Operating Security Analysis Method and Apparatus, Device, and Medium for Edge Computing Gateway

Abstract

The method, device, equipment and medium for analyzing the operation security of an edge computing gateway provided by this application relate to the field of artificial intelligence technology. In this application, first, target traffic data of a target edge computing gateway is obtained; secondly, using a semantic mining model in the target operation security analysis network, semantic mining is performed on the target traffic data, and corresponding global traffic features, first local traffic features and second local traffic features are output; then, using a semantic analysis model, operation security analysis is performed on the global traffic features, first local traffic features and second local traffic features, and a target operation security analysis result corresponding to the target edge computing gateway is output. Based on the above content, the problem of relatively low reliability of operation security analysis existing in the prior art can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to an edge computing gateway operation security analysis method and apparatus, equipment, and medium. Background Art

[0002] With the rapid development of the Internet of Things (IoT), cloud computing, and artificial intelligence (AI) technologies, edge computing has become a crucial computing architecture. By shifting data processing from traditional data centers to locations closer to the data source, edge computing enables low-latency, high-bandwidth, and real-time services while also reducing cloud load. However, with the increasing popularity of edge computing applications, ensuring the security of edge computing gateways has become a critical issue that needs to be addressed.

[0003] Edge computing gateways, as the bridge between edge devices and the cloud or data center, undertake key functions such as data collection, storage, processing, and transmission. Because edge computing environments typically involve multiple devices, application scenarios, and complex network topologies, their operational security faces multiple threats, including malicious attacks, network intrusions, and data leaks. Therefore, security analysis of edge computing gateways is crucial, especially in terms of traffic monitoring and anomaly detection. For example, DDoS (Distributed Denial of Service) attacks are a common network attack method that aims to overload target systems or network resources, preventing legitimate users from accessing them and causing service interruptions. However, existing security analysis methods for edge computing gateways often focus on static analysis or rule-based detection, which are difficult to handle with complex attack patterns and dynamically changing network environments. For example, if the number of requests from a certain IP segment surges over a certain period of time, and the request destination port remains consistent, then if the number of requests exceeds a threshold, it is considered a network intrusion. Therefore, simple threshold comparisons cannot reliably determine network intrusions. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide an operation security analysis method and device, equipment and medium for an edge computing gateway to improve the problem of relatively low reliability of operation security analysis in the prior art.

[0005] To achieve the above objectives, this application adopts the following technical solutions:

[0006] A method for analyzing the operation security of an edge computing gateway, comprising:

[0007] Obtain the target traffic data of the target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests;

[0008] Use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the target traffic data;

[0009] Use the semantic analysis model to perform operation security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and output the target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

[0010] In a preferred selection of the present application, in the above operation security analysis method of the edge computing gateway, the step of using the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature includes:

[0011] Use the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the global traffic feature corresponding to the target traffic data;

[0012] Use the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the first local traffic feature corresponding to the target traffic data;

[0013] Use the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the second local traffic feature corresponding to the target traffic data.

[0014] In a preferred selection of the present application, in the above operation security analysis method of the edge computing gateway, the step of using the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the global traffic feature corresponding to the target traffic data includes:

[0015] Load the target traffic data into the first mining branch included in the semantic mining model in the target operation security analysis network;

[0016] Perform embedding processing on the target traffic data to form traffic embedding features corresponding to the target traffic data, and perform self-attention processing on the traffic embedding features to form traffic attention features corresponding to the target traffic data;

[0017] Based on the traffic embedding features, perform gradient optimization processing on the traffic attention features to form global traffic features corresponding to the target traffic data.

[0018] In a preferred selection of the present application, in the above-mentioned operation security analysis method of the edge computing gateway, the step of using the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the first local traffic features corresponding to the target traffic data includes:

[0019] Based on the distribution of traffic sizes in the target traffic data, construct a traffic size distribution matrix corresponding to the target traffic data. Among them, in the traffic size distribution matrix, the traffic size data in the same row is used to reflect the traffic sizes of each data packet of the same source IP;

[0020] Perform parameter mapping processing on the traffic size distribution matrix so that each parameter in the traffic size distribution matrix is mapped to a target interval to form a corresponding traffic size mapping matrix;

[0021] Load the traffic size mapping matrix into the second mining branch included in the semantic mining model;

[0022] Perform convolution processing on the traffic size mapping matrix to form traffic size convolution features corresponding to the traffic size mapping matrix, and perform self-attention processing on the traffic size convolution features to form traffic size attention features corresponding to the traffic size convolution features;

[0023] Based on the traffic size convolution features, perform gradient optimization processing on the traffic size attention features to form the first local traffic features corresponding to the target traffic data.

