A method for identifying a resource and related devices

Abstract

The application relates to a resource identification method and related equipment, and is used for improving the accuracy of IP address resource identification. The method comprises the following steps: receiving a target object of a resource to be determined; taking the target object as an initial object node to find each IP address node connected with the initial object node in a preset resource graph; finding each other object node connected with the first IP address node in the resource graph, the first IP address node being any IP address node in the IP address nodes; determining resource sub-graphs between the first IP address node and each target object node based on the first IP address node and each target object node, the target object nodes including the initial object node and the other object nodes; determining whether the first IP address node is a target node of the target object according to the resource sub-graphs, the target node being a target node whose corresponding IP address belongs to the target object; and obtaining the IP address resource of the target object according to each target node of the target object.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method for identifying resources and related equipment. Background Technology

[0002] With the rapid development of digitalization, the importance of identifying an object's IP address (Internet Protocol Address) resources is becoming increasingly prominent. As cybersecurity threats continue to escalate, objects face increasingly complex security challenges. Accurately identifying an object's IP address resources can not only effectively prevent potential security risks but also provide the object with real-time security monitoring and response capabilities, helping it protect sensitive data and network resources.

[0003] In existing technologies, the method for identifying an object's IP address resource involves first identifying suspicious IP addresses of the object, and then inputting the object's characteristics and the identified suspicious IP address characteristics into a model for judgment to determine whether the IP address belongs to the object. However, this process cannot accurately determine the true ownership of the IP address resource, resulting in poor accuracy in IP address resource identification. Summary of the Invention

[0004] This invention provides a resource identification method to improve the efficiency of IP address resource identification.

[0005] In a first aspect, this application provides a method for identifying resources, the method comprising:

[0006] In response to a resource identification command sent by a user, the target object of the resource to be identified is determined. Taking the target object as the initial object node, each IP address node connected to the initial object node is searched in a preset resource graph. The resource graph is used to describe the association between each object and each IP address.

[0007] In the resource graph, find all other object nodes that are connected to the first IP address node, wherein the first IP address node is any one of the IP address nodes;

[0008] Based on the first IP address node and each target object node, resource sub-graphies are determined between the first IP address node and each target object node, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graphie is the same as the number of each target object node;

[0009] Based on each resource sub-graph, determine whether the first IP address node is a target node of the target object, wherein the target node is the IP address corresponding to the target node that belongs to the target object;

[0010] Based on each target node of the target object, the IP address resources of the target object are obtained.

[0011] In this embodiment, in response to a resource identification command sent by a user, the target object of the resource to be identified is determined. Using the target object as the initial object node, each IP address node connected to the initial object node is searched in a preset resource graph. Furthermore, each other object node connected to any one of the IP address nodes is searched in the resource graph to determine a resource sub-graph. Based on the resource sub-graph corresponding to any IP address node, it is determined whether that IP address node is a target node of the target object. Based on the target nodes of the target object, the IP address resource of the target object is obtained. Therefore, this embodiment, by identifying each IP address node associated with the target object, and by determining the affiliation relationship between each IP address node and all objects associated with that IP address node, determines whether the IP address node belongs to the target object from multiple dimensions. This ensures the accuracy of the identified IP address resource for the target object.

[0012] In one possible implementation, determining the resource sub-graphies between the first IP address node and each target object node based on the first IP address node and each target object node includes:

[0013] In the resource graph, a search is performed with the first IP address node as the starting node and the first target object node as the ending node to obtain a resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

[0014] In this embodiment of the application, by searching the resource graph with the first IP address node as the starting node and the first target object node as the ending node, a resource sub-graph between the first IP address node and the first target object node is obtained, thus ensuring the accuracy of the determined resource graph.

[0015] In one possible implementation, determining whether the first IP address node is a target node of the target object based on each resource sub-graph includes:

[0016] Each resource sub-graph is input into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node. The confidence scores represent the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node.

[0017] If the confidence level between the first IP address node and the initial object node meets the first specified condition, then the first IP address node is determined to be the target node of the target object;

[0018] Otherwise, it is determined that the first IP address node is not the target node of the target object.

[0019] In this embodiment, each resource sub-graph is input into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node. If the confidence score between the first IP address node and the initial object node is determined to be the highest among the confidence scores, then the first IP address node is determined to be a target node of the target object. Therefore, this embodiment does not only determine the relationship between the first IP address node and the target object, but also determines the attribution confidence score for all objects associated with the first IP address node, thus improving the accuracy of the identified target object's IP address resources.

[0020] In one possible implementation, the pre-trained IP address resource identification model includes a graph encoder, a deep neural network, and an activation function;

[0021] The step of inputting each resource sub-graph into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node includes:

[0022] The first resource sub-map is encoded using the graph encoder to obtain a first feature vector of the first resource sub-map, wherein the first resource sub-map is any one of the resource sub-maps;

[0023] The deep neural network is used to extract features from the feature vector to obtain a second feature vector.

