent by each second device among one or more second devices; and send the target model to each second device among the one or more second devices.

[0300] The first processing unit is configured to generate a k-th layer aggregation model based on the one or more k-th layer sub-models; and when it is determined based on the k-th layer aggregation model that a preset condition is met, use the k-th layer aggregation model as the target model.

[0301] The first processing unit is configured to send the k-th layer aggregation model to each second device of the one or more second devices through the first communication unit when the k-th layer aggregation model does not meet a preset condition.

[0302] The first processing unit is used to generate a k-th layer aggregation model based on the one or more k-th layer sub-models; when the first device determines that the preset conditions are met based on the k-th layer aggregation model and the k-1-th layer aggregation model, the first device uses the k-1-th layer aggregation model as the target model.

[0303] The first processing unit is configured to send the k-th layer aggregation model to each second device of the one or more second devices through the first communication unit when it is determined that a preset condition is not met based on the k-th layer aggregation model and the k-1-th layer aggregation model.

[0304] The preset condition includes: the accuracy of the k-th layer aggregation model is greater than a first threshold value.

[0305] The preset condition includes: the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model is less than a second threshold value.

[0306] The first communication unit is used to send first indication information to each of the one or more second devices, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data detected based on the target model.

[0307] The first communication unit is used to send second indication information to each second device in the one or more second devices, where the second indication information is used to indicate generating a k+1th layer sub-model based on the kth layer aggregation model.

[0308] The first processing unit is used to generate a k-th layer local sub-model based on a local training set and a k-1-th layer aggregation model; the local training set is part of the data of a local data set; and the k-th layer aggregation model is generated based on the k-th layer local sub-model and the one or more k-th layer sub-models.

[0309] The first processing unit is used to determine the accuracy of the k-th layer aggregation model based on a local test set; the local test set is part of the data in the local data set.

[0310] The first communication unit is configured to send the k-th layer aggregation model and third indication information; the third indication information is configured to instruct each second device to calculate an accuracy reference value of the k-th layer aggregation model; and receive one or more accuracy reference values ​​corresponding to the k-th layer aggregation model;

[0311] The first processing unit is configured to use an average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

[0312] The first processing unit is used to determine the local accuracy reference value of the k-th layer aggregation model based on a local test set; the local test set is part of the data in the local data set; and the local accuracy reference value of the k-th layer aggregation model and the average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model are used as the accuracy of the k-th layer aggregation model.

[0313] The local data set includes one or more sample data; wherein each of the one or more sample data includes: a label and a feature value indicating whether it is an intrusion behavior; or, each of the one or more sample data includes: a feature value of each sub-data in two sub-data, and a label indicating whether the two sub-data are of the same type.

[0314] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0315] The first device is a terminal device or a network device.

[0316] The network device is one of the following: access network device, core network device, server.

[0317] The server is an edge application server EAS; the core network device is a packet data network gateway PGW.

[0318] The second device is a terminal device.

[0319] The first device of the embodiment of the present application can realize the corresponding functions of the first device in the aforementioned model generation method embodiment. The processes, functions, implementation methods and beneficial effects corresponding to the various modules (sub-modules, units or components, etc.) in the first device can be found in the corresponding descriptions in the above-mentioned method embodiments, which will not be repeated here. It should be noted that the functions described by the various modules (sub-modules, units or components, etc.) in the first device of the application embodiment can be implemented by different modules (sub-modules, units or components, etc.), or by the same module (sub-module, unit or component, etc.).

[0320] FIG14 is a schematic diagram of the structure of a second device according to an embodiment of the present application, including:

[0321] The second communication unit 1401 is used to send the k-th layer sub-model; k is a positive integer; the k-th layer sub-model is used to determine the target model; receive the target model; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

[0322] The second communication unit is configured to receive first indication information, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data, detected based on the target model.

[0323] The second communication unit is used to receive the k-th layer aggregation model and second indication information, where the second indication information is used to indicate generating the k+1-th layer sub-model based on the k-th layer aggregation model.

[0324] The second device also includes: a second processing unit 1402, used to generate a k+1th layer sub-model based on the updated local training set and the kth layer aggregation model.

[0325] The second processing unit is used to input the j-th training sample in the local training set into the k-th layer aggregation model to obtain the feature vector output by the k-th layer aggregation model; the local training set is part of the data in the local data set; j is a positive integer; one or more training feature values ​​of the j-th training sample are randomly downsampled to obtain the training feature value of the processed j-th training sample; based on the training feature value of the processed j-th training sample and the feature vector output by the k-th layer aggregation model, the j-th training sample of the updated local training set is obtained.