[0024] In a preferred selection of the present application, in the above-mentioned operation security analysis method of the edge computing gateway, the step of using the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the second local traffic features corresponding to the target traffic data includes:

[0025] Based on the distribution of the number of requests in the target traffic data, a request number distribution matrix corresponding to the target traffic data is constructed. Among them, in the request number distribution matrix, any request number data is used to reflect the difference in the number of requests between two source IPs;

[0026] Perform parameter mapping processing on the request number distribution matrix so that each parameter in the request number distribution matrix is mapped to a target interval to form a corresponding request number mapping matrix;

[0027] Load the request number mapping matrix into the third mining branch included in the semantic mining model;

[0028] Perform convolution processing on the request number mapping matrix to form a request number convolution feature corresponding to the request number mapping matrix, and perform self-attention processing on the request number convolution feature to form a request number attention feature corresponding to the request number convolution feature;

[0029] Based on the request number convolution feature, perform gradient optimization processing on the request number attention feature to form a second local traffic feature corresponding to the target traffic data.

[0030] In a preferred selection of this application, in the above-mentioned method for analyzing the running security of an edge computing gateway, the step of using the semantic analysis model to perform running security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and outputting the target running security analysis result corresponding to the target edge computing gateway includes: [[ID=I6]]

[0031] Load the global traffic feature, the first local traffic feature, and the second local traffic feature into the semantic analysis model;

[0032] Based on the first local traffic feature, perform cross-attention processing on the global traffic feature to form a first cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, perform gradient optimization processing on the first cross-attention feature to form a corresponding first global gradient optimization feature;

[0033] Based on the second local traffic feature, perform cross-attention processing on the global traffic feature to form a second cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, perform gradient optimization processing on the second cross-attention feature to form a corresponding second global gradient optimization feature;

[0034] Perform bidirectional cross-attention processing on the first global gradient optimization feature and the second global gradient optimization feature to form corresponding first global attention feature and second global attention feature, and determine a target global traffic feature based on the concatenated feature of the first global attention feature and the second global attention feature;

[0035] Perform a fully connected processing on the target global traffic feature to form a fully connected feature corresponding to the target global traffic feature, and perform a classification processing on the fully connected feature to output a target running security analysis result corresponding to the target edge computing gateway.

[0036] In a preferred selection of the present application, in the above-mentioned running security analysis method of the edge computing gateway, the running security analysis method of the edge computing gateway further includes:

[0037] Obtain training traffic data for training an edge computing gateway, where the training traffic data includes the traffic distribution of the training edge computing gateway during a training time period, and this traffic distribution is at least used to characterize a source IP, a target port, a traffic size, and a request number;

[0038] Use a semantic mining model in a candidate running security analysis network to perform semantic mining on the training traffic data, and output corresponding training global traffic feature, training first local traffic feature, and training second local traffic feature, where the training global traffic feature is used to reflect global semantic information in the training traffic data, the training first local traffic feature is used to reflect semantic information about the distribution of traffic size in the training traffic data, and the training second local traffic feature is used to reflect semantic information about the distribution of request number in the training traffic data;

[0039] Use a semantic analysis model in the candidate running security analysis network to perform a running security analysis on the training global traffic feature, the training first local traffic feature, and the training second local traffic feature, and output a training running security analysis result corresponding to the training edge computing gateway, where the training running security analysis result is used to reflect whether the training edge computing gateway has been subjected to a target network attack;

[0040] Update parameters in the candidate running security analysis network based on the error between the training running security analysis result and the network attack label corresponding to the training traffic data, to obtain a target running security analysis network corresponding to the candidate running security analysis network.

[0041] The present application also provides a running security analysis device for an edge computing gateway, including:

[0042] A traffic data acquisition module, configured to acquire target traffic data of a target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and the traffic distribution is at least used to characterize a source IP, a target port, a traffic volume, and a request count;

[0043] A semantic mining module, configured to use a semantic mining model in a target operation security analysis network to perform semantic mining on the target traffic data and output corresponding global traffic features, first local traffic features, and second local traffic features. The target operation security analysis network belongs to a trained neural network and further includes a semantic analysis model. The global traffic features are used to reflect the global semantic information in the target traffic data. The first local traffic features are used to reflect the semantic information about the distribution of the traffic volume in the target traffic data. The second local traffic features are used to reflect the semantic information about the distribution of the request count in the target traffic data;

[0044] A semantic analysis module, configured to use the semantic analysis model to perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features, and output a target operation security analysis result corresponding to the target edge computing gateway, where the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

[0045] On the basis of the above, the present application further provides an electronic device, including:

[0046] A memory, configured to store a computer program;

[0047] A processor connected to the memory, configured to execute the computer program stored in the memory to implement the above-mentioned operation security analysis method for the edge computing gateway.

[0048] On the basis of the above, the present application further provides a computer-readable storage medium, in which a computer program is stored, and when the computer program runs, it executes each step of the above-mentioned operation security analysis method for the edge computing gateway.

