Security threat detection method, device, computer equipment and readable storage medium

Abstract

The present application discloses a security threat detection method, apparatus, computer equipment and readable storage medium, which relate to the field of network security technology. A master station end can aggregate model parameters of local detection models of multiple network element devices to establish a global security threat detection model. A slave station end, i.e., multiple network element devices, uses labeled data to establish their own local detection models, and automatically labels unlabeled data through the local detection model to expand the data set, and uploads model parameters through the network management network to complete parameter transmission between the master station end and multiple network element devices, thereby realizing the update of global security threat detection model parameters without sharing data with a centralized server. While reducing communication, privacy data is protected, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and more comprehensively perceiving threats from a global perspective.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a security threat detection method, apparatus, computer equipment, and readable storage medium. Background Art

[0002] With the development of network technology, power systems are expanding and becoming more intelligent, leading to an increasing demand for security monitoring of optical transmission equipment. Optical transmission equipment will enable smarter network management and fault prediction, improving network reliability and service quality. However, due to the large number and widespread distribution of optical transmission equipment, and the current blind spots in monitoring, it is extremely vulnerable to malicious attacks.

[0003] In the related art, there are two types of security threat detection methods: one is centralized detection in the cloud, and the other relies on lightweight detection on the optical transmission equipment itself. However, the applicant recognizes that centralized detection in the cloud faces the risk of increased communication burden, reduced data confidentiality, and data privacy leakage. There is also the potential threat of attackers maliciously stealing communication data and tampering with measurement data. Relying on the optical transmission equipment itself for lightweight detection has limited computing resources, cannot achieve comprehensive detection of potential threats from a global perspective, and lacks global sensitivity to system security threats, all of which lead to low accuracy of security threat detection. Summary of the Invention

[0004] In view of this, the present application provides a security threat detection method, apparatus, computer equipment and readable storage medium, the main purpose of which is to solve the following problems: centralized detection in the cloud will face the risk of increased communication burden, reduced data confidentiality, and data privacy leakage, and there is also a potential threat of attackers maliciously stealing communication data and tampering with measurement data; the computing resources that rely on the optical transmission equipment itself for lightweight detection are limited, and it is impossible to achieve comprehensive detection of potential threats from a global perspective. The lack of global sensitivity to system security threats will lead to low accuracy of security threat detection.

[0005] According to the first aspect of the present application, a security threat detection method is provided, the method comprising:

[0006] The master station obtains global model parameters of the global detection model and sends the global model parameters to multiple network element devices;

[0007] Each of the network element devices acquires labeled data, uses the labeled data and the global model parameters to train a local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station;

[0008] The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model;

[0009] The master station acquires business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result.

[0010] Optionally, each of the network element devices obtains labeled data, uses the labeled data, the trained local model parameters and the local model accuracy of the local detection model as a parameter set, and sends the parameter set to the master station, including:

[0011] For each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters;

[0012] If the network element device is a gateway network element device, obtaining its own target device location attribute, extracting the gateway model parameter from the global model parameter according to the target device location attribute, the target device location attribute being a gateway network element;

[0013] The network element device sets its own communication state to open;

[0014] The network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data;

[0015] The network element device trains the local detection model using the labeled data and the gateway model parameters to obtain target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model;

[0016] The network element device obtains a gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy;

[0017] When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed;

[0018] When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0019] Optionally, after the network element device receives the global model parameters, the method further includes:

[0020] If the network element device is a common network element device, obtaining its own designated device location attribute, extracting the common model parameters from the global model parameters according to the designated device location attribute, the designated device location attribute being a common network element;

[0021] The network element device sets its own communication state to open;

[0022] The network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data;

[0023] The network element device trains the local detection model using the labeled data and the common model parameters to obtain target common model parameters, and calculates the common model accuracy of the trained local detection model;

[0024] The network element device obtains a common network element threshold, and compares the common network element threshold with the common model accuracy;

[0025] When the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed;

[0026] When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0027] Optionally, the network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, and obtains the marked data, including:

[0028] The network element device inputs the gateway data to be marked into the local detection model, and obtains a logical value output by the local detection model;

[0029] The network element device calculates the logic value using a normalization function to obtain a probability distribution;

[0030] The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution;

[0031] If the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0032] Optionally, the network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution, including:

[0033] The network element device determines a maximum value of the probability distribution and a second maximum value of the probability distribution according to the probability distribution;

[0034] The network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, wherein the two-level factor screening condition is:

[0035]

[0036] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max Represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

[0037] Optionally, the method further includes:

[0038] The master station receives the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets;

[0039] The master station extracts a plurality of labeled gateway data and a plurality of labeled ordinary data from the plurality of parameter sets based on the target global detection model, and calculates the plurality of labeled gateway data and the plurality of labeled ordinary data respectively based on the target global detection model to obtain a plurality of gateway contribution rates and a plurality of ordinary contribution rates, wherein:

[0040]

[0041] in, Indicates the tag gateway data, Indicates the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. represents the ordinary contribution rate;

[0042] The master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein,

[0043]

[0044] in, represents the gateway model accuracy, Indicates the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set;

[0045] The master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain target global model parameters, wherein,

[0046]

[0047] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the common parameter weight coefficient, W r represents the target global model parameters;

[0048] The master station obtains a preset training round, sends the target global model parameters to the multiple network element devices again, and trains the target global detection model using multiple new parameter sets fed back by the multiple network element devices until the preset training round is reached, thereby obtaining a specified global detection model;

[0049] The master station uses the designated global detection model as the global security threat detection model.

