A malicious sample analysis method based on knowledge-enhanced neural network intelligent model

Abstract

The present invention discloses a malicious sample analysis method based on a knowledge-enhanced neural network intelligent model under the framework of an artificial intelligence model, which belongs to the field of artificial intelligence security technology. This method obtains more meaningful original features through knowledge enhancement, and uses an improved BP neural network algorithm to reduce the demand for training sample volume when analyzing and identifying malicious samples. Based on the fusion of semantic features and syntactic features, the present invention comprehensively characterizes text characteristics, uses Euclidean distance to construct anomaly detection indicators, and further improves the sensitivity to abnormal samples. By introducing external knowledge graphs to enrich feature dimensions, more comprehensive information support is provided for malicious sample detection. Introducing knowledge graphs in the pre-training stage of large models enhances the model's prior knowledge, enables the model to converge faster, and further improves detection efficiency.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model in a large language model system. Background Art

[0002] The significant development of large models in recent years, such as BERT, SORA, and GPT, has played a key role in a range of applications, demonstrating tremendous potential in downstream tasks from text summarization to code generation, visual question answering, and multimodal machine translation. Large models utilize large-scale pre-training on massive amounts of unlabeled data, introducing key technologies such as instruction fine-tuning and human alignment, enabling them to achieve high-level performance in a variety of tasks tailored to the specific application scenarios. However, the use of large models increases the risk of security attacks and privacy leaks. The "pre-training and fine-tuning" phase of AI models may become a new security attack surface, vulnerable to threats such as data poisoning, adversarial example attacks, model theft attacks, backdoor attacks, and instruction attacks. This puts the security and reliability of services based on large models at risk. Summary of the Invention

[0003] The present invention aims to provide a malicious sample analysis method based on a knowledge-enhanced neural network intelligent model. This knowledge-enhanced method enables the improved neural network intelligent model to effectively identify maliciously constructed samples. Furthermore, it leverages prior information provided by the knowledge graph to provide more meaningful initial features through knowledge embedding, reducing the model's reliance on large training samples and making the detection optimization process more efficient. This method addresses the technical problem of data poisoning attacks that exist in existing large language model systems.

[0004] The technical solution adopted by the present invention to solve the above technical problems is to introduce a knowledge-enhanced improved BP neural network and integrate the original features into the intelligent model training process in the form of a knowledge graph, thereby obtaining stronger model understanding and text representation capabilities, enhancing the robustness of malicious sample analysis, reducing computing time, and improving detection efficiency. The technical solution includes the following steps:

[0005] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows:

[0006] A method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model, the method comprising the following steps:

[0007] Step S1: Collect a large number of data samples, including known malicious sample sets and normal sample sets, use the pre-trained language model BERT to extract semantic features from the collected data samples, and select [CLS] The vector corresponding to the mark is used as the semantic feature vector;

[0008] Step S2: Use dependency syntax analysis to extract syntax features from the collected data samples, calculate the frequency distribution of dependency types, compose the frequency values ​​into a row statistical feature vector, and obtain the syntax feature vector after normalization;

[0009] Step S3: By calculating the data sample The Euclidean distance between the feature vector of and the feature vector of each normal sample set is used to construct an anomaly detection index vector;

[0010] Step S4: Introduce an external knowledge graph and enhance the semantic feature vector extracted in step S1; query the entities and relationships related to the sample features from the knowledge graph, generate a knowledge-enhanced feature vector based on the query results, and concatenate the semantic feature vector, syntactic feature vector, anomaly detection indicator vector and the knowledge-enhanced feature vector to generate a comprehensive feature vector;

[0011] Step S5: Construct a two-layer BP neural network model. The input of the two-layer BP neural network model is a normalized comprehensive feature vector, which includes semantic features, syntactic features, anomaly detection indicators, and knowledge-enhanced features. The number of neurons in each layer is adjusted according to the input feature dimension. The activation function uses ReLU. The output layer uses the softmax function to predict the probability that the sample is malicious. The cross-entropy loss function and the Adam optimization algorithm are used to optimize the network parameters. The pre-trained language model BERT and the two-layer BP neural network model constitute the final knowledge-enhanced malicious sample detection model.

