Situation element extraction model based on multiple attention mechanisms and training method

Abstract

The invention discloses a situation element extraction model based on multiple attention mechanisms and a training method, relates to the technical field of deep learning, and aims to solve the problem of low accuracy of situation element extraction of an existing model. The model comprises an input layer, a convolution layer, a multiple attention mechanism layer, a feature enhancement module, a full connection layer and an output layer. Wherein the input layer firstly receives original network traffic data containing time sequence correlation multi-dimensional features, inputs the original network traffic data into the convolution layer to extract periodic characteristics, generates a local time sequence feature map, then inputs the multiple attention mechanism layer to obtain key channel features, key space features and supplementary context features, and fuses the features to generate a network traffic feature map; the method comprises the following steps: firstly, inputting a feature enhancement module to carry out maximum pooling, normalization, long and short-term memory network and random discarding operations, outputting an anti-overfitting network flow representation vector, finally, mapping the network flow representation vector to a preset situation element space by a full connection layer, and outputting a situation element category through an output layer.

Description

Technical Field

[0001] The present application relates to the field of deep learning technology, and in particular to a situation factor extraction model and training method based on a multiple attention mechanism. Background Art

[0002] The extraction of network security situation elements is the basis of network security situation awareness. It can identify key security indicators from massive data and provide an important basis for timely detection of threats, risk assessment and formulation of protection strategies.

[0003] Currently, existing models have limitations when dealing with complex attack traffic. On the one hand, fixed convolution operations struggle to effectively capture traffic characteristics at different scales, making the model less adaptable to diverse attack types. On the other hand, the feature extraction process fails to adequately focus on key information, resulting in insufficient expressive power and impacting the accuracy of situational factor extraction. Therefore, there is an urgent need to design a network model that can improve the accuracy of situational factor extraction. Summary of the Invention

[0004] The purpose of this application is to provide a situation factor extraction model and training method based on a multiple attention mechanism, aiming to solve the problem of low accuracy in situation factor extraction by existing models.

[0005] To achieve the above objectives, this application adopts the following technical solutions: The present application provides a situation factor extraction model based on a multiple attention mechanism, which includes: an input layer for receiving original network traffic data containing time-related multi-dimensional features. A convolutional layer for extracting the periodic characteristics of the original network traffic data and generating a local time series feature map. A multiple attention mechanism layer for obtaining key channel features, key spatial features and supplementary context features in the local time series feature map, and fusing them to generate a network traffic feature map. A feature enhancement module for performing maximum pooling, normalization, long short-term memory network and random drop operations on the network traffic feature map, and outputting a network traffic representation vector that is resistant to overfitting. A fully connected layer for mapping the network traffic representation vector to a preset situation factor space. An output layer for outputting a situation factor category based on the preset situation factor space.

[0006] The situation factor extraction model based on the multiple attention mechanism provided in the embodiment of the present application is prone to missing cross-dimensional correlation features because the traditional situation factor extraction model only includes a single attention mechanism or a dual attention mechanism. Therefore, the situation factor extraction model based on the multiple attention mechanism in the present application realizes the synergy of channel-space-dual attention by designing a multiple attention mechanism layer and utilizing triple attention joint modeling, thereby strengthening the correlation between cross-dimensional features, making the features extracted by the model more comprehensive in indicating the corresponding situation factor category, thereby improving the accuracy of the situation factor extraction by the model.

[0007] In some embodiments, the multiple attention mechanism layers include: a channel attention mechanism for calculating the global information of the feature channels of the local temporal feature map, and learning the channel attention weights of the feature channel global information to obtain key channel features; a spatial attention mechanism for aggregating the spatial dimensions of the local temporal feature map to obtain a spatial dimension feature map, and learning the spatial attention weights of the spatial dimension feature map to obtain key spatial features; a dual attention mechanism for activating the attention features of the local temporal feature map through a trunk path to obtain a first feature map, and inverting and activating the attention features of the local temporal feature map through a dual path to obtain a second feature map, and summing the first feature map and the second feature map to obtain a supplementary context feature.

[0008] Based on this, this application realizes accurate feature extraction of load flow patterns through multi-order feature calibration by dynamically screening key feature channels, accurately locating abnormal spatial distribution of traffic, and complementary fusion of trunk paths and dual paths, thereby improving the extraction accuracy of the final constructed model.

[0009] In some embodiments, the feature enhancement module includes: a maximum pooling layer for downsampling the network traffic feature graph to obtain a compressed network traffic feature graph; a normalization layer for standardizing the compressed network traffic feature graph to obtain a standardized network traffic feature graph; a long short-term memory network layer for capturing temporal dependencies in the standardized network traffic feature graph to obtain a network traffic representation vector; and a random dropout layer for performing an anti-overfitting operation on the network traffic representation vector to obtain an anti-overfitting network traffic representation vector.

[0010] Based on this, this application forms a compression-standardization-time series modeling-anti-overfitting model processing flow by designing a maximum pooling layer, a normalization layer, a long short-term memory network layer, and a random dropout layer, which can adapt to scenarios with dynamically changing network traffic and improve the applicability of the model.

[0011] The present application provides a training method for a situation factor extraction model based on a multiple attention mechanism, the method comprising: obtaining a network security situation awareness data set, and dividing it into a training set, a validation set, and a test set according to a preset ratio, using the training set to iteratively train a preset model framework to obtain an initial situation factor extraction model, adjusting the parameters of the initial situation factor extraction model through the validation set until the parameters converge to obtain a target situation factor extraction model, using the test set to test the target situation factor extraction model to obtain performance indicators, and when the performance indicators meet the preset indicators, determining the target situation factor extraction model as a situation factor extraction model based on a multiple attention mechanism.

[0012] The training method for a situational factor extraction model based on a multiple-attention mechanism provided in the embodiments of this application uses a three-stage isolated training strategy of training, validation, and testing, combined with iterative parameter tuning driven by a validation set, to ensure that the model converges to the global optimal solution, avoid overfitting, and improve cross-scenario adaptability. At the same time, a test set is used to strictly verify whether the performance indicators meet the standards to ensure the reliability of the model in actual deployment, thereby ensuring the accuracy of the resulting situational factor extraction model based on the multiple-attention mechanism.

