Multi-element network security equipment intelligent access method based on deep learning
Through the intelligent access method of multi-network security devices based on deep learning, analytical sub-models and device categories are established, and call sub-policies are set, which solves the complex problem of network security device access management, improves access and resolution efficiency, and ensures the stable operation of network security devices.
Patent Information
- Application Number
- CN202510279582.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-10
- Publication Date
- 2025-06-27
AI Technical Summary
The access management of network security equipment in large distributed information systems is complex, and the resolution efficiency is low, making it difficult to ensure the stable operation of network security equipment.
The intelligent access method of multi-network security devices based on deep learning is adopted. By establishing multiple analytical sub-models and device categories, setting call sub-policies, comprehensively monitoring network equipment functions, operating status and potential risks, and improving access and analytical efficiency.
It improves the access efficiency and resolution efficiency of different network equipment, and ensures the stable operation and security of network security equipment.
Smart Images
Figure CN120223366A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the technical field of network security devices, and particularly to an intelligent access method for multi - element network security devices based on deep learning. Background Art
[0002] At present, the access management of network security devices in large - scale distributed information systems faces huge challenges. The main reason is that there are a wide variety of network security devices managed by the network security management system, such as firewalls, intrusion detection systems, Web application firewalls, etc., and each device may come from different manufacturers, making protocol management and policy parsing extremely complex. Summary of the Invention
[0003] The purpose of this application is: To solve the above - mentioned technical problems, this application provides an intelligent access method for multi - element network security devices based on deep learning, aiming to improve the parsing efficiency of network security devices and ensure the stable operation of network security devices.
[0004] In some embodiments of this application, multiple parsing sub - models are established based on various parsing methods of network devices, and multiple device categories are constructed according to historical network device parameters. Corresponding call sub - strategies are set based on the parsing requirements of each device category, so as to comprehensively monitor the functions, operating states, and potential risks of network devices, improve the access efficiency and parsing efficiency of different network devices, and ensure the secure operation of the network.
[0005] In some embodiments of this application, by periodically updating each parsing sub - model and the call sub - strategies corresponding to each device category, the parsing strategies for different network devices are continuously optimized, potential problems in the network device parsing process are solved, and the access efficiency and parsing efficiency of the system for network devices are improved. Ensure the secure operation of the network.
[0006] In some embodiments of this application, an intelligent access method for multi - element network security devices based on deep learning is provided, including: Establish a parsing model according to the historical connection data of network devices; Generate an access strategy for the device to be accessed, and obtain the identity data packet of the device to be accessed according to the access strategy; Set the primary parsing strategy for the device to be accessed according to the identity data packet and the parsing model; Obtain monitoring data packets according to the preset update time node, and generate an update instruction for the parsing model according to the monitoring data packets.
[0007] In some embodiments of this application, when establishing the parsing model, it includes: Generate multiple parsing sub - models according to the historical connection data; Establish a sequence A of parsing sub - models, A=(a1, a2…ai …a n ), where a i is the i-th parsing sub-model and n is the number of parsing sub-models; Generate multiple device feature indicators based on historical device parameters and establish multiple device categories based on all device feature indicators; Establish a device category sequence B, B = (b1, b2…b i …b m ), where b i is the i-th device category; m is the number of device categories; Set b i as the target device category in sequence according to the device category sequence B; Generate a call sub-strategy for the target device category; Generate call sub-strategies for each device category in sequence and establish a call sub-strategy sequence P, P = (p1, p2…p i …p m ), where p i is the call sub-strategy for the i-th device category; m is the number of device categories; Establish a parsing model based on the parsing sub-model sequence A and the call sub-strategy sequence P.
[0008] In some embodiments of the present application, when generating a call sub-strategy for the target device category, it includes: Generate a parsing requirement package for the target device category based on historical device parameters; Generate a dependency evaluation value of the target device category for each parsing sub-model according to the parsing requirement package; Establish a dependency evaluation value sequence W, W = (w1, w2…w i …w n ), where w i is the dependency evaluation value of the target device category for the i-th parsing sub-model; Preset a dependency evaluation value threshold W1; If w i > W1, set the i-th parsing sub-model as the dependent sub-model of the target device category; Generate a call sub-strategy for the target device category according to all the dependent sub-models of the target device category.
