Deep learning self-training model tuning method based on electric power closed source terminal

Abstract

The invention discloses a deep learning self-training model tuning method based on an electric power closed source terminal, and relates to the technical field of data processing, and the method comprises the steps: obtaining basic training sample data and real access data of a network attack detection model of the electric power closed source terminal, and carrying out the clustering analysis, calculating to obtain a model failure coefficient and a type attack data missing amount; according to the model failure coefficient and the multiple types of attack data missing quantities, multiple sample supplementary quantities are obtained through calculation, a supplementary sample attack data set is generated through a data confrontation generation channel, and the network attack detection model is updated, trained and optimized. According to the method, the technical problems that an existing network attack detection model of the electric power closed source terminal is insufficient in adaptability when facing a novel network attack and the detection accuracy is gradually attenuated are solved, and the purpose that the detection accuracy is gradually reduced through self-training and data updating is achieved. And the adaptability and the accuracy of the network attack detection model of the power closed source terminal are continuously improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly to a deep learning self-training model tuning method based on a power closed-source terminal. Background Art

[0002] In a power system, as a key device, the power closed-source terminal is of crucial importance for its security. With the continuous development of network technology, the power closed-source terminal is facing more and more network attack threats, such as malicious software intrusion, data tampering, denial of service, etc. To effectively address these threats, the power closed-source terminal is usually equipped with a network attack detection model to monitor and identify potential network attacks in real time.

[0003] The existing technology uses a deep learning training network attack detection model for attack detection and attack type identification. This model can identify and detect various network attack types by training a large amount of network attack data. However, over time, the attack methods and patterns are also constantly evolving, resulting in a reduced adaptability of the original model, thus affecting its detection effect. Summary of the Invention

[0004] This application provides a deep learning self-training model tuning method based on a power closed-source terminal, which is used to solve the technical problem that the existing network attack detection model of the power closed-source terminal has insufficient adaptability and gradually decaying detection accuracy when facing new network attacks.

[0005] In the first aspect of this application, a deep learning self-training model tuning method based on a power closed-source terminal is provided. The method includes: obtaining a preset number of basic training sample data of the network attack detection model of the power closed-source terminal, and performing clustering analysis to obtain the number of attack data of multiple sample types, wherein the network attack detection model is obtained based on deep learning training; obtaining the real access data of the power closed-source terminal within a preset time range in the past, and performing clustering analysis to obtain the number of real type attack data of multiple types; calculating and analyzing to obtain a model failure coefficient and the amount of missing attack data of multiple types according to the number of attack data of multiple sample types and the number of real type attack data of multiple types; calculating to obtain multiple sample supplement amounts according to the model failure coefficient and the amount of missing attack data of multiple types, inputting the real attack data in the real access data into a data adversarial generation channel to obtain multiple supplementary sample attack data sets of the multiple sample supplement amounts, and performing update training and tuning on the network attack detection model to obtain a tuned network attack detection model.

[0006] In a second aspect, the present application provides an electronic device, including: a processor, the processor is coupled to a memory, and the memory is used to store a program, and when the program is executed by the processor, the system is caused to execute the method according to any one of the first aspect.

[0007] In a third aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0008] One or more technical solutions provided in the present application have at least the following technical effects or advantages:

[0009] A deep learning self-training model tuning method based on a power closed-source terminal provided in the present application relates to the technical field of data processing. By obtaining basic training sample data and real access data for clustering analysis, calculating the model failure coefficient and the amount of missing attack data. According to these analysis results, the sample supplement amount is determined, and a generative adversarial network is used to generate a supplementary sample data set to update and optimize the network attack detection model, thereby improving the detection accuracy and adaptability of the model. It solves the technical problem that the existing network attack detection model of the power closed-source terminal has insufficient adaptability and the detection accuracy gradually decays when facing new network attacks, and realizes the technical effect of continuously improving the adaptability and accuracy of the network attack detection model of the power closed-source terminal through self-training and data update, thereby enhancing the security and reliability of the power system. Description of the Drawings

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0011] Figure 1 It is a schematic flowchart of a deep learning self-training model tuning method based on a power closed-source terminal provided by an embodiment of the present application;

[0012] Figure 2 It is a schematic flowchart of updating and training and tuning a network attack detection model in a deep learning self-training model tuning method based on a power closed-source terminal provided by an embodiment of the present application;

[0013] Figure 3 It is a schematic structural diagram of an electronic device provided by the present application.