[0049] The method, device, equipment and medium for analyzing the operation security of an edge computing gateway provided by this application first obtain the target traffic data of the target edge computing gateway; secondly, use the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic characteristics, first local traffic characteristics and second local traffic characteristics; then, use the semantic analysis model to perform operation security analysis on the global traffic characteristics, first local traffic characteristics and second local traffic characteristics, and output the target operation security analysis result corresponding to the target edge computing gateway. Based on the above content, since the powerful learning ability and analysis ability of the neural network can be utilized, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solutions of threshold comparison analysis, more reliable network intrusion judgments can be made. Moreover, in the process of mining potential semantic information, semantic information in three dimensions, namely global semantic information, semantic information about the distribution of traffic sizes, and semantic information about the distribution of request counts, will be mined, making the richness of the mined semantic information higher. Therefore, the results analyzed based on the corresponding semantic information are also more reliable, which can improve the problem of relatively low reliability of operation security analysis existing in the prior art, that is, realize reliable analysis of network intrusion. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] To make the above objects, features, and advantages of this application more obvious and understandable, the following specifically gives preferred embodiments and, in conjunction with the accompanying drawings, makes a detailed description as follows.

[0051] Figure 1 It is a structural block diagram of an electronic device provided by an embodiment of this application.

[0052] Figure 2 It is a schematic flowchart of a method for analyzing the operation security of an edge computing gateway provided by an embodiment of this application.

[0053] Figure 3 It is a schematic diagram of a traffic size distribution matrix provided by an embodiment of this application.

[0054] Figure 4 It is a schematic diagram of a request count distribution matrix provided by an embodiment of this application.

[0055] Figure 5 It is a block schematic diagram of a device for analyzing the operation security of an edge computing gateway provided by an embodiment of this application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0056] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only a part of the embodiments of this application, rather than all of the embodiments. The components of the embodiments of this application described and illustrated herein can be arranged and designed in various different configurations.

[0057] Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of this application that is claimed, but merely represents selected embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this application without creative efforts fall within the scope of protection of this application.

[0058] As Figure 1 shown, the embodiments of this application provide an electronic device. Among them, the electronic device may include a memory, a processor, and a running security analysis device for an edge computing gateway.

[0059] Specifically, the memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, the memory and the processor may be electrically connected through one or more communication buses or signal lines. The running security analysis device for the edge computing gateway includes at least one software function module stored in the memory in the form of software or firmware. The processor is used to execute the executable computer program stored in the memory, such as the software function modules and computer programs included in the running security analysis device for the edge computing gateway, to implement the running security analysis method for the edge computing gateway provided by the embodiments of this application.

[0060] Optionally, the memory may be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electric Erasable Programmable Read-Only Memory (EEPROM), etc. And, the processor may be a general-purpose processor, including Central Processing Unit (CPU), Network Processor (NP), System on Chip (SoC), etc.; it may also be a Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0061] It can be understood that Figure 1 The structure shown is only for illustration, and the electronic device may further include more or fewer components than those shown Figure 1 in the figure, or have a different configuration from that shown Figure 1 in the figure. For example, it may further include a communication unit for information interaction with other devices.

[0062] In combination with Figure 2 , an embodiment of the present application further provides an operation security analysis method for an edge computing gateway applicable to the above-mentioned electronic device. Among them, the method steps defined by the processes related to the operation security analysis method of the edge computing gateway can be implemented by the electronic device. The following will Figure 2 elaborate in detail on the specific process shown.

[0063] Step S110, obtain the target traffic data of the target edge computing gateway.

[0064] In an embodiment of the present application, the electronic device may obtain target traffic data of a target edge computing gateway. Among them, the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic volume, and number of requests. For example, the source IP "192.168.1.1" sent 1500 requests to the target port 80, and the packet size of each request was 25 KB (in an actual application scenario, the packet sizes of some requests may not be exactly the same, and the differences can be relatively large). The source IP "192.168.1.2" sent 70 requests to the target port 443, and the packet size of each request was 12 KB. The source IP "192.168.2.1" sent 120 requests to the target port 80, and the packet size of each request was 8 KB. The source IP "192.168.3.5" sent 400 requests to the target port 443, and the packet size of each request was 6 KB. The source IP "192.168.4.3" sent 800 requests to the target port 80, and the packet size of each request was 3 KB.

[0065] Step S120, using a semantic mining model in the target operation security analysis network, perform semantic mining on the target traffic data, and output corresponding global traffic features, first local traffic features, and second local traffic features.

[0066] In an embodiment of the present application, the electronic device may use a semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output corresponding global traffic features, first local traffic features, and second local traffic features (the manifestation form of each feature may be a vector). Among them, the target operation security analysis network belongs to a trained neural network and further includes a semantic analysis model. The global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of traffic volume in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the target traffic data.

