Application communication control model construction method, device and equipment

Abstract

The invention discloses an application communication control model construction method, device and equipment. The method comprises the following steps: acquiring a target application communication control sample by utilizing a network monitoring platform; constructing a target application connectivity control data set by using the target application connectivity control sample; constructing a machine learning model; and training the machine learning model by using the target application Unicom control data set to obtain an application Unicom control model. Through the application connectivity control model, the problem that the application connectivity control is easily detected by a network security system in the prior art is solved, and meanwhile, the application connectivity control model can also be used for identifying and detecting the application connectivity control and detecting other network security.

Description

Technical Field

[0001] The present invention relates to the field of computer science and technology, and in particular to the field of application communication control modeling based on artificial intelligence. Background Art

[0002] Application-level Unicom control is one of the network security challenges facing the world. For example, the Unicom control of some well-known AI applications for certain groups of users is one of the cases with great impact. Existing technologies attempt to break through Unicom control at the application level. The present invention classifies them into three categories: the first category is to embed attack traffic into DNS requests using DNS tunneling technology to break through IP Unicom control. The second category is to use anonymous proxy servers to make their traffic appear to come from IP addresses that are not controlled by Unicom to bypass IP-based Unicom control. The third category is to disguise or change its real IP address to circumvent Unicom control. Although the above technologies are effective in breaking through Unicom control, the following problems still exist: (1) Since the pattern of DNS tunnel traffic is different from that of normal DNS traffic, and some entities may control known anonymous proxy servers, DNS tunnels and anonymous servers are easily detected by network security systems, resulting in unavailability. (2) Network security systems can detect the disguise or change of IP addresses and take corresponding blocking measures. Summary of the invention

[0003] In order to solve the above problems, the present invention discloses a method for constructing an application interconnection control model, comprising:

[0004] Use the network monitoring platform to collect target application Unicom control samples;

[0005] Using the target application Unicom control sample to construct a target application Unicom control data set;

[0006] Build machine learning models;

[0007] The target application communication control data set is used to train the machine learning model to obtain an application communication control model.

[0008] In one embodiment of the above method of the present invention, the step of building the network monitoring platform includes:

[0009] Building at least one monitoring server;

[0010] A plurality of detection nodes are constructed, and the detection nodes are connected to the monitoring server.

[0011] In an embodiment of the above method of the present invention, the detection node includes one or more of a personal Internet terminal, a router, a gateway, a network middleware and a virtual private server.

[0012] In one embodiment of the above method of the present invention, the step of collecting target application connectivity control samples is obtained by one or more of crowdsourcing, user authorization and automatic collection.

[0013] In one embodiment of the above method of the present invention, the crowdsourcing method further comprises:

[0014] The target application interconnection control samples of users are collected by one or more methods, including accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and evaluating user contributions with the marginal contribution Shapley value to distribute rewards.

[0015] In one embodiment of the above method of the present invention, the step of collecting the user's target application connectivity control sample further includes:

[0016] A detection node sample is obtained, including network traffic data of the detection node that successfully passes through Unicom control and fails to pass through Unicom control when accessing the target application.

[0017] In one embodiment of the above method of the present invention, the network traffic data of successfully passing the Unicom control and unsuccessfully passing the Unicom control when the detection node accesses the target application further includes:

[0018] Configuration parameters of the detection node, wherein the configuration parameters include variable configuration parameters and immutable configuration parameters.

[0019] In one embodiment of the above method of the present invention, the immutable part of the configuration parameters further includes:

[0020] One or more of IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

[0021] In one embodiment of the above method of the present invention, the variable part configuration parameters further include:

[0022] One or more of HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts concurrently accessed by the same machine, concurrent request throughput, and account-related information.

[0023] In one embodiment of the above method of the present invention, the step of constructing a target application communication control data set using the target application communication control sample further comprises:

[0024] The Unicom control samples are used to mark some of the targets;

[0025] The target application is connected to control the sample for preprocessing.

[0026] In one embodiment of the above method of the present invention, the step of building a machine learning model further includes:

[0027] Build one or more of small deep learning models, pre-trained large models, and formalized models.

[0028] In one embodiment of the above method of the present invention, the step of constructing a small deep learning model further includes:

[0029] Build one or more models including convolutional neural networks, recurrent neural networks, and Transformer-based models;

[0030] Build a classifier, including a fully connected layer and a Softmax classification function;

[0031] Use the first loss function to optimize the model.