[0024] The activation function is used to perform a nonlinear transformation on the second feature vector to obtain the confidence scores between the first IP address node and the second target object node, wherein the second target object node is a target object node contained in the first resource sub-graph.

[0025] By introducing deep metric learning technology in this embodiment, the complex relationship between IP addresses and multiple objects can be effectively captured, thereby improving the accuracy of IP address resource identification.

[0026] In one possible implementation, the graph encoder includes a Long Short-Term Memory (LSTM) network module, an average pooling layer, and a fully connected layer; the LSTM module, the average pooling layer, and the fully connected layer are connected in series sequentially.

[0027] The step of encoding the first resource sub-graph using the graph encoder to obtain the first feature vector of the first resource sub-graph includes:

[0028] The LSTM module is used to extract features from the first resource sub-map to obtain multiple feature vectors;

[0029] The average pooling layer is used to aggregate the multiple feature vectors to obtain an aggregated feature vector;

[0030] The fully connected layer is used to perform a fully connected operation on the aggregated vector to obtain the first feature vector of the first resource sub-graph.

[0031] The embodiments of this application construct a comprehensive multi-dimensional feature space, which enables precise measurement of the similarity between objects and IP addresses, thereby improving the recognition accuracy and the generalization ability of the model, and increasing the accuracy of IP address resource identification.

[0032] In one possible implementation, the IP address resource identification model is trained in the following manner:

[0033] Obtain training samples, wherein the training samples include each object and each IP address corresponding to each object;

[0034] Using the first IP address of the first object, other object nodes connected to the first IP address are searched in a preset resource graph; wherein, the first object is any one of the objects in the training sample, and the first IP address is any one of the IP addresses corresponding to the first object;

[0035] The first IP address, the first object, and each of the other objects corresponding to the other object nodes are determined as training sub-samples corresponding to the first IP address;

[0036] The training subsamples are input into the IP address resource identification model to obtain the predicted confidence scores between the first IP address and each object to be identified, wherein each object to be identified includes the other objects and the first object;

[0037] Based on the predicted confidence levels, the sub-loss value corresponding to the first IP address is obtained;

[0038] The total loss value of the IP address resource identification model is obtained based on the sub-loss values ​​corresponding to each IP address of each object in the training samples.

[0039] If the total loss value does not meet the second specified condition, the model parameters of the IP address resource identification model are adjusted, and the process returns to the step of inputting the training sub-samples into the IP address resource identification model until the total loss value meets the second specified condition, at which point the training of the IP address resource identification model ends.

[0040] Secondly, this application provides a resource identification device, the device comprising:

[0041] The first search module is used to respond to the resource identification command sent by the user, determine the target object of the resource to be identified, and use the target object as the initial object node to search for each IP address node connected to the initial object node in a preset resource map. The resource map is used to describe the association between each object and each IP address.

[0042] The second search module is used to search for other object nodes connected to the first IP address node in the resource graph, wherein the first IP address node is any one of the IP address nodes.

[0043] The resource sub-graph determination module is used to determine the resource sub-graphs between the first IP address node and each target object node based on the first IP address node and each target object node, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graph is the same as the number of each target object node;

[0044] The judgment module is used to determine whether the first IP address node is a target node of the target object based on the resource sub-graphs, wherein the target node is the IP address corresponding to the target node that belongs to the target object;

[0045] The IP address resource determination module is used to obtain the IP address resources of the target object based on each target node of the target object.

[0046] In one possible implementation, the resource sub-map determination module is specifically used for:

[0047] In the resource graph, a search is performed with the first IP address node as the starting node and the first target object node as the ending node to obtain a resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

[0048] In one possible implementation, the determining module is specifically used for:

[0049] Each resource sub-graph is input into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node. The confidence scores represent the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node.

[0050] If the confidence level between the first IP address node and the initial object node meets the first specified condition, then the first IP address node is determined to be the target node of the target object;

[0051] Otherwise, it is determined that the first IP address node is not the target node of the target object.

[0052] In one possible implementation, the pre-trained IP address resource identification model includes a graph encoder, a deep neural network, and an activation function;

[0053] The judgment module is also used for:

[0054] The first resource sub-map is encoded using the graph encoder to obtain a first feature vector of the first resource sub-map, wherein the first resource sub-map is any one of the resource sub-maps;

[0055] The deep neural network is used to extract features from the feature vector to obtain a second feature vector.

[0056] The activation function is used to perform a nonlinear transformation on the second feature vector to obtain the confidence scores between the first IP address node and the second target object node, wherein the second target object node is a target object node contained in the first resource sub-graph.