[0012] Step S6: Collect the text to be detected and input it into the knowledge-enhanced malicious sample detection model to output the malicious detection results.

[0013] Furthermore, step S1 includes the following steps:

[0014] Step S11: Data samples Perform word segmentation preprocessing, data sample Expressed as: ,in For data samples No. word, Represents data samples The number of words in the data sample The head and tail are spliced ​​together [CLS] and [SEP] After that, get the text , [CLS] Indicates the beginning of a whole sentence or text sequence, [SEP] Indicates the end of the current input sequence; the text Input into the pre-trained language model BERT;

[0015] Step S12: The pre-trained language model BERT outputs the hidden state vector corresponding to each word. The output form of the BERT model is expressed as: H= [CLS], h 0 ,⋯, h i ,⋯, h n-1 ,[SEP] ;in, is the output sequence of the model, The hidden state vector corresponding to each word; for the entire text , select word [CLS] The vector corresponding to the tag is used as the semantic feature vector.

[0016] Furthermore, the step S2 specifically includes the following sub-steps:

[0017] Step S21: First, the data sample Perform dependency syntactic analysis to obtain the dependency relationship between each word and other words;

[0018] Step S22: Construct a dependency matrix To represent the dependency relationship between word units, the dependency matrix Chinese elements Indicates the When the first word is used as a subordinate word, The dependency type of a word as a dominant word;

[0019] Step S23: extract statistical features based on the dependency matrix, calculate the global frequency distribution of each dependency type using a row statistics method, and compose these frequency values ​​into a row statistical feature vector;

[0020] Step S24: Count the row feature vectors Normalize to the range of [0,1] to obtain the normalized row statistical feature vector.

[0021] Furthermore, the step S3 specifically includes the following sub-steps:

[0022] Step S31: The semantic feature vector and the syntactic feature vector form a feature vector, and the data sample The eigenvector of ; Calculate the semantic feature vector and syntactic feature vector of the normal sample set to form the feature vector of the normal sample set, expressed as ; Calculate data samples The Euclidean distance between the eigenvector of and the eigenvector of each normal sample set;

[0023] Step S32: Calculate data samples The average distance between the Euclidean distance of the eigenvector of and the eigenvector of all normal sample sets and standard deviation , construct anomaly detection indicator vector.

[0024] Furthermore, the step S4 specifically includes the following sub-steps:

[0025] Step S41: Match the semantic feature vector with the knowledge graph and query the related entities and relationships in the knowledge graph;

[0026] Step S42: Use knowledge graph embedding to map the relationships and entities in the knowledge graph into a vector space, and concatenate the entity vector and the relationship vector to obtain a knowledge-enhanced feature vector;

[0027] Step S43: concatenate the knowledge enhancement feature vector with the semantic feature vector, the syntactic feature vector, and the anomaly detection index vector into a comprehensive feature vector, and normalize the comprehensive feature vector to obtain a normalized comprehensive feature vector.

[0028] Furthermore, the step S5 specifically includes the following sub-steps:

[0029] Step S51: constructing a two-layer BP neural network model, and using the normalized comprehensive feature vector as the input of the BP neural network;

[0030] Step S52: using the ReLU function as the activation function of the hidden layer;

[0031] Step S53: Use the softmax function to output the probability of malicious samples;

[0032] Step S54: Based on the output results, the model is optimized using the weighted cross entropy loss function and the Adam optimizer.

[0033] Compared with the prior art, the present invention has the following beneficial technical effects:

[0034] (1) The present invention provides the model with more meaningful initial features through knowledge enhancement and anomaly detection indicator extraction methods, thereby improving the model's ability to analyze malicious samples.

[0035] (2) The present invention uses the construction of an external knowledge graph to obtain richer feature information, reduce the model's demand for training samples, and further improve the efficiency of malicious sample detection.

