Method, apparatus and device for constructing a unified control model

Abstract

A kind of application interconnection control model construction method, device and equipment, comprising: target application interconnection control sample is collected using network monitoring platform;Target application interconnection control sample is used to build target application interconnection control dataset;Machine learning model is built;The machine learning model is trained using the target application interconnection control dataset, and application interconnection control model is obtained.By the application interconnection control model, the problem that prior art breaks through application interconnection control and is easily detected by network security system is solved, and the application interconnection control model can also be used for identification and detection and other network security detection to break through application interconnection control.

Description

Technical Field

[0001] This invention relates to the field of computer science and technology, and in particular to the field of application-based connectivity control modeling based on artificial intelligence. Background Technology

[0002] Application-level connectivity control is one of the global cybersecurity challenges. For example, the connectivity control of certain well-known AI applications targeting specific user groups is a case with a huge impact. Existing technologies have attempted to break through connectivity control at the application level. This invention classifies them into three categories: The first category is to use DNS tunneling technology to embed attack traffic into DNS requests to break through IP connectivity control. The second category is to use anonymous proxy servers to make their traffic appear to come from IP addresses that are not connected to the network, in order to bypass IP-based connectivity control. The third category is to disguise or change their real IP address to circumvent connectivity control. Although the above technologies are effective in breaking through connectivity control, the following problems still exist: (1) Since the pattern of DNS tunnel traffic is different from that of normal DNS traffic, and some entities may connect to and control known anonymous proxy servers, DNS tunnels and anonymous servers are easily detected by network security systems, thus becoming unusable. (2) Network security systems can detect the disguise or change of IP addresses and take corresponding blocking measures. Summary of the Invention

[0003] To address the aforementioned problems, this invention discloses a method for constructing a connectivity control model, comprising:

[0004] Collect target application connectivity control samples using a network monitoring platform;

[0005] Construct a target application connectivity control dataset using the target application connectivity control samples;

[0006] Build machine learning models;

[0007] The machine learning model is trained using the target application connectivity control dataset to obtain the application connectivity control model.

[0008] In one embodiment of the method described above, the step of constructing the network monitoring platform includes:

[0009] Build at least one monitoring server;

[0010] Multiple detection nodes are constructed, and the detection nodes are connected to the monitoring server.

[0011] In one embodiment of the method described above, the detection node includes one or more of a personal internet terminal, a router, a gateway, a network middleware, and a virtual private server.

[0012] In one embodiment of the method described above, the step of collecting target application control samples is obtained through one or more of crowdsourcing, user authorization, and automatic collection methods.

[0013] In one embodiment of the method described above, the crowdsourcing approach further includes:

[0014] Collect user target application control samples through one or more of the following methods: accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and using the marginal contribution Shapley value to evaluate user contributions and distribute rewards.

[0015] In one embodiment of the method described above, the step of collecting user target application connectivity control samples further includes:

[0016] Obtain probe node samples, including network traffic data of the probe nodes when accessing the target application, including those that successfully passed the connection control and those that failed to pass the connection control.

[0017] In one embodiment of the method described above, the network traffic data of the probe node successfully accessing the target application and unsuccessfully accessing the network control system further includes:

[0018] Configuration parameters for the probe node, wherein the configuration parameters include variable configuration parameters and invariable configuration parameters.

[0019] In one embodiment of the method described above, the immutable configuration parameters further include:

[0020] One or more of the following: IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

[0021] In one embodiment of the method described above, the variable configuration parameters further include:

[0022] One or more of the following: HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts accessing concurrently on the same machine, concurrent request throughput, and account-related information.

[0023] In one embodiment of the method of the present invention, the step of constructing the target application connectivity control dataset using the target application connectivity control sample further includes:

[0024] The aforementioned targets are labeled using connectivity control samples;

[0025] The target application uses connected control samples for preprocessing.

[0026] In one embodiment of the method described above, the step of constructing the machine learning model further includes:

[0027] Construct one or more of the following: deep learning small models, pre-trained large models, and formal models.

[0028] In one embodiment of the method described above, the step of constructing a small deep learning model further includes:

[0029] Construct one or more models, including convolutional neural networks, recurrent neural networks, and Transformer-based models;

[0030] Construct a classifier, including a fully connected layer and a Softmax classification function;

[0031] The model is optimized using the first loss function.

