Network security situation awareness methods, devices, media and equipment

Abstract

This application discloses a method, apparatus, medium, and device for network security situation awareness. The method includes: acquiring key features related to network security; constructing an initial decision tree model based on a first training sample and the key features; optimizing the initial decision tree model to obtain an initial security awareness model; distilling a second training sample using a data distillation method; training the initial security awareness model based on the distilled sample; acquiring operational data of a power dispatch optical transmission monitoring system under the current situation; inputting the operational data into the trained security awareness model to obtain the security status of the power dispatch optical transmission monitoring system under the current situation; and directly judging the security status based on the operational data, thereby improving the accuracy of security event awareness. Furthermore, the use of data distillation technology to process the training sample yields more valuable high-level condensed samples, further improving the accuracy of security event awareness.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security situation awareness method, apparatus, medium and device. Background Technology

[0002] Optical communication networks have brought great convenience to power systems, but while improving network performance, they have also introduced new security risks. An increasing number of mature technologies and products are now capable of attacking and eavesdropping on the physical layer of optical networks. With the continuous evolution of attack methods, power optical transmission systems are also facing unprecedented security threats. To avoid serious impacts on power grid security, it is crucial to detect security incidents in power optical transmission systems.

[0003] Current methods for detecting security events in power optical transmission systems involve collecting various types of data during network data transmission, converting the raw data into features, inputting these features into a trained model, calculating security values ​​based on the features, comparing these security values ​​with thresholds, and determining whether the state corresponding to these network data is secure.

[0004] Current methods for security event perception in power optical transmission systems require a large amount of training data to train the model. If the training data is insufficient or biased, it may affect the perception coverage performance of the method, resulting in a relatively low accuracy of security event perception. In addition, the model calculates a security value, and then determines whether it is safe by comparing the security value with a threshold. The security value only represents a part of the network security status and cannot comprehensively represent the network security status. Therefore, the accuracy of existing security event perception methods for power optical transmission systems is relatively low. Summary of the Invention

[0005] In view of this, the present invention provides a network security situation awareness method, the main purpose of which is to solve the problem of low accuracy of existing security event awareness methods for power optical transmission systems.

[0006] According to one aspect of this application, a network security situation awareness method is provided, the method comprising:

[0007] Key features related to network security in the power dispatch optical transmission monitoring system are obtained. Based on the first training sample, the key features and their corresponding feature attributes, an initial decision tree model is constructed. The initial decision tree model is then optimized to obtain an initial security perception model.

[0008] A second training sample is obtained, and the second training sample is processed using a data distillation method to obtain a distilled training sample. The initial security perception model is trained based on the distilled sample to obtain a trained security perception model.

[0009] The system acquires operational data of the power dispatch optical transmission monitoring system under the current situation, inputs the operational data into the trained security perception model, and obtains the security status of the power dispatch optical transmission monitoring system under the current situation.

[0010] Optionally, optimizing the initial decision tree model to obtain the initial security awareness model includes:

[0011] Multiple optimized samples are selected from the training samples. Based on the optimized samples, the backpropagation method is used to perform feature recognition on the initial decision tree model to obtain inverse features.

[0012] In the initial decision tree model, only the nodes and branches corresponding to the reverse features are retained to obtain the intermediate decision tree model;

[0013] Calculate the information gain for each node in the intermediate decision tree model, and remove nodes whose information gain is less than the gain threshold from the intermediate decision tree model;

[0014] Based on the intermediate decision tree model with deleted nodes, the backpropagation method is used again to identify features and obtain new reverse features. Based on the new reverse features, a new intermediate decision tree model is obtained. Nodes in the new decision tree model are deleted until the number of iterations is reached, and the initial security perception model is obtained.

[0015] Optionally, based on the optimized samples, the backpropagation method is used to perform feature recognition on the initial decision tree model to obtain inverse features, including:

[0016] Based on the preset decision objective formula, the decision objective corresponding to the key feature of each node in the initial decision tree model is calculated;

[0017] Substitute the decision target corresponding to the key feature of each node into the preset relevant calculation formula to obtain the first correlation value between the key feature of each node and network security;

[0018] When the key feature corresponding to each node and the first correlation value of network security fall within a preset correlation range, the key feature corresponding to the node is a reverse feature.