[0036] (3) This invention enriches the feature dimensions by introducing external knowledge graphs, providing more comprehensive information support for malicious sample detection. Introducing knowledge graphs during the pre-training phase of large models enhances the model's prior knowledge, enabling faster model convergence and further improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in describing the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 This is a schematic diagram of the overall framework topology of a knowledge-enhanced BP neural network malicious sample detection method of the present invention.

[0039] Figure 2 This is a topological diagram of the pre-trained language model BERT of the present invention.

[0040] Figure 3 This is a topological diagram of the BP neural network model of the present invention. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] This paper proposes a malicious sample analysis method based on a knowledge-enhanced neural network intelligent model, which is applied to a large language model system. By introducing a knowledge-enhanced improved BP neural network, the original features are integrated into the intelligent model training process in the form of a knowledge graph, thereby obtaining a stronger model understanding ability and text representation ability, enhancing the robustness of malicious sample analysis, reducing computing time, and improving detection efficiency. Figure 1 As shown, the method includes the following steps:

[0043] Step S1: Collect a large number of data samples, including known malicious sample sets and normal sample sets, use the pre-trained language model BERT to extract semantic features from the collected data samples, and select [CLS] The vector corresponding to the tag is used as the semantic feature vector.

[0044] Specifically, if Figure 2As shown, step S1 includes the following steps:

[0045] Step S11: Data samples Perform word segmentation preprocessing, data sample Expressed as: ,in For data samples No. word, Represents data samples The number of words in the data sample The head and tail are spliced ​​together [CLS] and [SEP] After that, get the text , [CLS] Indicates the beginning of a whole sentence or text sequence, [SEP] Indicates the end of the current input sequence; the text Input into the pre-trained language model BERT.

[0046] Step S12: The pre-trained BERT language model outputs the hidden state vector corresponding to each word. Positional encoding information, sentence segmentation information, and token information are embedded in the position, segment, and tag embeddings, respectively, and the three are summed to form the final input embedding. The input embeddings are fused into word embeddings and fed into a feedforward neural network module with a self-attention mechanism, a fully connected layer, and ReLU activation functions, as well as residual connections and layer normalization. After this processing, the model's hidden layer representation is output through the fully connected layer. The output of the BERT model is represented as: H= [CLS], h 0 ,⋯, h i ,⋯, h n-1 ,[SEP] ; Where H is the output sequence of the model, The hidden state vector corresponding to each word. , you can choose a word [CLS] The vector corresponding to the tag (the tag is usually used to represent the overall semantics of the sentence) is used as the semantic feature vector , the hidden state dimension of the pre-trained language model BERT output is , then the semantic feature vector , represents the set of real numbers.

[0047] Step S2: Use dependency syntactic analysis to extract syntactic features from the collected data samples, calculate the frequency distribution of dependency relationship types, form a row statistical feature vector from the frequency values, and obtain a syntactic feature vector after normalization.

[0048] Specifically, step S2 includes the following steps:

[0049] Step S21: First, the data sample Perform dependency syntactic analysis to obtain the dependency relationship between each word and other words, such as subject-predicate relationship, verb-object relationship, etc.

[0050] Step S22: Construct a dependency matrix To represent the dependency relationship between word units, the dependency matrix Chinese elements Indicates the When the first word is used as a subordinate word, The dependency relationship type of the word element as the dominant word, such as the subject-predicate relationship type is 1, the verb-object relationship type is 2, etc. word and If there is no dependency relationship between the words, then is 0.

[0051] Step S23: Statistical feature extraction is performed based on the dependency matrix. The global frequency distribution of each dependency type is calculated using the row statistics method. These frequency values ​​are combined into a fixed length The row statistics eigenvector of ,in is the number of dependency types.

[0052] No. The row statistics formula for this dependency type is as follows:

[0053]

[0054] Where m is the number of dependency types, δ is the indicator function, .