[0326] The second processing unit is used to determine the accuracy reference value of the k-th layer aggregation model based on the local test set; wherein the local test set is part of the data in the local data set; the second communication unit is used to receive the k-th layer aggregation model and third indication information, and the third indication information is used to indicate the calculation of the accuracy reference value of the k-th layer aggregation model; and send the accuracy reference value of the k-th layer aggregation model.

[0327] The local data set includes one or more sample data; wherein each of the one or more sample data includes: a label and a feature value indicating whether it is an intrusion behavior; or, each of the one or more sample data includes: a feature value of each sub-data in two sub-data, and a label indicating whether the two sub-data are of the same type.

[0328] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0329] The second device is a terminal device.

[0330] The second device of the embodiment of the present application can realize the corresponding function of the second device in the aforementioned model generation method embodiment. The processes, functions, implementation methods and beneficial effects corresponding to the various modules (sub-modules, units or components, etc.) in the second device can be found in the corresponding description in the above-mentioned method embodiment, which will not be repeated here. It should be noted that the functions described by the various modules (sub-modules, units or components, etc.) in the second device of the application embodiment can be implemented by different modules (sub-modules, units or components, etc.), or by the same module (sub-modules, units or components, etc.).

[0331] FIG15 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application, including:

[0332] The third communication unit 1501 is used to receive communication data from the mobile network;

[0333] The third processing unit 1502 is used to input the communication data of the mobile network into the target model to obtain the detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein the target model is obtained based on the model generation method.

[0334] The third processing unit is configured to convert the communication data of the mobile network into a digital sequence; input the digital sequence into the target model, and obtain a detection result output by the target model.

[0335] The third processing unit is used to input the digital sequence and the abnormal data into the target model to obtain a detection result output by the target model; wherein the detection result is used to indicate whether the digital sequence and the abnormal data are the same type of data.

[0336] the third processing unit is configured to determine that the communication data of the mobile network is intrusion-type data when the detection result indicates that the digital sequence and the abnormal data are of the same type;

[0337] And / or, when the detection result indicates that the digital sequence and the abnormal data are not of the same type, determining that the communication data of the mobile network is normal data.

[0338] The target model includes at least one of the following: one or more random forests, one or more completely random forests.

[0339] The electronic device of the embodiment of the present application can realize the corresponding functions of the electronic device in the aforementioned information processing method embodiment. The processes, functions, implementation methods and beneficial effects corresponding to the various modules (sub-modules, units or components, etc.) in the electronic device can be found in the corresponding description in the above-mentioned method embodiment, which will not be repeated here. It should be noted that the functions described by the various modules (sub-modules, units or components, etc.) in the electronic device of the application embodiment can be implemented by different modules (sub-modules, units or components, etc.), or by the same module (sub-modules, units or components, etc.).

[0340] Figure 16 is a schematic structural diagram of a communication device 1600 according to an embodiment of the present application. The communication device 1600 includes a processor 1610, which can call and execute a computer program from a memory to enable the communication device 1600 to implement the method in the embodiment of the present application.

[0341] In a possible implementation, the communication device 1600 may further include a memory 1620. The processor 1610 may call and execute a computer program from the memory 1620 to enable the communication device 1600 to implement the method in the embodiment of the present application.

[0342] The memory 1620 may be a separate device independent of the processor 1610 , or may be integrated into the processor 1610 .

[0343] In one possible implementation, the communication device 1600 may further include a transceiver 1630 , and the processor 1610 may control the transceiver 1630 to communicate with other devices. Specifically, the transceiver 1630 may send information or data to other devices, or receive information or data sent by other devices.

[0344] The transceiver 1630 may include a transmitter and a receiver. The transceiver 1630 may further include an antenna, and the number of antennas may be one or more.

[0345] In one possible implementation, the communication device 1600 may be the first device of the embodiment of the present application, and the communication device 1600 may implement the corresponding processes implemented by the first device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0346] In one possible implementation, the communication device 1600 may be the second device of the embodiment of the present application, and the communication device 1600 may implement the corresponding processes implemented by the second device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0347] In one possible implementation, the communication device 1600 may be an electronic device of an embodiment of the present application, and the communication device 1600 may implement the corresponding processes implemented by the electronic device in each method of the embodiment of the present application. For the sake of brevity, they will not be repeated here.