[0050] Optionally, the master station uses the designated global detection model as the global security threat detection model, including:

[0051] The master station obtains a preset model accuracy, calculates a global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy;

[0052] If the global model accuracy is greater than or equal to the preset model accuracy, the master station uses the designated global detection model as the global security threat detection model.

[0053] According to a second aspect of the present application, a security threat detection device is provided, the device comprising:

[0054] A transmission module, configured to obtain global model parameters of a global detection model at a master station end, and send the global model parameters to a plurality of network element devices;

[0055] A first training module is configured to obtain labeled data from each network element device, train a local detection model using the labeled data and the global model parameters, use the labeled data, the trained local model parameters of the local detection model, and the local model accuracy as a parameter set, and send the parameter set to the master station;

[0056] A second training module is configured for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model;

[0057] The detection module is used for the master station to obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results.

[0058] Optionally, the first training module is used for each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or an ordinary network element device, and the global model parameters include gateway model parameters and ordinary model parameters; if the network element device is a gateway network element device, then obtain its own target device location attribute, extract the gateway model parameters from the global model parameters according to the target device location attribute, and the target device location attribute is a gateway network element; the network element device sets its own communication status to open; the network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; the network element device The local detection model is trained using the label data and the gateway model parameters to obtain target gateway model parameters, and the gateway model accuracy of the trained local detection model is calculated; the network element device obtains a gateway network element threshold and compares the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication status to closed; when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway label data as a parameter set of the network element device, and sends the parameter set to the master station.

[0059] Optionally, the first training module is used to obtain its own designated device location attribute if the network element device is a common network element device, extract the common model parameters from the global model parameters according to the designated device location attribute, and the designated device location attribute is a common network element; the network element device sets its own communication state to open; the network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data; the network element device uses the marked data and the common model parameters to train the local detection model to obtain the target common data. model parameters, calculate the common model accuracy of the local detection model after training; the network element device obtains the common network element threshold, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, the network element device sets its own communication status to closed; when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0060] Optionally, the first training module is used for the network element device to input the gateway data to be marked into the local detection model to obtain the logical value output by the local detection model; the network element device uses a normalization function to calculate the logical value to obtain a probability distribution; the network element device obtains a two-level factor screening condition and uses the two-level factor screening condition to detect the probability distribution; if the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0061] Optionally, the first training module is configured to enable the network element device to determine a maximum value and a second maximum value of the probability distribution based on the probability distribution; the network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value and the second maximum value of the probability distribution, wherein the two-level factor screening condition is:

[0062]

[0063] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max Represents the maximum value of the probability distribution, P2th-max Represents the second largest value of the probability distribution.

[0064] Optionally, the device further comprises:

[0065] The third training module is used for the master station to receive the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets; the master station extracts multiple labeled gateway data and multiple labeled ordinary data from the multiple parameter sets based on the target global detection model, and calculates the multiple labeled gateway data and the multiple labeled ordinary data based on the target global detection model to obtain multiple gateway contribution rates and multiple ordinary contribution rates, wherein,

[0066]

[0067] in, Indicates the tag gateway data, Indicates the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Represents a common contribution rate; the master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein,

[0068]

[0069] in, represents the gateway model accuracy, Indicates the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set; the master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain target global model parameters, wherein,

[0070]

[0071] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the common parameter weight coefficient, W rRepresents the target global model parameters; the master station obtains the preset training rounds, sends the target global model parameters to the multiple network element devices again, and uses the multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training rounds are reached to obtain the specified global detection model; the master station uses the specified global detection model as the global security threat detection model.

[0072] Optionally, the third training module is used by the master station to obtain the preset model accuracy, calculate the global model accuracy of the specified global detection model, and compare the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the master station will use the specified global detection model as the global security threat detection model.

[0073] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0074] According to a fourth aspect of the present application, a readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0075] By means of the above technical solution, the present application provides a security threat detection method, device, computer equipment and readable storage medium, in which the master station obtains the global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains the labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model and the local model accuracy as a parameter set, and sends the parameter set to the master station, the master station uses multiple parameter sets to train the global detection model to obtain the target global detection model, and uses the target global detection model as the global security threat detection model, the master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains the security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through the local detection model to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0076] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0078] Figure 1 A schematic diagram of a security threat detection method provided in an embodiment of the present application is shown;

[0079] Figure 2A A schematic diagram of another method for detecting security threats provided by an embodiment of the present application is shown;

[0080] Figure 2B A schematic diagram of the architecture of a security threat detection model provided in an embodiment of the present application is shown;

[0081] Figure 2C A schematic diagram of the architecture of a method for collaboratively detecting security threats to optical transmission equipment provided by an embodiment of the present application is shown;

[0082] Figure 3A A schematic diagram of a security threat detection system according to an embodiment of the present invention is shown.