[0067] Step S130, using the semantic analysis model, perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features, and output the target operation security analysis result corresponding to the target edge computing gateway.

[0068] In the embodiment of the present application, the electronic device may use the semantic analysis model to perform operational security analysis on the global traffic characteristics, the first local traffic characteristics, and the second local traffic characteristics, and output the target operational security analysis result corresponding to the target edge computing gateway. Wherein, the target operational security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack. Exemplarily, classification (such as binary classification, etc.) may be performed based on the global traffic characteristics, the first local traffic characteristics, and the second local traffic characteristics to determine whether the target edge computing gateway has been subjected to a target network attack (such as a DDoS attack).

[0069] Based on the above, since the powerful learning ability and analysis ability of the neural network can be utilized, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solution of threshold comparison analysis, more reliable network intrusion judgment can be performed. And in the process of mining potential semantic information, semantic information in three dimensions, namely global semantic information, semantic information about the distribution of traffic volume, and semantic information about the distribution of the number of requests, will be mined, so that the richness of the mined semantic information can be higher. Therefore, the result analyzed based on the corresponding semantic information is also more reliable, which can improve the problem of relatively low reliability of operational security analysis existing in the prior art, that is, reliable analysis of network intrusion can be achieved.

[0070] It should be noted that for step S120 in the above content, the specific manner of performing semantic mining on the target traffic data is not limited and can be selected according to actual needs.

[0071] For example, in an alternative embodiment, in order to improve the reliability of semantic mining and make the obtained global traffic characteristics, first local traffic characteristics, and second local traffic characteristics have a high semantic representation accuracy, step S120 above may further include step S121, step S122, and step S123, and the specific content of each step is as follows.

[0072] Step S121, use the first mining branch included in the semantic mining model in the target operational security analysis network to perform semantic mining on the target traffic data, and output the global traffic characteristics corresponding to the target traffic data.

[0073] In the embodiment of the present application, the first mining branch included in the semantic mining model of the target operation safety analysis network can be used to perform semantic mining on the target traffic data and output the global traffic characteristics corresponding to the target traffic data. That is to say, the first mining branch can be used to mine the global semantic information in the target traffic data, and the mined result can be characterized in the form of a vector. In this way, the corresponding global traffic characteristics can be obtained.

[0074] Step S122: Use the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the first local traffic characteristics corresponding to the target traffic data.

[0075] In the embodiment of the present application, the second mining branch included in the semantic mining model can be used to perform semantic mining on the target traffic data and output the first local traffic characteristics corresponding to the target traffic data. That is to say, the second mining branch can be used to mine the local semantic information about the traffic volume in the target traffic data, and the mined result can be characterized in the form of a vector. In this way, the corresponding first local traffic characteristics can be obtained.

[0076] Step S123: Use the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the second local traffic characteristics corresponding to the target traffic data.

[0077] In the embodiment of the present application, the third mining branch included in the semantic mining model can be used to perform semantic mining on the target traffic data and output the second local traffic characteristics corresponding to the target traffic data. That is to say, the third mining branch can be used to mine the local semantic information about the number of requests in the target traffic data, and the mined result can be characterized in the form of a vector. In this way, the corresponding second local traffic characteristics can be obtained. In addition, considering the mining accuracy, the above first mining branch, second mining branch, and third mining branch belong to different branches, and specific network parameters can be formed during the mining process.

[0078] It can be understood that in the above step S121, the specific manner of outputting the global traffic characteristics corresponding to the target traffic data is not limited. For example, in an alternative embodiment, in order to achieve reliable mining of the global semantic information in the target traffic data, the above step S121 can further include the following content:

[0079] First, the target traffic data can be loaded into the first mining branch included in the semantic mining model in the target running safety analysis network. In this way, subsequent specific mining processing can be performed through the first mining branch, and the specific content will be described later;

[0080] Second, the target traffic data can be embedded to form traffic embedding features corresponding to the target traffic data, and self-attention processing can be performed on the traffic embedding features to form traffic attention features corresponding to the target traffic data. Exemplarily, the first mining branch can include a word embedding model. In this way, the target traffic data can be embedded through this word embedding model to obtain corresponding traffic embedding features;

[0081] Then, based on the traffic embedding features, gradient optimization processing can be performed on the traffic attention features to form global traffic features corresponding to the target traffic data. Exemplarily, the traffic embedding features and the traffic attention features can be added or weighted and summed to avoid the problem of losing other semantic information due to focusing on internal correlation information during the self-attention processing, so that gradient optimization can be achieved and the problem of gradient explosion can be solved.