[0032] In one embodiment of the above method of the present invention, the step of building a pre-trained large model further includes:

[0033] Build one or more models including GPT, LLaMA, GLM, RWKVBert, Transformer model and BERT model;

[0034] Construct pre-training tasks to pre-train the model in a self-supervised manner;

[0035] Constructing multiple second loss functions;

[0036] Fine-tune the pre-trained model using the configuration samples and positive / negative feedback samples collected from the target application Unicom control sample;

[0037] Build a classifier, including a fully connected layer and a Softmax classification function;

[0038] The model is optimized using the multiple second loss functions.

[0039] In one embodiment of the above method of the present invention, the step of constructing a formalized model further comprises:

[0040] Constructing a formal model by one or more of rule-making, dimensionality reduction, forward combination and / or reverse combination;

[0041] generating a plurality of application request samples according to the formalized model;

[0042] Testing the application request sample using a deep learning small model and / or a pre-trained large model;

[0043] The formalized models whose test pass rate is greater than a pass threshold are retained.

[0044] In one embodiment of the above method of the present invention, the step of constructing a formal model by formulating rules further includes:

[0045] Constructing a rule set for describing key features of the application connectivity control model by formulating rules;

[0046] The rule set is encoded as a formal model using a rule engine or rule language.

[0047] In one embodiment of the above method of the present invention, the step of constructing a formal model by dimensionality reduction further comprises:

[0048] Extracting key features from a feature space describing the application connectivity control model;

[0049] A clustering algorithm is used to generate a subspace of the feature space as a formal model.

[0050] In one embodiment of the above method of the present invention, the step of constructing the formalized model by forward binding and / or reverse binding further comprises:

[0051] Generate a formal model using traversal or optimization search methods.

[0052] The present invention also discloses an application interconnection control model construction device, which is used to execute any of the above methods, including:

[0053] A collection module is used to collect target application communication control samples using a network monitoring platform;

[0054] A data set making module: used to construct a target application Unicom control data set using the target application Unicom control sample;

[0055] Model building module: used to build machine learning models;

[0056] Model training module: used to train the machine learning model using the target application Unicom control data set to obtain an application Unicom control model.

[0057] The present invention also discloses a device based on an application interconnection control model, which is connected to a detection node and used to break through the interconnection control of a target application, comprising: a processor, a memory, and an input / output device, and also comprises the above-mentioned application interconnection control model construction device.

[0058] The present invention also discloses a storage medium for storing a computer control program, wherein the computer control program is used to execute the steps of any one of the above methods.

[0059] The present invention discloses a method, device and equipment for constructing an application connectivity control model, which can accurately express the application connectivity control model and track its changes in real time. It has a wide range of uses, including being used to accurately detect and identify which requests can be controlled by the application connectivity and which requests can break through the application connectivity control.

[0060] At the same time, the network monitoring platform constructed by the present invention can collect a large amount of configuration sample data for model training; a large amount of configuration sample data can be obtained through crowdsourcing, user authorization and automatic collection methods; the application interconnection control model of the present invention can be constructed through deep learning small models, pre-trained large models and formal models, and can be flexibly constructed according to actual conditions and suitable for different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The figure is a flow chart of a method for constructing a communication control model according to an embodiment of the present invention.

[0062] Figure 2 It is a schematic diagram of the architecture of the method for constructing a interconnection control model in one embodiment of the present invention.

[0063] Figure 3 A schematic diagram of the process of constructing a small deep learning model in one embodiment of the present invention.

[0064] Figure 4 The figure is a schematic diagram of the process of constructing a pre-trained large model in one embodiment of the present invention.

[0065] Figure 5 It is a block diagram of the composition of a device for constructing a communication control model in one embodiment of the present invention.

[0066] Figure 6 The present invention is a block diagram of a device based on an application interconnection control model in one embodiment of the present invention.