[0009] In some embodiments of the present application, when setting the primary parsing strategy of the device to be accessed according to the identity data packet and the parsing model, it includes: Generate a similarity evaluation value between the device to be accessed and each device category; Establish a similarity evaluation value sequence J, J = (j1, j2…j i …j m ), where j iis the similarity evaluation value between the device to be connected and the i-th device category; Set the maximum value j in the similarity evaluation value sequence J max The call sub-strategy of the corresponding device category is the primary parsing strategy.
[0010] In some embodiments of the present application, when generating the similarity evaluation value between the device to be connected and each device category, it includes: Set b in sequence according to the device category sequence B i as the comparison device category; Generate the similarity evaluation value j between the device to be connected and the comparison device category; j = µ i *(v i - v' i ) 2 ; Among them, θ1 is the number of device feature indicators; µ i is the influence factor of the i-th device feature indicator; v i is the reference value of the i-th device feature indicator of the device to be connected; v' i is the reference value of the i-th device feature indicator of the comparison device category; Generate the similarity evaluation value between the device to be connected and each device category in sequence.
[0011] In some embodiments of the present application, when generating the update instruction of the parsing model according to the monitoring data packet, it includes: Set a in sequence according to the parsing sub-model sequence A i as the target parsing sub-model; Generate the sub-call data packet of the target parsing sub-region model according to the monitoring data packet at the current update time node; Generate the running evaluation value c of the target parsing sub-model according to the sub-call data packet; Generate the running evaluation values of each parsing sub-model in sequence; Establish the running evaluation value sequence C at the current update time node, C = (c1, c2…c i …c n ), where c i is the running evaluation value of the i-th device category at the current update time node; Preset the running evaluation value threshold C1; If c i < C1, generate the model update instruction of the i-th parsing sub-model at the current update time node.
[0012] In some embodiments of the present application, when generating the running evaluation value c of the target parsing sub-model, it includes: c = e1 * Q1 * βi *k i +e2 * Q2 * Y(i) * (s i - s')]; Wherein, e1 is a preset first weight coefficient; e2 is a preset second weight coefficient; Q1 is a preset first fixed coefficient; Q2 is a preset second fixed coefficient; θ1 is the number of evaluation indicators called; β i is the influence factor of the i-th evaluation indicator called; k i is the reference value of the i-th evaluation indicator called generated based on the sub-call data packet of the target parsing sub-model; θ2 is the number of calls of the target parsing sub-model within the sub-call data packet; s i is the parsing evaluation value of the i-th call; s' is the parsing evaluation value threshold; Y(i) is the selection coefficient; if (s i - s') > 0, Y(i) = 1; if (s i - s') < 0, Y(i) = 0.
[0013] In some embodiments of the present application, when generating an update instruction for the parsing model according to the monitoring data packet, it further includes: Set b i as the target device category in sequence according to the device category sequence B; Generate a sub-feedback data packet of the target device category according to the monitoring data packet at the current update time node; Generate a parsing efficiency value d of the target device category according to the sub-feedback data packet; Generate the parsing efficiency values of each device category in sequence; Establish a parsing efficiency value sequence D at the current update time node, D = (d1, d2... d i ... d m ), where d i is the parsing efficiency value of the i-th device category; Preset a parsing efficiency value threshold D1; If d i < D1, generate a policy update instruction for the i-th device category at the current update time node; Judge whether to generate a correction instruction according to the parsing efficiency value sequence D.