[0057] In one possible implementation, the graph encoder includes a Long Short-Term Memory (LSTM) network module, an average pooling layer, and a fully connected layer; the LSTM module, the average pooling layer, and the fully connected layer are connected in series sequentially.

[0058] The judgment module is also used for:

[0059] The first LSTM module is used to extract features from the input data to obtain a feature vector. The input data includes the feature vector output by the previous LSTM module of the LSTM module and / or the feature vectors corresponding to the two nodes connected by the edge in the first resource sub-graph that is in the same position as the first LSTM module. The first LSTM module is any one of the plurality of LSTM modules.

[0060] The feature vectors obtained from the tail LSTM modules in the first specified number of LSTM modules and the feature vectors obtained from the tail LSTM modules in the second specified number of LSTM modules are aggregated using the average pooling layer to obtain an aggregated feature vector.

[0061] The fully connected layer is used to perform a fully connected operation on the aggregated vector to obtain the first feature vector of the first resource sub-graph.

[0062] In one possible implementation, the device further includes:

[0063] The training module is used to train the IP address resource identification model in the following ways:

[0064] Obtain training samples, wherein the training samples include each object and each IP address corresponding to each object;

[0065] Using the first IP address of the first object, other object nodes connected to the first IP address are searched in a preset resource graph; wherein, the first object is any one of the objects in the training sample, and the first IP address is any one of the IP addresses corresponding to the first object;

[0066] The first IP address, the first object, and each of the other objects corresponding to the other object nodes are determined as training sub-samples corresponding to the first IP address;

[0067] The training subsamples are input into the IP address resource identification model to obtain the predicted confidence scores between the first IP address and each object to be identified, wherein each object to be identified includes the other objects and the first object;

[0068] Based on the predicted confidence levels, the sub-loss value corresponding to the first IP address is obtained;

[0069] The total loss value of the IP address resource identification model is obtained based on the sub-loss values ​​corresponding to each IP address of each object in the training samples.

[0070] If the total loss value does not meet the second specified condition, the model parameters of the IP address resource identification model are adjusted, and the process returns to the step of inputting the training sub-samples into the IP address resource identification model until the total loss value meets the second specified condition, at which point the training of the IP address resource identification model ends.

[0071] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps in the resource identification method.

[0072] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the resource identification method described above.

[0073] Fifthly, embodiments of this application provide a computer program product, including a computer program stored in a computer-readable storage medium; when a processor of a memory access device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the memory access device to perform the steps in the resource identification method described above.

[0074] For the various aspects in the second to fifth sections above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that the various possible solutions in the first section may achieve; they will not be repeated here. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 One of the flowcharts for a resource identification method provided in this application embodiment;

[0077] Figure 2 A schematic diagram of the resource map provided in the embodiments of this application;

[0078] Figure 3 A schematic diagram of a resource sub-map provided in an embodiment of this application;

[0079] Figure 4 A schematic diagram of the IP address resource identification model provided in the embodiments of this application;

[0080] Figure 5 A flowchart illustrating the process of determining the confidence levels between the first IP address node and each of the target object nodes, provided in an embodiment of this application;

[0081] Figure 6 This is a schematic diagram of the structure of the graph encoder provided in the embodiments of this application;

[0082] Figure 7 A flowchart illustrating the training of the IP address resource identification model provided in this application embodiment;

[0083] Figure 8 A second schematic flowchart illustrating the resource identification method provided in this application embodiment;

[0084] Figure 9 A schematic diagram of a resource identification device provided in an embodiment of this application;

[0085] Figure 10 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0086] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to the device embodiments or system embodiments.

[0087] In the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0088] In existing technologies, the method for identifying an object's IP address resource involves first identifying suspicious IP addresses of the object, and then inputting the object's characteristics and the identified suspicious IP address characteristics into a model for judgment to determine whether the IP address belongs to the object. However, this process cannot accurately determine the true ownership of the IP address resource, resulting in poor accuracy in IP address resource identification.

[0089] To address this, this application provides a resource identification method. Responding to a user-sent resource identification command, the method determines the target object of the resource to be identified. Using the target object as the initial object node, it searches a preset resource graph for each IP address node connected to the initial object node, and then searches the resource graph for other object nodes connected to any one of the IP address nodes, thus determining a resource sub-graph. Based on the resource sub-graph corresponding to any IP address node, it determines whether that IP address node is a target node of the target object. Based on the target nodes of the target object, the IP address resource of the target object is obtained. Therefore, this application, by identifying each IP address node associated with the target object and determining the affiliation relationship between each IP address node and all associated objects, determines whether the IP address node belongs to the target object from multiple dimensions, ensuring the accuracy of the identified IP address resource.