[0082] It can be understood that in the above step S122, the specific manner of outputting the first local traffic features corresponding to the target traffic data is not limited. For example, in an alternative implementation manner, in order to achieve reliable mining of the local semantic information about the traffic size in the target traffic data, the above step S122 can further include the following content:

[0083] First, based on the distribution of the traffic size in the target traffic data, a traffic size distribution matrix corresponding to the target traffic data can be constructed. Among them, in the traffic size distribution matrix, the traffic size data in the same row is used to reflect the traffic sizes of each data packet of the same source IP, and the number of source IPs is equal to the number of rows of the traffic size distribution matrix. Exemplarily, the traffic size distribution matrix can be as Figure 3 shown;

[0084] Second, parameter mapping processing can be performed on the traffic size distribution matrix so that each parameter in the traffic size distribution matrix is mapped to a target interval to form a corresponding traffic size mapping matrix. Exemplarily, an activation function such as the Tanh function (hyperbolic tangent function) can be used to process the traffic size distribution matrix to obtain a corresponding traffic size mapping matrix;

[0085] Then, the traffic size mapping matrix can be loaded into the second mining branch included in the semantic mining model. In this way, subsequent processing can be performed in the second mining branch;

[0086] After that, the traffic volume mapping matrix can be subjected to convolution processing to form traffic volume convolution features corresponding to the traffic volume mapping matrix, and self-attention processing can be performed on the traffic volume convolution features to form traffic volume attention features corresponding to the traffic volume convolution features; Exemplarily, a convolution network is included in the second mining branch, so that the traffic volume mapping matrix can be subjected to convolution processing through this convolution network to capture potential semantic information;

[0087] Finally, based on the traffic volume convolution features, gradient optimization processing can be performed on the traffic volume attention features to form first local traffic features corresponding to the target traffic data; Exemplarily, the traffic volume convolution features and the traffic volume attention features can be added or weighted and added to obtain corresponding first local traffic features.

[0088] It can be understood that in the above step S123, the specific manner of outputting the second local traffic features corresponding to the target traffic data is not limited. For example, in an alternative implementation manner, in order to reliably mine the local semantic information about the request count in the target traffic data, the above step S123 may further include the following content:

[0089] First, based on the distribution of the request count in the target traffic data, a request count distribution matrix corresponding to the target traffic data can be constructed. Among them, in the request count distribution matrix, any request count data is used to reflect the difference in the request counts between two source IPs. For example, Figure 4 As shown, the request count data in the first row and first column is used to reflect the difference (0) between the request count of the first source IP and the request count of the first source IP. The request count data in the first row and second column is used to reflect the difference between the request count of the first source IP and the request count of the second source IP. The request count data in the second row and first column is used to reflect the difference between the request count of the second source IP and the request count of the first source IP. In addition, the difference can be an absolute difference;

[0090] Secondly, parameter mapping processing can be performed on the request count distribution matrix so that each parameter in the request count distribution matrix is mapped to a target interval to form a corresponding request count mapping matrix; Exemplarily, an activation function such as the Tanh function (hyperbolic tangent function) can be used to process the request count distribution matrix to obtain a corresponding request count mapping matrix;

[0091] Then, the request count mapping matrix can be loaded into the third mining branch included in the semantic mining model, so that subsequent processing can be performed in the third mining branch;

[0092] After that, the request count mapping matrix can be subjected to convolution processing to form request count convolution features corresponding to the request count mapping matrix, and self-attention processing can be performed on the request count convolution features to form request count attention features corresponding to the request count convolution features; Exemplarily, a convolutional network is also included in the third mining branch, so that the convolutional network can perform convolution processing on the request count mapping matrix to capture potential semantic information;

[0093] Finally, based on the request count convolution features, gradient optimization processing can be performed on the request count attention features to form second local traffic features corresponding to the target traffic data; Exemplarily, the request count convolution features and the request count attention features can be added or weighted and added to obtain corresponding second local traffic features.

[0094] It should be noted that for step S130 in the above content, the specific manner of performing running safety analysis on the global traffic features, the first local traffic features, and the second local traffic features is not limited and can be selected accordingly according to actual needs.

[0095] For example, in an alternative implementation, in order to improve the reliability of running safety analysis, the semantic information represented by the global traffic features, the first local traffic features, and the second local traffic features can be fully utilized, and step S130 above can include:

[0096] First, the global traffic features, the first local traffic features, and the second local traffic features can be loaded into the semantic analysis model, so that subsequent processing can be performed; Additionally, in some implementations, when the sizes of the global traffic features, the first local traffic features, and the second local traffic features are different, the global traffic features, the first local traffic features, and the second local traffic features can also be processed through processing methods such as upsampling or downsampling to make the sizes of the features consistent for subsequent processing;

[0097] Second, based on the first local traffic features, cross-attention processing can be performed on the global traffic features to form first cross-attention features corresponding to the global traffic features, and based on the global traffic features, gradient optimization processing (as described previously) can be performed on the first cross-attention features to form corresponding first global gradient optimization features;

