Abnormal detection model training method and device, detection method and device and computer equipment

Abstract

The invention relates to the technical field of network communication, in particular to a training method, a detection method and a device of an anomaly detection model, and computer equipment. The method comprises the steps of obtaining training data; preprocessing the training data to obtain preprocessed data; for each round of training, the following operations are executed: carrying out random division on preprocessed data to obtain training sample data and verification sample data; inputting the training sample data into a bidirectional long-short-term memory network combined with a self-attention mechanism for training, and calculating a loss value of a current round; performing performance evaluation on the bidirectional long-short-term memory network combined with the self-attention mechanism based on the verification sample data to obtain at least one performance evaluation index; and when the difference between the loss value and the target loss is less than a preset value and the at least one performance evaluation index is greater than or equal to a corresponding index threshold, taking the current round of bidirectional long-short-term memory network combined with the self-attention mechanism as a pre-training detection model.

Description

Technical Field

[0001] The present disclosure relates to the field of network communication technologies, and in particular, to a training method, a detection method, a device, and a computer device for an anomaly detection model. Background Art

[0002] Currently, network intrusion detection technology has gradually evolved from traditional detection based on protocol rules to intelligent algorithm-driven detection. Early intrusion detection expert systems (IDES) relied on manual rules and statistical methods and were difficult to cope with complex attacks; the breakthrough of network traffic auditing technology in 1989 promoted innovation, and technologies such as threshold detection and neural network fusion emerged continuously. In recent years, domestic scholars have made progress in fields such as data augmentation and hyperparameter optimization. For example, the Traffic Conditional Generative Adversarial Network (Traffic-CGAN) balances the dataset, and the Population Evolution Particle Swarm Optimization (PEPSO) algorithm improves the model accuracy.

[0003] However, the current technology still faces challenges. For example, data imbalance and high annotation costs lead to high costs for network intrusion detection. Summary of the Invention

[0004] Based on this, in view of the above technical problems, it is necessary to provide a training method, a detection method, a device, a computer device, and a computer-readable storage medium for an anomaly detection model that can reduce the cost of network intrusion detection.

[0005] The present disclosure provides a training method for an anomaly detection model, including: obtaining training data; performing a preprocessing operation on the training data to obtain preprocessed data; where the preprocessing operation includes one or more of data cleaning, normalization operation, and one-hot encoding; for each round of training, the following operations are performed: randomly dividing the preprocessed data to obtain training sample data and validation sample data; inputting the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculating the loss value of the current round; evaluating the performance of the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; where the performance evaluation index includes any one of a loss value, an accuracy rate, a precision rate, a recall rate, and a target score value; in the case where the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round is used as a pre-trained detection model.

[0006] As an optional implementation manner of the present disclosure, the preprocessing operation includes data cleaning; performing a preprocessing operation on the training data to obtain preprocessed data, including: performing oversampling on the training data to obtain oversampled data; deleting noise samples and mislabeled samples in the oversampled data to obtain preprocessed data.

[0007] As an optional implementation manner of the present disclosure, the preprocessing operation includes a normalization operation; performing a preprocessing operation on the training data to obtain preprocessed data, including: using a target normalization algorithm to map the values in the training data to a specified range interval according to a preset ratio to obtain normalized data; using the normalized data as the preprocessed data.

[0008] As an optional implementation manner of the present disclosure, performing a random division on the preprocessed data to obtain training sample data and validation sample data, including: randomly selecting the preprocessed data by using k-fold cross-validation to obtain training sample data and validation sample data.

[0009] As an optional implementation manner of the present disclosure, performing training by inputting the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism and calculating the loss value of the current round, including: inputting the training sample data into the bidirectional long short-term memory network to capture the distance dependence relationship in the time series to obtain at least one hidden state and at least one cell state; inputting the at least one hidden state and the at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state; controlling the bidirectional long short-term memory network to train the training sample data according to the weight value corresponding to each hidden state and calculating the loss value of the current round.

[0010] As an optional implementation manner of the present disclosure, the training method of the anomaly detection model provided by the present disclosure further includes: in the case that the difference is greater than or equal to a preset value, and / or at least one performance evaluation index is less than the corresponding index threshold, performing the next round of training until the difference between the loss value and the target loss is less than the preset value and at least one performance evaluation index is greater than or equal to the corresponding index threshold, and then stopping the training.

[0011] The present disclosure provides a detection method, including: when receiving an access request, obtaining the access address included in the access request; detecting the access address based on a pre-trained detection model to determine a detection result; wherein, the pre-trained detection model is trained by the training method of the anomaly detection model in any one of the above; in the case that the detection result is an abnormal link, prohibiting access to the access address.

[0012] The present disclosure provides a training device for an anomaly detection model, including: an acquisition module configured to acquire training data; a processing module configured to:

[0013] perform a preprocessing operation on the training data acquired by the acquisition module to obtain preprocessed data; wherein the preprocessing operation includes one or more of data cleaning, normalization operation, and one-hot encoding; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; input the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculate the loss value of the current round; perform a performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; wherein the performance evaluation index includes any one of a loss value, accuracy, precision, recall, and target score value; in the case where the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as a pre-trained detection model.

[0014] As an optional implementation manner of the present disclosure, the preprocessing operation includes data cleaning; the processing module is configured to: perform oversampling processing on the training data to obtain oversampled data; delete noise samples and mislabeled samples in the oversampled data to obtain preprocessed data.

[0015] As an optional implementation manner of the present disclosure, the preprocessing operation includes a normalization operation; the processing module is configured to: map the numerical values in the training data to a specified range interval according to a preset ratio by using a target normalization algorithm to obtain normalized data; use the normalized data as preprocessed data.

[0016] As an optional implementation manner of the present disclosure, the processing module is configured to: randomly select the preprocessed data by using k-fold cross-validation to obtain training sample data and validation sample data.

[0017] As an optional implementation manner of the present disclosure, the processing module is configured to: input the training sample data into a bidirectional long short-term memory network to capture the distance dependence relationship in the time series, and obtain at least one hidden state and at least one cell state; input the at least one hidden state and the at least one cell state into an attention mechanism for learning to obtain a weight value corresponding to each hidden state; control the bidirectional long short-term memory network to train the training sample data according to the weight value corresponding to each hidden state, and calculate the loss value of the current round.

[0018] As an optional implementation manner of the present disclosure, the processing module is configured to: perform the next round of training when the difference is greater than or equal to a preset value and / or at least one performance evaluation index is less than the corresponding index threshold, until the difference between the loss value and the target loss is less than the preset value and at least one performance evaluation index is greater than or equal to the corresponding index threshold, and then stop the training.

[0019] The present disclosure provides a detection device, including:

[0020] A processing module, configured to:

[0021] When the receiving module receives an access request, control the receiving module to obtain the access address included in the access request;

[0022] Detect the access address received by the receiving module based on the pre-trained detection model to determine the detection result; wherein, the pre-trained detection model is obtained by training with the training method of the anomaly detection model in any one of the above.

[0023] When the detection result is an abnormal link, prohibit accessing the access address.

[0024] The present disclosure provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the training method of the anomaly detection model provided by the present disclosure, or the steps of the detection method.

[0025] The present disclosure provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the training method of the anomaly detection model provided by the present disclosure, or the steps of the detection method.

[0026] The training method of the anomaly detection model provided by the present disclosure, or the detection method, device, computer device and computer-readable storage medium, utilize the technical features of the independent claims of the training method of the anomaly detection model, or the detection method to derive and achieve the beneficial effects of being able to solve the technical problems proposed in the background art.

[0027] The training method of the anomaly detection model provided by the present disclosure, when obtaining training data, preprocesses the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be more fully and effectively utilized. After that, the training sample data is input into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and the loss value of the current round is calculated; the performance of the bidirectional long short-term memory network combined with the self-attention mechanism is evaluated based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as the pre-trained detection model.