[0055] Furthermore, the global frequency distribution of each dependency type is obtained by counting the number of times each dependency type appears in all sentences in the corpus and calculating its proportion.

[0056] The row statistics eigenvector is expressed as: F syn ' =[ F syn ' 1 ,…, F syn ' k ,…, F syn ' m ] .

[0057] Step S24. Count the row feature vectors Normalize to the range of [0,1], use maximum and minimum normalization, and the normalization method is as follows:

[0058]

[0059] in, Represents the normalized row statistical feature vector as a data sample The syntactic feature vector of .

[0060] Step S3: By calculating the data sample The Euclidean distance between the feature vector of and the feature vector of each normal sample set is used to construct an anomaly detection indicator vector.

[0061] Specifically, step S3 includes the following steps:

[0062] Step S31: The semantic feature vector and the syntactic feature vector form a feature vector, and the data sample The eigenvector of The semantic feature vector and syntactic feature vector of the normal sample set are calculated to form the feature vector of the normal sample set, which is expressed as . Calculate data samples The Euclidean distance between the eigenvector of and the eigenvector of each normal sample set is calculated as follows:

[0063]

[0064] in, Represents data samples With the The Euclidean distance of normal samples, Represents data samples The dimension of the eigenvector of Represents the number of elements in the normal sample set, Represents a data sample The eigenvector of A quantity, Indicates the normal sample set The first sample A portion.

[0065] Step S32: Calculate data samples The average distance between the Euclidean distance of the eigenvector of and the eigenvector of all normal sample sets and standard deviation , construct anomaly detection indicator vector .

[0066] The average distance calculation formula is:

[0067]

[0068] The formula for calculating standard deviation is:

[0069]

[0070] The calculation formula for the anomaly detection index value is:

[0071] N

[0072] in, Indicates the Anomaly detection indicator values; the dimension of the anomaly detection indicator vector is .

[0073] Anomaly detection indicator vector Expressed as: F anom =[ F anom 1 ,…, F anom i ,…, F anom N ] .

[0074] Step S4: Introduce the external knowledge graph and convert the semantic feature vector extracted in step S1 into Perform enhancement processing. Query entities and relationships related to sample features from the knowledge graph, generate a knowledge-enhanced feature vector based on the query results, and concatenate the semantic feature vector, syntactic feature vector, and anomaly detection indicator vector with the knowledge-enhanced feature vector to generate a comprehensive feature vector.

[0075] Specifically, step S4 includes the following steps:

[0076] Step S41: The knowledge graph contains a large number of entities and relationships. By matching semantic feature vectors with the knowledge graph, implicit attack intent or malicious patterns can be discovered. Based on the semantic feature vectors, the knowledge graph is searched for related entities and relationships (such as attack types and behavior patterns).

[0077] Step S42: Use TransE (Translating Embedding for Modeling Multi-relational Data, knowledge graph embedding) to map the relations and entities in the knowledge graph into the vector space, and concatenate the entity vector and the relation vector to obtain the knowledge enhanced feature vector .

[0078] In TransE, entities and relationships are mapped to one In a dimensional vector space, for any triple (head h, relation r, tail t), the following translation relation is satisfied:

[0079]

[0080] The knowledge graph consists of triples:

[0081]

[0082] in, represents the knowledge graph, is the head entity, It's a relationship. is the tail entity, and ε represents the set of all possible entities and relations.

[0083] In order to minimize the distance difference between positive samples and negative samples, negative sampling is used as the loss function.

[0084] Negative samples are represented as ,in, represents the negative sample head entity, Represents the negative sample tail entity.

[0085] The loss function of TransE is expressed as:

[0086]

[0087] Among them, γ is a hyperparameter, represents the universal Euclidean distance, which is calculated as follows:

[0088]

[0089] in, represents the L2 norm;

[0090] [∙] + Represents a positive function, defined as [x] + =max(0,x) ,in, To take the maximum value.