[0013] In some embodiments, the above-mentioned parameter adjustment of the initial situation factor extraction model through the verification set until the parameters converge to obtain the target situation factor extraction model includes: adjusting the parameters successively according to the preset amplitude, inputting the verification set into the initial situation factor extraction model for each adjusted parameter to obtain the model accuracy, and determining the parameters corresponding to the highest model accuracy as the target parameters to obtain the target situation factor extraction model.

[0014] Based on this, this application adjusts the parameters in sequence by preset amplitudes and selects the optimal parameters based on the accuracy of the validation set to avoid local optimality, and further selects the parameters corresponding to the highest accuracy as the parameters of the final model, thereby improving the classification accuracy of the model in real scenarios.

[0015] In some embodiments, the above-mentioned performance indicators include accuracy, precision, recall rate and harmonic mean evaluation index; the above-mentioned satisfaction of preset indicators includes: the accuracy rate is greater than the preset accuracy rate, and the precision rate is greater than the preset precision rate, and the recall rate is greater than the preset recall rate, and the harmonic mean evaluation index is greater than the preset evaluation index value.

[0016] In some embodiments, the training method of the situation factor extraction model based on the multi-attention mechanism provided in the embodiments of the present application also includes: deleting the target situation factor extraction model when the performance index does not meet the preset index.

[0017] The present application provides a training device for a situation factor extraction model based on a multiple attention mechanism, the device comprising: an acquisition unit, for acquiring a network security situation awareness data set, and dividing it into a training set, a validation set, and a test set according to a preset ratio. A training unit, for iteratively training a preset model framework using the training set acquired by the acquisition unit to obtain an initial situation factor extraction model. A verification unit, for adjusting the parameters of the initial situation factor extraction model using the validation set acquired by the acquisition unit until the parameters converge to obtain a target situation factor extraction model. A testing unit, for testing the target situation factor extraction model using the test set acquired by the acquisition unit to obtain a performance indicator, and when the performance indicator meets the preset indicator, determining the target situation factor extraction model as a situation factor extraction model based on a multiple attention mechanism.

[0018] In some embodiments, the above-mentioned verification unit is specifically used to: adjust the parameters successively according to the preset amplitude, input the verification set into the initial situation factor extraction model for each adjusted parameter to obtain the model accuracy, and determine the parameter corresponding to the highest model accuracy as the target parameter to obtain the target situation factor extraction model.

[0019] In some embodiments, the above-mentioned performance indicators include accuracy, precision, recall rate and harmonic mean evaluation index; the above-mentioned satisfaction of preset indicators includes: the accuracy rate is greater than the preset accuracy rate, and the precision rate is greater than the preset precision rate, and the recall rate is greater than the preset recall rate, and the harmonic mean evaluation index is greater than the preset evaluation index value.

[0020] In some embodiments, the training device for the situation factor extraction model based on the multi-attention mechanism provided in the embodiments of the present application also includes: a processing unit, which is used to delete the target situation factor extraction model when the performance index does not meet the preset index.

[0021] The present application provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the above-described situation factor extraction model based on the multiple attention mechanism.

[0022] The present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal, the terminal executes the situation factor extraction model based on the multi-attention mechanism described above.

[0023] The present application provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to execute the situation factor extraction model based on the multi-attention mechanism described above.

[0024] The present application provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run computer programs or instructions to implement the above-described situation factor extraction model based on the multiple attention mechanism.

[0025] Specifically, the chip provided in the embodiment of the present application also includes a memory for storing computer programs or instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 A framework diagram of a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 2 A framework diagram of another situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 3 A structural diagram of a multi-attention mechanism layer provided in an embodiment of the present application; Figure 4 A structural diagram of a dual attention mechanism provided in an embodiment of the present application; Figure 5 A flowchart of a training method for a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 6 A schematic diagram of a training scenario for a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 7 A schematic diagram of a training scenario for another situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 8 A diagram showing the structure of a device for a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application; Figure 9 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0029] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "back," "inner," "outer," and the like, indicating directions or positional relationships, are based on the directions or relative positional relationships shown in the accompanying drawings and are intended solely to facilitate the description of this application and simplify the description. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed, or operate in a specific direction. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned directionality descriptions may be flexibly set in actual application, provided that the relative positional relationships shown in the accompanying drawings are met.

[0030] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0031] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connected," and "connected" should be understood broadly. For example, they may refer to fixed connections, detachable connections, or integral connections. They may be directly connected, indirectly connected through an intermediary, or internally connected between two components. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.

[0032] In some embodiments, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, article, or apparatus that includes the element.

[0033] In some embodiments, words such as "exemplary" or "for example" are used to indicate an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0034] In the description of this specification, specific features, structures, materials or characteristics may be combined in an appropriate manner in any one or more embodiments or examples.

[0035] As the core link of situational awareness, network security situation factor extraction undertakes the important task of identifying key security indicators (such as attack behavior patterns, abnormal traffic characteristics, etc.) from massive heterogeneous data. Its accuracy directly affects the effectiveness of threat discovery, risk quantification and protection decision-making.

[0036] Among related technologies, the situation factor extraction model based on deep learning still has significant technical bottlenecks: on the one hand, traditional convolutional neural networks rely on fixed-size convolution kernels for local feature extraction, which makes it difficult to adaptively capture cross-scale associated attack characteristics in network traffic (such as the mixed representation of low-frequency covert attack signals and high-frequency sudden threats), resulting in limited generalization capabilities of the model in complex attack scenarios; on the other hand, the existing model lacks a dynamic attention guidance mechanism and fails to effectively enhance high-value information (such as attack chain timing characteristics and protocol field anomalies) in the feature fusion stage, resulting in insufficient feature expression capabilities and ultimately leading to low accuracy in the model's extraction of situation factors.

[0037] In this context, in order to solve the problem of low accuracy in situation factor extraction by existing models in related technologies, the present application provides a situation factor extraction model and training method based on a multiple attention mechanism. Since convolutional neural networks cannot fully capture multi-scale feature information, a multiple attention mechanism is introduced on the basis of extracting feature maps in the convolution layer. By capturing multi-scale feature information, the model can fully extract the key features of the input data. Experimental results show that the multiple attention mechanism improves the accuracy of situation factor extraction. The following is a detailed description of the implementation of the embodiment of the present application in conjunction with the drawings in the specification.