[0083] Figure 3B A schematic diagram of another security threat detection structure provided by an embodiment of the present application is shown;

[0084] Figure 4 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0085] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0086] The present invention provides a method for detecting security threats. Figure 1 As shown, the method includes:

[0087] 101. The master station obtains global model parameters of the global detection model and sends the global model parameters to multiple network element devices.

[0088] Due to the large number and widespread distribution of optical transmission equipment, as well as its presence in blind spots, it is highly vulnerable to malicious attacks. Therefore, existing security threat detection methods struggle to achieve real-time monitoring and security control of large numbers of optical transmission devices. Furthermore, traditional security threat detection methods struggle to effectively detect the widespread distribution of optical transmission equipment in power systems.

[0089] To address this issue, this application proposes a security threat detection method that combines semi-supervised federated learning and the Transformer deep learning model to perform collaborative security threat detection on optical transmission equipment. Since the federated learning method allows multiple parties to aggregate the parameters of local threat detection models to achieve global threat detection model parameter updates or gradient updates, learning is done in a collaborative manner without sharing data with a centralized server, thus reducing communication while protecting privacy data. Moreover, this method can achieve cross-domain device and cross-region collaborative security threat detection, and perceive threats more comprehensively from a global perspective. This application constructs a distributed master-slave collaborative detection system, including a master station end and a slave station end. The master station end is the optical transmission network management system service end, and the slave station end is the network element end and the network management communication network. The master-slave collaborative detection system relies on the computing power of the server to provide services to users. The server can be an independent server, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), as well as basic cloud computing servers such as big data and artificial intelligence platforms, so that the master-slave collaborative detection system can achieve global optimization of the security threat detection model in the scenario of distributed network topology.

[0090] In an embodiment of the present application, the master station end obtains the global model parameters of the global detection model and sends the global model parameters to multiple network element devices, wherein the master station end is the optical transmission network management system service end, the slave station end is the network element end and the network management communication network, the network element end includes multiple network element devices, and the network element device is a gateway network element device or an ordinary network element device.

[0091] 102. Each network element device obtains the labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station.

[0092] In an embodiment of the present application, each network element device obtains labeled data, uses the labeled data and global model parameters to train the local detection model, and then uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. When the network element device is a gateway network element device, the labeled data is labeled gateway data. It should be noted that federated learning is a machine learning paradigm that allows multiple clients to cooperate with each other under the coordination of a central server. Even when the data is scattered across the clients, a complete machine learning model can be obtained. Therefore, through federated learning, there is no need to share data with a centralized server, which reduces communication while protecting privacy data.

[0093] 103. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model.

[0094] In an embodiment of the present application, the master station uses multiple parameter sets to train a global detection model to obtain a target global detection model, and uses the target global detection model as the global security threat detection model. In this way, the master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave stations, i.e., multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data using the local detection models to expand the data set. The model parameters are uploaded through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby achieving the update of the parameters of the global security threat detection model.

[0095] 104. The main station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results.

[0096] In an embodiment of the present application, after the master station trains the global security threat detection model, it can obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results. In the scenario of distributed network topology, it can achieve global optimization of the security threat detection model and improve the accuracy of the security threat detection model.

[0097] According to the method provided in the embodiment of the present application, the master station obtains the global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through the local detection model to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0098] Furthermore, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, the embodiment of the present application provides another security threat detection method, such as Figure 2A As shown, the method includes:

[0099] 201. The master station obtains global model parameters of a global detection model and sends the global model parameters to multiple network element devices.

[0100] In an embodiment of the present application, the master station obtains global model parameters of the global detection model and sends the global model parameters to multiple network element devices.

[0101] 202. For each network element device, the network element device receives global model parameters; if the network element device is a gateway network element device, execute the following step 203; if the network element device is a common network element device, execute the following step 207.

[0102] In an embodiment of the present application, for each network element device, the network element device receives global model parameters, wherein, according to the different network locations of the network element devices, the network element devices are currently divided into gateway network element devices and ordinary network element devices, and the global model parameters include gateway model parameters and ordinary model parameters; if the network element device is a gateway network element device, execute the following step 203; if the network element device is an ordinary network element device, execute the following step 207.

[0103] 203. If the network element device is a gateway network element device, obtain the gateway data to be marked and the local detection model, input the gateway data to be marked into the local detection model for marking, obtain marked gateway data, use the marked gateway data as marked data, and execute the following step 204.