[0067] Wherein, the reference numerals are:

[0068] 1: Network monitoring platform

[0069] 2: Monitoring Server

[0070] 3: Detection Node

[0071] 4: Target Application

[0072] 5: Application of Unicom Control Model

[0073] 51: Deep Learning Small Model

[0074] 52: Pre-training large models

[0075] 53: Formal Model

[0076] 10: Application of Unicom control model construction device

[0077] 11: Collection module

[0078] 12: Dataset creation module

[0079] 13: Model building module

[0080] 14: Model training module

[0081] 100: Devices based on application-connected control models

[0082] 101: Processor

[0083] 102: Memory

[0084] 103: Input and output devices DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that references to "one embodiment", "embodiment", "example embodiment", etc. in the specification refer to the embodiment described, which may include specific features, structures or characteristics, but does not necessarily include these specific features, structures or characteristics. In addition, such expressions do not refer to the same embodiment. Further, when describing specific features, structures or characteristics in conjunction with the embodiments, whether or not there is a clear description, it has been shown that combining such features, structures or characteristics into other embodiments is within the knowledge of those skilled in the art.

[0086] Certain words are used in the specification and subsequent claims to refer to specific modules, components or parts. It should be understood by those skilled in the art that technical users or manufacturers may refer to the same module, component or part by different nouns or terms. This specification and subsequent claims do not use the difference in name as a way to distinguish modules, components or parts, but use the difference in function of modules, components or parts as the criterion for distinction. "Including" and "including" mentioned throughout the specification and subsequent claims are open-ended terms and should be interpreted as "including but not limited to". In addition, the word "connect" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connection through other devices.

[0087] Furthermore, in the following specification and claims, reference will be made to a number of terms which shall be defined as having the following meanings. The singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. "Optional" or "optionally" means that the subsequently described event or circumstance may or may not occur, and that the description includes instances where the event occurs and instances where it does not.

[0088] See also Figure 1 The present invention discloses a method for constructing an application interconnection control model 5, comprising:

[0089] Step S1: using the network monitoring platform 1 to collect target application Unicom control samples;

[0090] Step S2: construct a target application communication control data set using the target application communication control sample;

[0091] Step S3: Building a machine learning model;

[0092] Step S4: Use the target application Unicom control data set to train the machine learning model to obtain the application Unicom control model 5.

[0093] By utilizing the constructed application connectivity control model 5, the connectivity control model of the application can be accurately expressed and its changes can be tracked in real time, which has a wide range of uses, including accurately detecting and identifying which requests can be controlled by the application connectivity and which requests can break through the application connectivity control. That is, the request can be blocked or released through the recognition result of the connectivity request by the application connectivity control model 5, and the connectivity control of the application can be broken through and the application can be accessed.

[0094] In one embodiment of the above method of the present invention, the step of building a network monitoring platform 1 includes:

[0095] Construct at least one monitoring server 2;

[0096] A plurality of detection nodes 3 are constructed, and the detection nodes 3 are connected to the monitoring server 2 .

[0097] In one embodiment of the above method of the present invention, the detection node 3 includes one or more of a personal Internet terminal, a router, a gateway, a network middleware, and a virtual private server. By setting the detection node as the above device, the source, destination, and characteristics of various traffic in the network can be fully understood, providing a comprehensive and accurate data basis for subsequent processing.

[0098] In one embodiment of the above method of the present invention, the step of collecting target application Unicom control samples is obtained through one or more of crowdsourcing (which can cover scenarios with a large number of samples, multiple sample types, and low-cost data), user authorization (which can cover scenarios with high user participation and trust in data legitimacy and high data quality), and automatic collection (which can collect samples efficiently, in real time, and completely, and is suitable for large-scale data collection scenarios). Collecting samples using the above method can cover a variety of sample collection scenarios.

[0099] In one embodiment of the above method of the present invention, the crowdsourcing method further includes:

[0100] The target application interconnection control samples of users are collected by one or more methods, including accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and evaluating user contributions with the marginal contribution Shapley value to distribute rewards.

[0101] In one embodiment of the above method of the present invention, the step of collecting the user's target application connection control sample further includes:

[0102] A detection node sample is obtained, including network traffic data of the detection node that successfully passes through Unicom control and fails to pass through Unicom control when accessing target application 4.

[0103] In one embodiment of the above method of the present invention, the network traffic data of successfully passing the Unicom control and unsuccessfully passing the Unicom control when the detection node accesses the target application 4 further includes:

[0104] The configuration parameters of the detection node include variable configuration parameters and immutable configuration parameters.

[0105] In one embodiment of the above method of the present invention, the immutable part of the configuration parameters further includes:

[0106] One or more of IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

[0107] In one embodiment of the above method of the present invention, the variable part configuration parameters further include:

[0108] HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts concurrently accessed by the same machine, concurrent request throughput, account-related information such as one or more of nationality, organization, and physical address.

