Security threat detection method and device, computer equipment and readable storage medium

Abstract

The invention discloses a security threat detection method and device, computer equipment and a readable storage medium, and relates to the technical field of network security, a master station end can aggregate model parameters of local detection models of multiple pieces of network element equipment, so that a global security threat detection model is established; and the slave station end, namely a plurality of network element devices, establishes respective local detection models by using the marked data, automatically marks the unmarked data through the local detection models to expand the data set, and uploads model parameters through the network management network to complete parameter transmission between the master station end and the plurality of network element devices. Therefore, the global security threat detection model parameters are updated, data sharing with a centralized server is not needed, privacy data are protected while communication is reduced, cross-domain device and cross-region collaborative security threat detection is realized, and threats are sensed more comprehensively from the global perspective.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security threat detection method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] With the development of network technology, the power system is also expanding and becoming more intelligent, and the demand for safety detection of optical transmission equipment is also increasing. Optical transmission equipment will achieve more intelligent network management and fault prediction, improve network reliability and service quality, but due to the large number and wide distribution of optical transmission equipment, and currently being in a monitoring blind spot, it is extremely vulnerable to malicious attacks.

[0003] In the related art, there are two types of security threat detection methods, one is centralized detection in the cloud, and the other is lightweight detection based on the optical transmission equipment itself. However, the applicant recognizes that centralized detection in the cloud will face the risk of increased communication burden, reduced data confidentiality, and data privacy leakage, as well as the potential threat of attackers maliciously stealing communication data and tampering with measurement data; the computing resources that rely on the optical transmission equipment itself for lightweight detection are limited, and it is impossible to achieve comprehensive detection of potential threats from a global perspective. The lack of global sensitivity to system security threats will lead to low accuracy in security threat detection. Summary of the invention

[0004] In view of this, the present application provides a security threat detection method, apparatus, computer equipment and readable storage medium, the main purpose of which is to solve the following problems: centralized detection in the cloud will face the risk of increased communication burden, reduced data confidentiality, and data privacy leakage, and there is also a potential threat of attackers maliciously stealing communication data and tampering with measurement data; the computing resources that rely on the optical transmission equipment itself for lightweight detection are limited, and it is impossible to achieve comprehensive detection of potential threats from a global perspective. The lack of global sensitivity to system security threats will lead to the problem of low accuracy in security threat detection.

[0005] According to the first aspect of the present application, a security threat detection method is provided, the method comprising:

[0006] The master station obtains global model parameters of the global detection model, and sends the global model parameters to multiple network element devices;

[0007] Each of the network element devices acquires the labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station;

[0008] The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model;

[0009] The master station acquires business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results.

[0010] Optionally, each of the network element devices acquires the labeled data, uses the labeled data, the trained local model parameters and the local model accuracy of the local detection model as a parameter set, and sends the parameter set to the master station, including:

[0011] For each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters;

[0012] If the network element device is a gateway network element device, obtaining its own target device location attribute, extracting the gateway model parameter from the global model parameter according to the target device location attribute, the target device location attribute being a gateway network element;

[0013] The network element device sets its own communication state to open;

[0014] The network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data;

[0015] The network element device trains the local detection model using the label data and the gateway model parameters to obtain target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model;

[0016] The network element device obtains a gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy;

[0017] When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed;

[0018] When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as a parameter set of the network element device, and sends the parameter set to the master station.

[0019] Optionally, after the network element device receives the global model parameter, the method further includes:

[0020] If the network element device is a common network element device, obtaining its own designated device location attribute, extracting the common model parameters from the global model parameters according to the designated device location attribute, the designated device location attribute being a common network element;

[0021] The network element device sets its own communication state to open;

[0022] The network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data;

[0023] The network element device trains the local detection model using the marked data and the common model parameters to obtain target common model parameters, and calculates the common model accuracy of the trained local detection model;

[0024] The network element device obtains a common network element threshold, and compares the common network element threshold with the common model accuracy;

[0025] When the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed;

[0026] When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0027] Optionally, the network element device acquires the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, and obtains the marked data, including:

[0028] The network element device inputs the gateway data to be marked into the local detection model to obtain a logic value output by the local detection model;

[0029] The network element device calculates the logic value using a normalization function to obtain a probability distribution;

[0030] The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution;

[0031] If the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0032] Optionally, the network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution, including:

[0033] The network element device determines a maximum value of the probability distribution and a second maximum value of the probability distribution according to the probability distribution;