[0348] 17 is a schematic structural diagram of a chip 1700 according to an embodiment of the present application. The chip 1700 includes a processor 1710, which can call and execute a computer program from a memory to implement the method according to the embodiment of the present application.

[0349] In one possible implementation, the chip 1700 may further include a memory 1720. The processor 1710 may call and execute a computer program from the memory 1720 to implement the method executed by the electronic device, the second device, or the first device in the embodiment of the present application.

[0350] The memory 1720 may be a separate device independent of the processor 1710 , or may be integrated into the processor 1710 .

[0351] In a possible implementation, the chip 1700 may further include an input interface 1730. The processor 1710 may control the input interface 1730 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0352] In a possible implementation, the chip 1700 may further include an output interface 1740. The processor 1710 may control the output interface 1740 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0353] In one possible implementation, the chip can be applied to the first device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the first device in each method of the embodiment of the present application. For the sake of brevity, it will not be repeated here.

[0354] In one possible implementation, the chip can be applied to the second device in the embodiment of the present application, and the chip can implement the corresponding processes implemented by the second device in each method of the embodiment of the present application. For the sake of brevity, it will not be repeated here.

[0355] In one possible implementation, the chip can be applied to the electronic device in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the electronic device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0356] The chips used in the first device, the electronic device, and the second device may be the same chip or different chips.

[0357] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0358] The processor mentioned above may be a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other programmable logic devices, transistor logic devices, discrete hardware components, etc. The general-purpose processor mentioned above may be a microprocessor or any conventional processor, etc.

[0359] The memory mentioned above may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM).

[0360] It should be understood that the above-mentioned memories are exemplary but not restrictive. For example, the memories in the embodiments of the present application may also be static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM RAM (DR RAM), etc. In other words, the memories in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0361] FIG18 is a schematic block diagram of a communication system 1800 according to an embodiment of the present application. The communication system 1800 includes a second device 1810 and a first device 1820 .

[0362] The second device 1810 can be used to implement the corresponding functions implemented by the second device in the above method, and the first device 1820 can be used to implement the corresponding functions implemented by the first device in the above method. For the sake of brevity, they are not described here in detail.

[0363] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode to another website, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0364] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0365] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0366] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A model generation method, comprising: The first device receives one or more k-th layer sub-models; k is a positive integer; The first device determines a target model based on the one or more k-th layer sub-models; The target model is used to detect whether the communication data of the mobile network is an intrusion type of data; The first device sends the target model.

2. The method according to claim 1, wherein The first device receiving one or more k-th layer sub-models includes: the first device receiving the k-th layer sub-model sent by each second device among the one or more second devices; The sending, by the first device, of the target model includes: the first device sending the target model to each of the one or more second devices.

3. The method according to claim 2, wherein: The first device determines a target model based on the one or more k-th layer sub-models, including: The first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models; When the first device determines that the preset condition is met based on the k-th layer aggregation model, the k-th layer aggregation model is used as the target model.

4. The method according to claim 3, wherein: The method further comprises: When the k-th layer aggregation model does not meet a preset condition, the first device sends the k-th layer aggregation model to each second device of the one or more second devices.

5. The method according to claim 2, wherein: The first device determines a target model based on the one or more k-th layer sub-models, including: The first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models; When the first device determines that a preset condition is met based on the k-th layer aggregation model and the k-1-th layer aggregation model, the first device uses the k-1-th layer aggregation model as the target model.

6. The method according to claim 5, wherein: The method further comprises: When the first device determines that a preset condition is not met based on the k-th layer aggregation model and the k-1-th layer aggregation model, the first device sends the k-th layer aggregation model to each second device of the one or more second devices.

7. The method according to claim 3 or 4, wherein: The preset condition includes: the accuracy of the k-th layer aggregation model is greater than a first threshold value.

8. The method according to any one of claims 3 to 6, wherein: The preset condition includes: the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model is less than a second threshold value.

9. The method according to claim 3 or 5, wherein: When the first device sends the target model, the method further includes: The first device sends first indication information to each of the one or more second devices, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data, detected based on the target model.

10. The method according to claim 4 or 6, wherein: When sending the k-th layer aggregation model to each of the one or more second devices, the method further includes: The first device sends second indication information to each of the one or more second devices, where the second indication information is used to indicate generating a k+1th layer sub-model based on the kth layer aggregation model.

11. The method according to claim 7 or 8, wherein: The method further includes: the first device generating a k-th layer local sub-model based on a local training set and a k-1-th layer aggregation model; the local training set is part of the local data set; The first device generates a k-th layer aggregation model based on the one or more k-th layer sub-models, including: the first device generates the k-th layer aggregation model based on the k-th layer local sub-model and the one or more k-th layer sub-models.