[0104] In an embodiment of the present application, the global model parameters issued by the master station are differentiated according to the network node position of the network element device, and the network element device selects the model parameters that conform to itself according to its own device location attributes. If the network element device is a gateway network element device, it obtains its own target device location attributes, and extracts the gateway model parameters from the global model parameters according to the target device location attributes, wherein the target device location attributes are gateway network elements. Next, the network element device sets its own communication status to open, and obtains the gateway data to be marked and the local detection model. Subsequently, the network element device inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as marked data. Among them, the data to be marked can be power dispatching data. It should be noted that the power dispatching data network is a dedicated wide area data network for power dispatching production services. It is an infrastructure for real-time and quasi-real-time data communications such as computer monitoring systems between power dispatching production departments and between power dispatching production departments and power plants and substations. Since power dispatching data mainly transmits grid automation information, dispatching command instructions, relay protection and safety automatic device control information, etc., it belongs to the power industrial control system data and needs to have the characteristics of small data volume, strong real-time performance and high reliability. Therefore, the flow monitoring of the optical transmission equipment that carries its business must also meet the characteristics of strong real-time performance and high analytical capabilities.

[0105] Specifically, the network element device inputs the gateway data to be marked into the local detection model, obtains the logical value output by the local detection model, that is, outputs the logits value of the threat classification through the fully connected layer of the local detection model. Next, the network element device uses a normalization function to calculate the logical value to obtain a probability distribution, that is, the logits value is mapped to the interval [0, 1] through a softmax function to obtain the probability distribution of each category. The network element device determines the maximum value of the probability distribution and the second largest value of the probability distribution based on the probability distribution. Subsequently, the network element device obtains a two-level factor screening condition, and reads the category boundary value and the category difference value in the two-level factor screening condition. This application does not directly use the category of the maximum value of the probability distribution as a label, but designs a two-level factor to label the data set. One factor is the category boundary value, which is used to ensure the reliability of the marking result; the other factor is the category difference value, which is used to distinguish the differences between different categories. Then, the network element device uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, where the two-level factor screening condition is the following formula 1:

[0106] Formula 1:

[0107] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max Represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

[0108] If the probability distribution meets the two-level factor screening conditions, that is, This indicates that the data meets the two-level factor criteria and can be labeled to expand the client dataset. The network element then labels the gateway data to be labeled, generating labeled data. If the distribution probability does not meet the two-level factor screening criteria, the network element does not label it. This designed labeling mechanism improves the reliability and discrimination of the labeling results, preventing incorrect labeling from interfering with local model training and, in turn, affecting the global model.

[0109] Current machine learning-based anomaly detection models use machine learning algorithms, such as support vector machines, random forests, and neural networks, to build models and perform anomaly detection. Compared to traditional statistical methods, these models can better handle complex multivariate problems, but they also require large amounts of data for training and the selection of appropriate features for modeling. Deep learning-based anomaly detection models use deep learning algorithms, such as convolutional neural networks and long short-term memory networks, to build models and perform anomaly detection. Compared to machine learning algorithms, deep learning algorithms can automatically extract features and have better performance, but they require more computing resources and larger datasets for training.

[0110] To this end, this application constructs a local detection model based on Transformer, such as Figure 2BAs shown, the encoder module of the Transformer model has a strong feature extraction capability. Therefore, this application applies Transformer_encoder to the local detection model to extract the multi-scale features of the data. The Transformer_encoder module adopts a multi-head attention mechanism to better capture the different relationships in the sequence by weighting the input sequence multiple times with different weights. After the activation values of each layer are normalized, the output is added to the input sequence using a residual connection, which helps to better transfer the gradient during training and slow down the gradient disappearance problem. Then, the extraction of local features is achieved through a feedforward neural network (FFN), and the residual connection is applied again to add the output of the FFN to the previous residual connection, which can effectively promote the transmission of information and the back propagation of the gradient. Subsequently, a global average pooling operation is performed on the output of the model, the purpose of which is to compress the information of the entire sequence and obtain a global feature representation. The use of global average pooling helps to reduce the number of parameters of the model, improve the generalization ability of the model, and retain important information in the input sequence. Finally, the fully connected layer uses a multi-layer perceptron (MLP) for classification, further mapping and extracting global features to generate the final model output and complete the task of classifying sequence data. Therefore, by combining the attention mechanism, residual connections, and global average pooling techniques of the Transformer algorithm's encoder module, a deep learning model is constructed that is suitable for feature learning and classification of sequence data, improving the accuracy of local detection models.

[0111] 204. The network element device uses the labeled data and the gateway model parameters to train the local detection model, obtains the target gateway model parameters, calculates the gateway model accuracy of the trained local detection model, and compares the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, execute the following step 205; when the gateway model accuracy is greater than or equal to the gateway network element threshold, execute the following step 206.

[0112] In the embodiment of the present application, the network element device uses the labeled data and the gateway model parameters to train the local detection model to obtain the target gateway model parameters. Then, the network element device calculates the gateway model accuracy of the trained local detection model, obtains the gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy. For example, the gateway network element device calculates the gateway model accuracy based on the gateway network element threshold β. g , which can filter out some local models that are useless or even detrimental to the global model. Therefore, in each round of training, the gateway network element device first calculates the detection accuracy of the local detection model. If the gateway model accuracy is less than the gateway network element threshold, step 205 is executed. If the gateway model accuracy is greater than or equal to the gateway network element threshold, step 206 is executed.