[0034] The network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, wherein the two-level factor screening condition is:

[0035]

[0036] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

[0037] Optionally, the method further comprises:

[0038] The master station receives the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets;

[0039] The master station extracts multiple marked gateway data and multiple marked common data from the multiple parameter sets based on the target global detection model, and calculates the multiple marked gateway data and the multiple marked common data respectively based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein:

[0040]

[0041] in, Indicates the tag gateway data. represents the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. represents the ordinary contribution rate;

[0042] The master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies respectively based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein:

[0043]

[0044] in, represents the gateway model accuracy, represents the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set;

[0045] The master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters respectively based on the target global detection model to obtain target global model parameters, wherein:

[0046]

[0047] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the weight coefficient of common parameters, W r represents the target global model parameter;

[0048] The master station obtains a preset training round, sends the target global model parameters to the multiple network element devices again, and uses multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training round is reached to obtain a specified global detection model;

[0049] The master station uses the designated global detection model as the global security threat detection model.

[0050] Optionally, the master station uses the specified global detection model as the global security threat detection model, including:

[0051] The master station obtains a preset model accuracy, calculates a global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy;

[0052] If the global model accuracy is greater than or equal to the preset model accuracy, the master station uses the designated global detection model as the global security threat detection model.

[0053] According to a second aspect of the present application, a security threat detection device is provided, the device comprising:

[0054] A transmission module, used for the master station to obtain global model parameters of the global detection model and send the global model parameters to multiple network element devices;

[0055] A first training module is used for each of the network element devices to obtain labeled data, use the labeled data and the global model parameters to train the local detection model, use the labeled data, the local model parameters of the trained local detection model and the local model accuracy as a parameter set, and send the parameter set to the master station;

[0056] A second training module is used for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model;

[0057] The detection module is used for the master station to obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results.

[0058] Optionally, the first training module is used for each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters; if the network element device is a gateway network element device, then obtain its own target device location attribute, extract the gateway model parameters from the global model parameters according to the target device location attribute, and the target device location attribute is a gateway network element; the network element device sets its own communication status to open; the network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; the network element device The local detection model is trained using the label data and the gateway model parameters to obtain the target gateway model parameters, and the gateway model accuracy of the trained local detection model is calculated; the network element device obtains a gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to off; when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway label data as a parameter set of the network element device, and sends the parameter set to the master station.

[0059] Optionally, the first training module is used to obtain its own designated device location attribute if the network element device is a common network element device, extract the common model parameters from the global model parameters according to the designated device location attribute, and the designated device location attribute is a common network element; the network element device sets its own communication state to open; the network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data; the network element device uses the marked data and the common model parameters to train the local detection model to obtain the target common data model parameters, calculate the common model accuracy of the local detection model after training; the network element device obtains the common network element threshold, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed; when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0060] Optionally, the first training module is used for the network element device to input the gateway data to be marked into the local detection model to obtain the logical value output by the local detection model; the network element device uses a normalization function to calculate the logical value to obtain a probability distribution; the network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution; if the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0061] Optionally, the first training module is used for the network element device to determine the maximum value of the probability distribution and the second maximum value of the probability distribution according to the probability distribution; the network element device reads the category boundary value and the category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second maximum value of the probability distribution, wherein the two-level factor screening condition is:

[0062]

[0063] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max represents the maximum value of the probability distribution, P2th-max Represents the second largest value of the probability distribution.

[0064] Optionally, the device further comprises:

[0065] The third training module is used for the master station to receive the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets; the master station extracts multiple marked gateway data and multiple marked ordinary data from the multiple parameter sets based on the target global detection model, and calculates the multiple marked gateway data and the multiple marked ordinary data respectively based on the target global detection model to obtain multiple gateway contribution rates and multiple ordinary contribution rates, wherein,

[0066]

[0067] in, Indicates the tag gateway data. represents the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Represents a common contribution rate; the master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies respectively based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein,

[0068]

[0069] in, represents the gateway model accuracy, represents the gateway weight, represents the general model accuracy, represents the normal weight, E r represents a parameter set; the master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain the target global model parameters, wherein,

[0070]

[0071] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the weight coefficient of common parameters, W rRepresents the target global model parameters; the master station obtains the preset training rounds, sends the target global model parameters to the multiple network element devices again, and uses the multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training rounds are reached to obtain the specified global detection model; the master station uses the specified global detection model as the global security threat detection model.