[0014] In some embodiments of the present application, generating the parsing efficiency value d of the target device category includes: D = e3 * Q3 * η i * g i + e4 * Q4 * r i * c 1i ; Among them, e3 is a preset third weight coefficient; e4 is a preset fourth weight coefficient; Q3 is a preset third fixed coefficient; Q4 is a preset fourth fixed coefficient; θ3 is the number of device evaluation indicators; η i is the influence factor of the i-th device evaluation indicator; g i is the influence factor of the i-th device evaluation indicator generated based on the sub-feedback data packet; θ4 is the number of dependent sub-models of the target device category; r i is the influence factor of the i-th dependent sub-model of the target device category; c 1i is the running evaluation value of the i-th dependent sub-model of the target device category at the current update time node.
[0015] In some embodiments of the present application, when determining whether to generate a correction instruction according to the parsing efficiency value sequence D, it includes: Generating a correction evaluation value h according to the parsing efficiency value sequence D; h = e5 * Q5 * Δd + e6 * Q6 * T(i) * (d i - D1) 2 ; Among them, e5 is a preset fifth weight coefficient; e6 is a preset sixth weight coefficient; Q5 is a preset fifth fixed coefficient; Q6 is a preset sixth fixed coefficient; m is the number of device categories; Δd is the average value of all data in the parsing efficiency value sequence D; T(i) is a selection coefficient; if (d i - D1) < 0, T(i) = 1; if (d i - D1) > 0, T(i) = 0; Presetting a correction evaluation value threshold H1; If h > H1, a first-level correction instruction is generated at the current update time node.
[0016] Compared with the prior art, the beneficial effects of an intelligent access method for a multi-network security device based on deep learning in an embodiment of the present application are as follows: Multiple parsing sub-models are established based on multiple parsing methods of network devices, and multiple device categories are constructed according to historical network device parameters. Corresponding call sub-strategies are set based on the parsing requirements of each device category, so as to comprehensively monitor the functions, operating states, and potential risks of network devices, improve the access efficiency and parsing efficiency of different network devices, and ensure the safe operation of the network.
[0017] By periodically updating each parsing sub-model and the corresponding call sub-strategies of each device category, the parsing strategies for different network devices are continuously optimized, potential problems in the network device parsing process are solved, and the access efficiency and parsing efficiency of the system for network devices are improved. Ensure the safe operation of the network. Description of the Drawings
[0018] Figure 1 It is a schematic flowchart of a method for intelligent access of a multi - network security device based on deep learning in a preferred embodiment of the embodiments of the present application. Detailed implementation manners
[0019] The following will further describe in detail the specific implementation manners of the present application in conjunction with the drawings and embodiments. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.
[0020] In the description of the present application, it should be understood that the orientation or positional relationship indicated by the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc. is based on the orientation or positional relationship shown in the drawings. It is only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus should not be construed as a limitation of the present application.
[0021] The terms "first" and "second" are only used for descriptive purposes, and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the present application, unless otherwise stated, the meaning of "a plurality" is two or more.
[0022] In the description of the present application, it should be noted that unless otherwise clearly defined and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it may be a fixed connection, a detachable connection, or an integral connection; it may be a mechanical connection or an electrical connection; it may be directly connected, or indirectly connected through an intermediate medium, and it may be the communication inside two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to specific situations.
[0023] As Figure 1 shown, a method for intelligent access of a multi - network security device based on deep learning in a preferred embodiment of the embodiments of the present application includes: Establish an analysis model based on the historical connection data of the network device; Generate an access policy for the device to be accessed, and obtain the identity data packet of the device to be accessed according to the access policy; Set the primary analysis policy for the device to be accessed according to the identity data packet and the analysis model; Obtain the monitoring data packet according to the preset update time node, and generate an update instruction for the analysis model according to the monitoring data packet.
[0024] Specifically, when establishing the parsing model, it includes: Generating multiple parsing sub-models according to historical connection data; Establishing a sequence A of parsing sub-models, A = (a1, a2…a i …a n ), where a i is the i-th parsing sub-model, and n is the number of parsing sub-models; Generating multiple device characteristic indicators according to historical device parameters, and establishing multiple device categories according to all device characteristic indicators; Establishing a sequence B of device categories, B = (b1, b2…b i …b m ), where b i is the i-th device category; m is the number of device categories; Successively setting b i as the target device category according to the sequence B of device categories; Generating a calling sub-strategy for the target device category; Successively generating calling sub-strategies for each device category, and establishing a sequence P of calling sub-strategies, P = (p1, p2…p i …p m ), where p i is the calling sub-strategy for the i-th device category; m is the number of device categories; Establishing a parsing model according to the sequence A of parsing sub-models and the sequence P of calling sub-strategies.