[0028] In addition, when using the pre-trained detection model provided by the present disclosure for network intrusion detection, the pre-trained detection model provided by the present disclosure can use limited labeled data, and for each round of model training, new training sample data and validation sample data are regenerated, ensuring that the data for each training is different, and the limited training data can be more fully and effectively utilized. Since only a small amount of labeled data is used for model training, there is no need for manual large-scale data annotation, so the cost of data annotation can be reduced, and thus the problem of high cost of network intrusion detection caused by data imbalance and high annotation cost in the prior art is solved. Description of the Drawings

[0029] Figure 1 It is an application scenario diagram of the detection method in an embodiment;

[0030] Figure 2 It is a schematic flowchart of the training method of the anomaly detection model in an embodiment;

[0031] Figure 3 It is a schematic structural diagram of a BiLSTM model including an attention mechanism in the training method of the anomaly detection model in an embodiment;

[0032] Figure 4 It is a schematic structural diagram of the BiLSTM model and the attention mechanism layer in the training method of the anomaly detection model in an embodiment;

[0033] Figure 5 It is a schematic structural diagram of the neural structure of the long short-term memory network in the training method of the anomaly detection model in an embodiment;

[0034] Figure 6 Schematic diagram of the operation of the attention mechanism in the training method of the anomaly detection model in one embodiment;

[0035] Figure 7 Another process schematic diagram of the training method of the anomaly detection model in one embodiment;

[0036] Figure 8 Another process schematic diagram of the training method of the anomaly detection model in one embodiment;

[0037] Figure 9 Another process schematic diagram of the training method of the anomaly detection model in one embodiment;

[0038] Figure 10 Another process schematic diagram of the training method of the anomaly detection model in one embodiment;

[0039] Figure 11 Another process schematic diagram of the training method of the anomaly detection model in one embodiment;

[0040] Figure 12 Schematic diagram of the changes in the accuracy rate and loss function value during the training process of the bidirectional long short-term memory network combined with the self-attention mechanism in the training method of the anomaly detection model in one embodiment;

[0041] Figure 13 Function change diagram of the accuracy rate and loss value after removing the attention mechanism in the training method of the anomaly detection model in one embodiment;

[0042] Figure 14 Confusion matrix diagram without data balance enhancement in the training method of the anomaly detection model in one embodiment;

[0043] Figure 15 Confusion matrix diagram with data balance enhancement in the training method of the anomaly detection model in one embodiment;

[0044] Figure 16 Process schematic diagram of the detection method in one embodiment;

[0045] Figure 17 Structure schematic diagram of the training device of the anomaly detection model in one embodiment;

[0046] Figure 18 Structure schematic diagram of the computer device in one embodiment;

[0047] Figure 19 Structure schematic diagram of the detection device in one embodiment. Detailed implementation manners

[0048] To make the objectives, technical solutions and advantages of the present disclosure more clear and understandable, the present disclosure will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present disclosure and are not used to limit the present disclosure.

[0049] The NID in the embodiments of the present disclosure refers to Network Intrusion Detection, which is a proactive network security protection system in computer security and is used to detect abnormal behaviors (access and activities of unauthorized users) in large networks.

[0050] The IDS in the embodiments of the present disclosure refers to Intrusion Detection System, which is a common network security technology. By monitoring real-time network activities, it automatically perceives, analyzes and identifies unauthorized malicious behaviors to ensure network security.

[0051] The accuracy rate (acc) in the embodiments of the present disclosure represents the ratio of the number of samples correctly predicted by the model to the total number of samples.

[0052] The precision rate (pre) in the embodiments of the present disclosure represents the ratio of the number of truly malicious samples to the total number of samples predicted as malicious among the samples predicted as malicious by the model.

[0053] The recall rate (rec) in the embodiments of the present disclosure represents the ratio of the number of samples correctly predicted as malicious by the model to the total number of truly malicious samples among all real malicious samples.

[0054] The F1-Score in the embodiments of the present disclosure comprehensively considers the precision rate and the recall rate. The F1-Score can be regarded as the harmonic mean of the precision rate and the recall rate and is used to evaluate the comprehensive performance of the model when predicting malicious samples.

[0055] The deep learning model in the embodiments of the present disclosure is a machine learning model based on artificial neural networks, which learns and represents advanced features through the stacking of multiple neural network layers.

[0056] The LSTM in the embodiments of the present disclosure refers to Long Short-Term Memory, which is based on a memory cell that only selects to remember important information and filters out noise information to reduce the memory burden.

[0057] The attention mechanism in the embodiments of the present disclosure is a typical neural network that can quickly allocate resources to more important tasks and is an effective means of resource allocation to solve the overload problem of massive data.

[0058] The Smote-Enn (Synthetic Minority Over-sampling Technique - Edited Nearest Neighbors) in the embodiments of the present disclosure is a data balance enhancement algorithm, which is a combination of the Smote algorithm and the Enn algorithm. The Enn algorithm is a data cleaning technique, and when combined with the Smote algorithm, it can clean the noise data that may be generated by the Smote algorithm.

[0059] Overfitting in the embodiments of the present disclosure refers to the phenomenon that a machine learning model performs very well on the training set, but its performance on an unseen test set or actual data deteriorates significantly.

[0060] NSL-KDD in the embodiments of the present disclosure is a benchmark dataset for network intrusion detection and is an enhancement of the KDDCup’99 dataset (Dua & Graff, 2017).

[0061] One-hot encoding in the embodiments of the present disclosure: is a method of converting categorical variables into binary vectors, used to convert categorical data into a form that machine learning algorithms can handle. The core idea of this method is to create a new binary feature column for each category, where each column only represents the presence or absence of a category value. If a sample belongs to that category, the corresponding column value is 1; otherwise, it is 0.

[0062] Min-Max Scaling in the embodiments of the present disclosure: Min-Max Scaling is a method of mapping the original size of data to a specified size range according to a certain scaling ratio. This range is generally set to [0, 1]. The minimum value of the training data corresponds to the minimum value of the new range, and the maximum value of the training data corresponds to the maximum value of the new range. The data in the middle section is scaled according to the same ratio.

[0063] ReLU (Rectified Linear Unit, Rectified Linear Unit) in the embodiments of the present disclosure: is a commonly used activation function, widely used in deep learning and neural networks.

[0064] Softmax function in the embodiments of the present disclosure: The Softmax function is an activation function commonly used in multi-class classification problems, especially suitable for the output layer, used to convert the raw output of the model into a probability distribution. The Softmax function converts a K-dimensional real vector into another K-dimensional vector, where each element is between 0 and 1, and the sum of all elements is 1. This makes the Softmax function very suitable for classification tasks because it can output the probability of each class.

[0065] The centralized intrusion detection system (CIDS) in the embodiments of the present disclosure: All data is aggregated to a central node for analysis. This central node collects all traffic information in the network and then detects possible intrusion behaviors through predefined rules or algorithms.

[0066] The distributed intrusion detection system (DIDS) in the embodiments of the present disclosure: Multiple independent detection agents are deployed on different nodes of the network. Each agent is responsible for local data analysis and intrusion detection and then reports the results to the central manager.

[0067] The detection method provided by the present disclosure can be applied to an application environment as Figure 1 shown. This detection method is applied to a detection system. The detection system includes a terminal 102 and a server 104. Among them, the terminal 102 and the server 104 communicate through a network. When a user uses the terminal 102, the user can access the content that needs to be accessed on the terminal 102. For example, when the user needs to access News A, the user can access the corresponding Web page A of News A on the terminal 102. At this time, the terminal 102 sends an access request to the server 104 in response to the selection operation of the Web page A. When the server 104 receives the access request sent by the terminal 102, it obtains the access address included in the access request. After that, the server 104 detects the access address based on the pre-trained detection model to determine the detection result. For example, in the case where the detection result is an abnormal link, the server 104 rejects the terminal 102 from accessing the access address, thereby avoiding the problem of network intrusion caused by the terminal 102 accessing an abnormal link; or, in the case where the detection result is a normal link, the server 104 establishes a network connection between the terminal 102 and the server corresponding to the access address, so that the terminal 102 can access News A in the Web page A.

[0068] In one embodiment, as Figure 2 shown, a training method for an anomaly detection model is provided. This embodiment mainly takes the application of this method to Figure 1 the server 104 as an example for illustration.

[0069] S11. Obtain training data.

[0070] In some examples, the training data can be the NSL-KDD dataset.

[0071] S12. Perform preprocessing operations on the training data to obtain preprocessed data; where the preprocessing operations include one or more of data cleaning, normalization operation, and one-hot encoding.

[0072] In some examples, unprocessed training data, such as the NSL-KDD dataset, is received and cleaned using data cleaning techniques to obtain cleaned data. Then, the cleaned data is transformed and split to obtain transformed and split data. Then, the transformed and split data is numerically normalized using the min-max scaling algorithm to obtain normalized data. Then, the normalized data is transformed into preprocessed data in a coding format supported by a deep learning model using one-hot encoding.

[0073] In some examples, since there are three non-numerical features among the 41 features in the NSL-KDD dataset, in order to be able to enter a deep learning model for model training, it is necessary to convert the data format supported by the model.