[0038] Refer to the following Figures 1 to 4 The situation factor extraction model based on the multiple attention mechanism provided in the embodiment of the present application is described.

[0039] In some embodiments, as Figure 1As shown, the situation factor extraction model 100 based on the multiple attention mechanism provided in an embodiment of the present application may include an input layer 110, a convolutional layer 120, a multiple attention mechanism layer 130, a feature enhancement module 140, a fully connected layer 150 and an output layer 160.

[0040] In an embodiment of the present application, after the data is input into the situation factor extraction model 100 based on the multiple attention mechanism through the input layer 110, it will pass through the convolution layer 120, the multiple attention mechanism layer 130, the feature enhancement module 140 and the fully connected layer 150 in sequence, and then output the result through the output layer 160.

[0041] For example, the classification of network traffic data containing time-series-related multi-dimensional features using the multi-attention mechanism-based situational factor extraction model 100 is used. Raw network traffic data is input into the multi-attention mechanism-based situational factor extraction model 100 via the input layer 110. The convolutional layer 120 then extracts periodic features from the raw network traffic data, generating a local time-series feature map, which is then output to the multi-attention mechanism layer 130. The multi-attention mechanism layer 130 extracts key channel features, key spatial features, and supplementary context features from the local time-series feature map, fuses these key channel features, key spatial features, and supplementary context features to generate a network traffic feature map, which is then output to the feature enhancement module 140. The feature enhancement module 140 then performs maximum pooling, normalization, long short-term memory network, and random dropout on the network traffic feature map, outputting an overfitting-resistant network traffic representation vector to the fully connected layer 150. The fully connected layer 150 maps the network traffic representation vector to a preset situational factor space. Finally, the resulting network traffic category is output via the output layer 160.

[0042] Optionally, combined Figure 1 ,like Figure 2 As shown, the feature enhancement module 140 may include a maximum pooling layer 141 , a normalization layer 142 , a long short-term memory network layer 143 , and a random dropout layer 144 .

[0043] In an embodiment of the present application, after receiving the network traffic feature graph, the feature enhancement module 140 can use the maximum pooling layer 141 to improve the robustness of the model and stabilize the training process through the normalization layer 142; then, use the long short-term memory network layer 143 to capture the temporal dependency and obtain the long-term dependency features in the traffic data; then, introduce the random dropout layer 144 to reduce the risk of overfitting and improve the generalization ability of the model.

[0044] Exemplarily, after the multiple attention mechanism layer 130 outputs the obtained network traffic feature graph to the feature enhancement module 140, the maximum pooling layer 141 can downsample the network traffic feature graph to obtain a compressed network traffic feature graph and output it to the normalization layer 142; the normalization layer 142 can standardize the compressed network traffic feature graph to obtain a standardized network traffic feature graph and output it to the long short-term memory network layer 143; the long short-term memory network layer 143 can capture the temporal dependency in the standardized network traffic feature graph, obtain a network traffic representation vector and output it to the random drop layer 144; the random drop layer 144 can perform an anti-overfitting operation on the network traffic representation vector to obtain an anti-overfitting network traffic representation vector.

[0045] In this way, this application forms a compression-standardization-time series modeling-anti-overfitting model processing flow by designing the maximum pooling layer, normalization layer, long short-term memory network layer and random drop layer, which can adapt to scenarios with dynamic changes in network traffic and improve the applicability of the model.

[0046] Optionally, combined Figure 1 ,like Figure 3 As shown, the multi-attention mechanism (MAM) layer 130 may include a channel attention mechanism (CAM) 131, a spatial attention mechanism (SAM) 132, and a dual attention mechanism (DAM) 133.

[0047] In an embodiment of the present application, after receiving the local temporal feature map, the MAM layer 130 can use CAM131 to calculate the attention weight based on the global information of each channel, so that the model can focus on important channel features; it can also use SAM132 to dynamically adjust the spatial weight of the feature map to highlight the features of key positions; and it can use DAM133 to use a bidirectional path to process input features to capture information that has not been paid attention to in the trunk path. Finally, the features extracted by CAM131, SAM132 and DAM133 are fused to generate a network traffic feature map.

[0048] Exemplarily, after the convolutional layer 120 outputs the obtained local temporal feature map to the MAM layer 130, CAM131 can calculate the feature channel global information of the local temporal feature map, and learn the channel attention weights of the feature channel global information to obtain key channel features; SAM132 can aggregate the spatial dimensions of the local temporal feature map to obtain a spatial dimension feature map, and learn the spatial attention weights of the spatial dimension feature map to obtain key spatial features; DAM133 can activate the attention features of the local temporal feature map through the trunk path to obtain a first feature map, and invert and activate the attention features of the local temporal feature map through the dual path to obtain a second feature map, and finally sum the first feature map and the second feature map to obtain a supplementary context feature.

[0049] In this way, the present application realizes accurate feature extraction of load flow patterns through dynamic screening of key feature channels, precise positioning of traffic spatial distribution anomalies, and multi-order feature calibration of complementary fusion of trunk paths and dual paths, thereby improving the extraction accuracy of the final constructed model.

[0050] Further optionally, as Figure 4 As shown, DAM 133 may include a main path 133a and a dual path 133b. The main path 133a is used for basic feature extraction and transmission; the dual path 133b is an auxiliary path that supplements the limitations of the main path 133a through a parallel structure or feature fusion mechanism.

[0051] The following is a detailed description of the specific usage process of the situation factor extraction model based on the multiple attention mechanism provided in the embodiment of the present application.

[0052] In some embodiments, combined Figure 3 , the feature map extracted by the convolution operation can be set as U∈R C×L×1 First, CAM131 calculates global information for each channel using formula (1) through average pooling operation. Formula (1) is as follows: Among them, C represents the number of channels of the feature map, L represents the size of the feature, and Z c represents the global information of the cth channel, u c,l Represents the eigenvalue of the input feature u at the cth channel and lth position.

