Operation security analysis method and device of edge computing gateway, equipment and medium

Abstract

The invention provides an edge computing gateway operation security analysis method and device, equipment and a medium, and relates to the technical field of artificial intelligence. In the application, firstly, target traffic data of a target edge computing gateway are acquired; secondly, performing semantic mining on the target traffic data by using a semantic mining model in a target operation security analysis network, and outputting corresponding global traffic features, first local traffic features and second local traffic features; and then, by using a semantic analysis model, performing operation security analysis on the global traffic feature, the first local traffic feature and the second local traffic feature, and outputting a target operation security analysis result corresponding to the target edge computing gateway. Based on the content, the problem that in the prior art, the reliability of operation safety analysis is relatively low can be solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to an edge computing gateway operation security analysis method and apparatus, equipment, and medium. Background Art

[0002] With the rapid development of the Internet of Things (IoT), cloud computing, and artificial intelligence (AI) technologies, edge computing has gradually become an important computing architecture. By transferring data processing from traditional data centers to places closer to the data source, edge computing can achieve low latency, high bandwidth, and real-time services, and can also reduce the load pressure on the cloud. However, with the popularization of edge computing applications, how to ensure the security of edge computing gateways has become an important issue that needs to be solved urgently.

[0003] Among them, the edge computing gateway, as a bridge connecting edge devices with the cloud or data center, undertakes key functions such as data collection, storage, processing and transmission. Since the edge computing environment usually involves multiple devices, application scenarios and complex network topology, its operation security faces many threats such as malicious attacks, network intrusions, and data leakage. Therefore, security analysis of edge computing gateways is crucial, especially in terms of traffic monitoring and anomaly detection. For example, DDoS (Distributed Denial of Service) attacks are a common network attack method, the purpose of which is to overload the target system or network resources, causing legitimate users to be unable to access, thereby causing service interruption. However, in the prior art, the security analysis methods of edge computing gateways mostly focus on static analysis or rule-based detection, which is difficult to cope with complex attack patterns and dynamically changing network environments. For example, within a certain period of time, the number of requests from a certain IP segment surges, and the request target port is consistent. If the number of requests exceeds the threshold, it is considered to be a network intrusion. In this way, simple threshold comparison is difficult to reliably realize the judgment of network intrusion. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide an operation safety analysis method and device, equipment and medium for an edge computing gateway, so as to improve the problem of relatively low reliability of operation safety analysis existing in the prior art.

[0005] To achieve the above purpose, this application adopts the following technical solutions:

[0006] A method for analyzing the operation security of an edge computing gateway, comprising:

[0007] Obtain the target traffic data of the target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution situation is at least used to characterize the source IP, target port, traffic size, and number of requests;

[0008] Use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the target traffic data;

[0009] Use the semantic analysis model to perform operation security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and output the target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

[0010] In a preferred selection of this application, in the above operation security analysis method of the edge computing gateway, the step of using the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature includes:

[0011] Use the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the global traffic feature corresponding to the target traffic data;

[0012] Use the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the first local traffic feature corresponding to the target traffic data;

[0013] Use the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the second local traffic feature corresponding to the target traffic data.

[0014] In a preferred selection of this application, in the above operation security analysis method of the edge computing gateway, the step of using the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the global traffic feature corresponding to the target traffic data includes:

[0015] Load the target traffic data into the first mining branch included in the semantic mining model in the target operation security analysis network;

[0016] Perform embedding processing on the target traffic data to form traffic embedding features corresponding to the target traffic data, and perform self-attention processing on the traffic embedding features to form traffic attention features corresponding to the target traffic data;

[0017] Based on the traffic embedding features, perform gradient optimization processing on the traffic attention features to form global traffic features corresponding to the target traffic data.

[0018] In a preferred selection of the present application, in the above-mentioned operation security analysis method of the edge computing gateway, the step of using the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the first local traffic features corresponding to the target traffic data includes:

[0019] Based on the distribution of traffic sizes in the target traffic data, construct a traffic size distribution matrix corresponding to the target traffic data. Among them, in the traffic size distribution matrix, the traffic size data in the same row is used to reflect the traffic sizes of each data packet of the same source IP;

[0020] Perform parameter mapping processing on the traffic size distribution matrix so that each parameter in the traffic size distribution matrix is mapped to a target interval to form a corresponding traffic size mapping matrix;

[0021] Load the traffic size mapping matrix into the second mining branch included in the semantic mining model;

[0022] Perform convolution processing on the traffic size mapping matrix to form traffic size convolution features corresponding to the traffic size mapping matrix, and perform self-attention processing on the traffic size convolution features to form traffic size attention features corresponding to the traffic size convolution features;

[0023] Based on the traffic size convolution features, perform gradient optimization processing on the traffic size attention features to form the first local traffic features corresponding to the target traffic data.