[0113] 205. When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed.

[0114] In the embodiment of the present application, when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed, that is, The gateway network element device will set the communication status to False, and the gateway network element device will suspend uploading model parameters to the master station.

[0115] 206. When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0116] In the embodiment of the present application, when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station. That is, when When the parameter set Upload to the master station, where r is the round index and g is the gateway network element device index. This is the sample data of the gateway network element device in round r. It is the target gateway model parameter of the gateway network element device in round r. It is the gateway model accuracy of the gateway network element device in round r.

[0117] 207. If the network element device is a common network element device, obtain the common data to be marked and the local detection model, input the common data to be marked into the local detection model for marking, obtain marked common data, use the marked common data as marked data, and execute the following step 208.

[0118] In this embodiment of the present application, if the network element device is a common network element device, it obtains its own designated device location attributes, extracts common model parameters from the global model parameters based on the designated device location attributes, and specifies the device location attributes as common network elements. The network element device then sets its communication state to open, obtains common data to be marked and a local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as marked data. It should be noted that the process for marking data for common network element devices is the same as that for gateway network element devices.

[0119] 208. The network element device uses the labeled data and the common model parameters to train the local detection model, obtains the target common model parameters, calculates the common model accuracy of the trained local detection model, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, execute the following step 209; when the common model accuracy is greater than or equal to the common network element threshold, execute the following step 210.

[0120] In the embodiment of the present application, the network element device uses the labeled data and the common model parameters to train the local detection model, obtains the target common model parameters, calculates the common model accuracy of the trained local detection model, and compares the common network element threshold with the common model accuracy. For example, the common network element device uses the common network element threshold β c , which can filter out local models that are useless or even detrimental to the global model. Therefore, in each round of training, the standard network element device first calculates the detection accuracy of the local detection model. When the standard model accuracy is less than the standard network element threshold, step 209 is executed; when the standard model accuracy is greater than or equal to the standard network element threshold, step 210 is executed. It should be noted that the process of training a local detection model for a standard network element device is the same as that for a gateway network element device.

[0121] 209. When the accuracy of the common model is less than the common network element threshold, the network element device sets its own communication state to closed.

[0122] In the embodiment of the present application, when the accuracy of the common model is less than the common network element threshold, the network element device sets its own communication state to be closed, that is, The common network element device will set the communication status to False, and the common network element device will suspend uploading model parameters to the master station.

[0123] 210. When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0124] In the embodiment of the present application, when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, local model parameters, and gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station. That is, when When the parameter set Upload to the master station, where r is the round index and c is the common network element device index. This is the sample data of the common network element equipment in round r. It is the target common model parameter of common network element equipment in round r. It is the common model accuracy of common network element equipment in round r.

[0125] 211. The master station uses multiple parameter sets to train the global detection model to obtain the target global detection model.

[0126] In an embodiment of the present application, the master station uses multiple parameter sets to train the global detection model to obtain a target global detection model.

[0127] 212. The master station determines target global model parameters based on the target global detection model, sends the target global model parameters to multiple network element devices again, and uses multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until a preset training round is reached to obtain a specified global detection model.

[0128] In an embodiment of the present application, the master station receives parameter sets uploaded by multiple network element devices to obtain multiple parameter sets. Then, the master station extracts multiple labeled gateway data and multiple labeled common data from the multiple parameter sets based on the target global detection model, and calculates the multiple labeled gateway data and the multiple labeled common data based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein the calculation formula is the following formula 2:

[0129] Formula 2:

[0130]

[0131] in, Indicates the tag gateway data, Indicates the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Indicates the normal contribution rate.

[0132] Subsequently, the master station extracts multiple gateway model accuracies and multiple common model accuracies from multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein the calculation formula is the following formula 3:

[0133] Formula 3:

[0134]

[0135] in, represents the gateway model accuracy, Indicates the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set.

[0136] Then, the master station calculates different aggregation parameters based on the contribution rate, aggregation weight, and model parameters. Specifically, the master station extracts multiple target gateway model parameters and multiple target common model parameters from multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and multiple target common model parameters based on the target global detection model to obtain the target global model parameters, where the calculation formula is the following formula 4:

[0137] Formula 4:

[0138] in, represents the target gateway model parameters, δ g Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the common parameter weight coefficient, W r represents the target global model parameters, δ g ,δ c The weight coefficients specified by expert experience when calculating global model parameters for gateway network element devices and ordinary network element devices, δ g +δ c =1.

[0139] Finally, the master station obtains the preset training rounds, sends the target global model parameters to multiple network element devices again, and uses multiple new parameter sets fed back by multiple network element devices to train the target global detection model until the preset training rounds are reached and the specified global detection model is obtained.

[0140] 213. The master station obtains the preset model accuracy, calculates the global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, execute the following step 214.