12. The method according to any one of claims 7, 8 and 11, wherein: The method further comprises: The first device determines the accuracy of the k-th layer aggregation model based on a local test set; the local test set is part of the data in the local data set.

13. The method according to any one of claims 7, 8 and 11, wherein: After generating the k-th layer aggregation model, the method further includes: The first device sends the k-th layer aggregation model and third indication information; the third indication information is used to instruct each second device to calculate the accuracy reference value of the k-th layer aggregation model; The first device receives one or more accuracy reference values ​​corresponding to the k-th layer aggregation model; The first device uses an average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

14. The method according to claim 13, wherein The method further includes: the first device determining a local accuracy reference value of the k-th layer aggregation model based on a local test set; the local test set is part of the data in the local data set; The first device uses the average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model, including: the first device uses the local accuracy reference value of the k-th layer aggregation model and the average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

15. The method according to any one of claims 11, 12 and 14, wherein: The local data set includes one or more sample data; Each of the one or more sample data includes: a label indicating whether it is an intrusion behavior and a feature value; Alternatively, each sample data in the one or more sample data includes: a feature value of each sub-data in the two sub-data, and a label indicating whether the two sub-data are of the same type.

16. The method according to any one of claims 1 to 15, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

17. The method according to any one of claims 1 to 16, wherein: The first device is a terminal device or a network device.

18. The method according to claim 17, wherein The network device is one of the following: access network device, core network device, server.

19. The method according to claim 18, wherein The server is an edge application server EAS; the core network device is a packet data network gateway PGW.

20. The method according to any one of claims 2 to 15, wherein: The second device is a terminal device.

21. A model generation method comprising: The second device sends the k-th layer sub-model; k is a positive integer; The k-th layer sub-model is used to determine the target model; The second device receives the target model; The target model is used to detect whether the communication data of the mobile network is intrusion type data.

22. The method according to claim 21, wherein When the second device receives the target model, the method further includes: The second device receives first indication information, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data, detected based on the target model.

23. The method according to claim 21, wherein The method further comprises: The second device receives a k-th layer aggregation model and second indication information, where the second indication information is used to indicate generating a k+1-th layer sub-model based on the k-th layer aggregation model.

24. The method according to claim 23, wherein The method further comprises: The second device generates a k+1th layer sub-model based on the updated local training set and the kth layer aggregation model.

25. The method according to claim 24, wherein The method further comprises: The second device inputs the j-th training sample in the local training set into the k-th layer aggregation model to obtain a feature vector output by the k-th layer aggregation model; the local training set is part of the data in the local data set; j is a positive integer; The second device randomly downsamples one or more training feature values ​​of the j-th training sample to obtain a processed training feature value of the j-th training sample; The second device obtains the jth training sample of the updated local training set based on the training feature value of the processed jth training sample and the feature vector output by the kth layer aggregation model.

26. The method according to claim 21, wherein The method further comprises: The second device receives a k-th layer aggregation model and third indication information, where the third indication information is used to instruct calculation of an accuracy reference value of the k-th layer aggregation model; The second device determines the accuracy reference value of the k-th layer aggregation model based on a local test set; wherein the local test set is part of the data in the local data set; The second device sends the accuracy reference value of the k-th layer aggregation model.

27. The method according to claim 25 or 26, wherein The local data set includes one or more sample data; Each of the one or more sample data includes: a label indicating whether it is an intrusion behavior and a feature value; Alternatively, each sample data in the one or more sample data includes: a feature value of each sub-data in the two sub-data, and a label indicating whether the two sub-data are of the same type.

28. The method according to any one of claims 21 to 27, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

29. The method according to any one of claims 21 to 28, wherein: The second device is a terminal device.

30. An information processing method comprising: The electronic device receives communication data from the mobile network; The electronic device inputs the communication data of the mobile network into a target model to obtain a detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein the target model is obtained based on the method described in any one of claims 1-20 or 21-29.

31. The method according to claim 30, wherein The electronic device inputs the communication data of the mobile network into a target model to obtain a detection result output by the target model, including: The electronic device converts the communication data of the mobile network into a digital sequence; The electronic device inputs the digital sequence into the target model to obtain a detection result output by the target model.

32. The method according to claim 31, wherein The electronic device inputs the digital sequence into the target model to obtain a detection result output by the target model, including: The electronic device inputs the digital sequence and the abnormal data into the target model to obtain a detection result output by the target model; wherein the detection result is used to indicate whether the digital sequence and the abnormal data are of the same type.