[0032] In one embodiment of the method described above, the step of constructing a pre-trained large model further includes:

[0033] Construct one or more models, including GPT, LLaMA, GLM, RWKVBert, Transformer, and BERT models;

[0034] Construct a pre-training task to pre-train the model in a self-supervised manner;

[0035] Construct multiple second loss functions;

[0036] The pre-trained model is fine-tuned using configuration samples and positive / negative feedback samples collected from the target application's interconnected control samples;

[0037] Construct a classifier, including a fully connected layer and a Softmax classification function;

[0038] The model is optimized using the multiple second loss functions.

[0039] In one embodiment of the method described above, the step of constructing the formal model further includes:

[0040] Formal models can be constructed by using one or more of the following methods: rule-based approach, dimensionality reduction approach, forward combination approach, and / or reverse combination approach.

[0041] Multiple application request samples are generated based on the formal model;

[0042] The application request samples are tested using deep learning small models and / or pre-trained large models;

[0043] The formalized model is retained if the test pass rate is greater than a pass threshold.

[0044] In one embodiment of the method described above, the step of constructing a formal model by formulating rules further includes:

[0045] Construct a set of rules to describe the key features of the application connectivity control model by formulating rules;

[0046] The rule set is encoded as a formal model using a rule engine or rule language.

[0047] In one embodiment of the method described above, the step of constructing the formal model through dimensionality reduction further includes:

[0048] Extract key features from the feature space describing the application connectivity control model;

[0049] Clustering algorithms are used to generate subspaces of the feature space as formal models.

[0050] In one embodiment of the method of the present invention, the step of constructing the formal model using forward and / or reverse bonding further includes:

[0051] Formal models are generated using traversal or optimization search methods.

[0052] The present invention also discloses an apparatus for constructing a connectivity control model, used to perform any of the above methods, comprising:

[0053] The data acquisition module is used to collect target application connectivity control samples using a network monitoring platform.

[0054] Dataset creation module: used to construct the target application connectivity control dataset using the target application connectivity control samples;

[0055] Model building module: Used to build machine learning models;

[0056] Model training module: used to train the machine learning model using the target application connectivity control dataset to obtain the application connectivity control model.

[0057] The present invention also discloses a device based on an application connectivity control model, which is connected to a probe node and used to break the connectivity control of a target application, including: a processor, a memory, and an input / output device, and also includes the above-mentioned application connectivity control model construction device.

[0058] The present invention also discloses a storage medium for storing a computer control program, the computer control program being used to execute the steps of any of the above methods.

[0059] This invention discloses a method, apparatus, and device for constructing an application connectivity control model, which can accurately express the application connectivity control model and track its changes in real time. It has a wide range of applications, including for accurately detecting and identifying which requests can be controlled by the application connectivity and which requests can break through the application connectivity control.

[0060] Meanwhile, the network monitoring platform constructed by this invention can collect a large amount of configuration sample data for model training; it can acquire a large amount of configuration sample data through various methods such as crowdsourcing, user authorization, and automatic collection; the application connectivity control model of this invention can be constructed through deep learning small models, pre-trained large models, and formal models, and can be flexibly constructed according to actual conditions, making it suitable for different scenarios. Attached Figure Description

[0061] Figure 1 This is a flowchart illustrating the application of a connection control model construction method in one embodiment of the present invention.

[0062] Figure 2 This is a schematic diagram of the architecture of the connection control model construction method in one embodiment of the present invention.

[0063] Figure 3 This is a schematic diagram of the process of constructing a small deep learning model in one embodiment of the present invention.

[0064] Figure 4 This is a schematic diagram of the process of constructing a pre-trained large model in one embodiment of the present invention.

[0065] Figure 5 This is a block diagram of the device for constructing a connection control model in one embodiment of the present invention.

[0066] Figure 6 This is a block diagram of a device based on an application connectivity control model according to an embodiment of the present invention.