[0053] Next, the obtained global information is convolved twice using formula (2). The first convolution (Conv, 1×1) uses an activation function (such as the rectified linear unit (ReLU)) to compress the number of channels to C / r to reduce the complexity of the calculation. The second convolution (Conv, 1×1) uses an activation function (such as the logistic function (Sigmoid)) to restore the number of channels to the original dimension C to enhance the nonlinear expression ability of the feature. Formula (2) is as follows: F c (Z)=σ(V c2 *δ(V c1 *Z)) Formula (2) Among them, V c1 Represents the first convolution, σ represents the ReLU activation function corresponding to the first convolution, V c2 Represents the second convolution, and δ represents the Sigmoid activation function corresponding to the second convolution.

[0054] Finally, the obtained attention weight F(Z) and the input feature map U are weighted by formula (3) to obtain the weighted output U′ of each channel. Formula (3) is as follows: U′=F(Z)⊙U Formula (3) Here, ⊙ represents element-by-element multiplication.

[0055] Further, combined with Figure 3 , the feature map extracted by the convolution operation is set to U∈R C×L×1 After that, SAM132 performs an average pooling operation on the input feature map in the spatial dimension through formula (IV) to generate a feature vector S representing the average value of each channel in space. avg Formula (IV) is as follows: Then, the input feature map is aggregated in the spatial dimension by performing the maximum pooling operation according to formula (5) to generate a feature vector S representing the maximum value of each channel in space. max Formula (5) is as follows: Afterwards, the results of average pooling and maximum pooling are concatenated using formula (6) to generate a feature map containing spatial information. The concatenated features are then convolved (Conv, 5×1) to learn the spatial attention weights for each position. Formula (6) is as follows: S=σ(conv(concat(S avg ,S max Formula (VI) Among them, σ represents the Sigmoid activation function, conv represents the convolution operation, and concat represents the concatenation operation.

[0056] Finally, the generated spatial attention weight is multiplied by the original input feature map through formula (VII) to enhance the features of important spatial positions. Formula (VII) is as follows: S′=U⊙S Formula (VII) Furthermore, combined Figure 3 , the feature map extracted by the convolution operation is set to U∈R C×L×1 After that, 3×1 and 5×1 convolution kernels are used to extract features in a larger range, obtaining local and global information of the feature map at different scales. The output of each convolution layer is then padded to ensure that the output size is consistent with the input. Finally, the fused feature map is further processed by 5×1 convolution and output to SAM132, which performs dual-path processing on the input features, activating the input feature U through the main path and the dual path respectively. ex operate.

[0057] For example, in the backbone path, feature U is convolved twice using formula (VIII). The first convolution uses an activation function (ReLU) to compress the number of channels to C / r to reduce computational complexity, and the second convolution uses an activation function (Sigmoid) to restore the number of channels to the original dimension C. Formula (VIII) is as follows: Among them, V t1 Represents the first convolution, σ represents the ReLU activation function corresponding to the first convolution, V t2 Represents the second convolution, and δ represents the Sigmoid activation function corresponding to the second convolution.

[0058] Then, the generated attention features are converted into Perform a dot multiplication with the input feature map U of the attention module to generate a new feature map U′. Formula (9) is as follows: in, represents the activation of the backbone path, and ⊙ represents element-wise multiplication.

[0059] For example, in the dual path, the Sigmoid activation function is applied to the input feature U through formula (10), and then the inversion operation is performed to obtain the dual feature map corresponding to the dual path to obtain the feature information ignored by the main path and determine the integrity of the feature. Then the dual feature map is activated Operate to extract features and finally generate dual features of Dual Path Formula (10) is as follows: in, represents the activation of the dual path, V d1 Represents the first convolution, σ represents the ReLU activation function corresponding to the first convolution, V d2 Represents the second convolution, and δ represents the Sigmoid activation function corresponding to the second convolution.

[0060] Then, the generated attention features are converted into Perform dot multiplication with the input feature map U to generate a new feature map U″. Formula (11) is as follows: Finally, U′ and U″ are summed using formula (12) to obtain the final output U″′ of the dual attention module. Formula (12) is as follows: U″′=U′+U″ formula (12) For example, in combination Figure 2 and Figure 3 After obtaining the weighted output U′ of each channel, the feature S′ of important spatial positions, and the final output U″′ of the dual attention module, U′, S′, and U″′ can be weightedly fused to obtain the final network traffic feature map. Subsequently, the maximum pooling layer 141 is used to improve the robustness of the model, and the normalization layer 142 is used to stabilize the training process. After that, the long short-term memory network layer 143 is used to capture the temporal dependencies and obtain the long-term dependency features in the traffic data. Then, the random dropout layer 144 is introduced to reduce the risk of overfitting and improve the generalization ability of the model. Finally, the features are mapped through the fully connected layer 150, and the final classification output is achieved through the output layer 160.

[0061] In the situation factor extraction model based on the multiple attention mechanism provided in the embodiment of the present application, since the traditional situation factor extraction model only includes a single attention mechanism or a dual attention mechanism, it is easy to miss cross-dimensional correlation features. Therefore, the situation factor extraction model based on the multiple attention mechanism in the present application realizes the synergy of channel-space-dual attention by designing a multiple attention mechanism layer and utilizing triple attention joint modeling, thereby strengthening the correlation between cross-dimensional features, making the features extracted by the model more able to fully indicate the corresponding situation factor category, thereby improving the accuracy of the situation factor extraction by the model.

[0062] The following is a detailed description of a training method for a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application.

[0063] Figure 5A flowchart of a training method for a situation factor extraction model based on a multiple attention mechanism is provided in an embodiment of the present application. The subject executing the method can be an electronic device or various devices / modules in an electronic device, such as an integrated circuit or a chip. The embodiment of the present application does not make any specific limitations on this.

[0064] For example, Figure 5 As shown, the training method of the situation factor extraction model based on the multiple attention mechanism provided in the embodiment of the present application may include the following S501 to S504: S501. Obtain a network security situation awareness dataset and divide it into a training set, a validation set, and a test set according to a preset ratio.