[0072] Optionally, the third training module is used for the master station to obtain the preset model accuracy, calculate the global model accuracy of the specified global detection model, and compare the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the master station will use the specified global detection model as the global security threat detection model.

[0073] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0074] According to a fourth aspect of the present application, a readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0075] Through the above technical scheme, the present application provides a security threat detection method, device, computer equipment and readable storage medium, the master station end obtains the global model parameters of the global detection model, and sends the global model parameters to multiple network element devices, each network element device obtains the labeled data, and uses the labeled data and the global model parameters to train the local detection model, and uses the labeled data, the local model parameters of the trained local detection model and the local model accuracy as a parameter set, and sends the parameter set to the master station end, the master station end uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station end obtains business data, and inputs the business data into the global security threat detection model for detection to obtain a security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through local detection models to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0076] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0078] Figure 1 A schematic diagram of a method flow for security threat detection provided by an embodiment of the present application is shown;

[0079] Figure 2A A schematic diagram of another method flow for security threat detection provided by an embodiment of the present application is shown;

[0080] Figure 2B A schematic diagram of the architecture of a security threat detection model provided by an embodiment of the present application is shown;

[0081] Figure 2C A schematic diagram of the architecture of a method for collaboratively detecting security threats to optical transmission equipment provided by an embodiment of the present application is shown;

[0082] Figure 3A A schematic diagram of a security threat detection structure provided by an embodiment of the present application is shown;

[0083] Figure 3B A schematic diagram of another security threat detection structure provided by an embodiment of the present application is shown;

[0084] Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0085] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0086] The present application embodiment provides a security threat detection method, such as Figure 1 As shown, the method includes:

[0087] 101. The master station obtains global model parameters of the global detection model, and sends the global model parameters to multiple network element devices.

[0088] Since optical transmission equipment is large in number, widely distributed, and in blind spots, it is extremely vulnerable to malicious attacks. Therefore, existing security threat detection methods are difficult to achieve real-time monitoring and security control of a large number of optical transmission equipment. In addition, facing the scenario of widely distributed optical transmission equipment in the power system, traditional security threat detection methods are difficult to continue to effectively carry out detection in this scenario.

[0089] To solve this problem, this application proposes a security threat detection method that combines semi-supervised federated learning and the Transformer deep learning model to perform collaborative security threat detection on optical transmission equipment. Since the federated learning method allows multiple parties to aggregate the parameters of the local threat detection model to achieve global threat detection model parameter updates or gradient updates, learning is done in a collaborative manner without sharing data with a centralized server, which reduces communication while protecting privacy data. Moreover, this method can achieve cross-domain device and cross-region collaborative security threat detection, and perceive threats more comprehensively from a global perspective. The present application constructs a distributed master-slave collaborative detection system, including a master station end and a slave station end. The master station end is the optical transmission network management system server end, and the slave station end is the network element end and the network management communication network. The master-slave collaborative detection system relies on the computing power of the server to provide services to users. The server can be an independent server, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), as well as servers for basic cloud computing such as big data and artificial intelligence platforms, so that the master-slave collaborative detection system can achieve global optimization of the security threat detection model in the scenario of distributed network topology.

[0090] In an embodiment of the present application, the master station obtains the global model parameters of the global detection model and sends the global model parameters to multiple network element devices, wherein the master station is the optical transmission network management system service end, the slave station is the network element end and the network management communication network, the network element end includes multiple network element devices, and the network element device is a gateway network element device or an ordinary network element device.

[0091] 102. Each network element device obtains the labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station.

[0092] In an embodiment of the present application, each network element device obtains labeled data, uses the labeled data and global model parameters to train the local detection model, and then uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station, wherein when the network element device is a gateway network element device, the labeled data is labeled gateway data. It should be noted that federated learning is a machine learning paradigm that allows multiple clients to cooperate with each other under the coordination of a central server, and a complete machine learning model can be obtained even when the data is scattered on the client. Therefore, through federated learning, there is no need to share data with a centralized server, which reduces communication while protecting privacy data.

[0093] 103. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model.

[0094] In the embodiment of the present application, the master station uses multiple parameter sets to train the global detection model to obtain the target global detection model, and uses the target global detection model as the global security threat detection model. In this way, the master station can aggregate the model parameters of the local detection models of multiple network element devices, thereby establishing a global security threat detection model, and the slave station, i.e., multiple network element devices, use the labeled data to establish their own local detection models, and automatically label the unlabeled data through the local detection model to expand the data set, and upload the model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of the global security threat detection model parameters.