[0025] Specifically, according to different parsing strategies (including but not limited to DNS parsing, ARP parsing, DHCP parsing, configuration file parsing, routing table parsing, VLAN configuration parsing, hardware parsing, and other parsing methods), multiple parsing sub-models are constructed by means of deep learning in combination with the historical access device parameters of the current network, and the parsing functions of each parsing sub-model are different.
[0026] Specifically, the device characteristic indicators include but are not limited to device category, device version parameter, device vendor, access point IP address, and other parameters. After quantifying the device characteristic indicators, multiple value ranges are generated, and multiple device categories are constructed by randomly combining the value ranges of each device characteristic indicator.
[0027] Specifically, automatically identify the device to be accessed connected to the network, and collect relevant information of the device to be accessed, such as: IP address, docking protocol, system version, etc. Automatically adapt the device to be accessed through the protocol library or plug-in to generate an access strategy for the device to be accessed. At the same time, generate an identity data packet for the device to be accessed according to the collected relevant information.
[0028] Specifically, when generating the invocation sub-strategy for the target device category, it includes: Generating a parsing requirement package for the target device category based on historical device parameters; Generating a dependency evaluation value of the target device category for each parsing sub-model according to the parsing requirement package; Establishing a sequence of dependency evaluation values W, W = (w1, w2... w i …w n ), where w i is the dependency evaluation value of the target device category for the i-th parsing sub-model; Presetting a dependency evaluation value threshold W1; If w i > W1, setting the i-th parsing sub-model as the dependency sub-model of the target device category; Generating an invocation sub-strategy for the target device category according to all the dependency sub-models of the target device category.
[0029] Specifically, by analyzing the historical data of the target device category, a parsing requirement package for each device category is constructed, and the parsing requirement package includes the data types that the current device category needs to parse.
[0030] Specifically, the parsing requirement package is used to determine whether each parsing sub-model is the parsing sub-model required by the target device. The greater the dependency evaluation value, the higher the parsing efficiency of the corresponding parsing sub-model for the data within the target device category.
[0031] Specifically, the dependency evaluation value threshold can be set according to historical parameters.
[0032] It can be understood that in the above embodiments, multiple parsing sub-models are established based on multiple parsing methods of network devices, and multiple device categories are constructed according to historical network device parameters. Corresponding invocation sub-strategies are set based on the parsing requirements of each device category, so as to comprehensively monitor the functions, operating states, and potential risks of network devices, improve the access efficiency and parsing efficiency of different network devices, and ensure the safe operation of the network.
[0033] In a preferred embodiment of the present application, when setting the primary parsing strategy for the device to be accessed according to the identity data packet and the parsing model, it includes: Generating a similarity evaluation value between the device to be accessed and each device category; Establishing a sequence of similarity evaluation values J, J = (j1, j2... j i …j m ), where j i is the similarity evaluation value between the device to be accessed and the i-th device category; Setting the maximum value j maxThe invocation sub-strategy for the corresponding device category is the primary parsing strategy.
[0034] Specifically, when generating the similarity evaluation values between the device to be accessed and each device category, it includes: Set b sequentially according to the device category sequence B i as the comparison device category; Generate the similarity evaluation value j between the device to be accessed and the comparison device category; j = µ i *(v i - v' i ) 2 ; Among them, θ1 is the number of device characteristic indicators; µ i is the influence factor of the i-th device characteristic indicator; v i is the reference value of the i-th device characteristic indicator of the device to be accessed; v' i is the reference value of the i-th device characteristic indicator of the comparison device category; Generate the similarity evaluation values between the device to be accessed and each device category in sequence.