[0067] In the attached figures, the following labels are used:

[0068] 1: Network monitoring platform

[0069] 2: Monitoring Server

[0070] 3: Detection Node

[0071] 4: Target Application

[0072] 5: Application of the interconnection control model

[0073] 51: Small Deep Learning Models

[0074] 52: Pre-trained large models

[0075] 53: Formal Models

[0076] 10: Application of the interconnected control model to construct the device

[0077] 11: Data Acquisition Module

[0078] 12: Dataset Creation Module

[0079] 13: Model Building Module

[0080] 14: Model Training Module

[0081] 100: Devices based on the application connectivity control model

[0082] 101: Processor

[0083] 102: Memory

[0084] 103: Input / output devices Detailed Implementation

[0085] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that references to "an embodiment," "embodiment," "example embodiment," etc., in the specification refer to the described embodiment including specific features, structures, or characteristics, but not necessarily including these specific features, structures, or characteristics. Furthermore, such expressions do not refer to the same embodiment. Moreover, when describing specific features, structures, or characteristics in conjunction with embodiments, whether or not explicitly described, it is indicated that incorporating such features, structures, or characteristics into other embodiments is within the knowledge scope of those skilled in the art.

[0086] The specification and subsequent claims use certain terms to refer to specific modules, components, or parts. Those skilled in the art will understand that users or manufacturers may use different names or terms to refer to the same module, component, or part. This specification and subsequent claims do not distinguish modules, components, or parts by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and subsequent claims are open-ended and should be interpreted as "including but not limited to." Furthermore, the term "connection" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connections via other means.

[0087] Furthermore, in the following description and claims, numerous terms will be referenced, which should be defined as having the following meanings. The singular forms “a” and “the” include plural referents, unless the context clearly specifies otherwise. “Optional” or “optionally” indicates that an event or situation subsequently described may or may not occur, and the description includes both the scenario where the event occurs and the scenario where the event does not occur.

[0088] Please see Figure 1 This invention discloses a method for constructing a connectivity control model 5, comprising:

[0089] Step S1: Collect target application connectivity control samples using network monitoring platform 1;

[0090] Step S2: Construct the target application connectivity control dataset using the target application connectivity control samples;

[0091] Step S3: Build a machine learning model;

[0092] Step S4: Train the machine learning model using the target application connectivity control dataset to obtain application connectivity control model 5.

[0093] The constructed application connectivity control model 5 can accurately express the application's connectivity control model and track its changes in real time. It has a wide range of uses, including accurately detecting and identifying which requests can be controlled by the application connectivity control and which requests can bypass the application connectivity control. It can block or allow a request based on the identification results of the connectivity request through the application connectivity control model 5, and it can also bypass the application's connectivity control to access the application.

[0094] In one embodiment of the method described above, the step of constructing the network monitoring platform 1 includes:

[0095] Build at least one monitoring server 2;

[0096] Multiple detection nodes 3 are constructed, and the detection nodes 3 are connected to the monitoring server 2.

[0097] In one embodiment of the method described above, the probe node 3 includes one or more of a personal internet terminal, a router, a gateway, network middleware, and a virtual private server. By setting the probe node as one of these devices, the source, destination, and characteristics of various traffic flows in the network can be fully understood, providing a comprehensive and accurate data foundation for subsequent processing.

[0098] In one embodiment of the method described above, the step of collecting target application connectivity control samples is achieved through one or more of the following methods: crowdsourcing (which can cover scenarios with a large number of samples, multiple sample types, and low-cost data), user authorization (which can cover scenarios with high user participation and trust, ensuring data legality and high data quality), and automatic collection (which can efficiently, in real-time, and completely collect samples, suitable for large-scale data collection scenarios). The sample collection methods described above can cover a variety of sample collection scenarios.

[0099] In one embodiment of the method described above, the crowdsourcing approach further includes:

[0100] Collect user target application control samples through one or more of the following methods: accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and using the marginal contribution Shapley value to evaluate user contributions and distribute rewards.

[0101] In one embodiment of the method described above, the step of collecting user target application communication control samples further includes:

[0102] Obtain probe node samples, including network traffic data of probe nodes successfully accessing target application 4 through Unicom control and those that failed to do so.

[0103] In one embodiment of the method described above, the network traffic data of the probe node successfully passing the connection control and unsuccessfully passing the connection control when accessing the target application 4 further includes:

[0104] The configuration parameters of the probe node include both variable and immutable configuration parameters.

[0105] In one embodiment of the method described above, the immutable configuration parameters further include:

[0106] One or more of the following: IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

[0107] In one embodiment of the method described above, the variable configuration parameters further include:

[0108] HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts accessing concurrently on the same machine, concurrent request throughput, and one or more account-related information such as nationality, organization affiliation, and physical address.