[0014] Description of the reference numerals: Electronic device 300, Memory 301, Processor 302, Communication interface 303, Bus architecture 304. Detailed implementation mode

[0015] The present application provides a deep learning self-training model tuning method based on a power closed-source terminal, which is used to solve the technical problems that the existing network attack detection model of the power closed-source terminal has insufficient adaptability in the face of new network attacks and the detection accuracy gradually decays.

[0016] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative work shall fall within the protection scope of the present application.

[0017] It should be noted that the terms "first", "second", etc. in the specification of the present application and the above-mentioned accompanying drawings are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but may include other steps or modules not clearly listed or inherent to these processes, methods, products or devices.

[0018] Embodiment 1, as Figure 1 shown, the present application provides a deep learning self-training model tuning method based on a power closed-source terminal, and the method includes:

[0019] P10: Obtain the basic training sample data of a preset sample quantity of the network attack detection model of the power closed-source terminal, and perform clustering analysis to obtain the number of sample type attack data of multiple types, wherein the network attack detection model is obtained based on deep learning training.

[0020] Furthermore, step P10 of the embodiment of the present application further includes:

[0021] P11: Obtain the basic training sample data of a preset sample quantity of the network attack detection model of the power closed-source terminal, and extract the sample attack data set and the sample attack type set in the basic training sample data; P12: Cluster the sample attack data set according to the same sample attack types in the sample attack type set to obtain multiple type sample attack data sets, and respectively count the number of sample type attack data of multiple sample attack types.

[0022] It should be understood that a preset number of basic training sample data are obtained from the network attack detection model of the power closed-source terminal. These data usually contain various network attack events collected by the power closed-source terminal over a period of time in the past and are recorded as a sample attack data set. Each sample attack data set contains detailed information about the attack event, such as the timestamp of the attack occurrence, the source IP address, the target IP address, the attack type, etc. At the same time, these sample attack data sets are also equipped with corresponding sample attack type sets, that is, each attack event is marked with a specific attack type, such as packet injection attack, scanning attack, DDoS attack, etc.

[0023] Specifically, first, it is necessary to obtain a preset number of basic training sample data of the power closed-source terminal. These sample data usually include information such as terminal access logs, IP addresses, timestamps, etc., which can provide important clues about network activities. Further, the sample attack data set and the sample attack type set are separated from the obtained basic training sample data. Among them, the sample attack data set contains detailed information about all attack events, such as abnormal requests and packet information, while the sample attack type set contains all attack types, such as packet injection attack and scanning attack, etc., which can ensure that the model can understand various attack forms. Each attack type is associated with one or more attack events in the sample attack data set.

[0024] Next, the sample attack data set is subjected to clustering analysis according to the same sample attack types in the sample attack type set. Clustering analysis is a commonly used data mining technique that can divide a data set into multiple clusters, making the data points within the same cluster similar to each other, while the data points between different clusters are quite different. In this application, clustering algorithms (such as K-means, hierarchical clustering, etc.) are used to divide the sample attack data set with the same attack type into the same cluster, thereby obtaining multiple type sample attack data sets. Each type sample attack data set contains all the sample attack data belonging to that attack type. Finally, the number of samples in each type sample attack data set is respectively counted, providing quantitative information about different attack types for the model, so that subsequent model training can be more effectively adjusted according to the actual situation.

[0025] Through the above steps, not only can the distribution of sample attack data be clearly understood, but also necessary support can be provided for model training. This systematic method ensures that the attack detection model can effectively adapt to different types of attacks, thereby improving the accuracy and reliability of its detection.

[0026] P20: Obtain the real access data of the power closed-source terminal within a preset time range in the past, conduct clustering analysis, and obtain the number of real type attack data.