[0035] Specifically, by quantifying each device characteristic indicator, the device category to which the device to be accessed belongs can be quickly determined by analyzing the identity data packet of the device to be accessed.
[0036] Specifically, the larger the similarity evaluation value, the higher the adaptability of the device to be accessed to the current device category, and the higher the data parsing efficiency of the parsing strategy of the current device category for the device to be accessed.
[0037] Specifically, the identity data packet includes the reference values of each device characteristic indicator of the device to be accessed.
[0038] It can be understood that in the above embodiment, by analyzing all the device characteristic indicators of the device to be accessed, the primary parsing strategy of the device to be accessed is quickly constructed, thereby improving the access efficiency of the device to be accessed.
[0039] In the preferred embodiment of the present application, when generating the update instruction for the parsing model according to the monitoring data packet, it includes: Set a sequentially according to the parsing sub-model sequence A i as the target parsing sub-model; Generate the sub-invocation data packet of the target parsing sub-region model according to the monitoring data packet at the current update time node; Generate the running evaluation value c of the target parsing sub-model according to the sub-invocation data packet; Generate the running evaluation values of each parsing sub-model in sequence; Establish a sequence C of operation evaluation values for the current update time node, C = (c1, c2…c i …c n ), where c i is the operation evaluation value of the i-th device category at the current update time node; Preset operation evaluation value threshold C1; If c i < C1, a model update instruction for generating the i-th parsing sub-model is generated at the current update time node.
[0040] Specifically, the smaller the operation evaluation value, the worse the overall parsing efficiency of the current parsing sub-model.
[0041] Specifically, the operation evaluation value threshold can be set according to historical parameters.
[0042] Specifically, update and iterate the current parsing sub-model according to the model update instruction, or construct a new parsing sub-model with the same function based on the current parsing sub-model, so as to improve the parsing ability of the current parsing sub-model.
[0043] Specifically, monitor the operation data of all access devices recorded in the data packet between the current update time node and the previous update time node.
[0044] Specifically, when generating the operation evaluation value c of the target parsing sub-model, it includes: c = e1 * Q1 * β i * k i + e2 * Q2 * Y(i) * (s i - s')]; Among them, e1 is the preset first weight coefficient; e2 is the preset second weight coefficient; Q1 is the preset first fixed coefficient; Q2 is the preset second fixed coefficient; θ1 is the number of call evaluation indicators; β i is the influence factor of the i-th call evaluation indicator; k i is the reference value of the i-th call evaluation indicator generated based on the sub-call data packet of the target parsing sub-model; θ2 is the number of calls of the target parsing sub-model in the sub-call data packet; s i is the parsing evaluation value of the i-th call; s' is the parsing evaluation value threshold; Y(i) is the selection coefficient; if (s i - s') > 0, Y(i) = 1; if (s i - s') < 0, Y(i) = 0.
[0045] Specifically, normalize all parameters in the model through the preset first fixed coefficient and second fixed coefficient, so that each parameter is within the same value range.
[0046] Specifically, the current parsing sub-model is updated iteratively according to the model update instruction, or a new parsing sub-model with the same function is constructed based on the current parsing sub-model, so as to improve the parsing ability of the current parsing sub-model.
[0047] Specifically, the evaluation metrics for invocation include, but are not limited to, the number of invocations within a single cycle, the number of device categories invoked, and other parameters. The more times it is invoked and the more device categories are invoked, the higher the probability that the target parsing sub-model needs to be updated.
[0048] Specifically, its parsing evaluation value is set according to the parsing efficiency and parsing accuracy of the target parsing sub-model during the current invocation. The larger the parsing evaluation value, the better the parsing performance of the target parsing sub-model during the current invocation.
[0049] Specifically, the parsing evaluation value threshold can be set according to historical parameters.