[0024] In a preferred selection of the present application, in the above-mentioned operation security analysis method of the edge computing gateway, the step of using the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the second local traffic features corresponding to the target traffic data includes:

[0025] Based on the distribution of the request times in the target traffic data, a request times distribution matrix corresponding to the target traffic data is constructed. Among them, in the request times distribution matrix, any request times data is used to reflect the difference in the request times between two source IPs;

[0026] Perform parameter mapping processing on the request times distribution matrix so that each parameter in the request times distribution matrix is mapped to a target interval to form a corresponding request times mapping matrix;

[0027] Load the request times mapping matrix into the third mining branch included in the semantic mining model;

[0028] Perform convolution processing on the request times mapping matrix to form request times convolution features corresponding to the request times mapping matrix, and perform self-attention processing on the request times convolution features to form request times attention features corresponding to the request times convolution features;

[0029] Based on the request times convolution features, perform gradient optimization processing on the request times attention features to form second local traffic features corresponding to the target traffic data.

[0030] In a preferred selection of the present application, in the above-mentioned method for analyzing the running security of the edge computing gateway, the step of using the semantic analysis model to perform running security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and outputting the target running security analysis result corresponding to the target edge computing gateway includes:

[0031] Load the global traffic feature, the first local traffic feature, and the second local traffic feature into the semantic analysis model;

[0032] Based on the first local traffic feature, perform cross-attention processing on the global traffic feature to form a first cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, perform gradient optimization processing on the first cross-attention feature to form a corresponding first global gradient optimization feature;

[0033] Based on the second local traffic feature, perform cross-attention processing on the global traffic feature to form a second cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, perform gradient optimization processing on the second cross-attention feature to form a corresponding second global gradient optimization feature;

[0034] Perform bidirectional cross-attention processing on the first global gradient optimization feature and the second global gradient optimization feature to form corresponding first global attention features and second global attention features, and determine the target global traffic feature based on the concatenated features of the first global attention feature and the second global attention feature;

[0035] Perform a fully connected processing on the target global traffic feature to form a fully connected feature corresponding to the target global traffic feature, and perform a classification processing on the fully connected feature to output the target operation security analysis result corresponding to the target edge computing gateway.

[0036] In a preferred selection of the present application, in the above operation security analysis method of the edge computing gateway, the operation security analysis method of the edge computing gateway further includes:

[0037] Obtain training traffic data of the training edge computing gateway, where the training traffic data includes the traffic distribution of the training edge computing gateway during the training time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and request times;

[0038] Use the semantic mining model in the candidate operation security analysis network to perform semantic mining on the training traffic data, and output corresponding training global traffic features, training first local traffic features, and training second local traffic features, where the training global traffic feature is used to reflect the global semantic information in the training traffic data, the training first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the training traffic data, and the training second local traffic feature is used to reflect the semantic information about the distribution of request times in the training traffic data;

[0039] Use the semantic analysis model in the candidate operation security analysis network to perform operation security analysis on the training global traffic feature, the training first local traffic feature, and the training second local traffic feature, and output the training operation security analysis result corresponding to the training edge computing gateway, where the training operation security analysis result is used to reflect whether the training edge computing gateway has been attacked by a target network attack;

[0040] Update the parameters in the candidate operation security analysis network based on the error between the training operation security analysis result and the network attack label corresponding to the training traffic data, and obtain the target operation security analysis network corresponding to the candidate operation security analysis network.

[0041] The present application also provides an operation security analysis device for an edge computing gateway, including:

[0042] A traffic data acquisition module for acquiring target traffic data of a target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests;

[0043] A semantic mining module for using a semantic mining model in a target operation security analysis network to perform semantic mining on the target traffic data and output corresponding global traffic features, first local traffic features, and second local traffic features. The target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic features are used to reflect the global semantic information in the target traffic data, the first local traffic features are used to reflect the semantic information about the distribution of traffic size in the target traffic data, and the second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the target traffic data;

[0044] A semantic analysis module for using the semantic analysis model to perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features, and output a target operation security analysis result corresponding to the target edge computing gateway, where the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

[0045] On the above basis, the present application further provides an electronic device, including:

[0046] A memory for storing a computer program;

[0047] A processor connected to the memory for executing the computer program stored in this memory to implement the above-mentioned operation security analysis method for the edge computing gateway.

[0048] On the above basis, the present application further provides a computer-readable storage medium, in which a computer program is stored, and when this computer program runs, it executes each step of the above-mentioned operation security analysis method for the edge computing gateway.