[0074] Exemplarily, the non-numerical labels of the NSL-KDD dataset are shown in Table 1, and they are protocol_type, service, and flag respectively. The training method of the anomaly detection model provided by the embodiments of the present disclosure uses one-hot encoding to convert each unique category value in these three non-numerical labels into a new binary column. Each of the new columns after transformation corresponds to a category value. If the row where the original data is located belongs to this category, then the value of this new column is set to 1, otherwise it is set to 0. There are two obvious advantages in using one-hot encoding. One is that each value of the original non-numerical classification variable is converted into a digital feature that the model can directly use without omission. The other is that the mutual exclusivity between categories can still be retained.

[0075] Table 1

[0076] Protocol_type Non-numeric Service Non-numeric Flag Non-numeric

[0077] The training method of the anomaly detection model provided by the embodiments of the present disclosure takes the original data converted into the data format (dataframe) supported by the bidirectional long short-term memory network combined with the self-attention mechanism and the specified columns cols (protocol_type, service, and flag) to be one-hot encoded as input parameters. In the specific operation process, first, iterate through the column names in the cols list, and then perform the following operations on each column name: call the get_dummies function provided by the panda module of the deep learning framework to perform one-hot encoding on this column, and set prefix = each to make the original column name the prefix of the newly generated column names for easy distinction. At the same time, in order to ensure that all the original data is converted, set drop_first to false. Although this setting may lead to data redundancy, it completely represents all categories. After converting the original column, the next step is to splice it with the original data. The training method of the anomaly detection model provided by the embodiments of the present disclosure calls the concat function provided by the panda module for splicing, splicing the new data (dummies) obtained by one-hot encoding with the original data (dataframe) in the column direction, that is, adding the one-hot encoded columns to the original data to update the dataframe. Finally, delete the original cols from the updated dataframe, and thus the preprocessed data is obtained.

[0078] S13. For each round of training, perform the following operations: randomly divide the preprocessed data to obtain training sample data and validation sample data; input the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and calculate the loss value of the current round; evaluate the performance of the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; wherein, the performance evaluation index includes any one of the loss value, accuracy, precision, recall rate, and target score value.

[0079] In some examples, when randomly dividing the preprocessed data to obtain training sample data and validation sample data, the K-fold cross-validation experiment can be used to divide the preprocessed data into a training set (i.e., training sample data) and a validation set (i.e., validation sample data). The training set is used to train the bidirectional long short-term memory network (BiLSTM) model including the self-attention mechanism proposed in this article, and the validation set is used to evaluate the effectiveness of the BiLSTM model including the attention mechanism. Then, based on the multi-classification experiment, core indicators such as F1-Score and accuracy are used to evaluate the quality of the model.

[0080] In some examples, the network structure of the BiLSTM model including an attention mechanism provided by the embodiments of the present disclosure is as follows Figure 3 shown, including: an input layer for receiving training data, a convolutional layer, a max pooling layer, a batch normalization layer, a BiLSTM model and an attention mechanism layer, a flattening layer, a dropout layer, and a fully connected layer. Among them,

[0081] The batch_size of the training data input into the input layer can be A. For example, if A is equal to 32, that is, the number of samples processed by the input layer each time is 32, the sequence length of the input training data is 122, and the feature dimension is 1.

[0082] In the convolutional layer, a target convolutional layer is used. For example, the target convolutional layer is a Convolution1D convolutional layer, and the size of the convolutional kernel is set to B (e.g., 64), and the padding method is same to ensure that the output sequence length is the same as the input of the training data, and ReLU is selected as the activation function. The reason for selecting the ReLU function is that the ReLU function is a very simple function. For the ReLU function, when the input is greater than 0, the gradient remains unchanged at 1, which has the advantage of fast calculation speed and is very suitable for large-scale deep neural networks. It can help learn the features in the data and improve the accuracy of the model. The data input into the convolutional layer will be padded into a feature vector of 122×64.

[0083] In the max pooling layer (MaxPooling1D), the training method of the anomaly detection model provided by the embodiments of the present disclosure will set the size of the pooling window to C (e.g., 5) to extract the maximum eigenvalue of each subsequence, thereby reducing the data dimension, and the output data shape size is 24×64.

[0084] Then it enters the batch normalization layer, which is used to normalize the data feature distribution to improve the training efficiency and generalization ability of the model.

[0085] In the BiLSTM model and the attention mechanism layer, at this time, the BiLSTM model can quickly focus on important data while capturing the forward and backward context information of the sequence, and can efficiently complete the full extraction of data features. The sequence length output in the BiLSTM model and the attention mechanism layer remains unchanged.

[0086] In the attention mechanism layer, the training method of the anomaly detection model provided by the embodiments of the present disclosure uses a self-attention mechanism model (SeqSelfAttention) for processing sequence data to assign weights to the sequence features about to be output by the LSTM model to highlight important information and make the model focus on key data.

[0087] To enter the fully connected layer and prevent overfitting, in the training method of the anomaly detection model provided by the embodiments of the present disclosure, a flattening layer and a Dropout layer are added between the BiLSTM model layer and the fully connected layer. In the flattening layer, the three-dimensional feature vector is flattened into one dimension to enter the fully connected layer. In the Dropout layer, the probability of discarding is set to D (e.g., 0.5) in this paper, aiming to prevent overfitting in multi-classification experiments and improve the generalization ability of the model. In the fully connected layer (Dense), based on the number of categories corresponding to the multi-classification experiment, the number of output nodes is set to E (e.g., the output nodes include normal links and abnormal links, and the abnormal links include Abnormal 1, Abnormal 2, Abnormal 3, and Abnormal 4, then E is equal to 5).

[0088] Finally, in the activation layer, softmax is selected as the activation function. This is mainly because the softmax function is suitable for multi-classification problems and can output the probability distribution of each category (e.g., normal link, Abnormal 1, Abnormal 2, Abnormal 3, and Abnormal 4).

[0089] In some examples, in the training method of the anomaly detection model provided by the embodiments of the present disclosure, the structure of the BiLSTM model and the attention mechanism layer is as Figure 4 shown, including: Input (input layer), Embedding (embedding layer), BiLSTM (bidirectional long short-term memory layer), Attention mechanisms (attention mechanism layer), Dropout (dropout layer), and Output (output layer). Among them, Input is used to receive the data input by the batch normalization layer; Embedding is used to convert the discrete input of Input (such as the index of a word) into a low-dimensional, continuous vector representation, enabling the model to better process and understand the data; BiLSTM consists of two LSTMs with opposite directions, processing sequence data from the forward and backward directions respectively, used to capture the past and future information in the sequence output by Embedding, enhancing the understanding of the context; Attention mechanisms are used to let BiLSTM automatically focus on the parts that are more important for the current task when processing the sequence, assign different weights, and highlight key information; among them, Q (Query): query vector, used to guide the model to focus on specific information; X: input sequence vector; V (Value): value vector, containing the actual information to be extracted; SeqSelfAttention: sequence self-attention, calculating the correlation weights between elements in the sequence. Dropout randomly sets the output of a part of the neurons to 0 during the training process to prevent the model from overfitting and enhance the generalization ability of the model; Output is used to output the final prediction result or feature representation according to the results processed by the previous layers.

[0090] The training method of the anomaly detection model provided by the embodiments of the present disclosure, after the data embedded in the batch normalization layer enters the embedding layer, first let the data enter the BiLSTM. The BiLSTM will process the input sequence data, capture the long-distance dependencies in the time series, and output a series of hidden states and cell states. When entering the Attention mechanisms, the attention mechanism starts to intervene. It assigns a weight to each hidden state sequence generated in the LSTM layer. The magnitude of the weight value reflects the importance of the hidden state for predicting the current sample. In this way, the model can know which data is more important based on these weight information, so as to achieve rapid focusing and attention on more important data, and improve its own performance and accuracy. At the same time, the BiLSTM (bidirectional LSTM) is adopted in this article, rather than the traditional unidirectional LSTM. This is mainly because the unidirectional LSTM propagates unidirectionally from left to right or from right to left according to the time step in the network information. Unidirectional propagation means that the cell state at each moment can only depend on the information of the past moment or the information of the future moment. The BiLSTM can be understood as a combination of two LSTMs in opposite directions, that is, the combination of the forward LSTM and the backward LSTM, which can read the input sequence along the forward and backward directions of the time series simultaneously. Such a feature enables the LSTM to not only synthesize the past context information in the data features but also synthesize the future context information at each time step to make a judgment. Since the BiLSTM can synthesize the context information of the sequence, it can understand and express those sequence data features more comprehensively than the unidirectional LSTM, so the model can exhibit stronger performance.