[0019] Optionally, the information gain calculation formula is:

[0020]

[0021] Where, p t For the t-th feature x t The information gain of the corresponding node, C(x) t ) represents the t-th feature x t The first correlation value between the feature x and network security, B is the correlation value with the t-th feature x. t The number of optimized samples for corresponding node matching; w c For the t-th feature x t The number of node splits corresponding to the node, α e Let be the information entropy, v be the feature matrix, and β be the adjustment value.

[0022] Optionally, the step of processing the second training sample using a data distillation method to obtain the distilled training sample includes:

[0023] The second training samples are divided into multiple sample groups, and the samples in each sample group are written into multiple modal data according to a preset format;

[0024] A pre-trained feature extraction model is used to extract semantic and structural features from each modality of data.

[0025] Semantic and structural features in each modality are fused using cross-modal attention to obtain multiple distilled training samples.

[0026] Optionally, cross-modal attention fusion can be performed on the semantic and structural features in each modality of data using the following formula:

[0027]

[0028] Among them, W q W k Here, is a learnable parameter, and d is the feature dimension. For semantic features, Let m be the structural feature, m be the m-th mode, and M be the number of modes.

[0029] Optionally, the acquisition of key features related to network security in the power dispatch optical transmission monitoring system includes:

[0030] The network communication characteristics, equipment operation characteristics, and service application characteristics of the power dispatch optical transmission monitoring system are acquired. The network communication characteristics include network traffic data, port connection data, and communication protocol data. The equipment operation characteristics include optical power data, equipment temperature data, and equipment alarm data. The service application characteristics include service transmission data and user operation behavior.

[0031] Calculate the second correlation value between each of the network communication features, the device operation features, and the business application features and network security, and use the features whose second correlation value is greater than a preset threshold as key features.

[0032] According to another aspect of this application, a network security situation awareness device is provided, comprising:

[0033] The initial model acquisition module is used to acquire key features related to network security in the power dispatch optical transmission monitoring system. Based on the first training sample, the key features and their corresponding feature attributes, an initial decision tree model is constructed, and the initial decision tree model is optimized to obtain an initial security perception model.

[0034] The model training module is used to acquire a second training sample, process the second training sample using a data distillation method to obtain a distilled training sample, and train the initial security perception model based on the distilled sample to obtain a trained security perception model.

[0035] The security perception module is used to acquire the operating data of the power dispatch optical transmission monitoring system under the current situation, input the operating data into the trained security perception model, and obtain the security status of the power dispatch optical transmission monitoring system under the current situation.

[0036] Optionally, the initial model acquisition module is further configured to:

[0037] Multiple optimized samples are selected from the training samples. Based on the optimized samples, the backpropagation method is used to perform feature recognition on the initial decision tree model to obtain inverse features.

[0038] In the initial decision tree model, only the nodes and branches corresponding to the reverse features are retained to obtain the intermediate decision tree model;

[0039] Calculate the information gain for each node in the intermediate decision tree model, and remove nodes whose information gain is less than the gain threshold from the intermediate decision tree model;

[0040] Based on the intermediate decision tree model with deleted nodes, the backpropagation method is used again to identify features and obtain new reverse features. Based on the new reverse features, a new intermediate decision tree model is obtained. Nodes in the new decision tree model are deleted until the number of iterations is reached, and the initial security perception model is obtained.

[0041] Optionally, the initial model acquisition module is further configured to:

[0042] Based on the preset decision objective formula, the decision objective corresponding to the key feature of each node in the initial decision tree model is calculated;

[0043] Substitute the decision target corresponding to the key feature of each node into the preset relevant calculation formula to obtain the first correlation value between the key feature of each node and network security;

[0044] When the key feature corresponding to each node and the first correlation value of network security fall within a preset correlation range, the key feature corresponding to the node is a reverse feature.