[0098] Then, based on the second local traffic feature, cross-attention processing can be performed on the global traffic feature to form a second cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, gradient optimization processing can be performed on the second cross-attention feature to form a corresponding second global gradient optimization feature;

[0099] After that, the first global gradient optimization feature and the second global gradient optimization feature can be subjected to two-way cross-attention processing to form corresponding first global attention feature and second global attention feature (that is, based on the first global gradient optimization feature, cross-attention processing is performed on the second global gradient optimization feature to obtain the first global attention feature, and based on the second global gradient optimization feature, cross-attention processing is performed on the first global gradient optimization feature to obtain the second global attention feature), and based on the concatenated feature of the first global attention feature and the second global attention feature, the target global traffic feature is determined; Exemplarily, this concatenated feature can be directly used as the target global traffic feature, or this concatenated feature can also be processed by convolution, pooling, etc. to obtain the target global traffic feature;

[0100] Finally, full connection processing can be performed on the target global traffic feature to form a full connection feature corresponding to the target global traffic feature, and classification processing can be performed on the full connection feature to output the target operation security analysis result corresponding to the target edge computing gateway; For example, the full connection feature can be mapped to a corresponding probability distribution, such as (a1, a2), through a classification function such as softmax, where a1 can refer to the probability that the target edge computing gateway is subjected to a target network attack, and a2 can refer to the probability that the target edge computing gateway is not subjected to a target network attack.

[0101] Finally, it should also be noted that in order to ensure the reliable execution of the above steps S120 and S130, the operation security analysis method of the edge computing gateway may further include the step of training to form the target operation security analysis network (that is, the step of learning the mapping relationship between the corresponding training data and labels). Exemplarily, this step may include the following content:

[0102] First, training traffic data of the training edge computing gateway can be obtained, where the training traffic data includes the traffic distribution of the training edge computing gateway during the training period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and request times, and can specifically refer to the explanation of the target traffic data in the previous text;

[0103] Secondly, use the semantic mining model in the candidate running security analysis network to perform semantic mining on the training traffic data, and output the corresponding training global traffic features, training first local traffic features, and training second local traffic features. Among them, the training global traffic features are used to reflect the global semantic information in the training traffic data, the training first local traffic features are used to reflect the semantic information about the distribution of traffic volume in the training traffic data, and the training second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the training traffic data. For specific details, please refer to the explanation of step S120 in the previous text;

[0104] Then, use the semantic analysis model in the candidate running security analysis network to perform running security analysis on the training global traffic features, the training first local traffic features, and the training second local traffic features, and output the training running security analysis result corresponding to the training edge computing gateway. Among them, the training running security analysis result is used to reflect whether the training edge computing gateway has been subjected to a target network attack. For specific details, please refer to the explanation of step S130 in the previous text;

[0105] Finally, based on the error (such as cross-entropy error, etc.) between the training running security analysis result and the network attack label corresponding to the training traffic data, the parameters in the candidate running security analysis network can be updated (such as updating the parameters along the direction of reducing the error until the error converges, such as the error is reduced to a preset value or the amplitude of the error reduction is less than a preset amplitude, etc.), so as to obtain the target running security analysis network corresponding to the candidate running security analysis network.

[0106] Combined with Figure 5 , the embodiment of the present application further provides a running security analysis device for the edge computing gateway that can be applied to the above-mentioned electronic device. Among them, the running security analysis device for the edge computing gateway may include a traffic data acquisition module, a semantic mining module, and a semantic analysis module.

[0107] The traffic data acquisition module is used to acquire the target traffic data of the target edge computing gateway. Among them, the target traffic data includes the traffic distribution of the target edge computing gateway within the target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic volume, and the number of requests. In the embodiment of the present application, the traffic data acquisition module can be used to execute Figure 2 the step S110 shown in

[0108] The semantic mining module is used to perform semantic mining on the target traffic data by using the semantic mining model in the target operation security analysis network, and output the corresponding global traffic features, first local traffic features, and second local traffic features. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic features are used to reflect the global semantic information in the target traffic data. The first local traffic features are used to reflect the semantic information about the distribution of traffic volume in the target traffic data. The second local traffic features are used to reflect the semantic information about the distribution of the number of requests in the target traffic data. In the embodiment of the present application, the semantic mining module can be used to execute Figure 2 the steps S120 shown in. For the relevant content of the semantic mining module, reference can be made to the description of step S120 above.

[0109] The semantic analysis module is used to perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features by using the semantic analysis model, and output the target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack. In the embodiment of the present application, the semantic analysis module can be used to execute Figure 2 the steps S130 shown in. For the relevant content of the semantic analysis module, reference can be made to the description of step S130 above.