[0091] In some examples, the design idea of the LSTM in the training method of the anomaly detection model provided by the embodiments of the present disclosure is based on a memory cell that only selects to remember important information and filters out noise information to reduce the memory burden. The neural structure of the long short-term memory network is as Figure 5 shown, and the symbol meanings are shown in Table 2.

[0092] Table 2

[0093] Symbol Meaning Symbol Meaning <![CDATA[C t-1 > Memory cell at time t-1 <![CDATA[C t > Memory cell at time t-1 <![CDATA[h t-1 > State at time t-1 <![CDATA[h t > State at time t-1 δ Gate unit <![CDATA[f t > Forget gate <![CDATA[i t > Update gate <![CDATA[o t > Output gate

[0094] The first step of the LSTM needs to decide which noise information to filter out from the memory cell. The filtering work is completed by the sigmoid network layer of the forgetting gate ft. Calculated by Formula 1.

[0095] f t =σ(w f ·[h t-1 ,x t +b i ), Formula 1.

[0096] It receives x t and h t-1 Two input values to produce an output value between 0 and 1, where 0 means to ignore this information and 1 means to fully accept this information. After the forget gate decides which information to forget, it starts to decide what information to save and update in the memory cell at time t. This work is done in two parts. The first part determines the information to be updated through a sigmoid network called the input gate layer. The second part generates a new candidate value vector - C ′ t , which is added to the cell state and calculated by Equation 2.

[0097] C′ t =tanh(W c ·[h t-1 ,x t +b c ), Equation 2.

[0098] After that, the two parts are combined to update the cell state. The next task is to update the old cell state C t-1 to C t . In this article, the old state is multiplied by ft, aiming to remove what the memory cell should forget. Then, by adding i t ⊙C‘ t , a new candidate value is generated, and finally, it is scaled according to a certain proportion determined by the state of the memory cell. The update formula is as follows. Next, it enters the output gate to determine the output value.

[0099] C t =f t *C t-1 +i t ⊙C‘ t , Equation 3.

[0100] The updated memory cell state determines our output value, but this is a "filtered" version. First, through the sigmoid network layer, it determines which parts of the cell state can be output. After determination, the cell state is input into tanh to output a value between -1 and 1, and then multiplied by the output value of the sigmoid network layer to obtain an output value between 0 and 1. This value is the long-distance dependency in the time series. The specific calculation formula is as shown in Equation 4 and Equation 5.

[0101] O t =σ(W o [h t-1 ,x t +b o ), Equation 4;

[0102] ht = O t *tanh(C t ), Equation 5.

[0103] After the LSTM processes the data, the long-distance dependencies in the time series are calculated, and a series of hidden states and cell states are output. Next, it enters the self-attention mechanism model. The attention mechanism is a typical neural network that can quickly allocate resources to more important tasks and is an effective means of resource allocation to solve the overload problem of massive data. Whether it is traditional machine learning or deep learning, the accuracy and performance of the model are often proportional to the amount of information stored and the number of model parameters. This means that we have to face the problem of information overload. Through the attention mechanism, we can quickly focus on the more critical information of the current task in the massive input data, filter out irrelevant information, thus solving the problem of information overload and improving the efficiency and accuracy of the model. Figure 6 Shows the operation process of the key-value pair attention mechanism. The input information is represented by key-value pairs (K, V) = [(k1, v1),..., (kn, vn)] representing n input information, where the key is used to calculate the attention distribution σ i , and the value is used to calculate the aggregated information. For ease of understanding, this article compares the operation process of the attention mechanism to a soft addressing operation: comparing the input information X to the content in the storage unit, and the storage unit address is composed of the key and the value together. When triggering an addressing operation (key = Query), we want to retrieve the Value value (i.e., the Attention value) of the corresponding storage unit. Different from soft addressing, it is not necessary to meet the hard condition Key = Query to retrieve the stored information, but to determine how much content to retrieve from the corresponding element Value by calculating the similarity between the Query and the address Key of the elements in the memory. The Value value corresponding to each address Key will be extracted and then summed up, which is equivalent to calculating the weight of each Value value by the similarity between the Query and the Key, and then performing a weighted sum on the Value values. The weighted sum obtains the final Value value, which is the Attention value. The above process corresponds to Figure 6 the three stages in

[0104] In the first stage, calculate the similarity between the Query and the key, and then calculate the attention score s through the dot product model i , which can be expressed by the formula as:

[0105] S i = F(Q, k i ), Equation 6.

[0106] In stage two, according to the softmax function, S i is normalized to obtain a probability distribution with the sum of weight coefficients being 1. At the same time, the characteristics of the softmax function are used to highlight the weights of important elements, which can be expressed by the formula:

[0107]

[0108] In stage three, according to the weight coefficient α i perform a weighted sum on Value:

[0109]

[0110] Sorting out the three stages with formulas gives:

[0111]

[0112] So far, a weight has been assigned to each hidden state sequence generated by the LSTM layer. The magnitude of the weight value reflects the importance of the hidden state for predicting the current sample. In this way, the model can know which data is more important based on this weight information, so as to achieve fast focusing and pay attention to more important data, thereby improving its own performance and accuracy.

[0113] S14. When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round is used as the pre-trained detection model.

[0114] For the training method of the anomaly detection model provided by the embodiments of the present disclosure, when the training data is obtained, the training data is preprocessed to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be more fully and effectively utilized. After that, the training sample data is input into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and the loss value of the current round is calculated; the performance of the bidirectional long short-term memory network combined with the self-attention mechanism is evaluated based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round is used as the pre-trained detection model.

[0115] In one embodiment, the preprocessing operation includes data cleaning; combinedFigure 2 , as Figure 7 shown, the above S12 can be specifically implemented by the following S120 and S121.

[0116] S120. Perform oversampling on the training data to obtain oversampled data.

[0117] S121. Delete the noise samples and mislabeled samples in the oversampled data to obtain preprocessed data.

[0118] In some examples, there is a data imbalance problem in the training data. For example, when the training data is the NSL-KDD dataset, the number of normal (Normal) traffic in the NSL-KDD dataset is as high as 77,232, the traffic of the attack type Dos is 53,387, the traffic of the attack type Probe is 14,077, while the attack type R2L is only 3,702, and U2R is even only 119. If for a binary classification experiment, only the normal traffic and the abnormal traffic are discriminated and the difference in their numbers is not large, there is no need to enhance the data balance. However, for a multi-class classification experiment, the difference in the traffic numbers between different attack categories is extremely large. In the actual training process, the relatively small numbers of Probe, R2L, and U2R will become the "minority classes", while the normal (Normal) and Dos classes will become the "majority classes". The model will tend to the "majority classes" during training, resulting in insufficient recognition ability of the model for the "minority classes". To ensure that the accuracy of the model is not affected, this article does not adopt the strategy of reducing samples, but adopts the strategy of increasing samples, that is, the oversampling technique. Use the SMOTE algorithm to perform oversampling on the NSL-KDD dataset to improve the data balance, so that the model can still maintain considerable recognition ability and generalization ability when facing unbalanced data. However, it cannot be ignored that noise and over-complicated decision boundaries may be introduced during the data balance enhancement process. Therefore, in this article, the Smote algorithm is not used alone to enhance the data balance, but the Smote algorithm is combined with the ENN. The Smote algorithm is used for data enhancement, and then the ENN algorithm is used to delete potential noise and mislabeled samples to obtain preprocessed data. In this way, the data quality of the preprocessed data can be guaranteed, and this method is called the Smote-Enn algorithm.

[0119] The training method of the anomaly detection model provided by this disclosure oversamples the training data when the training data is obtained to obtain oversampled data. Delete the noise samples and mislabeled samples in the oversampled data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on the limited training data, in each round of training, new training sample data and validation sample data can be regenerated to ensure that the data for each training is different, and the limited training data can be utilized more fully and effectively. Then, input the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculate the loss value of the current round; evaluate the performance of the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than a preset value and at least one performance evaluation index is greater than or equal to the corresponding index threshold, use the bidirectional long short-term memory network combined with the self-attention mechanism of the current round as the pre-trained detection model.

[0120] In one embodiment, the preprocessing operation includes a normalization operation; combined Figure 2 , as Figure 8 shown, the above S12 can be specifically implemented by the following S122 and S123.

[0121] S122. Use the target normalization algorithm to map the values in the training data to a specified range interval according to a preset ratio to obtain normalized data;

[0122] S123. Use the normalized data as the preprocessed data.