[0045] Optionally, the information gain calculation formula is:

[0046]

[0047] Where, p t For the t-th feature x t The information gain of the corresponding node, C(x) t ) represents the t-th feature x t The first correlation value between the feature x and network security, B is the correlation value with the t-th feature x. t The number of optimized samples for corresponding node matching; w c For the t-th feature x t The number of node splits corresponding to the node, α e Let be the information entropy, v be the feature matrix, and β be the adjustment value.

[0048] Optionally, the model training module is further configured to:

[0049] The second training samples are divided into multiple sample groups, and the samples in each sample group are written into multiple modal data according to a preset format;

[0050] A pre-trained feature extraction model is used to extract semantic and structural features from each modality of data.

[0051] Semantic and structural features in each modality are fused using cross-modal attention to obtain multiple distilled training samples.

[0052] Optionally, cross-modal attention fusion can be performed on the semantic and structural features in each modality of data using the following formula:

[0053]

[0054] Among them, W q W k Here, is a learnable parameter, and d is the feature dimension. For semantic features, Let m be the structural feature, m be the m-th mode, and M be the number of modes.

[0055] Optionally, the initial model acquisition module is further configured to:

[0056] The network communication characteristics, equipment operation characteristics, and service application characteristics of the power dispatch optical transmission monitoring system are acquired. The network communication characteristics include network traffic data, port connection data, and communication protocol data. The equipment operation characteristics include optical power data, equipment temperature data, and equipment alarm data. The service application characteristics include service transmission data and user operation behavior.

[0057] Calculate the second correlation value between each of the network communication features, the device operation features, and the business application features and network security, and use the features whose second correlation value is greater than a preset threshold as key features.

[0058] According to another aspect of this application, a storage medium is provided that stores at least one executable instruction, which causes a processor to perform the operation corresponding to the above-described network security situation awareness method.

[0059] According to another aspect of this application, a computer device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other via the communication bus;

[0060] The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the above-described network security situation awareness method.

[0061] By employing the above-described technical solutions, the technical solutions provided by the embodiments of the present invention have at least the following advantages:

[0062] This application provides a network security situation awareness method, apparatus, medium, and device. Based on a first training sample, key features related to network security in a power dispatch optical transmission monitoring system, and their corresponding feature attributes, an initial decision tree model is constructed. To avoid overfitting, the initial decision tree model is optimized by removing non-compliant nodes, resulting in an initial security awareness model that meets the expected goals. Data distillation technology is applied to the second training sample to distill it, fusing multi-level features. While retaining key information from the original data, efficient compression of data volume is achieved, resulting in more valuable training samples. The initial security awareness model is trained based on the distilled training samples. The operational data of the power dispatch optical transmission monitoring system under the current situation is input into the trained security awareness model to obtain the security status of the power dispatch optical transmission monitoring system under the current situation. The security status is directly judged based on the operational data, improving the accuracy of security event perception. Because data distillation technology is used to process the training samples, more valuable high-level concentrated samples are obtained, avoiding the problem of poor perception coverage performance due to insufficient training data, and also improving the accuracy of security event perception.

[0063] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0064] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0065] Figure 1 A flowchart of a network security situation awareness method provided in an embodiment of this application is shown;

[0066] Figure 2 Another flowchart of a network security situation awareness method provided in an embodiment of this application is shown;

[0067] Figure 3 This paper illustrates another flowchart of a network security situation awareness method provided in an embodiment of this application;

[0068] Figure 4 This paper shows a structural block diagram of a network security situation awareness device provided in an embodiment of this application;

[0069] Figure 5A schematic diagram of the structure of a computer device provided in an embodiment of the present invention is shown.

[0070] in,

[0071] Figure 4 Chinese: 402 - Initial Model Acquisition Module; 404 - Model Training Module; 406 - Security Awareness Module;

[0072] Figure 5 In Chinese: 502 - Processor; 504 - Communication interface; 506 - Memory; 508 - Communication bus; 510 - Program. Detailed Implementation

[0073] The present invention will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present invention can be combined with each other.