[0049] The method, device, equipment and medium for analyzing the operation security of an edge computing gateway provided by this application first obtain the target traffic data of the target edge computing gateway; secondly, use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic characteristics, first local traffic characteristics and second local traffic characteristics; then, use the semantic analysis model to perform operation security analysis on the global traffic characteristics, first local traffic characteristics and second local traffic characteristics, and output the target operation security analysis result corresponding to the target edge computing gateway. Based on the above content, since the powerful learning ability and analysis ability of the neural network can be utilized, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solutions of threshold comparison analysis, more reliable network intrusion judgments can be made. Moreover, in the process of mining potential semantic information, semantic information in three dimensions, namely global semantic information, semantic information about the distribution of traffic sizes, and semantic information about the distribution of request times, will be mined, so that the richness of the mined semantic information can be higher. Therefore, the results analyzed based on the corresponding semantic information are also more reliable, which can improve the problem of relatively low reliability of operation security analysis existing in the prior art, that is, realize reliable analysis of network intrusion. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] To make the above objects, features and advantages of this application more obvious and understandable, the following specifically enumerates preferred embodiments and, in conjunction with the accompanying drawings, makes a detailed description as follows.

[0051] Figure 1 It is a structural block diagram of an electronic device provided by an embodiment of this application.

[0052] Figure 2 It is a schematic flowchart of a method for analyzing the operation security of an edge computing gateway provided by an embodiment of this application.

[0053] Figure 3 It is a schematic diagram of a traffic size distribution matrix provided by an embodiment of this application.

[0054] Figure 4 It is a schematic diagram of a request times distribution matrix provided by an embodiment of this application.

[0055] Figure 5 It is a block schematic diagram of a device for analyzing the operation security of an edge computing gateway provided by an embodiment of this application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0056] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only a part of the embodiments of this application, rather than all the embodiments. Generally, the components of the embodiments of this application described and illustrated herein can be arranged and designed in various different configurations.

[0057] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of this application that is claimed, but merely represents selected embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this application without creative efforts shall fall within the scope of protection of this application.

[0058] As Figure 1 shown, the embodiments of this application provide an electronic device. Among them, the electronic device may include a memory, a processor, and an operating security analysis device for an edge computing gateway.

[0059] Specifically, the memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, the memory and the processor may be electrically connected through one or more communication buses or signal lines. The operating security analysis device for the edge computing gateway includes at least one software function module stored in the memory in the form of software or firmware. The processor is configured to execute the executable computer programs stored in the memory, such as the software function modules and computer programs included in the operating security analysis device for the edge computing gateway, to implement the operating security analysis method for the edge computing gateway provided by the embodiments of this application.

[0060] Optionally, the memory may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electric Erasable Programmable Read-Only Memory (EEPROM), etc. And, the processor may be a general-purpose processor, including Central Processing Unit (CPU), Network Processor (NP), System on Chip (SoC), etc.; it may also be a Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0061] It can be understood that Figure 1 The structure shown is only for illustration, and the electronic device may further include more or fewer components than those shown Figure 1 in the figure, or have a different configuration from that shown Figure 1 in the figure. For example, it may further include a communication unit for information interaction with other devices.

[0062] Combined with Figure 2 , the embodiment of the present application further provides an operation security analysis method for an edge computing gateway applicable to the above-mentioned electronic device. Among them, the method steps defined by the process related to the operation security analysis method of the edge computing gateway can be implemented by the electronic device. The following will Figure 2 elaborate in detail on the specific process shown.

[0063] Step S110, obtain the target traffic data of the target edge computing gateway.

[0064] In an embodiment of the present application, the electronic device may obtain target traffic data of a target edge computing gateway. The target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic volume, and number of requests. For example, the source IP "192.168.1.1" sent 1500 requests to the target port 80, and the packet size of each request was 25 KB (in an actual application scenario, the packet sizes of some requests may not be exactly the same, and the differences can be relatively large). The source IP "192.168.1.2" sent 70 requests to the target port 443, and the packet size of each request was 12 KB. The source IP "192.168.2.1" sent 120 requests to the target port 80, and the packet size of each request was 8 KB. The source IP "192.168.3.5" sent 400 requests to the target port 443, and the packet size of each request was 6 KB. The source IP "192.168.4.3" sent 800 requests to the target port 80, and the packet size of each request was 3 KB.

[0065] Step S120: Use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature.

[0066] In an embodiment of the present application, the electronic device may use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature (the manifestation form of each feature may be a vector). The target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic volume in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the target traffic data.

[0067] Step S130: Use the semantic analysis model to perform operation security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and output the target operation security analysis result corresponding to the target edge computing gateway.