[0109] By collecting the aforementioned variable and / or invariable configuration parameters, a comprehensive understanding of the specific characteristics and information of various traffic flows in the network can be obtained, providing a comprehensive and accurate data foundation for subsequent processing.

[0110] In one embodiment of the method described above, the configuration parameters of the probe node also include the result of whether the probe node is successful, i.e., positive / negative configuration parameter samples.

[0111] In one embodiment of the method of the present invention, the step of constructing a target application connectivity control dataset using target application connectivity control samples further includes:

[0112] Annotate some target samples using connectivity control.

[0113] The target application uses connected control samples for preprocessing.

[0114] In one embodiment of the method described above, the step of constructing a machine learning model further includes:

[0115] Construct one or more of the following: a small deep learning model (51), a pre-trained large model (52), and a formal model (53). Suitable machine learning models can be flexibly constructed based on factors such as the size of the sample size and the specific applicable task. The advantages of the above approach are: flexible adaptation to different data scales and task requirements, improved resource utilization and model applicability; lowering the model deployment threshold; supporting edge-cloud collaboration; and suitability for different hardware environments.

[0116] In one embodiment of the method described above, step 51 of constructing a small deep learning model further includes:

[0117] Step S301: Construct one or more models, including convolutional neural networks, recurrent neural networks, and Transformer-based models;

[0118] Step S302: Construct a classifier, including a fully connected layer and a Softmax classification function;

[0119] Step S303: Optimize the model using the first loss function.

[0120] In one embodiment of the method described above, the first loss function may include the cross-entropy loss function, the logarithmic loss function, or other loss functions.

[0121] In one embodiment of the method described above, for the deep learning small model 51, when constructing the target application connection control dataset from the target application connection control samples, it is necessary to label the connection control samples to obtain the target application connection control dataset. Then, the machine learning model is trained based on the target application connection control dataset to obtain the application connection control model 5, i.e., M0.

[0122] In one embodiment of the method described above, step 52 of constructing the pre-trained large model further includes:

[0123] Step S311: Construct one or more models including GPT, LLaMA, GLM, RWKVBert, Transformer, and BERT.

[0124] Step S312: Construct a pre-training task to pre-train the model in a self-supervised manner;

[0125] Step S313: Construct multiple second loss functions;

[0126] Step S314: Fine-tune the pre-trained model using the configuration samples and positive / negative feedback samples collected from the target application's connected control samples;

[0127] Step S315: Construct a classifier, including a fully connected layer and a Softmax classification function;

[0128] Step S316: Optimize the model using multiple second loss functions.

[0129] By constructing a small deep learning model, an application-oriented control model can be obtained, which has the advantages of high computational efficiency, low resource consumption, easy deployment, and strong interpretability.

[0130] Specifically, in one embodiment of the above method of the present invention, when constructing the target application connectivity control dataset for the pre-trained large model 52, the target application connectivity control data (target application connectivity control samples) of the entire network accessing the target application 4 (including automatic API calls to access the target application 4) are collected through the probe node 3. The collected data is preprocessed, including removing missing values, outliers, numerical text type data, and normalization.

[0131] In one embodiment of the method described above, a pre-training task is constructed to pre-train the model in a self-supervised manner. The pre-training task includes predicting the next element in a traffic sequence and identifying different protocols used in network traffic, including HTTP, DNS, and TLS.

[0132] In one embodiment of the method described above, multiple second loss functions are constructed to optimize the model. Cross-entropy loss can be used to predict the protocol type corresponding to the sample, with each network protocol corresponding to a category. The model output is a probability distribution representing the likelihood of each category. The loss function is used to measure the difference between the probability distribution output by the model and the actual label. The model parameters are iteratively optimized based on the loss value to obtain a pre-trained large model. Those skilled in the art should understand that other loss functions can also be used as the second loss function, and this invention is not limited thereto.

[0133] In one embodiment of the method described above, the pre-trained model is fine-tuned using configuration samples and positive / negative feedback samples collected from the target application's connectivity control samples. Specifically, firstly, a classification model is built on top of the pre-trained large model, whose structure can consist of fully connected layers and a softmax function. Secondly, the fine-tuned samples are input into the model to obtain prediction results. Then, the loss between the prediction results and the true values ​​is calculated, and the parameters of the pre-trained model and the classification model are fine-tuned based on the loss value. Finally, the parameters of the pre-trained model and the classification model are iteratively optimized until the model converges, resulting in the pre-trained large model 52, denoted as... .