[0027] Further, step P20 of the embodiment of the present application further includes:

[0028] P21: Obtain the real access data of the power closed-source terminal within a preset time range in the past, and extract the real attack data set and the real attack type set from the real access data; P22: Cluster the real attack data set according to the same real attack types in the real attack type set to obtain multiple type real attack data sets, and respectively count the multiple real type attack data quantities of multiple real attack types.

[0029] Optionally, obtain the real access data of the power closed-source terminal within a preset time range in the past, and perform clustering analysis on it to obtain the multiple real type attack data quantities.

[0030] First, obtain the real access data of the power closed-source terminal within a preset time period in the past (such as one month, one quarter, etc.). These data usually include all network access requests received by the terminal during this period, including user access records, operation logs, and event records, and can reflect the real situation of network activities.

[0031] Further, separate the real attack data set and the real attack type set from the obtained real access data. Among them, the real attack data set contains all access requests identified as attack events, and these requests usually have some abnormal characteristics, such as abnormal request frequencies, request parameters, source addresses, etc. The real attack type set is a list containing all unique attack types, and each attack type is associated with one or more attack events in the real attack data set. These attack types may be known (such as DDoS attacks, SQL injections, etc.) or unknown (i.e., new attack types).

[0032] Next, perform clustering analysis on the real attack data set according to the same real attack types in the real attack type set. Select an appropriate clustering algorithm (such as K-means, DBSCAN, or hierarchical clustering) to divide the real attack data set with the same attack type into the same cluster, so as to obtain multiple type real attack data sets. Each type real attack data set contains all real attack data belonging to this attack type. Then, respectively count the data quantities in each type real attack data set, that is, obtain the multiple real type attack data quantities of multiple real attack types. These data quantities reflect the frequencies and intensities of various types of attacks suffered by the power closed-source terminal within a preset time range in the past, and can provide quantitative information about different real attack types for the model, so that subsequent model training can better reflect the actual situation.

[0033] P30: Calculate and analytically obtain a model failure coefficient, as well as the missing amounts of multiple types of attack data, based on the quantities of multiple sample-type attack data and multiple true-type attack data.

[0034] Further, step P30 of the embodiments of the present application further includes:

[0035] P31: Calculate the difference between the quantity of true-type attack data and the quantity of sample-type attack data of the same attack type based on the quantities of multiple sample-type attack data and multiple true-type attack data, to obtain the missing amounts of multiple types of attack data; P32: Calculate the missing amounts of the multiple types of attack data and the deviation amplitudes respectively, to obtain the deviation amplitudes of the quantities of multiple types of data; P33: Calculate the mean value of the deviation amplitudes of the quantities of the multiple types of data as the model failure coefficient.

[0036] Specifically, by comparing the quantities of multiple sample-type attack data and multiple true-type attack data, the performance of the network attack detection model is deeply evaluated, and based on this, the model failure coefficient and the missing amounts of multiple types of attack data are calculated.

[0037] First, calculate the difference between the quantity of true attack data and the quantity of sample attack data of the same attack type according to the quantities of multiple sample-type attack data and multiple true-type attack data. This calculation result reveals the missing amount of each attack type, that is, the number of attack instances that are not fully trained or recognized. For example, if the quantity of true data of a certain attack type is 50 and the quantity of sample data is 30, then the missing amount of this type is 20. This information is crucial for subsequent model tuning because it indicates the deficiencies of the model in certain attack types. When the quantity of true attack data far exceeds the sample data, it indicates that the model may lack sufficient training for this type of attack; conversely, if the sample data is excessive and the true data is scarce, it may mean that the model pays excessive attention to or misjudges this type of attack. The set of missing amounts of multiple types of attack data can reflect the data coverage of the model in various attacks.

[0038] Next, calculate the missing amounts of the obtained multiple types of attack data and the corresponding deviation amplitudes respectively. By calculating the ratio or difference between the missing amount of each type of attack data and the quantity of its corresponding sample-type attack data (the specific method can be flexibly selected according to actual needs), the deviation amplitudes of the quantities of multiple types of data are obtained, which are used to measure the recognition accuracy of the model in different attack types. Through this calculation, the system can understand the performance differences of each attack type in the training and actual environments, and help identify the weak links of the model.