[0068] In the embodiments of the present application, the electronic device may utilize the semantic analysis model to perform operational security analysis on the global traffic characteristics, the first local traffic characteristics, and the second local traffic characteristics, and output the target operational security analysis result corresponding to the target edge computing gateway. Wherein, the target operational security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack. Exemplarily, classification (such as binary classification, etc.) may be performed based on the global traffic characteristics, the first local traffic characteristics, and the second local traffic characteristics to determine whether the target edge computing gateway has been subjected to a target network attack (such as a DDoS attack).

[0069] Based on the above, since the powerful learning ability and analysis ability of the neural network can be utilized, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solutions of threshold comparison analysis, more reliable network intrusion judgment can be performed. Moreover, in the process of mining potential semantic information, semantic information in three dimensions, namely, global semantic information, semantic information about the distribution of traffic size, and semantic information about the distribution of request times, will be mined, so that the richness of the mined semantic information can be higher. Therefore, the results analyzed based on the corresponding semantic information are also more reliable, which can improve the problem of relatively low reliability of operational security analysis existing in the prior art, that is, reliable analysis of network intrusion can be achieved.

[0070] It should be noted that for step S120 in the above content, the specific manner of performing semantic mining on the target traffic data is not limited and can be selected accordingly according to actual needs.

[0071] For example, in an alternative embodiment, in order to improve the reliability of semantic mining and make the obtained global traffic characteristics, first local traffic characteristics, and second local traffic characteristics have a high semantic representation accuracy, step S120 above may further include step S121, step S122, and step S123, and the specific content of each step is described as follows.

[0072] Step S121, utilize the first mining branch included in the semantic mining model in the target operational security analysis network to perform semantic mining on the target traffic data, and output the global traffic characteristics corresponding to the target traffic data.

[0073] In the embodiments of the present application, the first mining branch included in the semantic mining model of the target operation safety analysis network can be used to perform semantic mining on the target traffic data and output the global traffic characteristics corresponding to the target traffic data. That is to say, the first mining branch can be used to mine the global semantic information in the target traffic data, and the mined results can be represented in the form of vectors. In this way, the corresponding global traffic characteristics can be obtained.

[0074] Step S122: Use the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the first local traffic characteristics corresponding to the target traffic data.

[0075] In the embodiments of the present application, the second mining branch included in the semantic mining model can be used to perform semantic mining on the target traffic data and output the first local traffic characteristics corresponding to the target traffic data. That is to say, the second mining branch can be used to mine the local semantic information about the traffic volume in the target traffic data, and the mined results can be represented in the form of vectors. In this way, the corresponding first local traffic characteristics can be obtained.

[0076] Step S123: Use the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the second local traffic characteristics corresponding to the target traffic data.

[0077] In the embodiments of the present application, the third mining branch included in the semantic mining model can be used to perform semantic mining on the target traffic data and output the second local traffic characteristics corresponding to the target traffic data. That is to say, the third mining branch can be used to mine the local semantic information about the number of requests in the target traffic data, and the mined results can be represented in the form of vectors. In this way, the corresponding second local traffic characteristics can be obtained. In addition, considering the mining accuracy, the above first mining branch, second mining branch, and third mining branch belong to different branches, and specific network parameters can be formed during the mining process.

[0078] It can be understood that in step S121 above, the specific manner of outputting the global traffic characteristics corresponding to the target traffic data is not limited. For example, in an alternative embodiment, in order to achieve reliable mining of the global semantic information in the target traffic data, step S121 above can further include the following content:

[0079] First, the target traffic data can be loaded into the first mining branch included in the semantic mining model in the target operation security analysis network. In this way, subsequent specific mining processing can be carried out through the first mining branch, and the specific content will be described later;

[0080] Second, the target traffic data can be embedded to form traffic embedding features corresponding to the target traffic data, and self-attention processing can be performed on the traffic embedding features to form traffic attention features corresponding to the target traffic data. Exemplarily, the first mining branch can include a word embedding model. In this way, the target traffic data can be embedded through this word embedding model to obtain corresponding traffic embedding features;

[0081] Then, based on the traffic embedding features, gradient optimization processing can be performed on the traffic attention features to form global traffic features corresponding to the target traffic data. Exemplarily, the traffic embedding features and the traffic attention features can be added or weighted and summed to avoid the problem of losing other semantic information due to focusing on internal correlation information during self-attention processing, so that gradient optimization can be achieved and the problem of gradient explosion can be solved.