[0141] In an embodiment of the present application, the master station obtains the preset model accuracy, calculates the global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the following step 214 is executed.

[0142] 214. If the global model accuracy is greater than or equal to the preset model accuracy, the master station will designate the global detection model as the global security threat detection model, obtain business data, input the business data into the global security threat detection model for detection, and obtain the security threat detection results.

[0143] In an embodiment of the present application, if the global model accuracy is greater than or equal to the preset model accuracy, the master station will designate the global detection model as the global security threat detection model, obtain business data, and input the business data into the global security threat detection model for detection to obtain security threat detection results. This application uses a federated learning method to allow multiple parties to aggregate the parameters of local threat detection models to achieve global threat detection model parameter updates or gradient updates, and learn in a collaborative manner without sharing data with a centralized server. This reduces communication while protecting privacy data, thereby achieving cross-domain device and cross-region collaborative security threat detection, and more comprehensively perceives threats from a global perspective.

[0144] Optionally, if a trained global detection model achieves an accuracy of 90% or higher after expert judgment, it will be used as the global security threat detection model for monitoring daily business data. Furthermore, detected anomalies can be judged by experts to determine if they are consistent with business requirements and true anomalies. For incorrect judgments, experts can provide corrected data as labeled data for subsequent model training.

[0145] In summary, the schematic diagram of the architecture of a collaborative detection method for security threats to optical transmission equipment proposed in an embodiment of the present application is as follows:

[0146] like Figure 2C As shown, the master station initiates parameter initialization to the gateway network element (NE) and general NEs. The gateway NE receives the NE parameters and updates its own model. It then sets a threshold to filter out non-compliant local NE models and uploads the compliant NE model parameters to the master station. General NEs receive the general NE parameters and update their own models. It then sets a threshold to filter out non-compliant local NE models and uploads the compliant general NE model parameters to the master station. The master station dynamically weights and aggregates all model parameters based on NE attributes. The master station then sends the updated global model parameters for the nth round to all NEs. Training is repeated until the desired performance is achieved.

[0147] According to the method provided in the embodiment of the present application, the master station obtains the global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains security threat detection results. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through the local detection model to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0148] Further, as Figure 1 In a specific implementation of the method, the present application provides a security threat detection device, such as Figure 3A As shown, the apparatus includes: a transmission module 301 , a first training module 302 , a second training module 303 and a detection module 304 .

[0149] A transmission module 301 is configured to obtain, at a master station, global model parameters of a global detection model and send the global model parameters to multiple network element devices;

[0150] A first training module 302 is configured to obtain labeled data from each network element device, train a local detection model using the labeled data and the global model parameters, use the labeled data, the trained local model parameters of the local detection model, and the local model accuracy as a parameter set, and send the parameter set to the master station;

[0151] A second training module 303 is configured for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model;

[0152] The detection module 304 is configured to obtain service data from the master station, input the service data into the global security threat detection model for detection, and obtain security threat detection results.

[0153] In a specific application scenario, the first training module 302 is used for each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or an ordinary network element device, and the global model parameters include gateway model parameters and ordinary model parameters; if the network element device is a gateway network element device, then the target device location attribute of the network element device is obtained, and the gateway model parameters are extracted from the global model parameters according to the target device location attribute, and the target device location attribute is a gateway network element; the network element device sets its own communication status to open; the network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; the The network element device uses the label data and the gateway model parameters to train the local detection model, obtains the target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model; the network element device obtains the gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy; when the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication status to closed; when the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway label data as the parameter set of the network element device, and sends the parameter set to the master station.

[0154] In a specific application scenario, the first training module 302 is used to obtain its own designated device location attribute if the network element device is an ordinary network element device, and extract the ordinary model parameters from the global model parameters according to the designated device location attribute, and the designated device location attribute is an ordinary network element; the network element device sets its own communication status to open; the network element device obtains the ordinary data to be marked and the local detection model, inputs the ordinary data to be marked into the local detection model for marking, obtains marked ordinary data, and uses the marked ordinary data as the marked data; the network element device uses the marked data and the ordinary model parameters to train the local detection model, and obtains target common model parameters, calculate the common model accuracy of the trained local detection model; the network element device obtains the common network element threshold, and compares the common network element threshold with the common model accuracy; when the common model accuracy is less than the common network element threshold, the network element device sets its own communication status to closed; when the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

[0155] In a specific application scenario, the first training module 302 is used for the network element device to input the gateway data to be marked into the local detection model to obtain the logical value output by the local detection model; the network element device uses a normalization function to calculate the logical value to obtain a probability distribution; the network element device obtains a two-level factor screening condition and uses the two-level factor screening condition to detect the probability distribution; if the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

[0156] In a specific application scenario, the first training module 302 is configured for the network element device to determine a maximum value and a second maximum value of the probability distribution based on the probability distribution; the network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value and the second maximum value of the probability distribution, wherein the two-level factor screening condition is:

[0157]

[0158] in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, Pmax Represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

[0159] In specific application scenarios, such as Figure 3B As shown, the device further includes: a third training module 305.