[0039] Finally, calculate the mean value of the deviation amplitudes of the quantities of multiple types of data, and use this as the model failure coefficient. The model failure coefficient reflects the adaptability of the model to different attack types. The larger the value, the higher the degree of failure of the model in identifying certain attack types. When the model failure coefficient is high, it indicates that there are problems with the data coverage or distribution balance of the model in multiple attack types, and targeted data supplementation or model tuning may be required. On the contrary, if the model failure coefficient is low, it indicates that the data coverage and distribution of the model in various attacks are relatively balanced, and the model performance is relatively stable. This coefficient provides an important reference basis for subsequent model tuning, enabling the model to be optimized for specific attack types to ensure its effectiveness and reliability in practical applications.

[0040] P40: Calculate multiple sample supplementation amounts based on the model failure coefficient and the missing amounts of multiple types of attack data. Input the real attack data in the real access data into the data adversarial generation channel to obtain multiple supplementary sample attack data sets corresponding to the multiple sample supplementation amounts, and update and train and tune the network attack detection model to obtain a tuned network attack detection model.

[0041] Further, step P40 of the embodiment of the present application further includes:

[0042] P41: Obtain multiple sample supplementation amounts by multiplying the model failure coefficient by the missing amounts of multiple types of attack data.

[0043] In a possible embodiment of the present application, based on the model failure coefficient and the missing amounts of multiple types of attack data, calculate the required multiple sample supplementation amounts, and use the real attack data in the real access data to generate multiple supplementary sample attack data sets that match these supplementation amounts through the data adversarial generation channel, and use these newly generated sample data sets to update and train and tune the network attack detection model, so as to obtain a tuned network attack detection model with better performance.

[0044] Specifically, the required sample supplementation amount can be calculated based on the product of the model failure coefficient and the missing amounts of multiple types of attack data. This calculation process can be expressed by the following formula: Sample supplementation amount = Model failure coefficient × Missing amounts of multiple types of attack data. For example, if the model failure coefficient for a certain type of attack is 2 and the missing amount is 10, then the sample supplementation amount is 20. Among them, the model failure coefficient reflects the effectiveness of the model in identifying specific attack types. The greater the degree of failure, it means the model has insufficient performance in these types, so more supplementary sample data is needed for training and tuning. On the contrary, if the failure coefficient is small, it indicates that the model is relatively accurate in detecting this type of attack, and the required supplementary sample amount will be reduced. This method can ensure that the model can flexibly adapt to changes in different attack types, timely supplement the missing training data, and thus improve its overall performance.

[0045] After calculating multiple sample supplementation amounts, the real attack data in the real access data can be input into the data adversarial generation channel to generate a supplementary sample attack data set. The data adversarial generation channel is a tool that can generate synthetic data similar to but not exactly the same as the real data, and can quickly generate a large number of supplementary sample attack data sets. These synthetic data not only have a similar feature distribution to the real data, but also can effectively simulate various potential attack scenarios, thus greatly enriching the training data of the model.

[0046] Finally, the newly generated supplementary sample attack data set is used to update, train, and tune the network attack detection model. During the training process, deep learning algorithms and optimization techniques can be adopted to ensure that the model can fully learn the features and information of these new data. After multiple rounds of iterative training, a tuned network attack detection model with better performance is obtained. This new model not only has a significantly improved detection accuracy for various attack types, but also has made great progress in overall robustness and generalization ability, ensuring good reliability and effectiveness in practical applications.

[0047] Further, as Figure 2 shown, for updating, training, and tuning the network attack detection model, step P40 of the embodiment of the present application further includes:

[0048] P42: The pre-trained data adversarial generation channel, where multiple data adversarial generation paths corresponding to multiple attack types are included in the data adversarial generation channel; P43: Extract multiple type-true attack data sets of multiple true attack types from the real access data; P44: Respectively input the multiple type-true attack data sets combined with random noise into the corresponding multiple data adversarial generation paths to respectively generate multiple supplementary sample attack data sets, where the number of data in the multiple supplementary sample attack data sets is respectively the multiple sample supplement amounts; P45: Use the multiple supplementary sample attack data sets combined with the multiple type-true attack data sets and multiple attack types to update, train, and optimize the network attack detection model.