[0082] It can be understood that in step S122 above, the specific manner of outputting the first local traffic features corresponding to the target traffic data is not limited. For example, in an alternative implementation manner, in order to reliably mine the local semantic information about the traffic size in the target traffic data, step S122 above can further include the following content:

[0083] First, based on the distribution of the traffic size in the target traffic data, a traffic size distribution matrix corresponding to the target traffic data can be constructed. Among them, in the traffic size distribution matrix, the traffic size data in the same row is used to reflect the traffic sizes of each data packet of the same source IP, and the number of source IPs is equal to the number of rows of the traffic size distribution matrix. Exemplarily, the traffic size distribution matrix can be as Figure 3 shown;

[0084] Second, parameter mapping processing can be performed on the traffic size distribution matrix so that each parameter in the traffic size distribution matrix is mapped to a target interval to form a corresponding traffic size mapping matrix. Exemplarily, an activation function such as the Tanh function (hyperbolic tangent function) can be used to process the traffic size distribution matrix to obtain a corresponding traffic size mapping matrix;

[0085] Then, the traffic size mapping matrix can be loaded into the second mining branch included in the semantic mining model. In this way, subsequent processing can be carried out in the second mining branch;

[0086] After that, the traffic volume mapping matrix can be subjected to convolution processing to form traffic volume convolution features corresponding to the traffic volume mapping matrix, and self-attention processing can be performed on the traffic volume convolution features to form traffic volume attention features corresponding to the traffic volume convolution features; Exemplarily, a convolution network is included in the second mining branch, so that the traffic volume mapping matrix can be subjected to convolution processing through this convolution network to capture potential semantic information;

[0087] Finally, based on the traffic volume convolution features, gradient optimization processing can be performed on the traffic volume attention features to form first local traffic features corresponding to the target traffic data; Exemplarily, the traffic volume convolution features and the traffic volume attention features can be added or weighted and added to obtain corresponding first local traffic features.

[0088] It can be understood that in the above step S123, the specific manner of outputting the second local traffic features corresponding to the target traffic data is not limited. For example, in an alternative implementation manner, in order to reliably mine the local semantic information about the request count in the target traffic data, the above step S123 may further include the following content:

[0089] First, based on the distribution of the request count in the target traffic data, a request count distribution matrix corresponding to the target traffic data can be constructed. In the request count distribution matrix, any request count data is used to reflect the difference between the request counts of two source IPs. For example, Figure 4 as shown, the request count data in the first row and first column is used to reflect the difference (0) between the request count of the first source IP and the request count of the first source IP, the request count data in the first row and second column is used to reflect the difference between the request count of the first source IP and the request count of the second source IP, the request count data in the second row and first column is used to reflect the difference between the request count of the second source IP and the request count of the first source IP. Additionally, the difference can be an absolute difference;

[0090] Secondly, parameter mapping processing can be performed on the request count distribution matrix so that each parameter in the request count distribution matrix is mapped to a target interval to form a corresponding request count mapping matrix; Exemplarily, an activation function such as the Tanh function (hyperbolic tangent function) can be used to process the request count distribution matrix to obtain a corresponding request count mapping matrix;

[0091] Then, the request count mapping matrix can be loaded into the third mining branch included in the semantic mining model, so that subsequent processing can be performed in the third mining branch;

[0092] After that, the request count mapping matrix can be subjected to convolution processing to form request count convolution features corresponding to the request count mapping matrix, and self-attention processing can be performed on the request count convolution features to form request count attention features corresponding to the request count convolution features; Exemplarily, a convolution network is also included in the third mining branch, so that the convolution network can perform convolution processing on the request count mapping matrix to capture potential semantic information;

[0093] Finally, based on the request count convolution features, gradient optimization processing can be performed on the request count attention features to form second local traffic features corresponding to the target traffic data; Exemplarily, the request count convolution features and the request count attention features can be added or weighted and added to obtain corresponding second local traffic features.

[0094] It should be noted that for step S130 in the above content, the specific manner of performing operational safety analysis on the global traffic features, the first local traffic features, and the second local traffic features is not limited and can be selected accordingly according to actual requirements.

[0095] For example, in an alternative embodiment, in order to improve the reliability of operational safety analysis, the semantic information represented by the global traffic features, the first local traffic features, and the second local traffic features can be fully utilized, and step S130 above can include:

[0096] First, the global traffic features, the first local traffic features, and the second local traffic features can be loaded into the semantic analysis model, so that subsequent processing can be performed; In addition, in some embodiments, when the sizes of the global traffic features, the first local traffic features, and the second local traffic features are different, the global traffic features, the first local traffic features, and the second local traffic features can also be processed by means such as upsampling or downsampling to make the sizes of the features consistent for subsequent processing;

[0097] Second, based on the first local traffic features, cross-attention processing can be performed on the global traffic features to form first cross-attention features corresponding to the global traffic features, and based on the global traffic features, gradient optimization processing (as described above) can be performed on the first cross-attention features to form corresponding first global gradient optimization features;

[0098] Then, based on the second local traffic feature, the global traffic feature may be cross-attention processed to form a second cross-attention feature corresponding to the global traffic feature, and, based on the global traffic feature, the second cross-attention feature may be gradient optimized to form a corresponding second global gradient optimized feature;