[0110] In the embodiment of the present application, corresponding to the above operation security analysis method applied to the edge computing gateway of the electronic device, a computer-readable storage medium is also provided. A computer program is stored in the computer-readable storage medium, and when the computer program runs, it executes each step of the operation security analysis method of the edge computing gateway.

[0111] Among them, the steps executed when the foregoing computer program runs will not be elaborated one by one here, and reference can be made to the explanation of the operation security analysis method of the edge computing gateway above.

[0112] In summary, for the method, device, equipment and medium for analyzing the operation security of the edge computing gateway provided in this application, first, target traffic data of the target edge computing gateway is obtained; secondly, the semantic mining model in the target operation security analysis network is used to perform semantic mining on the target traffic data, and the corresponding global traffic characteristics, first local traffic characteristics and second local traffic characteristics are output; then, the semantic analysis model is used to perform operation security analysis on the global traffic characteristics, first local traffic characteristics and second local traffic characteristics, and the target operation security analysis result corresponding to the target edge computing gateway is output. Based on the above content, due to the powerful learning and analysis capabilities of the neural network, potential semantic information can be mined from the target traffic data. Compared with the conventional technical solutions of threshold comparison analysis, more reliable network intrusion judgments can be made. Moreover, in the process of mining potential semantic information, semantic information in three dimensions, namely global semantic information, semantic information about the distribution of traffic sizes, and semantic information about the distribution of request counts, is mined, so that the richness of the mined semantic information can be higher. Therefore, the results analyzed based on the corresponding semantic information are also more reliable, which can improve the problem of relatively low reliability of operation security analysis existing in the prior art, that is, reliable analysis of network intrusion is achieved.

[0113] In several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0114] In addition, each functional module in various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0115] When the above-mentioned functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, an electronic device, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs. It should be noted that in this article, the term "including", "comprising", or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article, or device including a series of elements not only includes those elements, but also includes other elements that are not explicitly listed, or further includes elements inherent to such a process, method, article, or device. Without further limitations, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article, or device including the said element.

[0116] The foregoing is only the preferred embodiment of this application and is not intended to limit this application. For those skilled in the art, this application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims

1. A method for analyzing the operational security of an edge computing gateway, characterized in that, Including: Obtain the target traffic data of the target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway within a target time period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests; Utilize the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic feature is used to reflect the global semantic information in the target traffic data, the first local traffic feature is used to reflect the semantic information about the distribution of the traffic size in the target traffic data, and the second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the target traffic data; Utilize the semantic analysis model to perform operation security analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature, and output the target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

2. The operating security analysis method of the edge computing gateway according to claim 1, wherein The step of utilizing the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the corresponding global traffic feature, first local traffic feature, and second local traffic feature includes: Utilize the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data, and output the global traffic feature corresponding to the target traffic data; Utilize the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the first local traffic feature corresponding to the target traffic data; Utilize the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data, and output the second local traffic feature corresponding to the target traffic data.

3. The operating security analysis method of the edge computing gateway according to claim 2, wherein, The step of utilizing the first mining branch included in the semantic mining model in the target operation security analysis network to perform semantic mining on the target traffic data and output the global traffic feature corresponding to the target traffic data includes: Load the target traffic data into the first mining branch included in the semantic mining model in the target operation security analysis network; Perform embedding processing on the target traffic data to form the traffic embedding feature corresponding to the target traffic data, and perform self-attention processing on the traffic embedding feature to form the traffic attention feature corresponding to the target traffic data; Based on the traffic embedding feature, perform gradient optimization processing on the traffic attention feature to form the global traffic feature corresponding to the target traffic data.

4. The operating security analysis method of the edge computing gateway according to claim 2, characterized in that The step of utilizing the second mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the first local traffic feature corresponding to the target traffic data includes: Based on the distribution of traffic volume in the target traffic data, a traffic volume distribution matrix corresponding to the target traffic data is constructed. In the traffic volume distribution matrix, the traffic volume data in the same row is used to reflect the traffic volume of each data packet of the same source IP. Perform parameter mapping processing on the traffic volume distribution matrix so that each parameter in the traffic volume distribution matrix is mapped to a target interval to form a corresponding traffic volume mapping matrix. Load the traffic volume mapping matrix into the second mining branch included in the semantic mining model. Perform convolution processing on the traffic volume mapping matrix to form traffic volume convolution features corresponding to the traffic volume mapping matrix, and perform self-attention processing on the traffic volume convolution features to form traffic volume attention features corresponding to the traffic volume convolution features. Based on the traffic volume convolution features, perform gradient optimization processing on the traffic volume attention features to form the first local traffic feature corresponding to the target traffic data.