[0095] 104. The main station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results.

[0096] In an embodiment of the present application, after the master station trains the global security threat detection model, it can obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results. In the scenario of distributed network topology, it can achieve global optimization of the security threat detection model and improve the accuracy of the security threat detection model.

[0097] According to the method provided by the embodiment of the present application, the master station obtains global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through local detection models to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0098] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, the embodiment of the present application provides another security threat detection method, such as Figure 2A As shown, the method includes:

[0099] 201. The master station obtains global model parameters of the global detection model, and sends the global model parameters to multiple network element devices.

[0100] In an embodiment of the present application, the master station obtains global model parameters of the global detection model and sends the global model parameters to multiple network element devices.

[0101] 202. For each network element device, the network element device receives global model parameters; if the network element device is a gateway network element device, execute the following step 203; if the network element device is a common network element device, execute the following step 207.

[0102] In an embodiment of the present application, for each network element device, the network element device receives global model parameters, wherein, according to the different network locations of the network element devices, the network element devices are currently divided into gateway network element devices and ordinary network element devices, and the global model parameters include gateway model parameters and ordinary model parameters; if the network element device is a gateway network element device, execute the following step 203; if the network element device is an ordinary network element device, execute the following step 207.

[0103] 203. If the network element device is a gateway network element device, obtain the gateway data to be marked and the local detection model, input the gateway data to be marked into the local detection model for marking, obtain marked gateway data, use the marked gateway data as marked data, and execute the following step 204.

[0104] In an embodiment of the present application, the global model parameters issued by the master station are distinguished according to the network node position of the network element device, and the network element device selects the model parameters that conform to itself according to its own device location attributes. If the network element device is a gateway network element device, its own target device location attribute is obtained, and the gateway model parameters are extracted from the global model parameters according to the target device location attribute, wherein the target device location attribute is the gateway network element. Next, the network element device sets its own communication state to open, and obtains the gateway data to be marked and the local detection model. Subsequently, the network element device inputs the gateway data to be marked into the local detection model for marking, obtains the marked gateway data, and uses the marked gateway data as the marked data. Among them, the data to be marked can be power dispatching data. It should be noted that the power dispatching data network is a dedicated wide area data network for power dispatching production services. It is an infrastructure for real-time and quasi-real-time data communications such as computer monitoring systems between power dispatching production departments and between power dispatching production departments and power plants and substations. Since it mainly transmits grid automation information, dispatching command instructions, relay protection and safety automatic device control information, etc., the power dispatching data belongs to the power industrial control system data, which needs to have the characteristics of small data volume, strong real-time performance and high reliability. Therefore, the flow monitoring of the optical transmission equipment that carries its business must also meet the characteristics of strong real-time performance and high analysis capability.

[0105] Specifically, the network element device inputs the gateway data to be marked into the local detection model, obtains the logical value output by the local detection model, that is, outputs the logits value of the threat classification through the fully connected layer of the local detection model. Next, the network element device uses a normalization function to calculate the logical value to obtain a probability distribution, that is, the logits value is mapped to the interval [0, 1] through a softmax function to obtain the probability distribution of each category. The network element device determines the maximum value of the probability distribution and the second largest value of the probability distribution according to the probability distribution. Subsequently, the network element device obtains a two-level factor screening condition, and reads the category boundary value and the category difference value in the two-level factor screening condition. This application does not directly use the category of the maximum value of the probability distribution as a label, but designs a two-level factor to annotate the data set. One factor is the category boundary value, which is used to ensure the reliability of the marking result; the other factor is the category difference value, which is used to distinguish the differences between different categories. Then, the network element device uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, where the two-level factor screening condition is the following formula 1:

[0106] Formula 1:

[0107] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max represents the maximum value of probability distribution, P 2th-max Represents the second largest value in the probability distribution.

[0108] If the probability distribution meets the two-level factor screening conditions, that is, This means that the data meets the conditions of the two-level factors and can be marked and the client data set can be expanded. The network element device then marks the gateway data to be marked to obtain the marked data. If the distribution probability does not meet the two-level factor screening conditions, the network element device will not mark it. This design of the marking mechanism can improve the credibility and discrimination of the marking results, and avoid incorrect marking interfering with the training of the local model, thereby affecting the global model.