[0090] The present application will now be described in further detail with reference to the accompanying drawings. See also: Figure 1 The diagram shown is a flowchart illustrating a method for identifying IP address resources according to an embodiment of this application. The specific implementation process of this method is as follows:

[0091] Step 101: In response to the resource identification command sent by the user, determine the target object of the resource to be identified, take the target object as the initial object node, and search for each IP address node connected to the initial object node in the preset resource map, wherein the resource map is used to describe the association relationship between each object and each IP address;

[0092] The resource identification instruction in this application includes the target object.

[0093] The method for constructing resource maps in the embodiments of this application will be described below:

[0094] a. Define the nodes and edges of the resource graph:

[0095] (1) Use a keyword extraction tool to extract keywords from the names of objects in the ICP database (Internet Content Provider Record Database) and keywords from the corresponding website data. Nodes that can be constructed include: object name, website URL, keywords, etc. Edges that can be constructed include: object name-keyword, website URL-keyword, etc.

[0096] The website data corresponding to each object can be determined in the following way:

[0097] The process involves retrieving the names of each object in the ICP database and their corresponding primary domain names; and obtaining the historical subdomains corresponding to the primary domain names of each object from the DNS (Domain Name System) database. "http: / / " and "https: / / " are then added to the prefixes of each obtained domain name (including primary and subdomains) to obtain the corresponding URLs (Uniform Resource Locator). These URLs are then crawled to obtain the website data corresponding to each domain. The website data includes the website name and website content.

[0098] (2) The ICP database contains relationships between object names, ICP numbers, and object domain names. Therefore, nodes that can be constructed based on the ICP database include: object name, ICP number, domain name, etc. Edges that can be constructed include: object name-ICP number, ICP number-domain name, etc.

[0099] (3) The DNS database contains mappings from domain names to IPv4 / IPv6 records. Therefore, nodes that can be constructed based on the DNS database include: domain name nodes and IP address nodes, where both IPv4 and IPv6 records can be considered as IP address nodes. Edges that can be constructed include: domain name-IP address, domain name-domain name, etc.

[0100] (4) For the website database (including the website data of each object obtained above), the nodes that can be constructed include: URL, domain name, certificate, IP address, icon, etc. The edges that can be constructed include: URL-domain name, URL-certificate, URL-IP address, URL-icon, etc.

[0101] b. Using the nodes and edges constructed above, we obtain the resource graph, specifically as follows: Figure 2 As shown.

[0102] It should be noted that: Figure 2 The resource map in this example is for illustrative purposes only and does not limit the resource map in the embodiments of this application. The resource map in the embodiments of this application can be set according to the specific actual situation.

[0103] For example, such as Figure 2 As shown, taking object 1 as the initial object node, the IP address nodes connected to the initial object node 1 in the resource graph include: IP address node a and IP address node b.

[0104] Step 102: Locate other object nodes connected to the first IP address node in the resource graph, wherein the first IP address node is any one of the IP address nodes;

[0105] For example, such as Figure 2 As shown, if the first IP address node is taken as IP address node a, then the other object nodes connected to the first IP address node in the resource graph are: object 2 and object 3.

[0106] Step 103: Based on the first IP address node and each target object node, determine the resource sub-graphs between the first IP address node and each target object node respectively, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graph is the same as the number of each target object node;

[0107] In this embodiment of the application, there is a resource sub-graph between each target object node and the first IP address node.

[0108] In one possible implementation, step 103 may be specifically implemented as follows: in the resource graph, a search is performed with the first IP address node as the starting node and the first target object node as the ending node to obtain a resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

[0109] like Figure 2 As shown, with the first IP address node being IP address a and the first target object being object 1, the resulting resource sub-graph is as follows: Figure 3 As shown.

[0110] Step 104: Based on each resource sub-graph, determine whether the first IP address node is a target node of the target object, wherein the target node is the IP address corresponding to the target node that belongs to the target object;

[0111] In one possible implementation, step 104 may specifically be implemented as follows: inputting each resource sub-graph into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node, wherein the confidence score is used to represent the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node; if the confidence score between the first IP address node and the initial object node satisfies a first specified condition, then the first IP address node is determined to be the target node of the target object; otherwise, the first IP address node is determined not to be the target node of the target object.

[0112] The first specified condition in this embodiment is that the confidence level is the highest among all confidence levels, and this confidence level is greater than a specified threshold. The specified threshold in this embodiment can be set according to specific actual conditions, and this embodiment does not limit the specific value of the specified threshold.

[0113] like Figure 4 As shown, the pre-trained IP address resource identification model 400 in this embodiment includes a graph encoder 401, a deep neural network 402, and an activation function 403. The following describes the specific process of inputting each resource sub-graph into the pre-trained IP address resource identification model to obtain the confidence levels between the first IP address node and each target object node. Figure 5 The diagram shown is a specific flowchart, which may include the following steps:

[0114] Step 501: Encode the first resource sub-map using the graph encoder to obtain the first feature vector of the first resource sub-map, wherein the first resource sub-map is any one of the resource sub-maps;

[0115] like Figure 6 The diagram shows the structure of a graph encoder 600, which includes a Long Short-Term Memory (LSTM) module 601, an average pooling layer 602, and a fully connected layer 603. The LSTM module 601, the average pooling layer 602, and the fully connected layer 603 are connected in series.