[0074] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the specific embodiments, structures, features, and effects according to the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. In the following description, different "an embodiment" or "an embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0075] To address the low accuracy of existing security event perception methods for power optical transmission systems, this application provides a network security situation awareness method, such as... Figure 1 As shown, the method includes:

[0076] 102: Obtain key features related to network security in the power dispatch optical transmission monitoring system. Based on the first training sample, key features and their corresponding feature attributes, construct an initial decision tree model, optimize the initial decision tree model, and obtain an initial security perception model.

[0077] 104: Obtain the second training sample, process the second training sample using the data distillation method to obtain the distilled training sample, and train the initial security perception model based on the distilled sample to obtain the trained security perception model.

[0078] 106: Obtain the operational data of the power dispatch optical transmission monitoring system under the current situation, input the operational data into the trained security perception model, and obtain the security status of the power dispatch optical transmission monitoring system under the current situation.

[0079] Specifically, network security assessments are made using network communication data, equipment operating status, and business application data from the power dispatch optical transmission monitoring system.

[0080] Network communication data includes: (1) Network traffic data: including the size of optical transmission link traffic and the rate of traffic change between different nodes at different times. Abnormal increases or decreases in traffic may indicate security events such as network attacks, equipment failures, or sudden changes in services. (2) Port connection data: involving the connection status (connected / disconnected), connection frequency, connection duration, and information on which specific IP addresses or devices are connected to the optical transmission equipment ports. Abnormal port connection behavior may be a sign of unauthorized device access or malicious scanning. (3) Communication protocol data: such as parameters related to protocols used in optical transmission, such as SDH (Synchronous Digital Hierarchy) and OTN (Optical Transport Network), including the format, content, and error rate of protocol messages. Protocol anomalies may indicate the presence of protocol attacks or equipment communication failures.

[0081] The equipment operating status includes: (1) Optical power data: refers to the power intensity of the optical signal during transmission. Too high or too low optical power may affect the signal transmission quality, leading to data loss or increased bit error rate. In severe cases, it may cause equipment failure. It is an important indicator of abnormal equipment operating status. (2) Temperature data: the internal temperature of the optical transmission equipment. Long-term high-load operation of the equipment or failure of the heat dissipation system may cause the temperature to rise. Excessive temperature will affect the performance of the equipment and may even cause hardware damage. It can be used as a key feature of the health status of the equipment. (3) Equipment alarm data: alarm information issued by the equipment when it detects abnormalities, such as hardware failure alarm, link interruption alarm, performance index over-limit alarm, etc. These alarms directly reflect the equipment failure or potential risks and are the key basis for the perception of security events.

[0082] Business application data includes: (1) Business data transmission characteristics: including the type of business data (such as control instructions, monitoring data, etc.), data volume, transmission frequency, and data integrity. Abnormal business data transmission (such as data loss, errors, sudden changes in transmission frequency, etc.) may affect the normal operation of power dispatching services, indicating the existence of security problems. (2) User operation behavior data: involving user operations on the power dispatching optical transmission monitoring system, such as login time, login location, operation instructions, operation frequency, etc. Abnormal user operations (such as abnormal login outside of working hours, frequent attempts at sensitive operations, etc.) may be manifestations of unauthorized user intrusion or internal personnel violating regulations.

[0083] Key features that are representative are selected through feature selection. Specifically, network communication data, equipment operation status and business application data in the power dispatch optical transmission monitoring system are obtained. The correlation value between each type of data in the network communication data, equipment operation status and business application data and network security is calculated. Data with a correlation value greater than a preset correlation threshold are used as key features.