[0091] A gradient descent optimizer is used to adjust the entity vectors and relation vectors to minimize the loss.

[0092] The knowledge enhancement feature uses the weighted average of the aggregation function to concatenate the entity vector and the relationship vector:

[0093]

[0094]

[0095] in, represents the knowledge-enhanced feature vector, represents the vector representation of the first entity, The vector representation of the first relation, Indicates the number of entities, represents the number of relationships, represents the weight of the i-th entity, represents the weight of the j-th relationship, represents the vector representation of the i-th entity, The vector representation of the jth relationship, the dimension of the knowledge-enhanced feature vector is .

[0096] Step S43: concatenate the knowledge enhancement feature vector with the semantic feature vector, the syntactic feature vector, and the anomaly detection index vector into a comprehensive feature vector, and normalize the comprehensive feature vector to obtain a normalized comprehensive feature vector.

[0097] Combine the semantic feature vector, syntactic feature vector, anomaly detection index vector and knowledge enhancement feature vector to generate a comprehensive feature vector , the splicing method is as follows:

[0098]

[0099] After feature fusion, the overall normalized comprehensive feature vector is normalized. In order to balance the impact of each part of the feature on the model input, it can be normalized uniformly:

[0100]

[0101] in, represents the comprehensive feature vector after normalization, and are the mean and standard deviation of the comprehensive characteristics, respectively.

[0102] Step S5: Construct a two-layer BP neural network model. The input of the two-layer BP neural network model is the normalized comprehensive feature vector , including semantic features, syntactic features, anomaly detection indicators and knowledge enhancement features. The number of neurons in each layer is adjusted according to the input feature dimension. The activation function adopts ReLU. The output layer uses the softmax function to predict the probability that the sample is malicious. The cross entropy loss function and Adam optimization algorithm are used to optimize the network parameters. The pre-trained language model BERT and the two-layer BP neural network model constitute the final knowledge-enhanced malicious sample detection model.

[0103] Specifically, if Figure 3 As shown, step S5 includes the following steps:

[0104] Step S51: Construct a two-layer BP neural network model, and normalize the comprehensive feature vector As the input of the BP neural network, its dimension is:

[0105]

[0106] in, represents the dimension of the comprehensive feature vector, represents the dimension of the semantic feature vector, represents the dimension of the syntactic feature vector, represents the dimension of the anomaly detection indicator vector, Represents the dimension of the knowledge-enhanced feature vector.

[0107] Step S52: Use the ReLU function as the activation function of the hidden layer. The calculation formula for each hidden layer is:

[0108]

[0109] in, represents the output of the lth hidden layer, represents the ReLU activation function, is the weight matrix of layer l, Indicates the The output of the hidden layer is the feature of the previous layer that is the input of the current layer. is the bias of layer l.

[0110] Step S53: Use the softmax function to output the probability of malicious samples:

[0111]

[0112] in, represents the softmax function, represents the weight matrix of the output layer, represents the output of the last hidden layer, Represents the bias vector of the output layer.

[0113] When P(malicious) ≥ 50%, the sample is judged to be malicious.

[0114] Step S54: Based on the output results, the model is optimized using the weighted cross entropy loss function and the Adam optimizer.

[0115] To prevent the class imbalance problem (uneven ratio of malicious samples to normal samples), weighted cross entropy loss is used:

[0116]

[0117] in, Indicates the total number of samples involved in the loss function calculation, and is the weight of positive and negative samples, which can be dynamically adjusted according to the category ratio. represents the true label of the i-th sample, It represents the probability that the model predicts that the i-th sample is a malicious sample.

[0118] Back propagation and parameter update, calculate gradient:

[0119]

[0120] in, represents the gradient, and θt is the model parameter.