[0065] In the embodiment of the present application, the network security situation awareness dataset includes information such as various network attacks, normal traffic, network events, and system status.

[0066] For example, the cybersecurity situational awareness dataset can be the UNSW-Network Benchmark (NB) 15 dataset published by the University of New South Wales (UNSW), Australia. The UNSW-NB15 dataset contains various types of network attacks and features and can simulate complex scenarios of real-world network attacks.

[0067] For example, the UNSW-NB15 dataset consists of 2,540,044 records in four files, provided in comma-separated values (CSV) format. As shown in Table 1, the UNSW-NB15 dataset includes five data types: nominal, integer, float, timestamp, and binary.

[0068] Table 1 name Data Type Abbreviation nominal Nominal type N integer Integer Types I float floating-point types F timestamp Timestamp Type T binary Binary Type B For example, as shown in Table 2, the UNSW-NB15 dataset includes a total of 9 attack types: fuzzers, analysis, backdoors, denial of service (DoS), exploits, generics, reconnaissance, shellcode, and worms.

[0069] Table 2 Serial number Attack Type Attack Type Description 1 Fuzzers Pause the network by feeding it randomly generated data 2 Analysis Monitor and capture network traffic or data for analysis 3 Backdoors Implant a hidden entrance into the system to bypass the normal authentication mechanism 4 Dos A large number of requests exhausts resources, making the system unable to provide normal services 5 Exploits Exploit known vulnerabilities to execute malicious code or gain permissions 6 Generic A general term for common, non-specific aggressive behavior 7 Reconnaissance Collect target information before attacking and find potential vulnerabilities 8 Shellcode Embed malicious code and execute specific commands through vulnerabilities 9 Worms Self-replicating malicious programs spread across the network to infect systems For example, as shown in Table 3, the UNSW-NB15 dataset includes a total of 49 features, which can be classified into flow features, basic features, content features, time features, general features, connection features and label features.

[0070] Table 3 feature Data Type Feature Type feature Data Type Feature Type srcip N Flow characteristics res_bdy_len I Content Features sport I Flow characteristics sjit F Time characteristics dstip N Flow characteristics djit F Time characteristics dsport I Flow characteristics stime T Time characteristics proto N Flow characteristics ltime T Time characteristics state N Basic Features sintpkt F Time characteristics dur F Basic Features dintpkt F Time characteristics sbytes I Basic Features tcprtt F Time characteristics dbytes I Basic Features synack F Time characteristics sttl I Basic Features ackdat F Time characteristics dttl I Basic Features is_sm_ips_ports B Common Features sloss I Basic Features ct_state_ttl I Common Features dloss I Basic Features ct_flw_http_mthd I Common Features service N Basic Features is_ftp_login B Common Features sload F Basic Features ct_ftp_cmd I Common Features dload F Basic Features ct_srv_src I Connection features spkts I Basic Features ct_srv_dst I Connection features dpkts I Basic Features ct_dst_ltm I Connection features swin I Content Features ct_src_ltm I Connection features dwin I Content Features ct_src_sport_ltm I Connection features stcpb I Content Features ct_dst_sport_ltm I Connection features dtcpb I Content Features ct_dst_src_ltm I Connection features smeansz I Content Features attack_cat N Tag Features dmeansz I Content Features Label B Tag Features trans depth I Content Features Optionally, data can be preprocessed before being divided into training, validation, and test sets. This process includes four steps: data merging, outlier handling, numerical feature normalization, and one-hot encoding of categorical features.

[0071] Data merging: Load data from four CSV files and merge them into one data set to facilitate centralized data management, avoid omissions and errors, and ensure data consistency and integrity.

[0072] Abnormal data processing: As shown in Table 4, abnormal data mainly include missing values, outliers and special characters.

[0073] Table 4 feature Exception data types Treatment attack_cat Missing Values Fill is "normal" ct_flw_http_mthd Missing Values Fill with "0" is_ftp_login Missing Values Fill with "0" is_ftp_login Outliers Replaced with "1" service Special characters Replaced with "none" ct_ftp_cmd Special characters Replace with "0" Numerical feature standardization: Use the standard scaler method to process numerical features, unify the data distribution range of each numerical feature, and improve the performance of the model.

[0074] One-hot encoding of categorical features: Use the one-hot encoder method to process categorical features and convert them into binary representation to remove the sequential effect of categorical features and meet the input requirements of the model.

[0075] In this way, by preprocessing the UNSW-NB15 dataset, we can ensure the quality and consistency of the data and prepare the data for subsequent model training.

[0076] In some embodiments, the preset ratio may be a ratio set by a user, which can be flexibly adjusted according to the actual scenario. For example, the preset ratio may be: 20% for the test set, 80% for the training set, and 20% for the validation set.

[0077] It should be noted that the training environment configuration of the situation factor extraction model based on the multi-attention mechanism provided in the embodiment of the present application can be as shown in Table 5 below.

[0078] Table 5 Experimental environment Parameter configuration operating system Windows 11 processor AMD Ryzen 7 7840H Memory 32G Programming environment Python 3.8.2 Development Tools PyCharm 2023 Deep Learning Framework Tensorflow 2.13.0 S502: Iteratively train the preset model framework using the training set to obtain an initial situation factor extraction model.

[0079] In the embodiment of the present application, the preset model framework includes three levels of attention modules: channel attention module, spatial attention module and dual attention module.

[0080] For example, the channel attention can use the Efficient Channel Attention (ECA-Net) architecture with a compression ratio of 16; the spatial attention can use the Criss-Cross Attention (CCNet) architecture; and the dual attention module can use the Dual Attention Module (DAM) architecture.

[0081] In some embodiments, the data in the training set may be sequentially input into the preset framework module until all the data in the training set are input.

[0082] For example, taking the training set including 200 training data as an example, the 200 training data can be input into the above-mentioned preset model framework including the three-level attention module one by one to train the preset model framework until the training of the 200 data is completed.

[0083] S503 , adjusting the parameters of the initial situation factor extraction model using the validation set until the parameters converge to obtain the target situation factor extraction model.

[0084] In the embodiment of the present application, the parameters of the initial situation factor extraction model are used to accurately adjust the model. For example, the parameter can be a random drop rate.