[0084] Key features are matched with a pre-defined root node mapping table. This table, generated based on expert experience, records the key features corresponding to each root node. The key features corresponding to the root nodes of the decision tree are then determined. Branches are constructed based on the attributes of the key features corresponding to the root nodes. Alternatively, the data of the first training samples can be classified based on the root nodes. Multiple first-level branches are obtained based on the attributes or data classification results, using the attributes of the root node's key features or the data classification criteria as the first branch nodes. Within each first-level branch, a second-level branch is constructed based on the attributes of the key features corresponding to the first-level branch node or the data classification of the samples. The attributes of the key features corresponding to the first-level branch node or the data classification criteria are used as the second branch nodes. This process is repeated to generate multiple layers of branches until leaf nodes are generated, resulting in the initial decision tree model. To avoid overfitting and excessive size of the initial decision tree model, nodes that do not meet the requirements are optimized to obtain an initial security awareness model that achieves the expected results. The data distillation technique is applied to the sample data of the second training sample to distill the features of the sample data together to obtain more valuable features. The distilled training samples are then used to train the initial security perception model, and finally a trained security perception model is formed. Using the distilled training samples to train the model improves the training efficiency and accuracy of the model.

[0085] The system acquires operational data of the power dispatch optical transmission monitoring system under the current situation, inputs the operational data into the trained security perception model, and the security perception model judges the security status under the current situation and outputs the security status of the power dispatch optical transmission monitoring system under the current situation.

[0086] This application provides a network security situation awareness method. Compared with existing technologies, it constructs an initial decision tree model based on a first training sample, key features related to network security in a power dispatch optical transmission monitoring system, and their corresponding feature attributes. To avoid overfitting, the initial decision tree model is optimized by eliminating non-compliant nodes, resulting in an initial security awareness model that meets the expected goals. Data distillation technology is applied to the second training sample to distill it, fusing multi-level features. While retaining key information from the original data, it achieves efficient compression of data volume, resulting in more valuable training samples. The initial security awareness model is trained based on the distilled training samples. The operational data of the power dispatch optical transmission monitoring system under the current situation is input into the trained security awareness model to obtain the security status of the power dispatch optical transmission monitoring system under the current situation. The security status is directly judged based on the operational data, improving the accuracy of security event perception. Because data distillation technology is used to process the training samples, more valuable high-level concentrated samples are obtained, avoiding the problem of poor perception coverage performance due to insufficient training data, and also improving the accuracy of security event perception.

[0087] In one embodiment, such as Figure 2 As shown, the initial decision tree model is optimized to obtain the initial security awareness model, including:

[0088] 202: Select multiple optimized samples from the training samples, and use the backpropagation method to identify features of the initial decision tree model based on the optimized samples to obtain inverse features;

[0089] 204: In the initial decision tree model, only the nodes and branches corresponding to the reverse features are retained to obtain the intermediate decision tree model;

[0090] 206: Calculate the information gain for each node in the intermediate decision tree model, and remove nodes whose information gain is less than the gain threshold from the intermediate decision tree model;

[0091] 208: Based on the intermediate decision tree model with deleted nodes, the backpropagation method is used again to identify features and obtain new reverse features. Based on the new reverse features, a new intermediate decision tree model is obtained. Nodes in the new decision tree model are deleted until the number of iterations is reached, and the initial security perception model is obtained.

[0092] Specifically, in the process of building the model, in order to avoid overfitting of the security perception model, the reasonableness of the feature values ​​is deduced by using the results of the decision target. The features of the perception elements are identified based on the backpropagation method, and the features that do not conform to the target are removed.

[0093] We initially define the concept of "decision objective" in a decision tree, and the formula for setting the decision objective is Z(X):

[0094]

[0095] In the formula, c k represents the value of the k-th key feature in an optimized sample; n represents the number of branch nodes in the decision tree; g i d represents the decision rule of the decision tree, i.e., the value of each branch node; d represents the size of the decision rule base, i.e., the number of all feature values ​​of the decision tree; t represents the number of training iterations.

[0096] Based on a pre-defined decision objective formula, the decision objective corresponding to the key feature of each node in the initial decision tree model is calculated. Substituting the decision objective corresponding to the key feature of each node into a pre-defined related calculation formula, the first correlation value between the key feature of each node and network security is obtained. The related calculation formula is as follows:

[0097]

[0098] In the formula, k r E0 represents the degree of uncertainty of the feature vector, E0 represents the hyperbolic tangent function, and A represents the number of layers in the decision tree.