[0160] The third training module 305 is configured for the master station to receive the parameter sets uploaded by the multiple network element devices and obtain the multiple parameter sets; the master station extracts multiple labeled gateway data and multiple labeled common data from the multiple parameter sets based on the target global detection model, and calculates the multiple labeled gateway data and the multiple labeled common data based on the target global detection model to obtain multiple gateway contribution rates and multiple common contribution rates, wherein:

[0161]

[0162] in, Indicates the tag gateway data, Indicates the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. Represents a common contribution rate; the master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein,

[0163]

[0164] in, represents the gateway model accuracy, Indicates the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set; the master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain target global model parameters, wherein,

[0165]

[0166] in, represents the target gateway model parameters, δ h Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the common parameter weight coefficient, W r Represents the target global model parameters; the master station obtains the preset training rounds, sends the target global model parameters to the multiple network element devices again, and uses the multiple new parameter sets fed back by the multiple network element devices to train the target global detection model until the preset training rounds are reached to obtain the specified global detection model; the master station uses the specified global detection model as the global security threat detection model.

[0167] In a specific application scenario, the third training module 305 is used by the master station to obtain the preset model accuracy, calculate the global model accuracy of the specified global detection model, and compare the preset model accuracy with the global model accuracy; if the global model accuracy is greater than or equal to the preset model accuracy, the master station will use the specified global detection model as the global security threat detection model.

[0168] In the apparatus provided by the embodiment of the present application, the master station obtains global model parameters of the global detection model, sends the global model parameters to multiple network element devices, each network element device obtains labeled data, uses the labeled data and the global model parameters to train the local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station. The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model. The master station obtains business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result. The master station can aggregate the model parameters of the local detection models of multiple network element devices to establish a global security threat detection model. The slave station, that is, multiple network element devices, use labeled data to establish their own local detection models, and automatically label unlabeled data through the local detection model to expand the data set, and upload model parameters through the network management network to complete the parameter transmission between the master station and multiple network element devices, thereby realizing the update of global security threat detection model parameters. There is no need to share data with a centralized server, which protects privacy data while reducing communication, thereby realizing cross-domain device and cross-regional collaborative security threat detection, and perceiving threats more comprehensively from a global perspective.

[0169] It should be noted that for other corresponding descriptions of the functional units involved in the security threat detection device provided in the embodiment of the present application, please refer to Figure 1 and Figures 2A to 2C The corresponding description in will not be repeated here.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0171] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0172] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

[0173] In an exemplary embodiment, see Figure 4 A computer device is also provided. The computer device includes a bus, a processor, a memory, and a communication interface. It may also include an input / output interface and a display device. The various functional units can communicate with each other via the bus. The memory stores a computer program, and the processor is configured to execute the program stored in the memory and perform the security threat detection method in the above-described embodiment.

[0174] A readable storage medium stores a computer program, which implements the steps of the security threat detection method when executed by a processor.

[0175] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented through hardware or by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0176] Those skilled in the art will understand that the accompanying drawings are only schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required to implement the present application.

[0177] Those skilled in the art will appreciate that the modules in the devices in the implementation scenario can be distributed in the devices of the implementation scenario according to the implementation scenario description, or can be modified accordingly and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module or further split into multiple submodules.

[0178] The above application serial numbers are for description only and do not represent the advantages or disadvantages of the implementation scenarios.

[0179] The above disclosure only describes several specific implementation scenarios of the present application. However, the present application is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the scope of protection of the present application.

Claims

1. A security threat detection method, characterized in that: include: The master station obtains global model parameters of the global detection model and sends the global model parameters to multiple network element devices; Each of the network element devices acquires labeled data, uses the labeled data and the global model parameters to train a local detection model, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station; The master station uses multiple parameter sets to train the global detection model to obtain a target global detection model, and uses the target global detection model as a global security threat detection model; The master station acquires business data, inputs the business data into the global security threat detection model for detection, and obtains a security threat detection result.

2. The method according to claim 1, characterized in that Each of the network element devices obtains the labeled data, uses the labeled data, the local model parameters of the trained local detection model, and the local model accuracy as a parameter set, and sends the parameter set to the master station, including: For each of the network element devices, the network element device receives the global model parameters, the network element device is a gateway network element device or a common network element device, and the global model parameters include gateway model parameters and common model parameters; If the network element device is a gateway network element device, obtaining its own target device location attribute, extracting the gateway model parameter from the global model parameter according to the target device location attribute, the target device location attribute being a gateway network element; The network element device sets its own communication state to open; The network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, obtains marked gateway data, and uses the marked gateway data as the marked data; The network element device trains the local detection model using the labeled data and the gateway model parameters to obtain target gateway model parameters, and calculates the gateway model accuracy of the trained local detection model; The network element device obtains a gateway network element threshold, and compares the gateway network element threshold with the gateway model accuracy; When the gateway model accuracy is less than the gateway network element threshold, the network element device sets its own communication state to closed; When the gateway model accuracy is greater than or equal to the gateway network element threshold, the network element device uses the gateway model accuracy as the local model accuracy, the target gateway model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