[0116] In one possible implementation, step 501 may be specifically implemented as follows: using the LSTM module to extract features from the first resource sub-map to obtain multiple feature vectors; using the average pooling layer to aggregate the multiple feature vectors to obtain an aggregated feature vector; and using the fully connected layer to perform a fully connected operation on the aggregated vector to obtain the first feature vector of the first resource sub-map.

[0117] In this embodiment of the application, the LSTM module is used to extract features from the first resource sub-map to obtain multiple feature vectors. The specific implementation is as follows:

[0118] Traversing edges in any path in the first resource sub-graph in a specified order, for any traversed edge, inputting the feature data corresponding to the edge into the LSTM module to obtain a first feature vector, wherein the feature data corresponding to the edge comprises the initial feature vectors corresponding to two nodes connected by the edge and the first feature vector obtained by the previous edge of the edge in the first resource sub-graph; judging whether the edge is the last edge in the any path, if not, continuing to traverse the edges in the any path in the specified order; if yes, determining the first feature vector obtained from the edge as the feature vector.

[0119] In the embodiment of the present application, each path in the first resource sub-graph obtains one feature vector. The number of paths in the first resource sub-graph is the same as the number of multiple feature vectors obtained by the LSTM module. In the embodiment of the present application, using the average pooling layer to aggregate the multiple feature vectors to obtain an aggregated feature vector is actually using the average pooling layer to aggregate the feature vectors obtained from each path to obtain an aggregated feature vector.

[0120] The specified order in the embodiment of the present application is an order starting from an IP address node.

[0121] The two nodes connected by each edge in the resource graph in the embodiment of the present application include the following types:

[0122] <head=keyword, tail=URL>, <head=object name, tail=ICP number>, <head=ICP number, tail=object name>, <head=IC number, tail=domain>, <head=domain, tail=ICP number>, <head=domain, tail=IP address>, <head=IP address, tail=domain> <head=domain, tail=domain>, <head=URL, tail=domain>, <head=domain, tail=URL>, <head=URL, tail=certificate>, <head=certificate, tail=URL>, <head=URL, tail=IP address>, <head=IP address, tail=URL>, <head=URL, tail=icon>, <head=icon, tail=URL>.

[0123] In the embodiment of the present application, the initial feature vectors corresponding to the two nodes connected by each edge are preset, and the embodiment of the present application does not limit the initial feature vectors herein, and the specific values of the initial feature vectors in the embodiment of the present application can be set according to specific actual conditions.

[0124] Therefore, this embodiment models the type relationships between connected nodes, thereby reducing the number of nodes that need to be encoded. This reduces model complexity, improves data processing efficiency, and ensures the accuracy of the model in identifying IP address affiliation, enabling objects to more effectively identify resources.

[0125] Step 502: Use the deep neural network to extract features from the feature vector to obtain a second feature vector;

[0126] The deep neural network in this embodiment is a DNN, but the structure of the deep neural network is not limited in this embodiment.

[0127] Step 503: Use the activation function to perform a nonlinear transformation on the second feature vector to obtain the confidence scores between the first IP address node and the second target object node, wherein the second target object node is the target object node contained in the first resource sub-graph.

[0128] The activation function is not limited in this embodiment; the activation function can be set according to the specific circumstances.

[0129] The training method of the IP address resource identification model in the embodiments of this application will be described below. For example... Figure 7 The above is a flowchart illustrating the process of training an IP address resource identification model, which may specifically include the following steps:

[0130] Step 701: Obtain training samples, wherein the training samples include each object and each IP address corresponding to each object;

[0131] Step 702: Using the first IP address of the first object, search for other object nodes connected to the first IP address in the preset resource graph; wherein, the first object is any one of the objects in the training sample, and the first IP address is any one of the IP addresses corresponding to the first object;

[0132] Step 703: Determine the first IP address, the first object, and the other object nodes as training sub-samples corresponding to the first IP address;

[0133] In this embodiment of the application, the first object is the object to which the first IP address belongs.