[0050] In the preferred embodiment of the present application, when generating an update instruction for the parsing model based on the monitoring data packet, it further includes: Set b i as the target device category in sequence according to the device category sequence B; Generate a sub-feedback data packet for the target device category according to the monitoring data packet at the current update time node; Generate a parsing efficiency value d for the target device category according to the sub-feedback data packet; Generate the parsing efficiency values for each device category in sequence; Establish a parsing efficiency value sequence D at the current update time node, D = (d1, d2... d i ... d m ), where d i is the parsing efficiency value of the i-th device category; Preset a parsing efficiency value threshold D1; If d i < D1, generate a policy update instruction for the i-th device category at the current update time node; Judge whether to generate a correction instruction according to the parsing efficiency value sequence D.
[0051] Specifically, the larger the parsing efficiency value, the higher the adaptability between the current invocation sub-strategy of the device category and the access device corresponding to the current device category, and the higher the data parsing efficiency and parsing accuracy of the access device.
[0052] Specifically, the parsing efficiency value threshold can be set according to historical parameters.
[0053] Specifically, the policy update instruction refers to optimizing the invocation sub-policy corresponding to the current device category, adding new parsing sub-models or deleting some inefficient parsing sub-models, so as to improve the parsing efficiency for the current device category.
[0054] Specifically, generating the parsing efficiency value d of the target device category includes: D = e3 * Q3 * η i * g i + e4 * Q4 * r i * c 1i ; Wherein, e3 is a preset third weight coefficient; e4 is a preset fourth weight coefficient; Q3 is a preset third fixed coefficient; Q4 is a preset fourth fixed coefficient; θ3 is the number of device evaluation indicators; η i is the influence factor of the i-th device evaluation indicator; g i is the influence factor of the i-th device evaluation indicator generated based on the sub-feedback data packet; θ4 is the number of dependent sub-models of the target device category; r i is the influence factor of the i-th dependent sub-model of the target device category; c 1i is the running evaluation value of the i-th dependent sub-model of the target device category at the current update time node.
[0055] Specifically, the device evaluation indicator refers to multiple parameters such as the data parsing efficiency and data parsing accuracy of the access device corresponding to the target device category.
[0056] Specifically, all parameters in the model are normalized by the preset third fixed coefficient and fourth fixed coefficient, so that each parameter in the model is within the same value range.
[0057] In the preferred embodiment of the present application, when judging whether to generate a correction instruction according to the parsing efficiency value sequence D, it includes: Generating a correction evaluation value h according to the parsing efficiency value sequence D; h = e5 * Q5 * Δd + e6 * Q6 * T(i) * (d i - D1) 2 ; Wherein, e5 is a preset fifth weight coefficient; e6 is a preset sixth weight coefficient; Q5 is a preset fifth fixed coefficient; Q6 is a preset sixth fixed coefficient; m is the number of device categories; Δd is the average value of all data in the parsing efficiency value sequence D; T(i) is a selection coefficient; if (d i - D1) < 0, T(i) = 1; if (d i - D1) > 0, T(i) = 0; Preset the correction evaluation value threshold H1; If h > H1, a first-level correction instruction is generated at the current update time node.
[0058] Specifically, the correction evaluation value threshold is set according to historical parameters. When the real-time correction evaluation value is greater than the correction evaluation value threshold, the number of device categories is small, and there is a problem of low adaptation degree of some access devices.
[0059] Specifically, all parameters in the model are normalized by presetting a fifth fixed coefficient and a sixth fixed coefficient, so that each parameter in the model is within the same value range.
[0060] Specifically, the first-level correction instruction is to optimize the current device category sequence, add new device categories, and improve the adaptation degree of different types of devices to be accessed by continuously refining the device categories.
[0061] According to the first concept of the present application, multiple parsing sub-models are established based on various parsing methods of network devices, multiple device categories are constructed according to historical network device parameters, and corresponding call sub-strategies are set based on the parsing requirements of each device category, so as to comprehensively monitor the functions, operating states and potential risks of network devices, improve the access efficiency and parsing efficiency of different network devices, and ensure the safe operation of the network.