[0109] The current anomaly detection models based on machine learning use machine learning related algorithms, such as support vector machines, random forests, neural networks, etc. to build models and perform anomaly detection. Compared with traditional statistical methods, such models can better handle complex multivariate problems, but they also require a large amount of data for training and the selection of appropriate features for modeling. The anomaly detection models based on deep learning use deep learning algorithms, such as convolutional neural networks, long short-term memory networks, etc., to build models and perform anomaly detection. Compared with machine learning algorithms, deep learning algorithms can automatically extract features and have better performance, but they require more computing resources and larger data sets for training.

[0110] To this end, this application constructs a Transformer-based local detection model, such as Figure 2BAs shown, the encoder module of the Transformer model has a strong feature extraction capability. Therefore, this application applies Transformer_encoder to the local detection model to extract the multi-scale features of the data. The Transformer_encoder module adopts a multi-head attention mechanism, which better captures the different relationships in the sequence by weighting the input sequence with different weights multiple times. After the activation value of each layer is normalized, the output is added to the input sequence using a residual connection, which helps to better transfer the gradient in training and slow down the gradient disappearance problem. Then, the extraction of local features is realized by a feedforward neural network (FFN), and the residual connection is applied again to add the output of FFN to the previous residual connection, which can effectively promote the transmission of information and the back propagation of gradients. Subsequently, the output of the model is subjected to a global average pooling operation, the purpose of which is to compress the information of the entire sequence and obtain a global feature representation. The use of global average pooling helps to reduce the number of parameters of the model, improve the generalization ability of the model, and retain important information in the input sequence. Finally, the fully connected layer uses a multi-layer perceptron (MLP) for classification, and further maps and extracts global features to generate the final model output and complete the classification task of sequence data. Therefore, by combining the attention mechanism, residual connection, and global average pooling of the Transformer algorithm encoder module, a deep learning model is constructed, which is suitable for feature learning and classification of sequence data and improves the accuracy of the local detection model.

[0111] 204. The network element device uses the labeled data and the gateway model parameters to train the local detection model, obtain the target gateway model parameters, calculate the gateway model accuracy of the trained local detection model, and compare the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, execute the following step 205; when the gateway model accuracy is greater than or equal to the gateway network element threshold, execute the following step 206.

[0112] In the embodiment of the present application, the network element device uses the labeled data and the gateway model parameters to train the local detection model to obtain the target gateway model parameters. Then, the network element device calculates the gateway model accuracy of the trained local detection model, obtains the gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy. For example, the gateway network element device calculates the gateway model accuracy of the local detection model according to the gateway network element threshold β g , which can filter out some local models that are useless or even detrimental to the global model. Therefore, in each round of training, the gateway network element device first calculates the detection accuracy of the local detection model. When the gateway model accuracy is less than the gateway network element threshold, the following step 205 is executed; when the gateway model accuracy is greater than or equal to the gateway network element threshold, the following step 206 is executed.

[0113] 205. When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed.

[0114] In the embodiment of the present application, when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed, that is, The gateway network element device will set the communication status to False, and the gateway network element device will suspend uploading model parameters to the master station.

[0115] 206. When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0116] In the embodiment of the present application, when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station. That is, when When Upload to the master station, where r is the round index and g is the gateway network element device index. This is the sample data of the gateway network element device in round r. It is the target gateway model parameter of the gateway network element device in round r. It is the gateway model accuracy of the r-round gateway network element device.

[0117] 207. If the network element device is a common network element device, obtain the common data to be marked and the local detection model, input the common data to be marked into the local detection model for marking, obtain marked common data, use the marked common data as marked data, and execute the following step 208.

[0118] In the embodiment of the present application, if the network element device is a common network element device, it obtains its own designated device location attribute, extracts the common model parameters from the global model parameters according to the designated device location attribute, and specifies the device location attribute as a common network element. Then, the network element device sets its own communication state to open, obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as marked data. It should be noted that the process of marking data for common network element devices is the same as the process of marking data for gateway network element devices.

[0119] 208. The network element device uses the labeled data and the common model parameters to train the local detection model, obtains the target common model parameters, calculates the common model accuracy of the trained local detection model, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, execute the following step 209; when the common model accuracy is greater than or equal to the common network element threshold, execute the following step 210.

[0120] In the embodiment of the present application, the network element device uses the labeled data and the common model parameters to train the local detection model, obtains the target common model parameters, calculates the common model accuracy of the trained local detection model, and compares the common network element threshold with the common model accuracy. c , which can filter out some local models that are useless or even detrimental to the global model. Therefore, in each round of training, the common network element device first calculates the detection accuracy of the local detection model. When the common model accuracy is less than the common network element threshold, the following step 209 is executed; when the common model accuracy is greater than or equal to the common network element threshold, the following step 210 is executed. It should be noted that the process of training the local detection model of the common network element device is the same as the process of training the local detection model of the gateway network element device.