[0134] Step 704: Input the training sub-samples into the IP address resource identification model to obtain the predicted confidence scores between the first IP address and each object to be identified, wherein each object to be identified includes the other objects and the first object;

[0135] Step 705: Based on the predicted confidence levels, obtain the sub-loss value corresponding to the first IP address;

[0136] In one possible implementation, step 705 can be specifically implemented as follows: obtaining a first sub-loss value based on each prediction confidence level, and obtaining a second sub-loss value based on each prediction confidence level; adding the first sub-loss value and the second sub-loss value to obtain the sub-loss value. The sub-loss value corresponding to the first IP address can be obtained using formula (1):

[0137]

[0138] Where L1 is the first sub-loss value, and N is the total number of IP addresses in the training samples. The predicted confidence level between the first IP address and the first target object. Let k be the prediction confidence between the first IP address and other objects j, and k be the number of other objects.

[0139] The second sub-loss value in this embodiment can be obtained by formula (2):

[0140]

[0141] Wherein, L2 is the second sub-loss value.

[0142] Step 706: Based on the sub-loss values ​​corresponding to each IP address of each object in the training samples, obtain the total loss value of the IP address resource identification model;

[0143] In one possible implementation, step 706 can be specifically implemented as follows: for any object, the average value of each loss value of each IP address corresponding to the object is determined as the loss value of the object, and the average value of the loss values ​​corresponding to each object is determined as the total loss value of the IP address resource identification model.

[0144] Step 707: Determine whether the total loss value meets the second specified condition. If yes, end; otherwise, proceed to step 708.

[0145] Step 708: After adjusting the model parameters of the IP address resource identification model, return to step 704.

[0146] The second specified condition in this embodiment is that the total loss value is greater than the first specified threshold and / or the difference between the total loss value and the total loss value obtained in the previous multiple times is not greater than the second specified value.

[0147] This application does not limit the number of values, and can be set according to the specific actual situation.

[0148] Step 105: Obtain the IP address resources of the target object based on each target node of the target object.

[0149] In one possible implementation, step 105 may be specifically implemented as: determining the IP addresses corresponding to each target node of the target object as the IP address resources of the target object.

[0150] The following is combined Figure 8 The resource identification method in the embodiments of this application is described in detail, and may specifically include the following steps:

[0151] Step 801: In response to the resource identification command sent by the user, determine the target object of the resource to be identified, take the target object as the initial object node, and search for each IP address node connected to the initial object node in the preset resource map, wherein the resource map is used to describe the association relationship between each object and each IP address;

[0152] Step 802: Locate other object nodes connected to the first IP address node in the resource graph, wherein the first IP address node is any one of the IP address nodes.

[0153] Step 803: Search the resource graph with the first IP address node as the starting node and the first target object node as the ending node to obtain the resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

[0154] Step 804: Input each of the resource sub-graphs into the pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each of the target object nodes, wherein the confidence score is used to represent the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node;

[0155] Step 805: Determine whether the confidence level between the first IP address node and the initial object node meets the first specified condition. If yes, proceed to step 806; otherwise, proceed to step 807.

[0156] Wherein, the target node is the IP address corresponding to the target node that belongs to the target object;

[0157] Step 806: Determine that the first IP address node is the target node of the target object;

[0158] Step 807: Determine that the first IP address node is not the target node of the target object;

[0159] Step 808: Obtain the IP address resources of the target object based on each target node of the target object.

[0160] Based on the same inventive concept, this application also provides a resource identification device, such as... Figure 9 As shown, the device 900 includes:

[0161] The first search module 910 is used to respond to the resource identification command sent by the user, determine the target object of the resource to be determined, and use the target object as the initial object node to search for each IP address node connected to the initial object node in a preset resource map, wherein the resource map is used to describe the association relationship between each object and each IP address.

[0162] The second search module 920 is used to search for other object nodes connected to the first IP address node in the resource graph, wherein the first IP address node is any one of the IP address nodes.

[0163] The resource sub-graph determination module 930 is used to determine the resource sub-graph between the first IP address node and each target object node based on the first IP address node and each target object node, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graph is the same as the number of each target object node;

[0164] The judgment module 940 is used to determine whether the first IP address node is a target node of the target object based on the resource sub-graphs, wherein the target node is the IP address corresponding to the target node that belongs to the target object;

[0165] The IP address resource determination module 950 is used to obtain the IP address resources of the target object based on each target node of the target object.

[0166] In one possible implementation, the resource sub-map determination module 930 is specifically used for:

[0167] In the resource graph, a search is performed with the first IP address node as the starting node and the first target object node as the ending node to obtain a resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

[0168] In one possible implementation, the determining module 940 is specifically used for:

[0169] Each resource sub-graph is input into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node. The confidence scores represent the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node.

[0170] If the confidence level between the first IP address node and the initial object node meets the first specified condition, then the first IP address node is determined to be the target node of the target object;

[0171] Otherwise, it is determined that the first IP address node is not the target node of the target object.

[0172] In one possible implementation, the pre-trained IP address resource identification model includes a graph encoder, a deep neural network, and an activation function;

[0173] The judgment module 940 is further used for:

[0174] The first resource sub-map is encoded using the graph encoder to obtain a first feature vector of the first resource sub-map, wherein the first resource sub-map is any one of the resource sub-maps;

[0175] The deep neural network is used to extract features from the feature vector to obtain a second feature vector.