[0123] In some examples, due to the large-scale differences in the data features of the benchmark dataset NSL-KDD dataset for network intrusion detection, this will greatly affect the efficiency and stability of model training. To overcome this problem, it is necessary to scale the corresponding numerical features, and this process is called the normalization of data features. Common normalization methods include Min-Max Scaling, linear normalization, Z-Score normalization, and maximum normalization. Here, Min-Max Scaling is used in this article for the normalization of data features. The mathematical formula is expressed as:

[0124]

[0125] where, x normalized represents the normalized data value, x represents the current data point in the dataset (training set or validation set), x max represents the maximum data in the dataset, x minmin represents the smallest data in the dataset, newMax represents the maximum value of the target normalization range (for example, if you want to normalize the data to the specified range interval [0, 1], newMax is 1 here), and newMin represents the minimum value of the target normalization range (if normalized to the specified range interval [0, 1], newMin is 0).

[0126] Min - Max scaling is a method that maps the original size of the data to a specified size range interval according to a certain scaling ratio. This interval is generally set to [0, 1]. The minimum value of the training data corresponds to the minimum value of the new interval, and the maximum value of the training data corresponds to the maximum value of the new interval. The data in the middle section is scaled according to the same ratio. In this article, the following formula is used to simplify the algorithm. It has been proven by experiments that this will not affect the correctness of the model.

[0127]

[0128] Among them, for each column of the dataset, first obtain the maximum and minimum values of this column as x max and x min , and the training data is used as x.

[0129] After the training data NSL - KDD dataset is processed as above, its values are completely compressed within a specified range interval, such as the space of (0, 1), thus ensuring that the feature values have the same scale, enabling the model to make fair comparisons even when facing feature values with large differences.

[0130] The training method of the anomaly detection model provided by the embodiments of the present disclosure, when obtaining the training data, uses the target normalization algorithm to map the numerical values in the training data to a specified range interval according to a preset ratio to obtain the normalized data; uses the normalized data as the pre - processed data; for each round of training, the following operations are performed: randomly divide the pre - processed data to obtain the training sample data and the validation sample data; in this way, based on the limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and making more full and effective use of the limited training data. Then, input the training sample data into the bidirectional long - short - term memory network combined with the self - attention mechanism for training, and calculate the loss value of the current round; evaluate the performance of the bidirectional long - short - term memory network combined with the self - attention mechanism based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, use the bidirectional long - short - term memory network combined with the self - attention mechanism of the current round as the pre - trained detection model.

[0131] In one embodiment, in combination with Figure 2 , as Figure 9 shown, the above S13 can be specifically implemented by the following S130.

[0132] S130. For each round of training, the following operations are performed: randomly select the preprocessed data using k-fold cross-validation to obtain training sample data and validation sample data; input the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculate the loss value of the current round; evaluate the performance of the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation metric.

[0133] In some examples, the training sample data and the validation sample data are different, and both the training sample data and the validation sample data include at least one training link and the annotation result of the training link.

[0134] When inputting the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, the prediction result of the bidirectional long short-term memory network combined with the self-attention mechanism for the training sample data is obtained.

[0135] Based on the target loss function, calculate the loss value between the prediction result and the standard result.

[0136] Exemplarily, assume that the training data is the NSL-KDD dataset, and the number of cross-validation experiments for k-fold cross-validation is 20-fold cross-validation. This means that more than 140,000 pieces of data in the NSL-KDD dataset will be evenly divided into 20 subsets. In each iteration, the data of 19 subsets will be used as the training set, and the remaining subset will be used as the validation set. This process will be repeated 20 times to ensure that each subset has been used as the test set.

[0137] In the detailed implementation process, the kfold module in the sklearn deep learning framework is used to complete the experiment in the training method of the anomaly detection model provided by the embodiments of the present disclosure. First, this article creates a 20-fold cross-validation object and sets the random seed to 42 to ensure that the randomness during each data split is the same. During the training and validation process of each fold, first use the split function provided by the kfold module to divide the NSL-KDD dataset to obtain the label numbers of the corresponding test set and validation set. Then, use the Smote-Enn algorithm to enhance data balance on the obtained training set, and use the oversampled training set as the label numbers of the new training set. Currently, the label numbers of the training set and validation set are obtained, and based on these numbers, the training set and test set of the current fold can be determined. After determining the training set and test set, start to extract the feature columns of the training set data and convert its feature data into the format of the deep learning model. Finally, perform one-hot encoding on the unified training labels to convert them into the matrix form supported by the multi-classification task. The same operations as the training set are performed for the test set. After converting the training set and test set into the formats supported by deep learning, you can enter the model defined in this article to start training. The number of training rounds set in this article is 10, and the training process of each round is output. Next, the data of the training set is input into the model for training. After the model is trained, the test set is input into the model for prediction. Finally, output the relevant loss function, accuracy, recall rate, etc. information of each fold prediction.

[0138] For the training method of the anomaly detection model provided by the embodiments of the present disclosure, when the training data is obtained, preprocessing operations are performed on the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly select the preprocessed data by using k-fold cross-experiment to obtain training sample data and validation sample data; input the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index. In this way, based on the limited training data, new training sample data and validation sample data can be regenerated in each round of training, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. When the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as the pre-training detection model.

[0139] In one embodiment, in combination with Figure 2 , such as Figure 10As shown, the above S13 can be specifically implemented through the following S131 - S133.

[0140] S131. For each round of training, the following operations are performed: randomly divide the pre - processed data to obtain training sample data and validation sample data; input the training sample data into a bidirectional long - short - term memory network to capture the distance - dependence relationship in the time series, and obtain at least one hidden state and at least one cell state.

[0141] S132. Input at least one hidden state and at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state.

[0142] S133. Control the bidirectional long - short - term memory network to train the training sample data according to the weight value corresponding to each hidden state, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long - short - term memory network combined with the self - attention mechanism based on the validation sample data to obtain at least one performance evaluation index.

[0143] For the training method of the anomaly detection model provided by the embodiments of the present disclosure, when the training data is obtained, pre - processing operations are performed on the training data to obtain pre - processed data; for each round of training, the following operations are performed: randomly divide the pre - processed data to obtain training sample data and validation sample data; input the training sample data into a bidirectional long - short - term memory network to capture the distance - dependence relationship in the time series, and obtain at least one hidden state and at least one cell state; input at least one hidden state and at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state; control the bidirectional long - short - term memory network to train the training sample data according to the weight value corresponding to each hidden state, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long - short - term memory network combined with the self - attention mechanism based on the validation sample data to obtain at least one performance evaluation index; thus, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be more fully and effectively utilized. When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long - short - term memory network combined with the self - attention mechanism of the current round is used as the pre - trained detection model.

[0144] In one embodiment, in combination with Figure 2 , as Figure 11 shown, the training method of the anomaly detection model provided by the embodiments of the present disclosure further includes: S15.

[0145] S15. When the difference is greater than or equal to a preset value, and / or when at least one performance evaluation index is less than the corresponding index threshold, perform the next round of training until the difference between the loss value and the target loss is less than the preset value, and when at least one performance evaluation index is greater than or equal to the corresponding index threshold, stop training.

[0146] In some examples, when the difference is greater than or equal to a preset value, and / or when at least one performance evaluation index is less than the corresponding index threshold, perform the next round of training until the difference between the loss value and the target loss is less than the preset value, and when at least one performance evaluation index is greater than or equal to the corresponding index threshold, stop training. At this time, it means that the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold. Therefore, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round can be used as the pre-trained detection model.

[0147] In some examples, in order to determine the performance of the pre-trained detection model obtained by the training method of the anomaly detection model provided in this disclosure, after obtaining the pre-trained detection model, it is necessary to evaluate the performance of the pre-trained detection model through verification sample data to obtain at least one performance evaluation index. At the same time, evaluate the performance of the existing detection model through verification sample data to obtain at least one performance evaluation index. By comparing the differences in the performance evaluation indexes of the pre-trained detection model and the existing detection model, the performance of the pre-trained detection model obtained by the training method of the anomaly detection model provided in this disclosure can be determined.