[0121] 209. When the accuracy of the common model is less than the common network element threshold, the network element device sets its own communication state to closed.

[0122] In the embodiment of the present application, when the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed, that is, The common network element device will set the communication status to False, and the common network element device will suspend uploading model parameters to the master station.

[0123] 210. When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0124] In the embodiment of the present application, when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station. When Upload to the master station, where r is the round index and c is the common network element device index. It is the sample data of the common network element equipment in round r. It is the target common model parameter of the common network element equipment in round r. It is the common model accuracy of common network element equipment in round r.

[0125] 211. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model.

[0126] In an embodiment of the present application, the master station uses multiple parameter sets to train the global detection model to obtain a target global detection model.

[0127] 212. The master station determines the target global model parameters according to the target global detection model, sends the target global model parameters to multiple network element devices again, and uses multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until a preset training round is reached to obtain a specified global detection model.

[0128] In an embodiment of the present application, the master station receives parameter sets uploaded by multiple network element devices to obtain multiple parameter sets. Then, the master station extracts multiple marked gateway data and multiple marked common data from the multiple parameter sets based on the target global detection model, and calculates the multiple marked gateway data and the multiple marked common data respectively based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein the calculation formula is the following formula 2:

[0129] Formula 2:

[0130]

[0131] in, Indicates the tag gateway data. represents the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Indicates the common contribution rate.

[0132] Subsequently, the master station extracts multiple gateway model accuracies and multiple common model accuracies from multiple parameter sets based on the target global detection model, and respectively calculates the multiple gateway model accuracies and multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein the calculation formula is the following formula 3:

[0133] Formula 3:

[0134]

[0135] in, represents the gateway model accuracy, represents the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set.

[0136] Then, the master station calculates different aggregation parameters by combining the contribution rate, aggregation weight and model parameters. Specifically, the master station extracts multiple target gateway model parameters and multiple target common model parameters from multiple parameter sets based on the target global detection model, and calculates multiple target gateway model parameters and multiple target common model parameters based on the target global detection model to obtain the target global model parameters, wherein the calculation formula is the following formula 4:

[0137] Formula 4:

[0138] in, represents the target gateway model parameters, δ g Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the weight coefficient of common parameters, W r represents the target global model parameter, δ g ,δ c The weight coefficients specified based on expert experience when calculating the global model parameters for gateway network element devices and ordinary network element devices, δ g +δ c =1.

[0139] Finally, the master station obtains the preset training rounds, sends the target global model parameters to multiple network element devices again, and uses multiple new parameter sets fed back by multiple network element devices to train the target global detection model until the preset training rounds are reached to obtain the specified global detection model.

[0140] 213. The master station obtains the preset model accuracy, calculates the global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, execute the following step 214.

[0141] In an embodiment of the present application, the master station obtains the preset model accuracy, calculates the global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the following step 214 is executed.

[0142] 214. If the global model accuracy is greater than or equal to the preset model accuracy, the master station will designate the global detection model as the global security threat detection model, obtain business data, input the business data into the global security threat detection model for detection, and obtain the security threat detection result.

[0143] In an embodiment of the present application, if the global model accuracy is greater than or equal to the preset model accuracy, the master station will designate the global detection model as the global security threat detection model, obtain business data, and input the business data into the global security threat detection model for detection to obtain security threat detection results. The present application uses a federated learning method to allow multiple parties to aggregate the parameters of local threat detection models to achieve global threat detection model parameter updates or gradient updates, and learn in a collaborative manner without sharing data with a centralized server, thereby reducing communication while protecting privacy data, thereby achieving cross-domain device and cross-region collaborative security threat detection, and more comprehensively perceive threats from a global perspective.

[0144] Optionally, if the accuracy of the trained designated global detection model is 90% or above after expert judgment, the designated global detection model will be used as the global security threat detection model to monitor daily business data. In addition, the detected abnormal situation can be judged by experts to see whether it is in line with the business and whether it is a real abnormality. For wrong judgments, experts can give correct evaluation data as label data for subsequent model learning.