[0109] By collecting the above-mentioned variable configuration parameters and / or immutable configuration parameters, the specific characteristics and information of various traffic in the network can be fully understood, providing a comprehensive and accurate data basis for subsequent processing.

[0110] In one embodiment of the above method of the present invention, the configuration parameters of the detection node also include the result of whether the detection node is successful, that is, a positive / negative configuration parameter sample.

[0111] In one embodiment of the above method of the present invention, the step of constructing a target application communication control data set using the target application communication control sample further includes:

[0112] Marking of Unicom control samples for some targets;

[0113] The target application uses Unicom control samples for preprocessing.

[0114] In one embodiment of the above method of the present invention, the step of building a machine learning model further includes:

[0115] Construct one or more of a small deep learning model 51, a large pre-trained model 52, and a formalized model 53. Appropriate machine learning models can be flexibly constructed based on factors such as the number of samples and specific applicable tasks. The advantages of the above solution are flexible adaptation to different data scales and task requirements, improving resource utilization and model applicability. It reduces the threshold for model deployment, supports end-cloud collaboration, and is suitable for different hardware environments.

[0116] In one embodiment of the above method of the present invention, the step of constructing the deep learning small model 51 further includes:

[0117] Step S301: construct one or more models including a convolutional neural network, a recurrent neural network, and a Transformer-based model;

[0118] Step S302: construct a classifier, including a fully connected layer and a Softmax classification function;

[0119] Step S303: Use the first loss function to perform model optimization.

[0120] In one embodiment of the above method of the present invention, the first loss function may include a cross entropy loss function, a logarithmic loss function, or other loss functions.

[0121] In one embodiment of the above method of the present invention, for the deep learning small model 51, when constructing the target application Unicom control data set for the target application Unicom control sample, it is necessary to label the Unicom control sample to obtain the target application Unicom control data set, and then train the machine learning model according to the target application Unicom control data set to obtain the application Unicom control model 5, that is, M 0 .

[0122] In one embodiment of the above method of the present invention, the step of constructing the pre-trained large model 52 further includes:

[0123] Step S311: construct one or more models including GPT, LLaMA, GLM, RWKVBert, Transformer model and BERT model;

[0124] Step S312: constructing a pre-training task for pre-training the model in a self-supervised manner;

[0125] Step S313: construct multiple second loss functions;

[0126] Step S314: fine-tune the pre-trained model using the configuration samples and positive / negative feedback samples collected from the target application Unicom control sample;

[0127] Step S315: construct a classifier, including a fully connected layer and a Softmax classification function;

[0128] Step S316: Use multiple second loss functions to optimize the model.

[0129] By constructing a small deep learning model, an application interconnection control model is obtained, which has the advantages of high computational efficiency, low resource occupation, easy deployment and strong interpretability.

[0130] Specifically, in one embodiment of the above method of the present invention, for the pre-trained large model 52, when constructing a target application Unicom control data set for the target application Unicom control sample, the request call data (target application Unicom control sample) for accessing the target application 4 (including automatically calling the API to access the target application 4) from the entire network is collected through the detection node 3, and the collected data is pre-processed, including removing missing values, outliers, digitizing text type data, and normalizing.

[0131] In one embodiment of the above method of the present invention, a pre-training task is constructed to pre-train the model in a self-supervised manner, wherein the pre-training task includes predicting the next element in the traffic sequence and identifying different protocols used in network traffic, including HTTP, DNS, TLS, etc.

[0132] In one embodiment of the above method of the present invention, multiple second loss functions are constructed to optimize the model, and the cross entropy loss can be used to predict the protocol type corresponding to the sample, and each network protocol corresponds to a category. The output of the model is a probability distribution, which represents the possibility of each category. The loss function is used to measure the difference between the probability distribution of the model output and the actual label. The model parameters are optimized based on the loss value loop iteration to obtain a pre-trained large model. It should be known to those skilled in the art that the second loss function can also use other loss functions, and the present invention is not limited to this.