5. The operating security analysis method of the edge computing gateway according to claim 2, wherein The step of using the third mining branch included in the semantic mining model to perform semantic mining on the target traffic data and output the second local traffic feature corresponding to the target traffic data includes: Based on the distribution of the number of requests in the target traffic data, a request number distribution matrix corresponding to the target traffic data is constructed. In the request number distribution matrix, any request number data is used to reflect the difference in the number of requests between two source IPs. Perform parameter mapping processing on the request number distribution matrix so that each parameter in the request number distribution matrix is mapped to a target interval to form a corresponding request number mapping matrix. Load the request number mapping matrix into the third mining branch included in the semantic mining model. Perform convolution processing on the request number mapping matrix to form request number convolution features corresponding to the request number mapping matrix, and perform self-attention processing on the request number convolution features to form request number attention features corresponding to the request number convolution features. Based on the request number convolution features, perform gradient optimization processing on the request number attention features to form the second local traffic feature corresponding to the target traffic data.

6. The operation security analysis method of the edge computing gateway according to claim 1, characterized in that The step of using the semantic analysis model to perform running safety analysis on the global traffic feature, the first local traffic feature, and the second local traffic feature and output the target running safety analysis result corresponding to the target edge computing gateway includes: Load the global traffic feature, the first local traffic feature, and the second local traffic feature into the semantic analysis model. Based on the first local traffic feature, perform cross-attention processing on the global traffic feature to form a first cross-attention feature corresponding to the global traffic feature, and based on the global traffic feature, perform gradient optimization processing on the first cross-attention feature to form a corresponding first global gradient optimization feature. Perform cross-attention processing on the global traffic feature based on the second local traffic feature to form a second cross-attention feature corresponding to the global traffic feature, and perform gradient optimization processing on the second cross-attention feature based on the global traffic feature to form a corresponding second global gradient optimization feature; Perform two-way cross-attention processing on the first global gradient optimization feature and the second global gradient optimization feature to form corresponding first and second global attention features, and determine a target global traffic feature based on the concatenated feature of the first global attention feature and the second global attention feature; Perform fully connected processing on the target global traffic feature to form a fully connected feature corresponding to the target global traffic feature, and perform classification processing on the fully connected feature to output a target operation security analysis result corresponding to the target edge computing gateway.

7. The operation security analysis method of the edge computing gateway according to any one of claims 1-6, characterized in that, The operation security analysis method of the edge computing gateway further includes: Obtain training traffic data for training the edge computing gateway, where the training traffic data includes the traffic distribution of the training edge computing gateway during the training period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests; Use the semantic mining model in the candidate operation security analysis network to perform semantic mining on the training traffic data, and output corresponding training global traffic features, training first local traffic features, and training second local traffic features, where the training global traffic feature is used to reflect the global semantic information in the training traffic data, the training first local traffic feature is used to reflect the semantic information about the distribution of traffic size in the training traffic data, and the training second local traffic feature is used to reflect the semantic information about the distribution of the number of requests in the training traffic data; Use the semantic analysis model in the candidate operation security analysis network to perform operation security analysis on the training global traffic feature, the training first local traffic feature, and the training second local traffic feature, and output a training operation security analysis result corresponding to the training edge computing gateway, where the training operation security analysis result is used to reflect whether the training edge computing gateway has been subjected to a target network attack; Update the parameters in the candidate operation security analysis network based on the error between the training operation security analysis result and the network attack label corresponding to the training traffic data to obtain a target operation security analysis network corresponding to the candidate operation security analysis network.

8. An operating security analysis device for an edge computing gateway, characterized in that, Including: A traffic data acquisition module, configured to acquire target traffic data of a target edge computing gateway, where the target traffic data includes the traffic distribution of the target edge computing gateway during the target period, and this traffic distribution is at least used to characterize the source IP, target port, traffic size, and number of requests; A semantic mining module, which is used to perform semantic mining on the target traffic data by using a semantic mining model in the target operation security analysis network, and output corresponding global traffic features, first local traffic features, and second local traffic features. Among them, the target operation security analysis network belongs to a trained neural network and also includes a semantic analysis model. The global traffic features are used to reflect the global semantic information in the target traffic data. The first local traffic features are used to reflect the semantic information about the distribution of traffic sizes in the target traffic data. The second local traffic features are used to reflect the semantic information about the distribution of request counts in the target traffic data; A semantic analysis module, which is used to perform operation security analysis on the global traffic features, the first local traffic features, and the second local traffic features by using the semantic analysis model, and output a target operation security analysis result corresponding to the target edge computing gateway. Among them, the target operation security analysis result is used to reflect whether the target edge computing gateway has been subjected to a target network attack.

9. An electronic device, characterized in that, Comprising: A memory, which is used to store computer programs; A processor connected to the memory, which is used to execute the computer programs stored in the memory to implement the operation security analysis method of the edge computing gateway according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, and when the computer program runs, it executes the operation security analysis method of the edge computing gateway according to any one of claims 1-7.

Images