[0148] In some examples, the training method of the anomaly detection model provided in this disclosure uses four indexes, Accuracy, Precision, Recall, and F1-Score, to evaluate the performance of the pre-trained detection model. On the NSL-KDD dataset, the pre-trained detection model finally starts to converge around 40 rounds, and the accuracy rate can reach 99.52%. The specific experimental results are shown in Table 3. In order to macroscopically observe the pros and cons of the model performance, the training method of the anomaly detection model provided in this disclosure introduces two more indexes, macro average and weighted average. The so-called macro average is to add up different category indexes and then take the average, while the weighted average is weighted according to the weight, and the weight is measured by the proportion of the number of this category in the total number of categories. In this experiment, for the macro average (Macroavg), Precision is 0.92, Recall is 0.99, and F1-Score is 0.95. For the weighted average (wtdavg), Precision is 0.99, Recall is 0.99, and F1-Score is 0.99.

[0149] Table 3

[0150]

[0151] In some examples, such as Figure 12 shown, the changes in the accuracy and loss function values of the bidirectional long short-term memory network combined with the self-attention mechanism during the training process. In Figure 12 it can be seen that in the 4th fold experiment, that is, at the 40th round, the curves of the loss function and the accuracy start to become smooth. Finally, the loss value drops to about 0.012, and the accuracy stabilizes at about 0.995. For the loss value, it can be found through the numerical size that the loss value of the test set prediction (val-loss) always fluctuates around the loss value during training, but always approaches the loss value; for the accuracy, the prediction accuracy of the test set (val-accuracy) is slightly lower than or even equal to the accuracy during training. This slight difference in the performance of the model on the training set and the test set comes from the added Dropout layer in this article, which effectively prevents the overfitting phenomenon.

[0152] In some examples, in order to verify the improvement of the attention mechanism and data balance enhancement on the model performance, the training method of the anomaly detection model provided by the embodiments of the present disclosure sets two comparative experiments respectively. In the first comparative experiment, in this article, while keeping the original parameter settings unchanged, the self-attention mechanism is removed to observe the performance of the single BiLSTM model. In the second comparative experiment, similarly, while keeping other model parameters unchanged, the data balance enhancement is no longer performed to observe the influence of the Smote-Enn algorithm on the prediction results of the minority classes in the model.

[0153] Figure 13 The function change diagram of the accuracy and loss value after removing the attention mechanism is given. Compared with Figure 11 in terms of, the curve of the loss value is not as smooth, and it is still decreasing at a very slow speed as the number of rounds increases. In order to better compare with Figure 11 it, its value may take the middle value 0.030 of its fluctuation range. That is to say, removing the attention mechanism increases the loss value by 0.018, and the convergence speed has seriously declined. In terms of accuracy, the accuracy starts to converge at the 40th round, and its value finally stabilizes at 0.985. Removing the attention mechanism results in a 1.02% decrease in accuracy.

[0154] Figure 14 is the confusion matrix diagram without data balance enhancement. Figure 15It is a confusion matrix diagram with data balance enhancement. Since the data balance enhancement technique we adopted is the Smote-Enn algorithm, the Smote-Enn algorithm is an oversampling technique that increases the number of samples of the minority class, thereby improving the prediction accuracy for the minority class. The experimental results show that this is indeed the case. In the multi-classification experiment of this paper, Probe, R2L, and L2R are all minority classes. In Figure 14 it can be seen that due to the lack of data balance enhancement processing, there are 33 misjudged data for Probe, and 898 data are predicted correctly. There are 22 misjudged data for R2L, and 227 data are predicted correctly. There are 3 misjudged data for L2R, and 4 data are predicted correctly. The misjudgment rate of L2R with the smallest number is close to 50%. After the data balance enhancement processing, in Figure 15 it can be seen that the number of misjudged Probe data has decreased from 33 to 1, the number of misjudged R2L data has decreased from 22 to 3, and the number of misjudged L2R data is 0. Table 3 reflects the changes in the accuracy of different types of predictions due to data balance enhancement. For the majority class, the correct rate of data balance enhancement has decreased slightly because the model training no longer favors the majority class. Here, in order to distinguish it from the Figure 12 accuracy in, the calculation formula for accuracy in Table 4 is: accuracy = the number of correctly predicted data of this class / the number of data of this class participating in training.

[0155] Table 4

[0156]

[0157] To better illustrate the superiority of the model in this paper, the training method of the anomaly detection model provided in the embodiments of the present disclosure is compared with existing detection models. Two metrics, accuracy and F1-Score, are selected for comparison. The reason for choosing these two metrics is that they are the metrics mentioned in most models. The comparison results are shown in Table 5. From the results, there is an increase of nearly 15%. This significant performance improvement is not entirely due to the attention mechanism and the long short-term memory network model itself, but also comes from the data balance enhancement processing using the Smote-Enn algorithm selected in this paper. For the existing detection model that uses the Smote data enhancement algorithm based on k-means, the accuracy of its model has been greatly improved. The Smote-Enn data enhancement algorithm selected by the training method of the anomaly detection model provided in the embodiments of the present disclosure is still superior to it, with an increase of nearly 2% in terms of accuracy. In addition, the superiority of the pre-trained detection model obtained by the training method of the anomaly detection model provided in the embodiments of the present disclosure is also reflected in the F1 score. Whether data enhancement processing is performed or not, the pre-trained detection model proposed by the training method of the anomaly detection model provided in the embodiments of the present disclosure has an increase of nearly 10% compared with the existing detection model.

[0158] Table 5

[0159]

[0160] It can be seen that there are two major problems in the existing detection models at present. One is that the features between data cannot be fully extracted for large datasets; the other is that the model will face the problem of information overload while ensuring performance. The training method of the anomaly detection model provided by the embodiments of the present disclosure uses a BiLSTM model with a self-attention mechanism. The BiLSTM is used to capture the long-distance dependence relationship between data, and the self-attention mechanism is used to assign different weights to features. The experimental results show that introducing the self-attention mechanism can not only improve the prediction accuracy of the model but also improve the stability of the model. At the same time, in order to enhance the prediction accuracy of the model for the minority class, the training method of the anomaly detection model provided by the embodiments of the present disclosure performs data balance enhancement processing on the training data. The Smote-Enn algorithm, which combines the Smote algorithm and the Enn algorithm, is used to oversample the original data. The Smote algorithm is used to increase the samples of the minority class, and the Enn algorithm is used to clean the possible generated noise data. The experiment shows that the data balance enhancement processing improves the prediction accuracy of the minority classes Probe, R2L, and L2R in the NSL-KDD dataset by 3.39%, 7.21%, and 42.86% respectively. In addition, in order to prevent overfitting in the multi-classification experiment, a Dropout layer is added between the attention mechanism layer and the fully connected layer. The final experimental results show that this model is superior to other models in terms of two indicators: accuracy and F1 score.

[0161] The training method of the anomaly detection model provided by the embodiments of the present disclosure, when obtaining training data, performs a preprocessing operation on the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. After that, the training sample data is input into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and the loss value of the current round is calculated; the performance of the bidirectional long short-term memory network combined with the self-attention mechanism is evaluated based on the validation sample data to obtain at least one performance evaluation index; in the case where the difference is greater than or equal to a preset value, and / or at least one performance evaluation index is less than the corresponding index threshold, the next round of training is performed until the difference between the loss value and the target loss is less than the preset value, and all at least one performance evaluation index is greater than or equal to the corresponding index threshold, and then the training is stopped. At this time, since the difference between the loss value and the target loss is less than the preset value, and all at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round can be used as the pre-trained detection model.

[0162] It should be understood that although Figure 2-15 the steps in the flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, Figure 2-15 at least a part of the steps in

[0163] In one embodiment, as Figure 16 shown, a detection method is provided. This embodiment mainly takes the application of this method to Figure 1 the server 104 in

[0164] S20. When receiving an access request, obtain the access address included in the access request;

[0165] S21. Based on the pre-trained detection model, detect the access address to determine the detection result. Among them, the pre-trained detection model is obtained by training with the training method of the anomaly detection model in any of the above items.

[0166] S22. When the detection result is an abnormal link, access to the access address is prohibited.

[0167] In some examples, the abnormal link includes any one of Dos (Denial of Service Attack), Probe, R2L (Remote to Local Attack), and L2R (Local to Remote Attack).

[0168] In some examples, when the detection result is a normal link (such as Normal), access to the access address is allowed.

[0169] When the detection method provided by the embodiments of the present disclosure performs network intrusion detection on the pre-trained detection model, a limited amount of labeled data can be used. For each round of model training, new training sample data and validation sample data are regenerated, ensuring that the data used for each training is different, and the limited training data can be more fully and effectively utilized. Since only a small amount of labeled data is used to complete the model training during model training, without the need for a large amount of manual data annotation, the cost of data annotation can be reduced.