[0062] According to the second concept of the present application, by periodically updating each parsing sub-model and the call sub-strategies corresponding to each device category, the parsing strategies for different network devices are continuously optimized, potential problems in the network device parsing process are solved, and the access efficiency and parsing efficiency of the system for network devices are improved. Ensure the safe operation of the network.
[0063] The above are only the preferred embodiments of the present application. It should be noted that for those of ordinary skill in the art, without departing from the technical principle of the present application, several improvements and substitutions can be made, and these improvements and substitutions should also be regarded as the protection scope of the present application.
Claims
1. A method for intelligent access of multiple network security devices based on deep learning, characterized in that: include: Build a parsing model based on historical connection data of network devices; Generate an access policy for the device to be connected, and obtain an identity data packet of the device to be connected according to the access policy; Set the primary resolution strategy for the device to be connected based on the identity data packet and resolution model; The monitoring data packet is obtained according to the preset update time node, and the update instruction of the analysis model is generated according to the monitoring data packet.
2. The deep learning-based intelligent access method for multiple network security devices according to claim 1, characterized in that: When building an analytical model, include: Generate multiple analytical sub-models based on historical connection data; Establish the analytical sub-model sequence A, A=(a1, a2…a i …a n ), where a i is the i-th analytical sub-model, n is the number of analytical sub-models; Generate multiple equipment characteristic indicators based on historical equipment parameters, and establish multiple equipment categories based on all equipment characteristic indicators; Establish a series of equipment categories B, B=(b1,b2…b i …b m ), where b i is the i-th device category; m is the number of device categories; Set b in sequence according to the equipment category sequence B i is the target device category; Generate a call sub-policy for the target device category; Generate the calling sub-strategies of each device category in turn, and establish the calling sub-strategy sequence P, P = (p1, p2…p i …p m ), where p i is the calling sub-strategy of the i-th device category; m is the number of device categories; The analytical model is established according to the analytical sub-model sequence A and the calling sub-strategy sequence P.
3. The deep learning-based intelligent access method for multiple network security devices according to claim 2, characterized in that: When generating a call sub-policy for a target device class, include: Generate a parsing requirement package for the target device category based on historical device parameters; Generate the dependency evaluation value of the target device category on each parsing sub-model according to the parsing requirement package; Establish a dependent evaluation value sequence W, W=(w1, w2…w i …w n ), where w i is the dependency evaluation value of the target device category on the i-th analytical sub-model; Preset dependent evaluation value threshold W1; If i >W1, set the i-th parsing sub-model as the dependent sub-model of the target device category; A calling sub-strategy of the target device class is generated according to all dependent sub-models of the target device class.
4. The deep learning-based intelligent access method for multiple network security devices according to claim 3, characterized in that: When setting the primary resolution strategy for the device to be connected based on the identity data packet and the resolution model, it includes: Generate similarity evaluation values between the device to be connected and each device category; Establish a similar evaluation value sequence J, J=(j1, j2…j i …j m ), where j i is the similarity evaluation value between the device to be connected and the i-th device category; Set the maximum value j in the similarity evaluation value sequence J max The calling sub-strategy of the corresponding device category is the first-level resolution strategy.
5. The deep learning-based intelligent access method for multiple network security devices according to claim 4, characterized in that: When generating similarity evaluation values between the device to be connected and each device category, it includes: Set b in sequence according to the equipment category sequence B i To compare device categories; Generate a similarity evaluation value j between the device to be connected and the comparison device category; j=[ µ i *(v i -v' i ) 2 ]; Among them, θ1 is the number of equipment characteristic indicators; µ i is the influencing factor of the characteristic index of the i-th device; v i is the reference value of the i-th device characteristic indicator of the device to be connected; v' i is the reference value of the ith device characteristic indicator of the comparison device category; Generate similarity evaluation values between the device to be connected and each device category in turn.