[0085] For example, in combination Figure 2 Different hyperparameters (dropout rates) can be used in the random dropout layer 144 to observe their effects on the initial situation factor extraction model. By adjusting the hyperparameter dropout rate, the optimal dropout rate value can be found, thereby improving the generalization ability of the model.

[0086] Exemplarily, the verification operation may include the following steps: S503a, adjusting parameters one by one according to the preset range.

[0087] Exemplarily, five random dropout rates may be selected for verification: 0.1, 0.2, 0.3, 0.4, and 0.5.

[0088] S503b: For each adjusted parameter, input the validation set into the initial situation factor extraction model to obtain the model accuracy.

[0089] For example, Figure 6As shown in Figure 3, with the change of random dropout rate, the accuracy rate obtained after inputting the validation set into the initial situation factor extraction model shows a trend of first increasing and then decreasing.

[0090] When the random dropout rate was 0.1, the model's accuracy was low. This was because fewer neurons were discarded under the random dropout mechanism, and the regularization effect was not fully utilized. When the random dropout rate was increased to 0.2, the model's accuracy reached 0.9792, the peak value of the entire verification process. This effectively reduced the initial situation factor extraction model's reliance on specific neurons and achieved a relatively ideal balance between preventing overfitting and maintaining the model's learning ability, significantly improving the model's generalization ability. When the random dropout rate continued to increase to 0.3-0.5, the model's accuracy decreased. This indicates that an excessively high random dropout rate resulted in excessively discarded neurons, significantly reducing the effective information available for the model to learn, and thus leading to a decrease in accuracy. Therefore, in this verification, the random dropout rate with the highest accuracy was 0.2.

[0091] S503c: Determine the parameter corresponding to the highest model accuracy as the target parameter to obtain the target situation factor extraction model.

[0092] Exemplarily, after obtaining the random discard rate with the highest accuracy as 0.2, the initial situation factor extraction model corresponding to the random discard rate of 0.2 is determined as the target situation factor extraction model.

[0093] In this way, the present application adjusts the parameters successively by a preset amplitude and selects the optimal parameters based on the accuracy of the verification set to avoid local optimality, and further selects the parameters corresponding to the highest accuracy as the parameters of the final model, thereby improving the classification accuracy of the model in real scenarios.

[0094] S504. Use the test set to test the target situation factor extraction model to obtain performance indicators, and when the performance indicators meet the preset indicators, determine the target situation factor extraction model as a situation factor extraction model based on the multiple attention mechanism.

[0095] In some embodiments, the above performance indicators may include accuracy, precision, recall, and harmonic mean evaluation index (F1 value). The harmonic mean evaluation index is the harmonic mean evaluation index of precision and recall.

[0096] Exemplarily, the true value of the test set includes N categories and other categories, and the predicted value of the model for the test set includes predicting N categories and predicting other categories.

[0097] Specifically, as shown in Table 6, it is the confusion matrix of the test set and the corresponding prediction results, where TP represents the number of samples that are actually positive and are judged as positive; FP represents the number of samples that are actually negative but are judged as positive; FN represents the number of samples that are actually positive but are judged as negative; TN represents the number of samples that are actually negative and are judged as negative.

[0098] Table 6 Accuracy: The percentage of correctly predicted samples in the total samples, which is used to reflect the classification effect of the model. The accuracy A can be calculated using formula (13). Formula (13) is as follows: Precision: The probability of correctly predicting a positive sample among the correctly predicted samples can be calculated using formula (14). Formula (14) is as follows: Recall rate: The probability of a correct sample being predicted as a positive sample can be calculated using formula (15). Formula (15) is as follows: F1 value: It is the harmonic mean evaluation index of precision P and recall R. It can be calculated by formula (16). Formula (16) is as follows: In the embodiment of the present application, the above-mentioned preset indicators can be set values, which can be flexibly adjusted according to the actual scenario. For example, the above-mentioned preset indicators can be the performance indicators of the model after combining two of the three attention mechanisms of CAM, SAM, and DAM.

[0099] For example, the pairwise combination models include (CAM+SAM), (DAM+SAM), and (DAM+CAM). The test set is input into the corresponding models of (CAM+SAM), (DAM+SAM), and (DAM+CAM), as well as the three-level attention mechanism (DAM+CAM+SAM) in this application, and the performance indicators shown in Table 7 are obtained.

[0100] Table 7 Model Accuracy Accuracy Recall F1 value CAM+SAM 0.9783 0.9903 0.9696 0.9798 DAM+SAM 0.9788 0.9905 0.9703 0.9803 DAM+CAM 0.9786 0.9905 0.9701 0.9802 DAM+CAM+SAM 0.9792 0.9907 0.9708 0.9806 Furthermore, the above-mentioned performance indicators satisfying the preset indicators may include: the accuracy rate is greater than the preset accuracy rate, the precision rate is greater than the preset precision rate, the recall rate is greater than the preset recall rate, and the harmonic mean evaluation index is greater than the preset evaluation index value.

[0101] For example, Figure 7As shown in the figure, the accuracy of the model corresponding to CAM and SAM is 0.9783, the precision is 0.9903, the recall rate is 0.9696, and the F1 value is 0.9798, indicating that the model corresponding to CAM and SAM can effectively enhance the feature channel selectivity and spatial feature extraction capabilities, and improve the overall performance of the model; the accuracy of the model corresponding to SAM and DAM is 0.9788, the precision is 0.9905, the recall rate is 0.9703, and the F1 value is 0.9803, indicating that DAM can enhance the model's attention to global features, and effectively supplement the features that have not been paid attention to in the multi-scale fusion process, further improving the model's feature expression ability; The model corresponding to DAM and CAM has an accuracy of 0.9786, a precision of 0.9905, a recall of 0.9701, and an F1 value of 0.9802, indicating that CAM mainly focuses on enhancing the model's selectivity for feature channels; the model corresponding to CAM, SAM, and DAM has an accuracy of 0.9792, a precision of 0.9907, a recall of 0.9708, and an F1 value of 0.9806, all of which are higher than the model performance indicators corresponding to other pairwise combinations. This indicates that the models corresponding to CAM, SAM, and DAM can maximize the advantages of each attention mechanism, improve the model's attention to features, and thus improve the overall classification performance.