[0145] In summary, the schematic diagram of the architecture of a method for collaborative detection of security threats to optical transmission equipment proposed in an embodiment of the present application is as follows:

[0146] like Figure 2C As shown, the master station initiates initialization parameters to the gateway network element end and the general network element end. The gateway network element end receives the gateway network element parameters and updates its own model, then sets the threshold, filters the non-compliant local models of the gateway network element, and uploads the compliant gateway network element model parameters to the master station end. The general network element end receives the general network element parameters and updates its own model, then sets the threshold, filters the non-compliant local models of the general network element, and uploads the compliant general network element model parameters to the master station end. The master station end dynamically weights and aggregates the full model parameters according to the network elements with different attributes, and then the master station end sends the global model parameters updated in the nth round to all network element ends. Repeat the training until the expected requirements are met.

[0147] According to the method provided by the embodiment of the present application, the master station obtains global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through local detection models to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0148] Further, as Figure 1 In a specific implementation of the method, the present application provides a security threat detection device, such as Figure 3A As shown, the device includes: a transmission module 301, a first training module 302, a second training module 303 and a detection module 304.

[0149] A transmission module 301 is used for the master station to obtain global model parameters of the global detection model and send the global model parameters to multiple network element devices;

[0150] A first training module 302 is configured for each network element device to obtain labeled data, use the labeled data and the global model parameters to train a local detection model, use the labeled data, the trained local model parameters and the local model accuracy of the local detection model as a parameter set, and send the parameter set to the master station;

[0151] A second training module 303 is used for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model;

[0152] The detection module 304 is used for the master station to obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results.

[0153] In a specific application scenario, the first training module 302 is used for each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters; if the network element device is a gateway network element device, then obtain its own target device location attribute, extract the gateway model parameters from the global model parameters according to the target device location attribute, and the target device location attribute is a gateway network element; the network element device sets its own communication status to open; the network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; The network element device uses the label data and the gateway model parameters to train the local detection model, obtains the target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model; the network element device obtains the gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed; when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway label data as the parameter set of the network element device, and sends the parameter set to the master station.

[0154] In a specific application scenario, the first training module 302 is used to obtain its own designated device location attribute if the network element device is a common network element device, and extract the common model parameters from the global model parameters according to the designated device location attribute, and the designated device location attribute is a common network element; the network element device sets its own communication status to open; the network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data; the network element device uses the marked data and the common model parameters to train the local detection model to obtain target common model parameters, calculate the common model accuracy of the local detection model after training; the network element device obtains the common network element threshold, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, the network element device sets its own communication status to closed; when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0155] In a specific application scenario, the first training module 302 is used for the network element device to input the gateway data to be marked into the local detection model to obtain the logical value output by the local detection model; the network element device uses a normalization function to calculate the logical value to obtain a probability distribution; the network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution; if the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0156] In a specific application scenario, the first training module 302 is used for the network element device to determine the maximum value of the probability distribution and the second maximum value of the probability distribution according to the probability distribution; the network element device reads the category boundary value and the category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second maximum value of the probability distribution, wherein the two-level factor screening condition is:

[0157]

[0158] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, Pmax represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

[0159] In specific application scenarios, such as Figure 3B As shown, the device also includes: a third training module 305.

[0160] The third training module 305 is used for the master station to receive the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets; the master station extracts multiple marked gateway data and multiple marked common data from the multiple parameter sets based on the target global detection model, and calculates the multiple marked gateway data and the multiple marked common data respectively based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein,

[0161]

[0162] in, Indicates the tag gateway data. represents the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Represents a common contribution rate; the master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies respectively based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein,

[0163]

[0164] in, represents the gateway model accuracy, represents the gateway weight, represents the general model accuracy, represents the normal weight, E r represents a parameter set; the master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain the target global model parameters, wherein,

[0165]

[0166] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the weight coefficient of common parameters, W r Represents the target global model parameters; the master station obtains the preset training rounds, sends the target global model parameters to the multiple network element devices again, and uses the multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training rounds are reached to obtain the specified global detection model; the master station uses the specified global detection model as the global security threat detection model.

[0167] In a specific application scenario, the third training module 305 is used by the master station to obtain the preset model accuracy, calculate the global model accuracy of the specified global detection model, and compare the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the master station uses the specified global detection model as the global security threat detection model.