[0099] Afterwards, the first global gradient optimization feature and the second global gradient optimization feature may be subjected to bidirectional cross-attention processing to form corresponding first global attention features and second global attention features (i.e., based on the first global gradient optimization feature, the second global gradient optimization feature is subjected to cross-attention processing to obtain the first global attention feature, and based on the second global gradient optimization feature, the first global gradient optimization feature is subjected to cross-attention processing to obtain the second global attention feature), and, based on the concatenated features of the first global attention feature and the second global attention feature, a target global flow feature is determined; illustratively, the concatenated feature may be directly used as the target global flow feature, or the concatenated feature may be subjected to convolution, pooling, and other processing to obtain the target global flow feature;

[0100] Finally, the target global traffic feature can be fully connected to form a fully connected feature corresponding to the target global traffic feature, and the fully connected feature can be classified to output the target operation security analysis result corresponding to the target edge computing gateway; for example, the fully connected feature can be mapped to a corresponding probability distribution, such as (a1, a2), through classification functions such as softmax, where a1 can refer to the probability that the target edge computing gateway is attacked by the target network, and a2 can refer to the probability that the target edge computing gateway is not attacked by the target network.

[0101] Finally, it should be noted that in order to ensure the reliable execution of the above-mentioned steps S120 and S130, the operation safety analysis method of the edge computing gateway may also include a step of training to form the target operation safety analysis network (i.e., a step of learning the mapping relationship between the corresponding training data and the label). Exemplarily, this step may include the following:

[0102] First, the training traffic data of the training edge computing gateway can be obtained, wherein the training traffic data includes the traffic distribution of the training edge computing gateway during the training time period, and the traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests. For details, please refer to the explanation of the target traffic data in the previous text;

[0103] Secondly, use the semantic mining model in the candidate running security analysis network to perform semantic mining on the training traffic data, and output the corresponding training global traffic features, training first local traffic features, and training second local traffic features. Among them, the training global traffic features are used to reflect the global semantic information in the training traffic data, the training first local traffic features are used to reflect the semantic information about the distribution of traffic volume in the training traffic data, and the training second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the training traffic data. For specific details, please refer to the explanation of step S120 in the previous text;

[0104] Then, use the semantic analysis model in the candidate running security analysis network to perform running security analysis on the training global traffic features, the training first local traffic features, and the training second local traffic features, and output the training running security analysis result corresponding to the training edge computing gateway. Among them, the training running security analysis result is used to reflect whether the training edge computing gateway has been attacked by a target network attack. For specific details, please refer to the explanation of step S130 in the previous text;

[0105] Finally, based on the error (such as cross-entropy error, etc.) between the training running security analysis result and the network attack label corresponding to the training traffic data, the parameters in the candidate running security analysis network can be updated (such as updating the parameters along the direction of reducing the error until the error converges, such as the error is reduced to a preset value or the amplitude of the error reduction is less than a preset amplitude, etc.), and the target running security analysis network corresponding to the candidate running security analysis network can be obtained.

[0106] Combined with Figure 5 , the embodiment of the present application further provides an operating security analysis device applicable to the edge computing gateway of the above-mentioned electronic device. Among them, the operating security analysis device of the edge computing gateway may include a traffic data acquisition module, a semantic mining module, and a semantic analysis module.

[0107] The traffic data acquisition module is used to acquire the target traffic data of the target edge computing gateway. Among them, the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic volume, and the number of requests. In the embodiment of the present application, the traffic data acquisition module can be used to execute Figure 2 the step S110 shown, and the relevant content of the traffic data acquisition module can be referred to the description of step S110 in the previous text.

[0108] The semantic mining module is used to perform semantic mining on the target traffic data by using the semantic mining model in the target operation security analysis network, and output the corresponding global traffic features, first local traffic features, and second local traffic features. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic features are used to reflect the global semantic information in the target traffic data. The first local traffic features are used to reflect the semantic information about the distribution of traffic volume in the target traffic data. The second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the target traffic data. In the embodiment of the present application, the semantic mining module can be used to execute Figure 2 the steps S120 shown in the figure. For the relevant content of the semantic mining module, reference can be made to the description of step S120 above.

[0109] The semantic analysis module is used to perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features by using the semantic analysis model, and output the target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack. In the embodiment of the present application, the semantic analysis module can be used to execute Figure 2 the steps S130 shown in the figure. For the relevant content of the semantic analysis module, reference can be made to the description of step S130 above.

[0110] In the embodiment of the present application, corresponding to the above operation security analysis method applied to the edge computing gateway of the electronic device, a computer-readable storage medium is also provided. A computer program is stored in the computer-readable storage medium, and when the computer program runs, it executes each step of the operation security analysis method of the edge computing gateway.