[0170] It should be understood that although Figure 16 the steps in the flowchart of Figure 16 are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover,

[0171] In one embodiment, as Figure 17 shown, a training device for an anomaly detection model is provided, including an acquisition module and a processing module, where:

[0172] The acquisition module is configured to acquire training data;

[0173] The processing module is configured to:

[0174] Perform preprocessing operations on the training data acquired by the acquisition module to obtain preprocessed data; where the preprocessing operations include one or more of data cleaning, normalization operations, and one-hot encoding;

[0175] For each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; input the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculate the loss value of the current round; evaluate the performance of the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation metric; wherein, the performance evaluation metric includes any one of the loss value, accuracy, precision, recall, and target score value;

[0176] In the case where the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation metric is greater than or equal to the corresponding metric threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as a pre-trained detection model.

[0177] In one embodiment, the preprocessing operation includes data cleaning; when performing the preprocessing operation on the training data to obtain the preprocessed data, the processing module is configured to:

[0178] Perform oversampling on the training data to obtain oversampled data;

[0179] Delete the noise samples and mislabeled samples in the oversampled data to obtain the preprocessed data.

[0180] In one embodiment, the preprocessing operation includes a normalization operation; when performing the preprocessing operation on the training data to obtain the preprocessed data, the processing module is configured to:

[0181] Use the target normalization algorithm to map the values in the training data to a specified range interval according to a preset ratio to obtain normalized data;

[0182] Take the normalized data as the preprocessed data.

[0183] In one embodiment, when performing the random division of the preprocessed data to obtain the training sample data and the validation sample data, the processing module is configured to:

[0184] Use k-fold cross-validation to randomly select the preprocessed data to obtain the training sample data and the validation sample data.

[0185] In one embodiment, when performing the input of the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training and calculating the loss value of the current round, the processing module is configured to:

[0186] Input the training sample data into the bidirectional long short-term memory network to capture the distance dependencies in the time series, and obtain at least one hidden state and at least one cell state;

[0187] Input at least one hidden state and at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state;

[0188] Control the bidirectional long short-term memory network to train the training sample data according to the weight value corresponding to each hidden state, and calculate the loss value of the current round.

[0189] In one embodiment, the processing module is configured to:

[0190] In the case where the difference is greater than or equal to a preset value, and / or at least one performance evaluation index is less than the corresponding index threshold, perform the next round of training until the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, then stop training.

[0191] When the training device for the anomaly detection model provided by the embodiments of the present disclosure obtains training data, it preprocesses the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; thus, based on limited training data, new training sample data and validation sample data can be regenerated in each round of training, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. After that, input the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, use the bidirectional long short-term memory network combined with the self-attention mechanism of the current round as the pre-trained detection model.

[0192] For the specific limitations on the training device of the anomaly detection model, reference can be made to the limitations on the training method of the anomaly detection model in the above text, which will not be elaborated here. Each module in the above training device of the anomaly detection model can be implemented in whole or in part through software, hardware and their combination. The above modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0193] In one embodiment, a computer device is provided. This computer device can be a server, and its internal structure diagram can be as Figure 18As shown in the figure. The computer device includes a processor, a memory, and a network interface connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store training data for the anomaly detection model. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a method for training an anomaly detection model.

[0194] Those skilled in the art can understand that Figure 18 the structure shown in the figure is only a block diagram of some structures related to the solution of the present disclosure, and does not constitute a limitation on the computer device to which the solution of the present disclosure is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0195] In one embodiment, the training device for the anomaly detection model provided by the present disclosure can be implemented in the form of a computer program, and the computer program can run on a computer device as shown in Figure 18 the figure. Each program module constituting the training device for the anomaly detection model can be stored in the memory of the computer device. For example, Figure 17 the acquisition module and the processing module shown in the figure. The computer program composed of each program module enables the processor to execute the steps in the method for training the anomaly detection model in each embodiment of the present disclosure described in this specification.

[0196] For example, Figure 18 the computer device shown in the figure can execute S11 through the acquisition module in the training device for the anomaly detection model as shown in Figure 17 the figure. The computer device can execute S12 - S14 through the processing module.

[0197] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the following steps are implemented: S11, S12, S13, and S14.

[0198] S11. Obtain training data;

[0199] S12. Perform preprocessing operations on the training data to obtain preprocessed data; wherein, the preprocessing operations include one or more of data cleaning, normalization operation, and one-hot encoding;

[0200] S13. For each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; input the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; wherein, the performance evaluation index includes any one of the loss value, accuracy, precision, recall rate, and target score value.

[0201] S14. When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round is used as the pre-trained detection model.

[0202] In one embodiment, the preprocessing operation includes data cleaning; when the computer device performs the preprocessing operation on the training data to obtain the preprocessed data, the following steps are also implemented: perform oversampling processing on the training data to obtain oversampled data; delete the noise samples and mislabeled samples in the oversampled data to obtain the preprocessed data.

[0203] In one embodiment, the preprocessing operation includes normalization operation; when the computer device performs the preprocessing operation on the training data to obtain the preprocessed data, the following steps are also implemented: use the target normalization algorithm to map the values in the training data to a specified range interval according to a preset ratio to obtain normalized data; use the normalized data as the preprocessed data.

[0204] In one embodiment, when the computer device randomly divides the preprocessed data to obtain training sample data and validation sample data, the following steps are also implemented: randomly select the preprocessed data by using k-fold cross-validation to obtain training sample data and validation sample data.

[0205] In one embodiment, when the computer device inputs the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training and calculates the loss value of the current round, the following steps are also implemented: input the training sample data into the bidirectional long short-term memory network to capture the distance dependence relationship in the time series, and obtain at least one hidden state and at least one cell state; input at least one hidden state and at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state; control the bidirectional long short-term memory network to train the training sample data according to the weight value corresponding to each hidden state, and calculate the loss value of the current round.

[0206] In one embodiment, the computer device further implements the following steps: in the case where the difference is greater than or equal to a preset value, and / or at least one performance evaluation index is less than the corresponding index threshold, perform the next round of training until the difference between the loss value and the target loss is less than the preset value, and stop training when at least one performance evaluation index is greater than or equal to the corresponding index threshold.

[0207] The training method of the anomaly detection model provided by the embodiments of the present disclosure, when obtaining training data, performs preprocessing operations on the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. Then, input the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, use the bidirectional long short-term memory network combined with the self-attention mechanism of the current round as the pre-trained detection model.

[0208] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: S11, S12, S13, and S14.

[0209] S11, obtain training data;

[0210] S12, perform preprocessing operations on the training data to obtain preprocessed data; where the preprocessing operations include one or more of data cleaning, normalization operations, and one-hot encoding;

[0211] S13, for each round of training, perform the following operations: randomly divide the preprocessed data to obtain training sample data and validation sample data; input the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training, and calculate the loss value of the current round; perform performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the validation sample data to obtain at least one performance evaluation index; where the performance evaluation index includes any one of the loss value, accuracy rate, precision rate, recall rate, and target score value;

[0212] S14. When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism in the current round is used as the pre-trained detection model.

[0213] In one embodiment, the preprocessing operation includes data cleaning; when the computer program performs the preprocessing operation on the training data to obtain the preprocessed data, the following steps are also implemented: oversampling the training data to obtain oversampled data; deleting the noise samples and mislabeled samples in the oversampled data to obtain the preprocessed data.

[0214] In one embodiment, the preprocessing operation includes normalization operation; when the computer program performs the preprocessing operation on the training data to obtain the preprocessed data, the following steps are also implemented: using the target normalization algorithm to map the values in the training data to a specified range interval according to a preset ratio to obtain the normalized data; using the normalized data as the preprocessed data.

[0215] In one embodiment, when the computer program performs the random division of the preprocessed data to obtain the training sample data and the validation sample data, the following steps are also implemented: randomly selecting the preprocessed data by using k-fold cross-validation to obtain the training sample data and the validation sample data.

[0216] In one embodiment, when the computer program inputs the training sample data into the bidirectional long short-term memory network combined with the self-attention mechanism for training and calculates the loss value of the current round, the following steps are also implemented: inputting the training sample data into the bidirectional long short-term memory network to capture the distance dependence relationship in the time series to obtain at least one hidden state and at least one cell state; inputting at least one hidden state and at least one cell state into the attention mechanism for learning to obtain the weight value corresponding to each hidden state; controlling the bidirectional long short-term memory network to train the training sample data according to the weight value corresponding to each hidden state and calculate the loss value of the current round.

[0217] In one embodiment, the computer program also implements the following steps: in the case that the difference is greater than or equal to the preset value, and / or at least one performance evaluation index is less than the corresponding index threshold, perform the next round of training until the difference between the loss value and the target loss is less than the preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, and then stop training.