33. The method according to claim 32, wherein The method further comprises: When the detection result indicates that the digital sequence and the abnormal data are of the same type, the electronic device determines that the communication data of the mobile network is intrusion-type data; And / or, when the detection result indicates that the digital sequence and the abnormal data are not the same type of data, the electronic device determines that the communication data of the mobile network is normal data.

34. The method according to any one of claims 30 to 33, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

35. A first device comprising: A first communication unit, configured to receive one or more k-th layer sub-models; And send the target model; k is a positive integer; The first processing unit is configured to determine a target model based on the one or more k-th layer sub-models; the target model is used to detect whether the communication data of the mobile network is an intrusion type of data.

36. The first device according to claim 35, wherein The first communication unit is configured to receive a k-th layer sub-model sent by each second device among the one or more second devices; And sending the target model to each second device of the one or more second devices.

37. The first device according to claim 36, wherein The first processing unit is configured to generate a k-th layer aggregation model based on the one or more k-th layer sub-models; and when it is determined based on the k-th layer aggregation model that a preset condition is met, use the k-th layer aggregation model as the target model.

38. The first device according to claim 37, wherein The first processing unit is configured to send the k-th layer aggregation model to each second device of the one or more second devices through the first communication unit when the k-th layer aggregation model does not meet a preset condition.

39. The first device according to claim 36, wherein The first processing unit is used to generate a k-th layer aggregation model based on the one or more k-th layer sub-models; when the first device determines that the preset conditions are met based on the k-th layer aggregation model and the k-1-th layer aggregation model, the first device uses the k-1-th layer aggregation model as the target model.

40. The first device according to claim 39, wherein The first processing unit is configured to send the k-th layer aggregation model to each second device of the one or more second devices through the first communication unit when it is determined that a preset condition is not met based on the k-th layer aggregation model and the k-1-th layer aggregation model.

41. The first device according to claim 37 or 38, wherein The preset condition includes: the accuracy of the k-th layer aggregation model is greater than a first threshold value.

42. The first device according to any one of claims 37 to 40, wherein: The preset condition includes: the difference between the accuracy of the k-th layer aggregation model and the accuracy of the k-1-th layer aggregation model is less than a second threshold value.

43. The first device according to claim 37 or 39, wherein The first communication unit is used to send first indication information to each of the one or more second devices, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data detected based on the target model.

44. The first device according to claim 38 or 40, wherein The first communication unit is used to send second indication information to each second device in the one or more second devices, where the second indication information is used to indicate generating a k+1th layer sub-model based on the kth layer aggregation model.

45. The first device according to claim 41 or 42, wherein The first processing unit is configured to generate a k-th layer local sub-model based on a local training set and a k-1-th layer aggregation model; the local training set is part of the local data set; The k-th layer aggregate model is generated based on the k-th layer local sub-model and the one or more k-th layer sub-models.

46. ​​The first device according to any one of claims 41, 42, and 45, wherein: The first processing unit is used to determine the accuracy of the k-th layer aggregation model based on a local test set; the local test set is part of the data in the local data set.

47. The first device according to any one of claims 41, 42, and 45, wherein: The first communication unit is configured to send the k-th layer aggregation model and third indication information; the third indication information is configured to instruct each second device to calculate an accuracy reference value of the k-th layer aggregation model; and receive one or more accuracy reference values ​​corresponding to the k-th layer aggregation model; The first processing unit is configured to use an average of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model as the accuracy of the k-th layer aggregation model.

48. The first device according to claim 47, wherein The first processing unit is configured to determine a local accuracy reference value of the k-th layer aggregation model based on a local test set; the local test set is a portion of data in a local data set; The local accuracy reference value of the k-th layer aggregation model and the average value of one or more accuracy reference values ​​corresponding to the k-th layer aggregation model are used as the accuracy of the k-th layer aggregation model.

49. The first device according to any one of claims 45, 46, and 48, wherein: The local data set includes one or more sample data; Each of the one or more sample data includes: a label indicating whether it is an intrusion behavior and a feature value; Alternatively, each sample data in the one or more sample data includes: a feature value of each sub-data in the two sub-data, and a label indicating whether the two sub-data are of the same type.

50. The first device according to any one of claims 35 to 49, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

51. The first device according to any one of claims 35 to 50, wherein: The first device is a terminal device or a network device.

52. The first device according to claim 51, wherein The network device is one of the following: access network device, core network device, server.