[0121] Update the parameters using the Adam optimizer formula:

[0122]

[0123]

[0124]

[0125]

[0126]

[0127] in, Indicates time The first moment estimate of Indicates the previous time The first moment estimate of is the gradient, =0.9 is the first-order momentum decay factor, represents the second-order moment estimate at time t, Indicates the previous time The second moment estimate of =0.999 is the second-order momentum decay factor, represents the value after bias correction of the first-order moment estimate, represents the value after bias correction of the second-order moment estimate, represents the parameter vector at time t, represents the updated parameter vector, α=1×10-4 is the learning rate, and ϵ is a smoothing term to prevent the denominator from being zero.

[0128] Step S6: Collect the text to be detected and input it into the knowledge-enhanced malicious sample detection model to output the malicious detection results.

[0129] Step S5 also includes model testing and evaluation: using the validation set to calculate the accuracy, recall rate, and F1 score to evaluate the model performance.

[0130] The performance indicators use accuracy rates of:

[0131]

[0132] The recall rate is:

[0133]

[0134] in, Indicates the number of samples that the model correctly predicts as normal text, Indicates the number of samples that the model correctly predicts as malicious samples, Indicates the number of samples that the model incorrectly predicts as normal text, Indicates the number of samples that the model incorrectly predicts as malicious.

[0135] The F1-score is:

[0136]

[0137] The present invention also proposes a knowledge-enhanced BP neural network malicious sample detection system, based on the malicious sample detection method of the knowledge-enhanced BP neural network model, comprising: a feature extraction module, a knowledge-enhanced feature extraction module, a knowledge-enhanced malicious sample detection model and a model construction and training module;

[0138] The knowledge-enhanced malicious detection model includes the pre-trained language model BERT and the BP neural network model;

[0139] Feature extraction module, used to extract semantic features, syntactic features and anomaly detection indicators of text;

[0140] The knowledge enhancement feature extraction module is used to further enhance text features. It obtains knowledge enhancement vectors through the knowledge graph and embeds text features to obtain comprehensive feature vectors.

[0141] The pre-trained language model BERT is used to extract semantic feature vectors of text;

[0142] The model construction and training module is used to build a two-layer BP neural network model. The model input is a comprehensive feature vector containing semantic features, syntactic features, anomaly detection indicators, and knowledge-enhanced features. The number of neurons in each layer is adjusted according to the input feature dimension. The activation function uses ReLU. The output layer uses the softmax function to predict the probability that a sample is malicious. The cross-entropy loss function and the Adam optimization algorithm are used to optimize the network parameters to obtain the final knowledge-enhanced malicious sample detection model.

[0143] The knowledge-enhanced malicious sample detection model is used to input the text to be detected and output the malicious detection results.

[0144] This invention fully utilizes the advantages of knowledge enhancement. Through the improved BP neural network intelligent model, it can not only effectively analyze maliciously constructed samples, but also reduce the model's demand for training samples. By introducing external knowledge graphs, it can enrich features, enhance the model's understanding, improve detection efficiency, reduce computing time, and further enhance the robustness of the intelligent model in analyzing malicious samples.

[0145] It will be understood that the present invention is described by way of some embodiments, and it will be appreciated by those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are intended to be protected by the present invention.

Claims

1. A malicious sample analysis method based on a knowledge-enhanced neural network intelligent model, characterized in that: The method comprises the following steps: Step S1: Collect a large number of data samples, including known malicious sample sets and normal sample sets, use the pre-trained language model BERT to extract semantic features from the collected data samples, and select The vector corresponding to the mark is used as the semantic feature vector; Step S2: Use dependency syntax analysis to extract syntax features from the collected data samples, calculate the frequency distribution of dependency types, compose the frequency values ​​into a row statistical feature vector, and obtain the syntax feature vector after normalization; Step S3: By calculating the data sample The Euclidean distance between the feature vector of and the feature vector of each normal sample set is used to construct an anomaly detection index vector; Step S4: Introduce an external knowledge graph and enhance the semantic feature vector extracted in step S1; query the entities and relationships related to the sample features from the knowledge graph, generate a knowledge-enhanced feature vector based on the query results, and concatenate the semantic feature vector, syntactic feature vector, anomaly detection indicator vector and the knowledge-enhanced feature vector to generate a comprehensive feature vector; Step S5: Construct a two-layer BP neural network model. The input of the two-layer BP neural network model is a normalized comprehensive feature vector, which includes semantic features, syntactic features, anomaly detection indicators, and knowledge-enhanced features. The number of neurons in each layer is adjusted according to the input feature dimension. The activation function uses ReLU. The output layer uses the softmax function to predict the probability that the sample is malicious. The cross-entropy loss function and the Adam optimization algorithm are used to optimize the network parameters. The pre-trained language model BERT and the two-layer BP neural network model constitute the final knowledge-enhanced malicious sample detection model. Step S6: Collect the text to be detected and input it into the knowledge-enhanced malicious sample detection model to output the malicious detection results.