3. The method according to claim 2, characterized in that After the network element device receives the global model parameters, the method further includes: If the network element device is a common network element device, obtaining its own designated device location attribute, extracting the common model parameters from the global model parameters according to the designated device location attribute, the designated device location attribute being a common network element; The network element device sets its own communication state to open; The network element device obtains the common data to be marked and the local detection model, inputs the common data to be marked into the local detection model for marking, obtains marked common data, and uses the marked common data as the marked data; The network element device trains the local detection model using the labeled data and the common model parameters to obtain target common model parameters, and calculates the common model accuracy of the trained local detection model; The network element device obtains a common network element threshold, and compares the common network element threshold with the common model accuracy; When the common model accuracy is less than the common network element threshold, the network element device sets its own communication state to closed; When the common model accuracy is greater than or equal to the common network element threshold, the network element device uses the common model accuracy as the local model accuracy, the target common model parameters as the local model parameters, and the local model accuracy, the local model parameters, and the gateway tag data as the parameter set of the network element device, and sends the parameter set to the master station.

4. The method according to claim 2, characterized in that The network element device obtains the gateway data to be marked and the local detection model, inputs the gateway data to be marked into the local detection model for marking, and obtains the marked data, including: The network element device inputs the gateway data to be marked into the local detection model, and obtains a logic value output by the local detection model; The network element device calculates the logic value using a normalization function to obtain a probability distribution; The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution; If the probability distribution meets the two-level factor screening condition, the network element device marks the gateway data to be marked to obtain the marked data.

5. The method according to claim 4, characterized in that The network element device obtains a two-level factor screening condition, and uses the two-level factor screening condition to detect the probability distribution, including: The network element device determines a maximum value of the probability distribution and a second maximum value of the probability distribution according to the probability distribution; The network element device reads a category boundary value and a category difference value in the two-level factor screening condition, and uses the category boundary value and the category difference value to detect the maximum value of the probability distribution and the second largest value of the probability distribution, wherein the two-level factor screening condition is: in, represents the two-level factor screening condition, θ represents the category boundary value, represents the category difference value, P max Represents the maximum value of the probability distribution, P 2th-max Represents the second largest value of the probability distribution.

6. The method according to claim 1, characterized in that The method further comprises: The master station receives the parameter sets uploaded by the multiple network element devices to obtain the multiple parameter sets; The master station extracts a plurality of labeled gateway data and a plurality of labeled ordinary data from the plurality of parameter sets based on the target global detection model, and calculates the plurality of labeled gateway data and the plurality of labeled ordinary data respectively based on the target global detection model to obtain a plurality of gateway contribution rates and a plurality of ordinary contribution rates, wherein: in, Indicates the tag gateway data, Indicates the gateway contribution rate, E r Represents a parameter set, Indicates marking of normal data. represents the ordinary contribution rate; The master station extracts multiple gateway model accuracies and multiple common model accuracies from the multiple parameter sets based on the target global detection model, and calculates the multiple gateway model accuracies and the multiple common model accuracies based on the target global detection model to obtain multiple gateway weights and multiple common weights, wherein, in, represents the gateway model accuracy, Indicates the gateway weight, represents the general model accuracy, represents the normal weight, E r Represents a parameter set; The master station extracts multiple target gateway model parameters and multiple target common model parameters from the multiple parameter sets based on the target global detection model, and calculates the multiple target gateway model parameters and the multiple target common model parameters based on the target global detection model to obtain target global model parameters, wherein, in, represents the target gateway model parameters, δ g Indicates the gateway parameter weight coefficient, represents the target common model parameters, δ c Represents the common parameter weight coefficient, W r represents the target global model parameters; The master station obtains a preset training round, sends the target global model parameters to the multiple network element devices again, and trains the target global detection model using multiple new parameter sets fed back by the multiple network element devices until the preset training round is reached, thereby obtaining a specified global detection model; The master station uses the designated global detection model as the global security threat detection model.

7. The method according to claim 6, characterized in that The master station uses the designated global detection model as the global security threat detection model, including: The master station obtains a preset model accuracy, calculates a global model accuracy of the specified global detection model, and compares the preset model accuracy with the global model accuracy; If the global model accuracy is greater than or equal to the preset model accuracy, the master station uses the designated global detection model as the global security threat detection model.

8. A security threat detection device, characterized in that: include: A transmission module, configured to obtain global model parameters of a global detection model at a master station end, and send the global model parameters to a plurality of network element devices; A first training module is configured to obtain labeled data from each network element device, train a local detection model using the labeled data and the global model parameters, use the labeled data, the trained local model parameters of the local detection model, and the local model accuracy as a parameter set, and send the parameter set to the master station; A second training module is configured for the master station to train the global detection model using the parameter set to obtain a target global detection model, and use the target global detection model as a global security threat detection model; The detection module is used for the master station to obtain business data, input the business data into the global security threat detection model for detection, and obtain security threat detection results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images