[0111] Among them, the steps executed when the foregoing computer program runs will not be elaborated here one by one, and reference can be made to the foregoing explanation of the operation security analysis method of the edge computing gateway.

[0112] In summary, for the method, device, equipment, and medium for analyzing the running security of the edge computing gateway provided in this application, first, obtain the target traffic data of the target edge computing gateway; secondly, use the semantic mining model in the target running security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic characteristics, first local traffic characteristics, and second local traffic characteristics; then, use the semantic analysis model to perform running security analysis on the global traffic characteristics, first local traffic characteristics, and second local traffic characteristics, and output the target running security analysis result corresponding to the target edge computing gateway. Based on the above content, since the powerful learning ability and analysis ability of the neural network can be utilized, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solutions of threshold comparison analysis, more reliable network intrusion judgments can be made. Moreover, during the process of mining potential semantic information, semantic information in three dimensions, namely global semantic information, semantic information about the distribution of traffic sizes, and semantic information about the distribution of request counts, will be mined, making the richness of the mined semantic information higher. Therefore, the results analyzed based on the corresponding semantic information are also more reliable, which can improve the relatively low reliability of running security analysis existing in the prior art, that is, realize reliable analysis of network intrusion.

[0113] In several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0114] In addition, in each embodiment of the present application, the various functional modules can be integrated together to form an independent part, or each module can exist separately, or two or more modules can be integrated to form an independent part.

[0115] When the above-mentioned functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art or a part of this technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, an electronic device, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs. It should be noted that in this article, the term "including", "comprising", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article, or device. Without further limitations, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or device including the said element.

[0116] The foregoing are only the preferred embodiments of this application and are not used to limit this application. For those skilled in the art, this application may have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims

1. A method for analyzing the operation security of an edge computing gateway, characterized in that: include: Obtain target traffic data of a target edge computing gateway, wherein the target traffic data includes traffic distribution of the target edge computing gateway within a target time period, and the traffic distribution is used to characterize at least the source IP, target port, traffic size, and number of requests; Using the semantic mining model in the target operation safety analysis network, semantic mining is performed on the target traffic data to output corresponding global traffic features, first local traffic features, and second local traffic features, wherein the target operation safety analysis network belongs to a trained neural network and also includes a semantic analysis model, the global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of request times in the target traffic data; Using the semantic analysis model, an operation security analysis is performed on the global traffic characteristics, the first local traffic characteristics and the second local traffic characteristics, and a target operation security analysis result corresponding to the target edge computing gateway is output, wherein the target operation security analysis result is used to reflect whether the target edge computing gateway is attacked by the target network.

2. The operation security analysis method of the edge computing gateway according to claim 1 is characterized in that: The step of using the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and outputting the corresponding global traffic features, first local traffic features and second local traffic features includes: Using the first mining branch included in the semantic mining model in the target operation safety analysis network, semantic mining is performed on the target traffic data to output global traffic features corresponding to the target traffic data; Using the second mining branch included in the semantic mining model, semantic mining is performed on the target traffic data to output a first local traffic feature corresponding to the target traffic data; The target traffic data is semantically mined using the third mining branch included in the semantic mining model to output a second local traffic feature corresponding to the target traffic data.

3. The operation security analysis method of the edge computing gateway according to claim 2 is characterized in that: The step of using the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and outputting the global traffic features corresponding to the target traffic data includes: Loading the target traffic data into a first mining branch included in a semantic mining model in a target operational safety analysis network; Embedding the target traffic data to form a traffic embedding feature corresponding to the target traffic data, and performing self-attention processing on the traffic embedding feature to form a traffic attention feature corresponding to the target traffic data; Based on the traffic embedding feature, the traffic attention feature is gradient optimized to form a global traffic feature corresponding to the target traffic data.

4. The operation security analysis method of the edge computing gateway according to claim 2 is characterized in that: The step of using the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and outputting the first local traffic feature corresponding to the target traffic data includes: Based on the distribution of the flow size in the target flow data, a flow size distribution matrix corresponding to the target flow data is constructed, wherein, in the flow size distribution matrix, the flow size data in the same row is used to reflect the flow size of each data packet of the same source IP; Performing parameter mapping processing on the flow size distribution matrix so that each parameter in the flow size distribution matrix is ​​mapped to a target interval to form a corresponding flow size mapping matrix; Loading the traffic size mapping matrix into a second mining branch included in the semantic mining model; Performing convolution processing on the flow size mapping matrix to form a flow size convolution feature corresponding to the flow size mapping matrix, and performing self-attention processing on the flow size convolution feature to form a flow size attention feature corresponding to the flow size convolution feature; Based on the flow size convolution feature, the flow size attention feature is gradient optimized to form a first local flow feature corresponding to the target flow data.