[0218] The training method of the anomaly detection model provided by the embodiments of the present disclosure, when obtaining training data, performs preprocessing operations on the training data to obtain preprocessed data; for each round of training, the following operations are performed: randomly divide the preprocessed data to obtain training sample data and validation sample data; in this way, based on limited training data, in each round of training, new training sample data and validation sample data can be regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. After that, the training sample data is input into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and the loss value of the current round is calculated; the performance of the bidirectional long short-term memory network combined with the self-attention mechanism is evaluated based on the validation sample data to obtain at least one performance evaluation index; when the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation index is greater than or equal to the corresponding index threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as the pre-trained detection model.

[0219] In one embodiment, as Figure 19 shown, a detection device is provided, including a receiving module and a processing module, where:

[0220] The receiving module is configured to receive an access request;

[0221] The processing module is configured to:

[0222] When the receiving module receives an access request, control the receiving module to obtain the access address included in the access request;

[0223] Based on the pre-trained detection model, detect the access address received by the receiving module to determine the detection result; where the pre-trained detection model is obtained by training with the training method of the anomaly detection model in any of the above items;

[0224] In the case where the detection result is an abnormal link, prohibit access to the access address.

[0225] When the detection device provided by the embodiments of the present disclosure performs network intrusion detection using the pre-trained detection model, it can use limited labeled data. For each round of model training, new training sample data and validation sample data are regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. Since only a small amount of labeled data is used for model training, there is no need for manual large-scale data annotation, so the cost of data annotation can be reduced.

[0226] For the specific definition of the detection device, please refer to the definition of the detection method above and will not be repeated here. Each module in the above-mentioned detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software so that the processor can call and execute the operations corresponding to each of the above modules.

[0227] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 18 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store detection data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a detection method is implemented.

[0228] Those skilled in the art will understand that Figure 18 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present disclosure, and does not constitute a limitation on the computer device to which the solution of the present disclosure is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0229] In one embodiment, the detection device provided by the present disclosure can be implemented in the form of a computer program. The computer program can be used in Figure 18 The computer device shown in FIG. 1 is run on the computer device shown in FIG. The memory of the computer device can store various program modules constituting the detection device, such as, Figure 19 The receiving module and processing module shown in the figure. The computer program composed of various program modules enables the processor to execute the steps of the detection method of each embodiment of the present disclosure described in this specification.

[0230] For example, Figure 18 The computer device shown can be Figure 19 The receiving module in the detection device shown executes S20. The computer device can execute S22 and S23 through the processing module.

[0231] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the following steps are implemented: S20, S21, and S22.

[0232] In one embodiment, when the processor executes the computer program, the following steps are further implemented: when the detection result is a normal link, access the access address.

[0233] When the detection device provided by the embodiments of the present disclosure performs network intrusion detection on the pre-trained detection model, it can use limited labeled data. For each round of model training, new training sample data and validation sample data are regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. Since only a small amount of labeled data is used for model training, there is no need for manual large-scale data labeling, so the cost of data labeling can be reduced.

[0234] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: S20, S21, and S22.

[0235] In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: when the detection result is a normal link, access the access address.

[0236] When the detection device provided by the embodiments of the present disclosure performs network intrusion detection on the pre-trained detection model, it can use limited labeled data. For each round of model training, new training sample data and validation sample data are regenerated, ensuring that the data for each training is different, and the limited training data can be utilized more fully and effectively. Since only a small amount of labeled data is used for model training, there is no need for manual large-scale data labeling, so the cost of data labeling can be reduced.

[0237] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above various methods. Among them, any reference to a memory, database, or other medium used in the various embodiments provided by the present disclosure can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory, etc. Volatile memory can include random access memory (RAM) or an external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static random access memory (SRAM) and dynamic random access memory (DRAM), etc.

[0238] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

[0239] The above embodiments merely represent several implementation manners of the present disclosure. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present disclosure, several modifications and improvements can still be made, and these all belong to the protection scope of the present disclosure. Therefore, the protection scope of the patent of the present disclosure shall be subject to the appended claims.

Claims

1. A training method for an anomaly detection model, characterized in that: include: Get training data; Performing a preprocessing operation on the training data to obtain preprocessed data; wherein the preprocessing operation includes one or more of data cleaning, normalization, and one-hot encoding; For each round of training, the following operations are performed: randomly dividing the preprocessed data to obtain training sample data and verification sample data; inputting the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculating the loss value of the current round; performing a performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the verification sample data to obtain at least one performance evaluation indicator; wherein the performance evaluation indicator includes any one of the loss value, accuracy, precision, recall rate, and target score value; When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation indicator is greater than or equal to the corresponding indicator threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as a pre-trained detection model.

2. The training method of the anomaly detection model according to claim 1, characterized in that: The pre-processing operation includes data cleaning; The preprocessing operation on the training data to obtain preprocessed data includes: Performing oversampling processing on the training data to obtain oversampled data; Noise samples and erroneously labeled samples in the oversampled data are deleted to obtain preprocessed data.

3. The training method of the anomaly detection model according to claim 1, characterized in that: The preprocessing operation includes a normalization operation; The preprocessing operation on the training data to obtain preprocessed data includes: Using a target normalization algorithm to map the values in the training data to a specified range according to a preset ratio to obtain normalized data; The normalized data is used as preprocessed data.

4. The training method of the anomaly detection model according to claim 1, characterized in that: The randomly dividing the preprocessed data to obtain training sample data and verification sample data includes: The preprocessed data are randomly selected using a k-fold crossover experiment to obtain training sample data and verification sample data.

5. The training method of the anomaly detection model according to claim 1, characterized in that: Inputting the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculating the loss value of the current round, includes: Inputting the training sample data into a bidirectional long short-term memory network to capture the distance dependency in the time series, and obtaining at least one hidden state and at least one cell state; Inputting the at least one hidden state and the at least one cell state into an attention mechanism for learning to obtain a weight value corresponding to each hidden state; The bidirectional long short-term memory network is controlled to train the training sample data according to the weight value corresponding to each hidden state, and the loss value of the current round is calculated.

6. The training method of the anomaly detection model according to claim 1, characterized in that: The method further comprises: When the difference is greater than or equal to the preset value, and / or at least one performance evaluation indicator is less than the corresponding indicator threshold, the next round of training is carried out until the difference between the loss value and the target loss is less than the preset value, and the at least one performance evaluation indicator is greater than or equal to the corresponding indicator threshold, and the training is stopped.

7. A detection method, characterized in that: include: Upon receiving an access request, obtaining an access address included in the access request; Detecting the access address based on a pre-trained detection model to determine a detection result; wherein the pre-trained detection model is trained by the training method of the anomaly detection model according to any one of claims 1 to 6; If the detection result is an abnormal link, access to the access address is prohibited.

8. A training device for an anomaly detection model, characterized in that: include: an acquisition module configured to acquire training data; Processing module, configured as: Performing a preprocessing operation on the training data acquired by the acquisition module to obtain preprocessed data; wherein the preprocessing operation includes one or more of data cleaning, normalization, and one-hot encoding; For each round of training, the following operations are performed: randomly dividing the preprocessed data to obtain training sample data and verification sample data; inputting the training sample data into a bidirectional long short-term memory network combined with a self-attention mechanism for training, and calculating the loss value of the current round; performing a performance evaluation on the bidirectional long short-term memory network combined with the self-attention mechanism based on the verification sample data to obtain at least one performance evaluation indicator; wherein the performance evaluation indicator includes any one of the loss value, accuracy, precision, recall rate, and target score value; When the difference between the loss value and the target loss is less than a preset value, and at least one performance evaluation indicator is greater than or equal to the corresponding indicator threshold, the bidirectional long short-term memory network combined with the self-attention mechanism of the current round is used as a pre-trained detection model.

9. A detection device, characterized in that: include: Processing module, configured as: When the receiving module receives the access request, controlling the receiving module to obtain the access address included in the access request; The access address received by the receiving module is detected based on a pre-trained detection model to determine a detection result; wherein the pre-trained detection model is trained by the training method of the anomaly detection model according to any one of claims 1 to 6; If the detection result is an abnormal link, access to the access address is prohibited.

10. A computer device, characterized in that: The computer device comprises: processor; a memory configured to store instructions executable by the processor; The processor is configured to execute the instructions to implement the training method of the anomaly detection model as described in any one of claims 1 to 6, or to implement the detection method as described in claim 7.

Images