[0049] It should be understood that the specific process of updating, training, and optimizing the network attack detection model can be, first, to perform the pre-training work of the data adversarial generation channel. The data adversarial generation channel is a generation model that can generate synthetic data similar to but not exactly the same as the real data by learning the distribution of the real data. In this application, this channel is designed to include multiple data adversarial generation paths corresponding to multiple attack types. Each path is specifically responsible for generating supplementary sample data for a specific attack type. Such a design can generate more targeted supplementary samples for different types of attacks, thereby improving the training effect of the model.

[0050] Next, extract multiple type-true attack data sets of multiple true attack types from the real access data. These data sets are the basis for subsequent supplementary sample generation and model update training, providing important information about the attack types and helping to maintain the characteristics of real attack behaviors when generating samples. By carefully screening and organizing these real attack data, it can be ensured that the generated supplementary samples are highly consistent with the real attack scenarios.

[0051] Then, respectively input the multiple type-true attack data sets combined with random noise into the corresponding multiple data adversarial generation paths. The purpose of this is to utilize the generation ability of the data adversarial generation channel to generate multiple supplementary sample attack data sets based on the real attack data and random noise. The number of each data set will be set according to the previously calculated sample supplement amount. Such a design can ensure that the generated supplementary samples are both diverse and can accurately supplement the data missing of the model in various attacks.

[0052] Finally, multiple supplementary sample attack datasets are combined with multiple types of real attack datasets and multiple attack types to update, train, and optimize the network attack detection model. During the training process, by fully utilizing these newly generated supplementary samples and real attack data, through iterative training and optimization algorithms, the detection performance and generalization ability of the model are continuously improved. After multiple rounds of training, a tuned network attack detection model with better performance is obtained, which not only improves the detection performance of the model but also provides a more solid guarantee for its future practical applications.

[0053] Further, for the pre-training of the data adversarial generation channel, step P42 of the embodiment of the present application further includes:

[0054] P42-1: Collect a set of attack data of multiple sample attack types according to multiple attack types; P42-2: Based on the generative adversarial network, construct the network structure of the multiple data adversarial generation paths, and each data adversarial generation path includes a generator and a discriminator; P42-3: Respectively use the set of attack data of the multiple sample attack types to iteratively train the generator and the discriminator in the multiple data adversarial generation paths until the generation convergence requirement is met, and obtain multiple data adversarial generation paths; P42-4: Combine the multiple data adversarial generation paths to obtain a data adversarial generation channel.

[0055] Specifically, the specific process of pre-training the data adversarial generation channel can be as follows. First, according to multiple attack types, collect relevant sets of attack data of multiple sample attack types. These data sets include various real attack samples, such as packet injection, denial of service, etc., to ensure that a wide range of attack forms can be covered. By widely collecting sample data of various attack scenarios, it can ensure that the generator can learn the diversity of attacks, thereby improving the training effect of the model and the detection accuracy in actual applications.

[0056] After sufficient data is collected, based on the principle of the generative adversarial network (GAN), construct the network structure of multiple data adversarial generation paths. Each data adversarial generation path includes a generator and a discriminator (or called a discriminator). The task of the generator is to generate synthetic data similar to the real data, while the task of the discriminator is to distinguish the generated data from the real data and promote the improvement of the generator through feedback. This structure enables the generative networks to interact with each other during the training process, thereby continuously improving the quality of the generated samples.

[0057] Next, multiple collected sample attack type data sets are used to iteratively train the generator and discriminator in each data adversarial generation path. This process will continue until the generation convergence requirement is met, that is, the generated samples are similar to the real samples in terms of features, and the discriminator cannot easily distinguish between the fake samples and the real samples. This iterative training not only improves the quality of the generated samples but also enhances the learning ability of the model, enabling it to better adapt to the actual attack scenarios.

[0058] Finally, multiple trained data adversarial generation paths are combined to obtain a complete data adversarial generation channel. By combining multiple paths, the system can achieve a more complex sample generation process, ensuring that the generated samples cover the characteristics of multiple attack types. This combination not only improves the diversity and accuracy of sample generation but also provides a rich data source for subsequent model training.