[0102] Optionally, after obtaining the performance index as described above, the target situation factor extraction model may be deleted if the performance index does not meet a preset index.

[0103] In the training method for the situation factor extraction model based on the multiple attention mechanism provided in the embodiments of the present application, a three-stage isolated training strategy of training-validation-testing is adopted, combined with iterative parameter tuning driven by the validation set, to ensure that the model converges to the global optimal solution, avoid overfitting, and improve cross-scenario adaptability. At the same time, the test set is used to strictly verify whether the performance indicators meet the standards to ensure the reliability of the model in actual deployment, thereby ensuring the accuracy of the final situation factor extraction model based on the multiple attention mechanism.

[0104] Optionally, the embodiment of the present application may also compare the situation factor extraction model based on the multiple attention mechanism with multiple existing models to further ensure the performance of the situation factor extraction model based on the multiple attention mechanism provided by the embodiment of the present application.

[0105] For example, we use existing models including the convolutional neural network-long short-term memory (CNN-LSTM), the multi-layer bidirectional LSTM with efficient channel attention (MBiLSTM-ECA), the multi-feature scale extraction convolutional neural network (MFSE-CNN), and the convolutional neural network-bidirectional LSTM (CNN-BidirectionalLSTM). Table 8 shows the performance indicators of existing models and the situation factor extraction model based on multiple attention mechanisms.

[0106] Table 8 Model Accuracy Accuracy Recall F1 value CNN-LSTM 0.8723 0.8825 0.8702 0.8763 MBiLSTM-ECA 0.9093 0.8878 0.9560 0.9206 MFSE-CNN 0.9271 0.9141 0.9428 0.9282 CNN-BiLSTM 0.9691 0.9763 0.9703 0.9733 DAM+CAM+SAM 0.9792 0.9907 0.9708 0.9806 Among them, the accuracy of the CNN-LSTM model is 0.8723, the precision is 0.8825, the recall is 0.8702, and the F1 value is 0.8763; the accuracy of the MbiLSTM-ECA model is 0.9093, the precision is 0.8878, the recall is 0.9560, and the F1 value is 0.9206; the accuracy of the MFSE-CNN model is 0.9271, the precision is 0.9141, the recall is 0.9428, and the F1 value is 0.9282; the accuracy of the CNN-BiLSTM model is 0. The accuracy of the models corresponding to CAM, SAM, and DAM is 0.9792, the precision is 0.9907, the recall is 0.9708, and the F1 value is 0.9806, which are all higher than the performance indicators of other models. This shows that the models corresponding to CAM, SAM, and DAM can better identify and classify the attack types of data, accurately identify positive samples, better detect positive samples, comprehensively cover the targets to be detected, and improve the ability to extract key features.

[0107] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the training device or electronic device of the situation factor extraction model based on the multiple attention mechanism includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0108] In the embodiment of the present application, the training device or electronic device of the situation factor extraction model based on the multiple attention mechanism can be divided into functional modules according to the above method. For example, the training device or electronic device of the situation factor extraction model based on the multiple attention mechanism can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0109] Figure 8 A structural diagram of a training device for a situation factor extraction model based on a multiple attention mechanism provided in an embodiment of the present application. The training device 800 for a situation factor extraction model based on a multiple attention mechanism includes: an acquisition unit 801, a training unit 802, a verification unit 803, and a testing unit 804.

[0110] Wherein: the above-mentioned acquisition unit 801 is used to acquire the network security situation awareness data set and divide it into a training set, a validation set and a test set according to a preset ratio. The training unit 802 is used to iteratively train the preset model framework using the training set acquired by the acquisition unit to obtain an initial situation factor extraction model. The verification unit 803 is used to adjust the parameters of the initial situation factor extraction model using the validation set acquired by the acquisition unit until the parameters converge to obtain the target situation factor extraction model. The testing unit 804 is used to test the target situation factor extraction model using the test set acquired by the acquisition unit to obtain performance indicators, and when the performance indicators meet the preset indicators, determine the target situation factor extraction model as a situation factor extraction model based on a multiple attention mechanism.

[0111] In some embodiments, the above-mentioned verification unit 803 is specifically used to: adjust the parameters successively according to the preset amplitude, input the verification set into the initial situation factor extraction model for each adjusted parameter to obtain the model accuracy, and determine the parameter corresponding to the highest model accuracy as the target parameter to obtain the target situation factor extraction model.

[0112] In some embodiments, the above-mentioned performance indicators include accuracy, precision, recall rate and harmonic mean evaluation index; the above-mentioned satisfaction of preset indicators includes: the accuracy rate is greater than the preset accuracy rate, and the precision rate is greater than the preset precision rate, and the recall rate is greater than the preset recall rate, and the harmonic mean evaluation index is greater than the preset evaluation index value.

[0113] In some embodiments, the training device 800 for the situation factor extraction model based on the multi-attention mechanism provided in the embodiment of the present application also includes: a processing unit, which is used to delete the target situation factor extraction model when the performance index does not meet the preset index.

[0114] In the training device for the situation factor extraction model based on the multiple attention mechanism provided in the embodiments of the present application, a three-stage isolated training strategy of training-validation-testing is adopted, combined with iterative parameter tuning driven by the validation set, to ensure that the model converges to the global optimal solution, avoid overfitting, and improve cross-scenario adaptability. At the same time, the test set is used to strictly verify whether the performance indicators meet the standards to ensure the reliability of the model in actual deployment, thereby ensuring the accuracy of the final situation factor extraction model based on the multiple attention mechanism.

[0115] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0116] Figure 9 This is a structural diagram of an electronic device provided in an embodiment of the present application. Figure 9 As shown, the electronic device 900 includes but is not limited to: a processor 901 and a memory 902 .

[0117] The memory 902 is used to store executable instructions of the processor 901. It is understandable that the processor 901 is configured to execute instructions to implement the situation factor extraction model based on the multiple attention mechanism in the above embodiment.

[0118] It should be noted that those skilled in the art can understand that Figure 9 The electronic device structure shown in the figure does not limit the electronic device, and the electronic device may include Figure 9 More or fewer components may be shown, or certain components may be combined, or the components may be arranged differently.