2. The method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model according to claim 1 is characterized in that: Step S1 includes the following steps: Step S11: Data samples Perform word segmentation preprocessing, data sample Expressed as: ,in For data samples No. word, Represents a data sample The number of words in the data sample The head and tail are spliced ​​together and After that, get the text , Indicates the beginning of a whole sentence or text sequence, Indicates the end of the current input sequence; the text Input into the pre-trained language model BERT; Step S12: The pre-trained language model BERT outputs the hidden state vector corresponding to each word. The output form of the BERT model is expressed as: ;in, is the output sequence of the model, The hidden state vector corresponding to each word; for the entire text , select word The vector corresponding to the tag is used as the semantic feature vector.

3. The malicious sample analysis method based on the knowledge-enhanced neural network intelligent model according to claim 2 is characterized in that: The step S2 specifically includes the following sub-steps: Step S21: First, the data sample Perform dependency syntactic analysis to obtain the dependency relationship between each word and other words; Step S22: Construct a dependency matrix To represent the dependency relationship between word units, the dependency matrix Chinese elements Indicates the When the first word is used as a subordinate word, The dependency type of a word as a dominant word; Step S23: extract statistical features based on the dependency matrix, calculate the global frequency distribution of each dependency type using a row statistics method, and compose these frequency values ​​into a row statistical feature vector; Step S24: Count the row feature vectors Normalize to the range of [0,1] to obtain the normalized row statistical feature vector.

4. The method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model according to claim 3 is characterized in that: The step S3 specifically includes the following sub-steps: Step S31: The semantic feature vector and the syntactic feature vector form a feature vector, and the data sample The eigenvector of ; Calculate the semantic feature vector and syntactic feature vector of the normal sample set to form the feature vector of the normal sample set, expressed as ; Calculate data samples The Euclidean distance between the eigenvector of and the eigenvector of each normal sample set; Step S32: Calculate data samples The average distance between the Euclidean distance of the eigenvector of and the eigenvector of all normal sample sets and standard deviation , construct anomaly detection indicator vector.

5. The method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model according to claim 4 is characterized in that: The step S4 specifically includes the following sub-steps: Step S41: Match the semantic feature vector with the knowledge graph and query the related entities and relationships in the knowledge graph; Step S42: Use knowledge graph embedding to map the relationships and entities in the knowledge graph into a vector space, and concatenate the entity vector and the relationship vector to obtain a knowledge-enhanced feature vector; Step S43: concatenate the knowledge enhancement feature vector with the semantic feature vector, the syntactic feature vector, and the anomaly detection index vector into a comprehensive feature vector, and normalize the comprehensive feature vector to obtain a normalized comprehensive feature vector.

6. The method for analyzing malicious samples based on a knowledge-enhanced neural network intelligent model according to claim 5 is characterized in that: The step S5 specifically includes the following sub-steps: Step S51: constructing a two-layer BP neural network model, and using the normalized comprehensive feature vector as the input of the BP neural network; Step S52: using the ReLU function as the activation function of the hidden layer; Step S53: Use the softmax function to output the probability of malicious samples; Step S54: Based on the output results, the model is optimized using the weighted cross entropy loss function and the Adam optimizer.

Images