[0134] By constructing a pre-trained large model, an application connectivity control model is obtained, addressing the performance degradation issue caused by data distribution differences in network configuration. Feedback samples are used to optimize the model's decision boundary, enhancing its ability to capture connectivity control policy rules. In summary, this model possesses advantages such as strong generalization ability, generative ability, and the capacity to handle complex tasks.

[0135] In one embodiment of the method described above, a trained application connectivity control model 5 can be used (this model can be a deep learning small model 51 or a pre-trained large model 52, i.e. Predict whether the test sample successfully accesses the target application. For example, if it successfully accesses the application, the model outputs a value of 1, otherwise it outputs a value of 0.

[0136] In one embodiment of the method described above, step 53 of constructing the formal model further includes:

[0137] Formal models can be constructed by one or more of the following methods: rule formulation, dimensionality reduction, forward combination, and / or reverse combination.53

[0138] Multiple application request samples were generated based on formal model 53;

[0139] Test the application request samples using a deep learning small model 51 and / or a pre-trained large model 52;

[0140] Formal models with a test pass rate greater than a pass threshold are retained.53

[0141] Specifically, in one embodiment of the method described above, step 53, which involves constructing a formal model by formulating rules, further includes:

[0142] A rule set is constructed to describe the key characteristics of the application's connectivity control model 5 by defining rules. Specifically, the rule set includes the source, frequency, content, and behavior of requests. For example, whether the requesting IP address is in a blacklist, whether the user agent field contains a specific crawler identifier, whether the frequency of requests from the same IP address exceeds a set threshold, whether the request originates from a specific geographical location, and whether the request contains abnormal behavior, including large-scale request errors and abnormal user interaction patterns.

[0143] The rule set is encoded as a formal model using a rule engine or rule language.53 Specifically, a rule engine such as Drools, Jess, or CLIPS is selected, and a rule file is constructed according to the syntax format set by the rule engine, which describes the rules and triggering conditions. The configured rule engine will determine whether to trigger the rule based on the conditions defined in the rule file. If a match is found, the operation defined in the rule will be executed, such as marking the request as being controlled by connectivity.

[0144] In one embodiment of the above method, step 53, which constructs the formal model through dimensionality reduction, further includes:

[0145] Key features are extracted from the feature space describing the application's control model 5. Specifically, request pattern information is extracted using machine learning methods, such as request frequency features, request time period features, URL segmentation features, user agent string features, keyword matching features, request time interval features, and historical request behavior features. Domain expertise and relevance analysis are used to select features that contribute significantly to the model, i.e., key features.

[0146] A subspace of the feature space is generated using clustering algorithms as a formal model 53. For example, clustering algorithms such as K-means, DBSCAN, and hierarchical clustering are used to adjust the distance between samples in the embedding space, assigning each data point to a corresponding cluster. The features of the cluster centers of each cluster represent the entire cluster. The quality of clustering is evaluated using silhouette coefficients or labels, and iterative optimization is performed until the clustering algorithm converges. Finally, the features of the cluster centers of each cluster constitute the formal model 53.

[0147] In one embodiment of the above method, the step of generating breakthrough samples using a formal model constructed by formulating rules includes:

[0148] The coded rule set is traversed using automated scripts to generate application requests (samples).

[0149] In one embodiment of the above method, the step of generating breakthrough samples using a formal model constructed through dimensionality reduction includes:

[0150] The optimization algorithm automatically finds the optimal application request in a subspace of the feature space. This optimization algorithm includes genetic algorithms and simulated annealing algorithms. The optimization algorithm uses the performance metrics of the application connectivity control model 5 as the objective function, with common performance metrics such as accuracy and false alarm rate.

[0151] When breakthrough samples generated using the formal model are input into the application's connectivity control model 5 for testing, the connectivity control model extracts features from the application request samples and predicts the probability that the sample can pass the connectivity control. Based on the simulation test results, the candidate solutions of the formal model are iteratively optimized.

[0152] If the probability of the batch-generated breakthrough samples passing the connection control is higher than the set passing threshold, such as 99%, then the formal model is considered to be highly fitted to the connection control model and can be used as the final formal model.