[0176] The activation function is used to perform a nonlinear transformation on the second feature vector to obtain the confidence scores between the first IP address node and the second target object node, wherein the second target object node is a target object node contained in the first resource sub-graph.

[0177] In one possible implementation, the graph encoder includes a Long Short-Term Memory (LSTM) network module, an average pooling layer, and a fully connected layer; the LSTM module, the average pooling layer, and the fully connected layer are connected in series sequentially.

[0178] The judgment module 940 is further used for:

[0179] The first LSTM module is used to extract features from the input data to obtain a feature vector. The input data includes the feature vector output by the previous LSTM module of the LSTM module and / or the feature vectors corresponding to the two nodes connected by the edge in the first resource sub-graph that is in the same position as the first LSTM module. The first LSTM module is any one of the plurality of LSTM modules.

[0180] The feature vectors obtained from the tail LSTM modules in the first specified number of LSTM modules and the feature vectors obtained from the tail LSTM modules in the second specified number of LSTM modules are aggregated using the average pooling layer to obtain an aggregated feature vector.

[0181] The fully connected layer is used to perform a fully connected operation on the aggregated vector to obtain the first feature vector of the first resource sub-graph.

[0182] In one possible implementation, the device further includes:

[0183] Training module 960 is used to train the IP address resource identification model in the following manner:

[0184] Obtain training samples, wherein the training samples include each object and each IP address corresponding to each object;

[0185] Using the first IP address of the first object, other object nodes connected to the first IP address are searched in a preset resource graph; wherein, the first object is any one of the objects in the training sample, and the first IP address is any one of the IP addresses corresponding to the first object;

[0186] The first IP address, the first object, and each of the other objects corresponding to the other object nodes are determined as training sub-samples corresponding to the first IP address;

[0187] The training subsamples are input into the IP address resource identification model to obtain the predicted confidence scores between the first IP address and each object to be identified, wherein each object to be identified includes the other objects and the first object;

[0188] Based on the predicted confidence levels, the sub-loss value corresponding to the first IP address is obtained;

[0189] The total loss value of the IP address resource identification model is obtained based on the sub-loss values ​​corresponding to each IP address of each object in the training samples.

[0190] If the total loss value does not meet the second specified condition, the model parameters of the IP address resource identification model are adjusted, and the process returns to the step of inputting the training sub-samples into the IP address resource identification model until the total loss value meets the second specified condition, at which point the training of the IP address resource identification model ends.

[0191] Based on the same inventive concept, this application also provides an electronic device. The electronic device can realize the function of the aforementioned resource identification device, see reference... Figure 10 The electronic device includes:

[0192] At least one processor 1001 and a memory 1002 connected to at least one processor 1001. In this embodiment, the specific connection medium between the processor 1001 and the memory 1002 is not limited. Figure 10 The example shown is the connection between processor 1001 and memory 1002 via bus 1000. Bus 1000 is... Figure 10 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The Bus 1000 can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 10 The term 1001 is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 1001 can also be called a controller; there are no restrictions on the name.

[0193] In this embodiment, memory 1002 stores instructions executable by at least one processor 1001. By executing the instructions stored in memory 1002, at least one processor 1001 can perform the resource identification method discussed above. Processor 1001 can implement... Figure 9 The functions of each module in the device shown.

[0194] The processor 1001 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 1002 and calling data stored in memory 1002, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0195] In one possible design, processor 1001 may include one or more processing units. Processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 1001. In some embodiments, processor 1001 and memory 1002 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0196] The processor 1001 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the resource identification method disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0197] Memory 1002, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 1002 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory 1002 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 1002 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0198] By designing and programming the processor 1001, the code corresponding to the resource identification method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the code during operation. Figure 1The steps of the resource identification method in the illustrated embodiment are as follows. How to design and program the processor 1001 is a technique well-known to those skilled in the art and will not be described further here.

[0199] This application also provides a computer-readable storage medium storing computer-executable instructions required to execute the processor, including a program required to execute the processor.

[0200] In some possible implementations, various aspects of the resource identification method provided in this application may also be implemented as a program product, which includes program code. When the program product is run on an electronic device, the program code is used to cause the electronic device to perform the steps in the resource identification method according to the various exemplary embodiments of this application described above.