53. The first device according to claim 52, wherein The server is an edge application server EAS; the core network device is a packet data network gateway PGW.

54. The first device according to any one of claims 36 to 49, wherein: The second device is a terminal device.

55. A second device comprising: The second communication unit is used to send the k-th layer sub-model; k is a positive integer; The k-th layer sub-model is used to determine the target model; receiving a target model; The target model is used to detect whether the communication data of the mobile network is intrusion type data.

56. The second device according to claim 55, wherein The second communication unit is configured to receive first indication information, where the first indication information is used to indicate whether communication data of the mobile network is intrusion-type data, detected based on the target model.

57. The second device according to claim 55, wherein The second communication unit is used to receive the k-th layer aggregation model and second indication information, where the second indication information is used to indicate generating the k+1-th layer sub-model based on the k-th layer aggregation model.

58. The second device according to claim 57, wherein The second device further includes: The second processing unit is used to generate a k+1-th layer sub-model based on the updated local training set and the k-th layer aggregation model.

59. The second device according to claim 58, wherein The second processing unit is configured to input the j-th training sample in the local training set into the k-th layer aggregation model to obtain a feature vector output by the k-th layer aggregation model; the local training set is a portion of the data in the local data set; j is a positive integer; and randomly downsample one or more training feature values ​​of the j-th training sample to obtain a processed training feature value of the j-th training sample; Based on the training feature value of the processed j-th training sample and the feature vector output by the k-th layer aggregation model, the j-th training sample of the updated local training set is obtained.

60. The second device according to claim 55, wherein The second device further includes: A second processing unit is configured to determine an accuracy reference value of the k-th layer aggregation model based on a local test set, wherein the local test set is a portion of data in the local data set; The second communication unit is used to receive the k-th layer aggregation model and third indication information, where the third indication information is used to indicate the calculation of the accuracy reference value of the k-th layer aggregation model; and send the accuracy reference value of the k-th layer aggregation model.

61. The second device according to claim 59 or 60, wherein The local data set includes one or more sample data; Each of the one or more sample data includes: a label indicating whether it is an intrusion behavior and a feature value; Alternatively, each sample data in the one or more sample data includes: a feature value of each sub-data in the two sub-data, and a label indicating whether the two sub-data are of the same type.

62. The second device according to any one of claims 55 to 61, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

63. The second device according to any one of claims 55 to 62, wherein: The second device is a terminal device.

64. An electronic device comprising: a third communication unit, configured to receive communication data from a mobile network; A third processing unit is used to input the communication data of the mobile network into a target model to obtain a detection result output by the target model; the detection result is used to determine whether the communication data of the mobile network is an intrusion type of data; wherein the target model is obtained based on the method described in any one of claims 1-20 or 21-29.

65. The electronic device according to claim 64, wherein The third processing unit is configured to convert the communication data of the mobile network into a digital sequence; input the digital sequence into the target model, and obtain a detection result output by the target model.

66. The electronic device according to claim 65, wherein The third processing unit is used to input the digital sequence and the abnormal data into the target model to obtain a detection result output by the target model; wherein the detection result is used to indicate whether the digital sequence and the abnormal data are the same type of data.

67. The electronic device according to claim 66, wherein the third processing unit is configured to determine that the communication data of the mobile network is intrusion-type data when the detection result indicates that the digital sequence and the abnormal data are of the same type; And / or, when the detection result indicates that the digital sequence and the abnormal data are not of the same type, determining that the communication data of the mobile network is normal data.

68. The electronic device according to any one of claims 64 to 67, wherein: The target model includes at least one of the following: one or more random forests, one or more completely random forests.

69. A first device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory, so that the terminal device executes the method according to any one of claims 1 to 20.

70. A second device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory so that the terminal device executes the method according to any one of claims 21 to 29.

71. An electronic device comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory so as to enable the terminal device to execute the method according to any one of claims 30 to 34.

72. A chip comprising: A processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes the method according to any one of claims 1 to 20, or claims 21 to 29, or claims 30 to 34.

73. A computer-readable storage medium for storing a computer program, which, when executed by a device, causes the device to perform the method according to any one of claims 1 to 20, or claims 21 to 29, or claims 30 to 34.

74. A computer program product comprising computer program instructions for causing a computer to perform the method of any one of claims 1 to 20, or claims 21 to 29, or claims 30 to 34.

75. A computer program causing a computer to perform the method of any one of claims 1 to 20, or claims 21 to 29, or claims 30 to 34.

Images