[0153] By automating and efficiently searching for the optimal strategy, the inefficiency of manual exhaustive search is avoided, significantly reducing strategy tuning time. The objective function ensures that the optimization direction aligns with the target task, improving strategy quality. Through collaborative verification of the formal model and the connected control model, the formal model is iteratively improved based on test feedback, while the connected control model enhances its generalization ability by adding new samples. In traditional solutions, the formal model and the connected control model are typically used independently; this embodiment achieves bidirectional optimization by breaking through sample testing and probability threshold verification, resolving the issue of their separation. The decision-making process of the formal model is transparent and complies with regulatory requirements. In summary, obtaining an applied connected control model through the formal model offers advantages such as high accuracy, reliability, and high interpretability.

[0154] In one embodiment of the method described above, step 53, which involves constructing a formal model using forward and / or reverse bonding, further includes:

[0155] Formal models are generated using traversal or optimization search methods 53;

[0156] Generate multiple application request samples based on the formal model;

[0157] Test the application request samples using a deep learning small model 51 and / or a pre-trained large model 52;

[0158] Formal models with a test pass rate greater than the above pass threshold are retained (53).

[0159] In the above scheme, the formal model generates diverse samples to comprehensively verify the robustness of the deep learning model and reduce manual costs. The combination of rapid initial screening by small models and fine-grained judgment by large models improves reliability and reduces computational overhead. The formal model provides interpretable rules, while the deep learning model handles complex patterns, balancing accuracy and transparency. In summary, by combining the formal model with small deep learning models and / or pre-trained large models to construct the final formal model, an applied connected control model is obtained. Furthermore, by combining the advantages of small deep learning models and pre-trained large models, the applied connected control model possesses the advantages of high accuracy, reliability, and high interpretability.

[0160] The present invention also discloses an application connectivity control model construction device 10, used to perform any of the above methods, comprising:

[0161] The acquisition module 11 is used to acquire target application connectivity control samples using the network monitoring platform 1;

[0162] Dataset creation module 12: Used to construct a target application connectivity control dataset using target application connectivity control samples;

[0163] Model building module 13: Used to build machine learning models;

[0164] Model training module 14: Used to train the machine learning model using the target application connectivity control dataset to obtain application connectivity control model 5.

[0165] This invention also discloses a device based on an application connectivity control model 5, connected to a probe node 3 and used to bypass the connectivity control of a target application 4, comprising: a processor 101, a memory 102, and an input / output device 103, and further comprising the application connectivity control model construction device 10 as described above. The aforementioned device based on the application connectivity control model 5 can be a server, or other types of devices including the aforementioned application connectivity control model construction device 10.

[0166] The present invention also discloses a storage medium for storing a computer control program, the computer control program being used to execute the steps of any of the above methods.

[0167] The computer program that can be executed by the processor 101 may be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0168] The present invention discloses a method, apparatus, and device for constructing an application connectivity control model, which solves the problem that existing technologies are easily detected by network security systems when they break through application connectivity control. At the same time, the connectivity control model can also be used for the identification and detection of breakthroughs in application connectivity control and other network security detection.

[0169] Meanwhile, the network monitoring platform constructed by this invention can collect a large amount of configuration sample data for model training; it can acquire a large amount of configuration sample data through various methods such as crowdsourcing, user authorization, and automatic collection; the application connectivity control model of this invention can be constructed through deep learning small models, pre-trained large models, and formal models, and can be flexibly constructed according to actual conditions, making it suitable for different scenarios.

[0170] In summary, the present invention may have many other embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can devise various corresponding changes and modifications based on the present invention, but these corresponding changes and modifications should all fall within the protection scope of the patent application of the present invention.

Claims

1. A method for constructing a connected control model, characterized in that, include: Collect target application connectivity control samples using a network monitoring platform; Construct a target application connectivity control dataset using the target application connectivity control samples; Build machine learning models; The machine learning model is trained using the target application connectivity control dataset to obtain the application connectivity control model, wherein... The application connectivity control model is used to identify the connectivity request of the target application to perform connectivity control, or to bypass the connectivity control of the target application to access the target application. The construction of the machine learning model further includes: Formal models can be constructed by using one or more of the following methods: rule-based approach, dimensionality reduction approach, forward combination approach, and / or reverse combination approach. Multiple application request samples are generated based on the formal model; The application request samples are tested using deep learning small models and / or pre-trained large models; The formalized model is retained if the test pass rate is greater than a pass threshold.