[0133] In one embodiment of the above method of the present invention, the configuration samples and positive / negative feedback samples collected from the target application Unicom control sample are used to fine-tune the pre-trained model. Specifically, first, a classification model is constructed on the pre-trained large model, and its structure can be composed of a fully connected layer and a Softmax function. Secondly, the fine-tuning sample is input into the model to obtain a prediction result. Then, the loss between the prediction result and the true value is calculated, and the parameters of the pre-trained model and the classification model are fine-tuned based on the loss value. Finally, the parameters of the pre-trained model and the classification model are optimized in a loop until the model converges, that is, the obtained pre-trained large model 52 is recorded as .

[0134] By constructing a pre-trained large model, an application interconnection control model is obtained to solve the problem of performance degradation of the pre-trained large model in the field of network configuration due to data distribution differences. Feedback samples are used to optimize the model decision boundary and enhance the model's ability to capture interconnection control strategy rules. In summary, this model has the advantages of strong generalization ability, generation ability, and the ability to handle complex tasks.

[0135] In one embodiment of the above method of the present invention, a trained application communication control model 5 (the model can be a deep learning small model 51 or a pre-trained large model 52, i.e. ) predicts whether the sample to be tested successfully accesses the target application 4. For example, if the access is successful, the model output value is 1, otherwise it is 0.

[0136] In one embodiment of the above method of the present invention, the step of constructing the formalized model 53 further includes:

[0137] Constructing a formal model through one or more of rule-making, dimensionality reduction, forward combination and / or reverse combination 53;

[0138] generating a plurality of application request samples according to the formalized model 53;

[0139] Testing the application request samples using the deep learning small model 51 and / or the pre-trained large model 52;

[0140] The formalized models 53 whose test pass rate is greater than a pass threshold are retained.

[0141] Specifically, in one embodiment of the above method of the present invention, the step of constructing the formalized model 53 by formulating rules further includes:

[0142] Construct a rule set to describe the key features of the application connectivity control model 5 by formulating rules; specifically, the rule set includes the source, frequency, content and behavior of the request, etc. For example, whether the IP address of the request is in the blacklist, whether the user agent field contains a specific crawler identifier, whether the request frequency from the same IP address exceeds the set threshold, whether the request comes from a specific geographical location, whether the request contains abnormal behavior, where abnormal behavior includes large-scale request errors, abnormal user interaction patterns, etc.

[0143] The rule set is encoded as a formal model using a rule engine or rule language 53. Specifically, a rule engine such as Drools, Jess or CLIPS is selected, and a rule file is constructed according to the syntax format set by the rule engine, that is, describing the rules and triggering conditions. The set rule engine will determine whether to trigger the rule according to the conditions defined in the rule file. If a match is found, the operation defined in the rule is executed, such as marking the request as being controlled by Unicom.

[0144] In one embodiment of the above method, the step of constructing the formalized model 53 by dimensionality reduction further includes:

[0145] Extract key features from the feature space describing the application connectivity control model 5; specifically, extract request pattern information by using machine learning methods, such as request frequency features, request time period features, URL segmentation features, user agent string features, keyword matching features, request time interval features, request historical behavior features, etc., and use domain expertise and correlation analysis to select features that contribute more to the model, i.e., key features.

[0146] A clustering algorithm is used to generate a subspace of the feature space as a formal model 53. For example, a clustering algorithm such as K-means, DBSCAN, or hierarchical clustering is used to adjust the distance of samples in the embedding space, assign each data point to a corresponding cluster, and use the features of the cluster center of each cluster to represent the entire cluster. The quality of clustering is evaluated using the silhouette coefficient or label, and iterative optimization is performed until the clustering algorithm converges. Finally, the features of the cluster center of each cluster constitute the formal model 53.

[0147] In one embodiment of the above method, the step of generating breakthrough samples using a formal model constructed by formulating rules includes:

[0148] Use automated scripts to traverse the encoded rule set and generate application requests (samples).

[0149] In one embodiment of the above method, the step of generating breakthrough samples using a formal model constructed by dimensionality reduction includes:

[0150] The optimization algorithm is used to automatically find the optimal application request in the subspace of the feature space. The optimization algorithm includes a genetic algorithm and a simulated annealing algorithm. At the same time, the optimization algorithm uses the performance indicators of the application interconnection control model 5 as the optimization objective function. Common performance indicators include accuracy, false alarm rate, etc.

[0151] When the breakthrough sample generated by the formal model is input into the application Unicom control model 5 for testing, the Unicom control model extracts the characteristics of the application request sample and predicts the probability that the sample can pass the Unicom control. According to the results of the simulation test, the candidate solutions of the formal model are iteratively optimized.