[0059] Through the above steps, the network attack detection model of the power closed-source terminal can effectively generate diverse attack samples, improving its detection ability and accuracy in practical applications.

[0060] In summary, the embodiments of the present application at least have the following technical effects:

[0061] In the present application, the basic training sample data and real access data of the network attack detection model of the power closed-source terminal are obtained for clustering analysis, and the model failure coefficient and the missing amount of type attack data are calculated. Based on the model failure coefficient and multiple missing amounts of type attack data, multiple sample supplement amounts are calculated, and a corresponding number of supplementary sample attack data sets are generated using the data adversarial generation channel to update and optimize the training of the network attack detection model.

[0062] It achieves the technical effect of continuously improving the adaptability and accuracy of the network attack detection model of the power closed-source terminal through self-training and data update, thereby enhancing the security and reliability of the power system.

[0063] Embodiment 2, based on the same inventive concept as the method for optimizing the deep learning self-training model based on the power closed-source terminal in the foregoing embodiment, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method in Embodiment 1 is implemented.

[0064] Through the foregoing detailed description of a method for optimizing a deep learning self-training model based on a power closed-source terminal, those skilled in the art can clearly know a method and system for optimizing a deep learning self-training model based on a power closed-source terminal in this embodiment. Therefore, for the sake of brevity of the specification, it will not be described in detail herein. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0065] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0066] Exemplary electronic device

[0067] Reference is made below Figure 3 to describe the electronic device of the embodiments of the present application.

[0068] Based on the same inventive concept as the method for optimizing a deep learning self-training model based on a power closed-source terminal in the foregoing embodiment, the present application further provides a system for optimizing a deep learning self-training model based on a power closed-source terminal, including: a processor, the processor is coupled to a memory, and the memory is used to store a program. When the program is executed by the processor, the system is enabled to execute the steps of the method described in Embodiment 1.

[0069] The electronic device 300 includes: a processor 302, a communication interface 303, and a memory 301. Optionally, the electronic device 300 may further include a bus architecture 304. Among them, the communication interface 303, the processor 302, and the memory 301 may be interconnected through the bus architecture 304; the bus architecture 304 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus architecture 304 may be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, Figure 3 only a thick line is used to represent it in the figure, but it does not mean that there is only one bus or one type of bus.

[0070] The processor 302 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application solution.

[0071] The communication interface 303 uses any device such as a transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), wired access network, etc.

[0072] The memory 301 can be a ROM or other types of static storage devices that can store static information and instructions, a RAM or other types of dynamic storage devices that can store information and instructions, or can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM), or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory can exist independently and be connected to the processor through the bus architecture 304. The memory can also be integrated with the processor.

[0073] Among them, the memory 301 is used to store the computer execution instructions for executing the solution of this application, and is controlled by the processor 302 for execution. The processor 302 is used to execute the computer execution instructions stored in the memory 301, so as to implement a method for optimizing a deep learning self-training model based on a power closed-source terminal provided in the above embodiments of this application.

[0074] It should be noted that the above sequence of embodiments of this application is only for description and does not represent the advantages or disadvantages of the embodiments. And the above specific embodiments of this specification have been described. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0075] The above are only the preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of this application shall be included in the protection scope of this application.

[0076] This specification and the accompanying drawings are merely illustrative of the present application and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the present application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, provided that these modifications and variations of the present application fall within the scope of the present application and its equivalent technologies, the present application is intended to cover these changes and modifications.

Claims

1. A deep learning self-training model tuning method based on a closed-source power terminal, characterized in that: The method comprises: Obtaining a preset number of basic training sample data of a network attack detection model for a closed-source power terminal, and performing cluster analysis to obtain a number of attack data of multiple sample types, wherein the network attack detection model is obtained based on deep learning training; Acquire the real access data of the power closed-source terminal within a preset time range in the past, perform cluster analysis, and obtain the number of real attack data of multiple types; According to the numbers of the attack data of the multiple sample types and the numbers of the attack data of the multiple real types, calculating and analyzing to obtain the model failure coefficient and the missing amount of the attack data of the multiple types; According to the model failure coefficient and the missing amount of multiple types of attack data, multiple sample supplement amounts are calculated, and the real attack data in the real access data is input into the data adversarial generation channel to obtain multiple supplementary sample attack data sets of the multiple sample supplement amounts, and the network attack detection model is updated, trained and optimized to obtain the optimized network attack detection model.