[0168] In the apparatus provided by the embodiment of the present application, the master station obtains global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through local detection models to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0169] It should be noted that for other corresponding descriptions of the functional units involved in the security threat detection device provided in the embodiment of the present application, reference can be made to Figure 1 and FIG. 2A to FIG. 2C The corresponding description in will not be repeated here.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0171] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0172] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

[0173] In an exemplary embodiment, see Figure 4 , and also provides a computer device, which includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device, wherein each functional unit can communicate with each other through the bus. The memory stores a computer program, and the processor is used to execute the program stored in the memory and execute the security threat detection method in the above embodiment.

[0174] A readable storage medium stores a computer program, which implements the steps of the security threat detection method when executed by a processor.

[0175] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0176] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required for implementing the present application.

[0177] Those skilled in the art will appreciate that the modules in the device in the implementation scenario can be distributed in the device in the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module, or can be further split into multiple sub-modules.

[0178] The above application serial numbers are for description only and do not represent the advantages or disadvantages of the implementation scenarios.

[0179] The above disclosure only discloses several specific implementation scenarios of the present application. However, the present application is not limited thereto, and any changes that can be conceived by technicians in this field should fall within the scope of protection of the present application.

Claims

1. A security threat detection method, characterized in that: include: The master station obtains global model parameters of the global detection model, and sends the global model parameters to multiple network element devices; Each of the network element devices acquires the labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station; The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model; The master station acquires business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results.

2. The method according to claim 1, characterized in that Each of the network element devices acquires the labeled data, uses the labeled data, the trained local model parameters and the local model accuracy of the local detection model as a parameter set, and sends the parameter set to the master station, including: For each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters; If the network element device is a gateway network element device, obtaining its own target device location attribute, extracting the gateway model parameter from the global model parameter according to the target device location attribute, the target device location attribute being a gateway network element; The network element device sets its own communication state to open; The network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; The network element device trains the local detection model using the label data and the gateway model parameters to obtain target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model; The network element device obtains a gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy; When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed; When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as a parameter set of the network element device, and sends the parameter set to the master station.

3. The method according to claim 2, characterized in that After the network element device receives the global model parameter, the method further includes: If the network element device is a common network element device, obtaining its own designated device location attribute, extracting the common model parameters from the global model parameters according to the designated device location attribute, the designated device location attribute being a common network element; The network element device sets its own communication state to open; The network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data; The network element device trains the local detection model using the marked data and the common model parameters to obtain target common model parameters, and calculates the common model accuracy of the trained local detection model; The network element device obtains a common network element threshold, and compares the common network element threshold with the common model accuracy; When the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed; When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

4. The method according to claim 2, characterized in that: The network element device acquires the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, and obtains the marked data, including: The network element device inputs the gateway data to be marked into the local detection model to obtain a logic value output by the local detection model; The network element device calculates the logic value using a normalization function to obtain a probability distribution; The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution; If the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

5. The method according to claim 4, characterized in that The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution, including: The network element device determines a maximum value of the probability distribution and a second maximum value of the probability distribution according to the probability distribution; The network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, wherein the two-level factor screening condition is: in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

6. The method according to claim 1, characterized in that The method further comprises: The master station receives the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets; The master station extracts multiple marked gateway data and multiple marked common data from the multiple parameter sets based on the target global detection model, and calculates the multiple marked gateway data and the multiple marked common data respectively based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein: in, Indicates the tag gateway data. represents the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. represents the ordinary contribution rate; The master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies respectively based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein: in, represents the gateway model accuracy, represents the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set; The master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters respectively based on the target global detection model to obtain target global model parameters, wherein: in, represents the target gateway model parameters, δ g Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the weight coefficient of common parameters, W r represents the target global model parameter; The master station obtains a preset training round, sends the target global model parameters to the multiple network element devices again, and uses multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training round is reached to obtain a specified global detection model; The master station uses the designated global detection model as the global security threat detection model.

7. The method according to claim 6, characterized in that The master station uses the specified global detection model as the global security threat detection model, including: The master station obtains a preset model accuracy, calculates a global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; If the global model accuracy is greater than or equal to the preset model accuracy, the master station uses the designated global detection model as the global security threat detection model.

8. A security threat detection device, characterized in that: include: A transmission module, used for the master station to obtain global model parameters of the global detection model and send the global model parameters to multiple network element devices; A first training module is used for each of the network element devices to obtain labeled data, use the labeled data and the global model parameters to train the local detection model, use the labeled data, the local model parameters of the trained local detection model and the local model accuracy as a parameter set, and send the parameter set to the master station; A second training module is used for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model; The detection module is used for the main station to obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images