[0152] If the probability of the batch-generated breakthrough samples passing the Unicom control is higher than the set passing threshold, such as 99%, it is considered that the formal model is highly fitted with the Unicom control model and can be used as the final formal model.

[0153] By efficiently searching for the optimal strategy through automation, the inefficiency of manual exhaustive strategies is avoided, the strategy tuning time is greatly reduced, and the objective function is used to ensure that the optimization direction is consistent with the target task, thereby improving the quality of the strategy. Through the collaborative verification of the formal model and the Unicom control model, the formal model is iteratively improved based on test feedback, and the Unicom control model enhances the generalization ability by adding new samples. In traditional solutions, the formal model and the Unicom control model are usually used independently. This embodiment achieves two-way optimization by breaking through sample testing and probability threshold verification, solving the problem of the separation between the two. The decision-making process of the formal model is transparent and meets regulatory requirements. In summary, the application Unicom control model obtained through the formal model has the advantages of high accuracy, reliability, and high interpretability.

[0154] In one embodiment of the above method of the present invention, the step of constructing the formalized model 53 by forward binding and / or reverse binding further includes:

[0155] Generate a formal model using traversal or optimization search methods53;

[0156] Generate multiple application request samples according to the formal model;

[0157] Testing the application request samples using the deep learning small model 51 and / or the pre-trained large model 52;

[0158] The formalized models 53 whose test pass rate is greater than the above pass threshold are retained.

[0159] In the above scheme, the formal model generates diversified samples, comprehensively verifies the robustness of the deep learning model, and reduces labor costs. The combination of fast initial screening of small models and fine judgment of large models improves reliability and reduces computing overhead. The formal model provides interpretable rules, and the deep learning model handles complex patterns, taking into account both accuracy and transparency. In summary, the final formal model is constructed by combining the formal model with a small deep learning model and / or a pre-trained large model, and then the application Unicom control model is obtained. The advantages of the small deep learning model and the pre-trained large model can be combined to make the application Unicom control model have the advantages of high accuracy, reliability, and high interpretability.

[0160] The present invention also discloses an application interconnection control model construction device 10, which is used to execute any of the above methods, including:

[0161] The collection module 11 is used to collect target application communication control samples using the network monitoring platform 1;

[0162] Data set making module 12: used for constructing a target application Unicom control data set by using the target application Unicom control sample;

[0163] Model building module 13: used to build machine learning models;

[0164] Model training module 14: used to train the machine learning model using the target application Unicom control data set to obtain the application Unicom control model 5.

[0165] The present invention also discloses a device based on an application interconnection control model 5, which is connected to a detection node 3 and used to break through the interconnection control of a target application 4, comprising: a processor 101, a memory 102, and an input / output device 103, and also comprises the above-mentioned application interconnection control model construction device 10. The above-mentioned device based on the application interconnection control model 5 may be a server, or may be another type of device including the above-mentioned application interconnection control model construction device 10.

[0166] The present invention also discloses a storage medium for storing a computer control program, and the computer control program is used to execute the steps of any one of the above methods.

[0167] The above-mentioned computer program executable by the processor 101 can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the technical field.

[0168] The method, device and equipment for constructing an application interconnection control model disclosed in the present invention solves the problem that the prior art is easily detected by the network security system when breaking through the application interconnection control. At the same time, the interconnection control model can also be used for identification and detection of breaking through the application interconnection control and other network security detections.

[0169] At the same time, the network monitoring platform constructed by the present invention can collect a large amount of configuration sample data for model training; a large amount of configuration sample data can be obtained through crowdsourcing, user authorization and automatic collection methods; the application interconnection control model of the present invention can be constructed through deep learning small models, pre-trained large models and formal models, and can be flexibly constructed according to actual conditions and suitable for different scenarios.

[0170] In summary, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, technicians familiar with the field can evolve various corresponding changes and deformations based on the present invention, but these corresponding changes and deformations should all fall within the scope of protection of the patent applied for the present invention.

Claims

1. A method for constructing an application interconnection control model, characterized in that: include: Use the network monitoring platform to collect target application Unicom control samples; Using the target application Unicom control sample to construct a target application Unicom control data set; Build machine learning models; The target application communication control data set is used to train the machine learning model to obtain an application communication control model.