6. The deep learning-based intelligent access method for multiple network security devices according to claim 4, characterized in that: When generating update instructions for the parsing model based on the monitoring data packet, it includes: According to the analytical sub-model sequence A, set a i Parse sub-models for the target; Generate a sub-calling data packet of the target parsing sub-area model according to the monitoring data packet of the current update time node; Generate a running evaluation value c of the target parsing sub-model according to the sub-call data packet; Generate the operation evaluation value of each analytical sub-model in turn; Establish the running evaluation value sequence C of the current update time node, C=(c1,c2…c i …c n ), where c i is the operation evaluation value of the i-th equipment category at the current update time node; Preset operation evaluation value threshold C1; If c i <C1, generate a model update instruction for the i-th parsing sub-model at the current update time node.
7. The deep learning-based intelligent access method for multiple network security devices according to claim 6, characterized in that: When generating the running evaluation value c of the target parsing sub-model, it includes: c=e1*Q1*[ β i *k i ]+e2*Q2*[ Y(i)*(s i -s')]; Among them, e1 is the preset first weight coefficient; e2 is the preset second weight coefficient; Q1 is the preset first fixed coefficient; Q2 is the preset second fixed coefficient; θ1 is the number of evaluation indicators called; β i is the influencing factor of the i-th call evaluation index; k i is the reference value of the i-th call evaluation index generated by the sub-call data packet based on the target parsing sub-model; θ2 is the number of calls of the target parsing sub-model in the sub-call data packet; s i is the analytical evaluation value of the i-th call; s' is the analytical evaluation value threshold; Y(i) is the selection coefficient; if (s i -s')>0,Y(i)=1; if (s i -s')<0,Y(i)=0.
8. The deep learning-based intelligent access method for multiple network security devices according to claim 7, characterized in that: When the update instruction of the parsing model is generated according to the monitoring data packet, it also includes: Set b in sequence according to the equipment category sequence B i is the target device category; Generate a sub-feedback data packet of the target device category according to the monitoring data packet of the current update time node; Generate a parsing efficiency value d of the target device category according to the sub-feedback data packet; Generate the analytical efficiency value of each device category in turn; Establish the analytical efficiency value series D of the current update time node, D=(d1, d2…d i …d m ), where d i is the analytical efficiency value of the i-th device category; Preset analysis efficiency value threshold D1; If d i <D1, generate a policy update instruction for the i-th device category at the current update time node; Whether to generate a correction instruction is determined based on the analysis efficiency value sequence D.
9. The deep learning-based intelligent access method for multiple network security devices according to claim 8, characterized in that: Generate the resolution efficiency value d of the target device category, including: D=e3*Q3* η i *g i ]+e4*Q4*[ r i *c 1i ]; Wherein, e3 is the preset third weight coefficient; e4 is the preset fourth weight coefficient; Q3 is the preset third fixed coefficient; Q4 is the preset fourth fixed coefficient; θ3 is the number of equipment evaluation indicators; η i is the influencing factor of the i-th equipment evaluation index; g i is the influencing factor of the i-th device evaluation index generated based on the sub-feedback data packet; θ4 is the number of dependent sub-models of the target device category; r i is the impact factor of the i-th dependent sub-model of the target device category; c 1i It is the running evaluation value of the i-th dependent sub-model of the target device category at the current update time node.
10. The deep learning-based intelligent access method for multiple network security devices according to claim 8, characterized in that: When judging whether to generate a correction instruction according to the analytical efficiency value sequence D, it includes: Generate a modified evaluation value h based on the analytical efficiency value sequence D; h=e5*Q5*Δd+e6*Q6*[ T(i)*(d i -D1) 2 ]; Wherein, e5 is the preset fifth weight coefficient; e6 is the preset sixth weight coefficient; Q5 is the preset fifth fixed coefficient; Q6 is the preset sixth fixed coefficient; m is the number of equipment categories; Δd is the average value of all data in the analytical efficiency value series D; T(i) is the selection coefficient; if (d i -D1)<0,T(i)=1; if (d i -D1)>0,T(i)=0; Preset modified evaluation value threshold H1; If h>H1, the current update time node generates a first-level correction instruction.