5. The operation security analysis method of the edge computing gateway according to claim 2 is characterized in that: The step of using the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and outputting the second local traffic feature corresponding to the target traffic data includes: Based on the distribution of the number of requests in the target traffic data, a request number distribution matrix corresponding to the target traffic data is constructed, wherein in the request number distribution matrix, any request number data is used to reflect the difference between the request numbers of two source IPs; Performing parameter mapping processing on the request number distribution matrix so that each parameter in the request number distribution matrix is ​​mapped to a target interval to form a corresponding request number mapping matrix; Loading the request frequency mapping matrix into the third mining branch included in the semantic mining model; Performing convolution processing on the request number mapping matrix to form a request number convolution feature corresponding to the request number mapping matrix, and performing self-attention processing on the request number convolution feature to form a request number attention feature corresponding to the request number convolution feature; Based on the request number convolution feature, the request number attention feature is gradient optimized to form a second local traffic feature corresponding to the target traffic data.

6. The operation security analysis method of the edge computing gateway according to claim 1 is characterized in that: The step of using the semantic analysis model to perform operation security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and outputting the target operation security analysis result corresponding to the target edge computing gateway includes: Loading the global traffic feature, the first local traffic feature, and the second local traffic feature into the semantic analysis model; Based on the first local traffic feature, performing cross-attention processing on the global traffic feature to form a first cross-attention feature corresponding to the global traffic feature, and, based on the global traffic feature, performing gradient optimization processing on the first cross-attention feature to form a corresponding first global gradient optimization feature; Based on the second local traffic feature, performing cross-attention processing on the global traffic feature to form a second cross-attention feature corresponding to the global traffic feature, and, based on the global traffic feature, performing gradient optimization processing on the second cross-attention feature to form a corresponding second global gradient optimization feature; Performing bidirectional cross-attention processing on the first global gradient optimization feature and the second global gradient optimization feature to form a corresponding first global attention feature and a second global attention feature, and determining a target global flow feature based on a concatenated feature of the first global attention feature and the second global attention feature; The target global traffic feature is fully connected to form a fully connected feature corresponding to the target global traffic feature, and the fully connected feature is classified and processed to output a target operation security analysis result corresponding to the target edge computing gateway.

7. The operation security analysis method of the edge computing gateway according to any one of claims 1 to 6, characterized in that: The operation safety analysis method of the edge computing gateway also includes: Obtain training traffic data of the training edge computing gateway, wherein the training traffic data includes traffic distribution of the training edge computing gateway during a training time period, and the traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests; Using the semantic mining model in the candidate operation safety analysis network, semantic mining is performed on the training traffic data to output corresponding training global traffic features, training first local traffic features and training second local traffic features, wherein the training global traffic features are used to reflect the global semantic information in the training traffic data, the training first local traffic features are used to reflect the semantic information about the distribution of traffic size in the training traffic data, and the training second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the training traffic data; Using the semantic analysis model in the candidate operation security analysis network, an operation security analysis is performed on the training global traffic feature, the training first local traffic feature, and the training second local traffic feature, and a training operation security analysis result corresponding to the training edge computing gateway is output, wherein the training operation security analysis result is used to reflect whether the training edge computing gateway is attacked by the target network; Based on the error between the training operation safety analysis result and the network attack label corresponding to the training traffic data, the parameters in the candidate operation safety analysis network are updated to obtain the target operation safety analysis network corresponding to the candidate operation safety analysis network.

8. An operation safety analysis device for an edge computing gateway, characterized in that: include: A traffic data acquisition module is used to acquire target traffic data of a target edge computing gateway, wherein the target traffic data includes traffic distribution of the target edge computing gateway within a target time period, and the traffic distribution is used to characterize at least the source IP, target port, traffic size, and number of requests; A semantic mining module, used to perform semantic mining on the target traffic data using a semantic mining model in a target operation safety analysis network, and output corresponding global traffic features, first local traffic features, and second local traffic features, wherein the target operation safety analysis network is a trained neural network and also includes a semantic analysis model, the global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of request times in the target traffic data; A semantic analysis module is used to use the semantic analysis model to perform an operation security analysis on the global traffic characteristics, the first local traffic characteristics and the second local traffic characteristics, and output a target operation security analysis result corresponding to the target edge computing gateway, wherein the target operation security analysis result is used to reflect whether the target edge computing gateway is attacked by a target network.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor connected to the memory, used to execute a computer program stored in the memory to implement the operation security analysis method of the edge computing gateway described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed, executes the operation security analysis method for the edge computing gateway described in any one of claims 1 to 7.

Images