2. The method as described in claim 1, characterized in that, The steps for constructing the network monitoring platform include: Build at least one monitoring server; Multiple detection nodes are constructed, and the detection nodes are connected to the monitoring server.

3. The method as described in claim 2, characterized in that, The detection nodes include one or more of the following: personal internet terminals, routers, gateways, network middleware, and virtual private servers.

4. The method as described in claim 1, characterized in that, The target application control sample collection step is obtained through one or more of the following methods: crowdsourcing, user authorization, and automatic collection.

5. The method as described in claim 4, characterized in that, The crowdsourcing method further includes: Collect user target application control samples through one or more of the following methods: accumulating user contribution points or monetary rewards, authorizing users to use services for free, purchasing data from users at a fixed price, and using the marginal contribution Shapley value to evaluate user contributions and distribute rewards.

6. The method as described in claim 5, characterized in that, The step of collecting user target application connectivity control samples further includes: Obtain probe node samples, including network traffic data of the probe nodes when accessing the target application, including those that successfully passed the connection control and those that failed to pass the connection control.

7. The method as described in claim 6, characterized in that, The network traffic data of the probe node successfully accessing the target application and unsuccessfully accessing the network control system further includes: Configuration parameters for the probe node, wherein the configuration parameters include variable configuration parameters and invariable configuration parameters.

8. The method as described in claim 7, characterized in that, The immutable configuration parameters further include: One or more of the following: IP address, bandwidth, operating system, operating system version, network protocol stack version, and related hardware information fingerprint.

9. The method as described in claim 7, characterized in that, The variable configuration parameters further include: One or more of the following: HTTP request interval, HTTPS request interval, number of concurrent application requests, number of different application accounts accessing concurrently on the same machine, concurrent request throughput, and account-related information.

10. The method as described in claim 1, characterized in that, The step of constructing the target application connectivity control dataset using the target application connectivity control sample further includes: The target application connectivity control samples are labeled; The target application uses connected control samples for preprocessing.

11. The method as described in claim 1, characterized in that, The construction steps of the deep learning small model further include: Construct one or more models, including convolutional neural networks, recurrent neural networks, and Transformer-based models; Construct a classifier, including a fully connected layer and a Softmax classification function; The model is optimized using the first loss function.

12. The method as described in claim 1, characterized in that, The steps for constructing the pre-trained large model further include: Construct one or more models, including GPT, LLaMA, GLM, RWKVBert, Transformer, and BERT models; Construct a pre-training task to pre-train the model in a self-supervised manner; Construct multiple second loss functions; The pre-trained model is fine-tuned using configuration samples and positive / negative feedback samples collected from the target application's interconnected control samples; Construct a classifier, including a fully connected layer and a Softmax classification function; The model is optimized using the multiple second loss functions.

13. The method as described in claim 1, characterized in that, The step of constructing a formal model by formulating rules further includes: Construct a set of rules to describe the key features of the application connectivity control model by formulating rules; The rule set is encoded as a formal model using a rule engine or rule language.

14. The method as described in claim 1, characterized in that, The step of constructing the formal model through dimensionality reduction further includes: Extract key features from the feature space describing the application connectivity control model; Clustering algorithms are used to generate subspaces of the feature space as formal models.

15. The method as described in claim 1, characterized in that, The step of constructing the formal model using forward and / or reverse associative methods further includes: Formal models are generated using traversal or optimization search methods.

16. An apparatus for constructing a connectivity control model, used to perform the method as described in any one of claims 1-15, characterized in that, include: The data acquisition module is used to collect target application connectivity control samples using a network monitoring platform. Dataset creation module: used to construct the target application connectivity control dataset using the target application connectivity control samples; Model building module: Used to build machine learning models; Model training module: used to train the machine learning model using the target application connectivity control dataset to obtain the application connectivity control model.

17. A device based on an application connectivity control model, connected to a probe node and used to bypass the connectivity control of a target application, comprising: The processor, memory, and input / output devices are characterized by further comprising the application connectivity control model construction apparatus as described in claim 16.

18. A storage medium for storing a computer control program, characterized in that, The computer control program is used to perform the steps of the method as described in any one of claims 1 to 15.

Images