2. The method according to claim 1, characterized in that: The steps of constructing the network monitoring platform include: Building at least one monitoring server; A plurality of detection nodes are constructed, and the detection nodes are connected to the monitoring server.

3. The method according to claim 2, characterized in that: The detection node includes one or more of a personal Internet terminal, a router, a gateway, a network middleware and a virtual private server.

4. The method according to claim 1, characterized in that The step of collecting target application connectivity control samples is obtained through one or more of crowdsourcing, user authorization and automatic collection.

5. The method according to claim 4, characterized in that The crowdsourcing method further includes: The target application interconnection control samples of users are collected by one or more methods, including accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and evaluating user contributions with the marginal contribution Shapley value to distribute rewards.

6. The method according to claim 5, characterized in that The step of collecting the user's target application communication control sample further includes: A detection node sample is obtained, including network traffic data of the detection node that successfully passes through Unicom control and fails to pass through Unicom control when accessing the target application.

7. The method according to claim 6, characterized in that The network traffic data of the detection node target application that successfully passes the Unicom control and that fails to pass the Unicom control further includes: Configuration parameters of the detection node, wherein the configuration parameters include variable configuration parameters and immutable configuration parameters.

8. The method according to claim 7, characterized in that The immutable part configuration parameters further include: One or more of IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

9. The method according to claim 7, characterized in that The variable part configuration parameters further include: One or more of HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts concurrently accessed by the same machine, concurrent request throughput, and account-related information.

10. The method according to claim 1, characterized in that The step of constructing a target application communication control data set using the target application communication control sample further includes: Marking of some of the target application Unicom control samples; The target application is connected to control the sample for preprocessing.

11. The method according to claim 1, characterized in that The step of building a machine learning model further includes: Build one or more of small deep learning models, pre-trained large models, and formalized models.

12. The method according to claim 11, characterized in that The step of constructing a small deep learning model further includes: Build one or more models including convolutional neural networks, recurrent neural networks, and Transformer-based models; Build a classifier, including a fully connected layer and a Softmax classification function; Use the first loss function to optimize the model.

13. The method according to claim 11, characterized in that The step of constructing a pre-trained large model further includes: Build one or more models including GPT, LLaMA, GLM, RWKVBert, Transformer model and BERT model; Construct pre-training tasks to pre-train the model in a self-supervised manner; Constructing multiple second loss functions; Fine-tune the pre-trained model using the configuration samples and positive / negative feedback samples collected from the target application Unicom control sample; Build a classifier, including a fully connected layer and a Softmax classification function; The model is optimized using the multiple second loss functions.

14. The method according to claim 11, characterized in that The step of constructing a formalized model further includes: Constructing a formal model by one or more of rule-making, dimensionality reduction, forward combination and / or reverse combination; generating a plurality of application request samples according to the formalized model; Testing the application request sample using a deep learning small model and / or a pre-trained large model; The formalized models whose test pass rate is greater than a pass threshold are retained.

15. The method according to claim 14, characterized in that The step of constructing a formal model by formulating rules further includes: Constructing a rule set for describing key features of the application connectivity control model by formulating rules; The rule set is encoded as a formal model using a rule engine or rule language.

16. The method according to claim 14, characterized in that The step of constructing a formal model by dimensionality reduction further includes: Extracting key features from a feature space describing the application connectivity control model; A clustering algorithm is used to generate a subspace of the feature space as a formal model.

17. The method according to claim 14, characterized in that The step of constructing the formalized model by forward binding and / or reverse binding further includes: Generate a formal model using traversal or optimization search methods.

18. An application interconnection control model construction device, used to execute the method according to any one of claims 1 to 17, characterized in that: include: A collection module is used to collect target application communication control samples using a network monitoring platform; A data set making module: used to construct a target application Unicom control data set using the target application Unicom control sample; Model building module: used to build machine learning models; Model training module: used to train the machine learning model using the target application Unicom control data set to obtain an application Unicom control model.

19. A device based on an application connectivity control model, connected to a detection node and used to break through the connectivity control of a target application, comprising: A processor, a memory and an input / output device, characterized in that it also includes an application communication control model building device as described in claim 18.

20. A storage medium for storing a computer control program, characterized in that: The computer control program is used to execute the steps of the method according to any one of claims 1 to 17.

Images