[0201] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0202] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0203] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0204] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0205] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0206] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for identifying resources, characterized in that, The method includes: In response to a resource identification command sent by a user, the target object of the resource to be identified is determined. Taking the target object as the initial object node, each IP address node connected to the initial object node is searched in a preset resource graph. The resource graph is used to describe the association between each object and each IP address. In the resource graph, find all other object nodes that are connected to the first IP address node, wherein the first IP address node is any one of the IP address nodes; Based on the first IP address node and each target object node, resource sub-graphies are determined between the first IP address node and each target object node, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graphie is the same as the number of each target object node; Each resource sub-graph is input into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node. The confidence score represents the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node. If the confidence score between the first IP address node and the initial object node is the highest among the confidence scores, then the first IP address node is determined to be a target node of the target object. Otherwise, the first IP address node is determined not to be a target node of the target object, where a target node is defined as an IP address corresponding to the target node belonging to the target object. Based on each target node of the target object, the IP address resources of the target object are obtained.

2. The method according to claim 1, characterized in that, The step of determining the resource sub-graphies between the first IP address node and each target object node based on the first IP address node and each target object node includes: In the resource graph, a search is performed with the first IP address node as the starting node and the first target object node as the ending node to obtain a resource sub-graph between the first IP address node and the first target object node, wherein the first target object node is any one of the target object nodes.

3. The method according to claim 1, characterized in that, The pre-trained IP address resource identification model includes a graph encoder, a deep neural network, and an activation function. The step of inputting each resource sub-graph into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node includes: The first resource sub-map is encoded using the graph encoder to obtain a first feature vector of the first resource sub-map, wherein the first resource sub-map is any one of the resource sub-maps; The deep neural network is used to extract features from the feature vector to obtain a second feature vector. The activation function is used to perform a nonlinear transformation on the second feature vector to obtain the confidence scores between the first IP address node and the second target object node, wherein the second target object node is a target object node contained in the first resource sub-graph.

4. The method according to claim 3, characterized in that, The graph encoder includes a Long Short-Term Memory (LSTM) module, an average pooling layer, and a fully connected layer; the LSTM module, the average pooling layer, and the fully connected layer are connected in series. The step of encoding the first resource sub-graph using the graph encoder to obtain the first feature vector of the first resource sub-graph includes: The LSTM module is used to extract features from the first resource sub-map to obtain multiple feature vectors; The average pooling layer is used to aggregate the multiple feature vectors to obtain an aggregated feature vector; The first feature vector of the first resource sub-map is obtained by performing a fully connected operation on the aggregated feature vector using the fully connected layer.

5. The method according to claim 3, characterized in that, The IP address resource identification model is trained using the following method: Obtain training samples, wherein the training samples include each object and each IP address corresponding to each object; Using the first IP address of the first object, other object nodes connected to the first IP address are searched in a preset resource graph; wherein, the first object is any one of the objects in the training sample, and the first IP address is any one of the IP addresses corresponding to the first object; The first IP address, the first object, and each of the other objects corresponding to the other object nodes are determined as training sub-samples corresponding to the first IP address; The training subsamples are input into the IP address resource identification model to obtain the predicted confidence scores between the first IP address and each object to be identified, wherein each object to be identified includes the other objects and the first object; Based on the predicted confidence levels, the sub-loss value corresponding to the first IP address is obtained; The total loss value of the IP address resource identification model is obtained based on the sub-loss values ​​corresponding to each IP address of each object in the training samples. If the total loss value does not meet the second specified condition, the model parameters of the IP address resource identification model are adjusted, and the process returns to the step of inputting the training sub-samples into the IP address resource identification model until the total loss value meets the second specified condition, at which point the training of the IP address resource identification model ends; the second specified condition is that the total loss value is greater than the first specified threshold and / or the difference between the total loss value and the total loss value obtained in the previous multiple times is not greater than the second specified value.

6. A resource identification device, characterized in that, The device includes: The first search module is used to respond to the resource identification command sent by the user, determine the target object of the resource to be identified, and use the target object as the initial object node to search for each IP address node connected to the initial object node in a preset resource map. The resource map is used to describe the association between each object and each IP address. The second search module is used to search for other object nodes connected to the first IP address node in the resource graph, wherein the first IP address node is any one of the IP address nodes. The resource sub-graph determination module is used to determine the resource sub-graphs between the first IP address node and each target object node based on the first IP address node and each target object node, wherein each target object node includes the initial object node and each other object node, and the number of each resource sub-graph is the same as the number of each target object node; The judgment module is used to input each resource sub-graph into a pre-trained IP address resource identification model to obtain the confidence scores between the first IP address node and each target object node, wherein the confidence score represents the probability that the IP address corresponding to the first IP address node belongs to the object corresponding to the target object node; if the confidence score between the first IP address node and the initial object node is the largest among the confidence scores, then the first IP address node is determined to be the target node of the target object; otherwise, the first IP address node is determined not to be the target node of the target object, wherein the target node is the IP address corresponding to the target node belonging to the target object; The IP address resource determination module is used to obtain the IP address resources of the target object based on each target node of the target object.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-5.

9. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-5.

Images