2. The deep learning self-training model tuning method based on the power closed source terminal according to claim 1 is characterized in that: Obtain a preset number of basic training sample data of the network attack detection model of the power closed-source terminal, and perform cluster analysis to obtain the number of attack data of multiple sample types, including: Obtaining a preset number of basic training sample data of a network attack detection model for a closed-source power terminal, and extracting a sample attack data set and a sample attack type set from the basic training sample data; According to the same sample attack types in the sample attack type set, the sample attack data set is clustered to obtain multiple types of sample attack data sets, and the number of multiple sample type attack data of the multiple sample attack types is respectively obtained by counting.

3. The deep learning self-training model tuning method based on the power closed source terminal according to claim 1 is characterized in that: Acquire the real access data of the power closed-source terminal within the past preset time range, perform cluster analysis, and obtain the number of real attack data of multiple types, including: Acquire real access data of the power closed-source terminal within a preset time range in the past, and extract a real attack data set and a real attack type set from the real access data; According to the same real attack type in the real attack type set, the real attack data set is clustered to obtain multiple types of real attack data sets, and the number of multiple types of real attack data of multiple real attack types is respectively obtained by counting.

4. The deep learning self-training model tuning method based on the power closed source terminal according to claim 1 is characterized in that: According to the number of attack data of the multiple sample types and the number of attack data of the multiple real types, the model failure coefficient and the missing amount of attack data of the multiple types are calculated and analyzed, including: According to the numbers of the multiple sample type attack data and the numbers of the multiple real type attack data, the difference between the number of real type attack data and the number of sample type attack data of the same attack type is calculated to obtain the missing amount of multiple types of attack data; Calculate the missing amount and deviation amplitude of the multiple types of attack data respectively to obtain the deviation amplitude of the number of multiple types of data; The mean value of the deviation amplitudes of the quantity of the multiple types of data is calculated as the model failure coefficient.

5. The deep learning self-training model tuning method based on the power closed source terminal according to claim 1 is characterized in that: According to the failure coefficient of the model and the missing amount of multiple types of attack data, multiple sample supplement amounts are calculated, including: Multiple sample supplement quantities are obtained by multiplying the model failure coefficient by the missing quantities of the multiple types of attack data.

6. The deep learning self-training model tuning method based on the power closed source terminal according to claim 1 is characterized in that: Inputting the real attack data in the real access data into the data adversarial generation channel to obtain multiple supplementary sample attack data sets of the multiple sample supplementary amounts, and updating, training and optimizing the network attack detection model, including: A pre-trained data adversarial generation channel, wherein the data adversarial generation channel includes multiple data adversarial generation paths corresponding to multiple attack types; Extracting multiple types of real attack data sets of multiple real attack types in the real access data; Combine the multiple types of real attack data sets with the multiple data adversarial generation paths corresponding to the random noise input, and generate multiple supplementary sample attack data sets respectively, wherein the number of data in the multiple supplementary sample attack data sets is the multiple sample supplement amounts respectively; The network attack detection model is updated, trained and optimized by using the multiple supplementary sample attack data sets in combination with the multiple types of real attack data sets and multiple attack types.

7. The deep learning self-training model tuning method based on the power closed source terminal according to claim 6 is characterized in that: Pre-training data adversarial generation channel, including: According to multiple attack types, collecting multiple sample attack type attack data sets; Based on a generative adversarial network, construct a network structure of the multiple data adversarial generation paths, each data adversarial generation path including a generator and an adversary; Using the multiple sample attack type attack data sets respectively, iteratively train the generators and adversaries in the multiple data adversarial generation paths until the generation convergence requirements are met, and obtain multiple data adversarial generation paths; The multiple data adversarial generation paths are combined to obtain a data adversarial generation channel.

8. An electronic device, characterized in that: include: A processor, the processor is coupled to a memory, the memory is used to store a program, when the program is executed by the processor, the system is enabled to perform the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 7 are implemented.

Images