[0119] The processor 901 is the control center of the electronic device. It uses various interfaces and lines to connect the various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 902 and calling data stored in the memory 902, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 901 may include one or more processing units. Optionally, the processor 901 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 901.

[0120] The memory 902 can be used to store software programs and various data. The memory 902 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, application programs required by at least one functional module (such as a determination unit, a processing unit, etc.), etc. In addition, the memory 902 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0121] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 902 including instructions. The above instructions can be executed by the processor 901 of the electronic device 900 to implement the situation factor extraction model based on the multiple attention mechanism in the above embodiment.

[0122] In actual implementation, Figure 8 The steps performed by the acquisition unit 801, the training unit 802, the verification unit 803 and the testing unit 804 in Figure 9 The processor 901 in the embodiment calls the computer program stored in the memory 902. The specific execution process can be referred to the description of the method part in the above embodiment, which will not be repeated here.

[0123] Optionally, the computer-readable storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0124] In an exemplary embodiment, the present application also provides a computer program product comprising one or more instructions, which can be executed by the processor 901 of the electronic device to complete the situation factor extraction model based on the multiple attention mechanism in the above embodiment.

[0125] It should be noted that when the instructions in the above-mentioned computer-readable storage medium or one or more instructions in the computer program product are executed by the processor of the electronic device, the various processes of the above-mentioned method embodiment are implemented and the same technical effect as the above-mentioned method can be achieved. To avoid repetition, they will not be repeated here.

[0126] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete the full classification or partial functions described above.

[0127] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0128] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0129] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0130] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the full classification part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute the full classification part or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

[0131] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A situation factor extraction model based on multiple attention mechanisms, characterized by: include: The input layer is used to receive raw network traffic data containing time-series-related multi-dimensional features; A convolutional layer, configured to extract the periodic characteristics of the raw network traffic data and generate a local time series feature map; A multiple attention mechanism layer is used to obtain key channel features, key spatial features and supplementary context features in the local temporal feature map, and fuse them to generate a network traffic feature map; A feature enhancement module is used to perform maximum pooling, normalization, long short-term memory network and random drop operations on the network traffic feature graph, and output a network traffic representation vector that is resistant to overfitting; A fully connected layer, used to map the network traffic representation vector to a preset situation factor space; The output layer is used to output the network traffic category based on the preset situation factor space.

2. The model according to claim 1, characterized in that The multi-attention mechanism layer includes: A channel attention mechanism is used to calculate the feature channel global information of the local temporal feature map and learn the channel attention weights of the feature channel global information to obtain the key channel features; A spatial attention mechanism is used to aggregate the spatial dimensions of the local temporal feature map to obtain a spatial dimension feature map, and learn the spatial attention weights of the spatial dimension feature map to obtain the key spatial features; Dual attention mechanism, used for: Activate the attention feature on the local temporal feature map through the trunk path to obtain a first feature map; Inverting the local temporal feature map through a dual path and activating the attention feature to obtain a second feature map; The first feature map and the second feature map are summed to obtain the supplementary context feature.

3. The model according to claim 1 or 2, characterized in that The feature enhancement module includes: A maximum pooling layer is used to downsample the network traffic feature map to obtain a compressed network traffic feature map; A normalization layer, configured to perform normalization processing on the compressed network traffic characteristic graph to obtain a normalized network traffic characteristic graph; A long short-term memory network layer is used to capture the temporal dependency in the standardized network traffic feature graph to obtain a network traffic representation vector; The random dropout layer is used to perform an anti-overfitting operation on the network traffic representation vector to obtain the anti-overfitting network traffic representation vector.

4. A training method for a situation factor extraction model based on a multiple attention mechanism, characterized in that: The method comprises: Obtain a cybersecurity situational awareness dataset and divide it into a training set, a validation set, and a test set according to a preset ratio; Iteratively training the preset model framework using the training set to obtain an initial situation factor extraction model; Adjusting parameters of the initial situation factor extraction model using the validation set until the parameters converge to obtain a target situation factor extraction model; The target situation element extraction model is tested using the test set to obtain a performance indicator, and when the performance indicator meets the preset indicator, the target situation element extraction model is determined to be the situation element extraction model based on the multiple attention mechanism.

5. The method according to claim 4, characterized in that The step of adjusting parameters of the initial situation factor extraction model using the validation set until the parameters converge to obtain a target situation factor extraction model comprises: Adjust the parameters one by one according to the preset amplitude; For each adjusted parameter, inputting the verification set into the initial situation factor extraction model to obtain a model accuracy rate; The parameter corresponding to the highest model accuracy is determined as the target parameter to obtain the target situation factor extraction model.

6. The method according to claim 4, characterized in that The performance indicators include accuracy, precision, recall and harmonic mean evaluation index; The meeting of preset indicators includes: The accuracy rate is greater than a preset accuracy rate; The accuracy is greater than a preset accuracy; The recall rate is greater than a preset recall rate; The harmonic mean evaluation index is greater than a preset evaluation index value.

7. The method according to any one of claims 4 to 6, characterized in that The method further comprises: When the performance indicator does not meet the preset indicator, the target situation factor extraction model is deleted.

8. A training device for a situation factor extraction model based on a multiple attention mechanism, characterized in that: The device comprises: An acquisition unit is used to acquire a network security situation awareness data set and divide it into a training set, a validation set, and a test set according to a preset ratio; A training unit, configured to iteratively train a preset model framework using the training set acquired by the acquisition unit to obtain an initial situation factor extraction model; a verification unit, configured to adjust parameters of the initial situation factor extraction model using the verification set acquired by the acquisition unit until the parameters converge, so as to obtain a target situation factor extraction model; A testing unit is used to test the target situation factor extraction model using the test set acquired by the acquisition unit to obtain a performance indicator, and when the performance indicator meets a preset indicator, determine the target situation factor extraction model as the situation factor extraction model based on the multiple attention mechanism.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 4 to 7.

10. A computer-readable storage medium storing instructions, characterized in that: When a computer executes the instruction, the computer performs the method according to any one of claims 4 to 7.

Images