[0099] When the first correlation value between the key feature corresponding to each node and network security falls within the preset correlation range corresponding to the key feature, the key feature is a reverse feature. Key features that do not fall within the preset correlation range are features that do not meet the requirements. In the initial decision tree model, the nodes and branches corresponding to the features that do not meet the requirements are deleted. Therefore, the initial decision tree model only retains the nodes and branches corresponding to the reverse features, and finally obtains the intermediate decision tree model.

[0100] By calculating the information gain of the key features corresponding to each node in the intermediate decision tree model, where information gain describes the contribution of a feature to the decision result, features with high importance are selected based on information gain. Nodes with information gain greater than or equal to the gain threshold are retained, while nodes with information gain less than the gain threshold are deleted, resulting in the decision tree model for the first iteration. Based on the decision tree model for the first iteration, backpropagation feature identification and information gain calculation are performed for the next iteration, resulting in the decision tree model for the second iteration. This process is repeated until the required number of iterations is reached, yielding the initial security awareness model.

[0101] The formula for calculating information gain is:

[0102]

[0103] Where, p t For the t-th feature x t The information gain of the corresponding node, C(x) t ) represents the t-th feature xt The first correlation value between the feature x and network security, B is the correlation value with the t-th feature x. t The number of optimized samples for corresponding node matching; w c For the t-th feature x t The number of node splits corresponding to the node, α e Let be the information entropy, v be the feature matrix, and β be the adjustment value.

[0104] In one embodiment, such as Figure 3 As shown, the second training sample is processed using a data distillation method to obtain the distilled training sample, including:

[0105] 302: Divide the second training samples into multiple sample groups, and write the samples in each sample group into multiple modal data according to a preset format;

[0106] 304: A pre-trained feature extraction model is used to extract semantic and structural features from each modality of data;

[0107] 306: Semantic and structural features in each modality data are fused using cross-modal attention to obtain multiple distilled training samples.

[0108] Specifically, as the methods of sabotage improve, the criteria for judging network security are changing. Therefore, only the recent network operation data and security status are obtained as the second training sample. Since the number of the second training samples is relatively small, data distillation is performed on the second training samples. Data distillation adopts multi-level feature fusion and adaptive importance sampling. While retaining the key information of the original data, it achieves efficient compression of the data volume and obtains more valuable feature data. Then, the security perception model is trained by using the distilled training samples, which can improve the training speed and accuracy of the model.

[0109] The specific method for data distillation of the second training sample is as follows:

[0110] First, the second training samples are divided into multiple sample groups, and the samples in each sample group are written into multiple modal data according to a preset format. in Let y represent the m-th modal text. i For tags.

[0111] Then, a pre-trained model (CLIP) is used to extract high-level semantic features and low-level structural features for each modality:

[0112] High-level semantic features: EM stands for Modal Encoder m (BERT).

[0113] Low-level structure characteristics:

[0114] Finally, high-level semantic features and low-level structural features are fused using cross-modal attention, and the fused data is used as a distilled training sample. This process is repeated for each sample group to obtain multiple distilled training samples.

[0115] The following formula is used to perform cross-modal attention fusion on the semantic and structural features in each modality of data:

[0116]

[0117] Among them, W q W k Here, is a learnable parameter, and d is the feature dimension. For semantic features, Let m be the structural feature, m be the m-th mode, and M be the number of modes.

[0118] Furthermore, as a response to the above Figure 1 The implementation of the method shown in this invention provides a network security situation awareness device, such as... Figure 4 As shown, the device includes:

[0119] The initial model acquisition module 402 is used to acquire key features related to network security in the power dispatch optical transmission monitoring system. Based on the first training sample, key features and their corresponding feature attributes, an initial decision tree model is constructed, and the initial decision tree model is optimized to obtain an initial security perception model.

[0120] The model training module 404 is used to acquire the second training sample, process the second training sample using the data distillation method to obtain the distilled training sample, and train the initial security perception model based on the distilled sample to obtain the trained security perception model.

[0121] The security perception module 406 is used to acquire the operating data of the power dispatch optical transmission monitoring system under the current situation, input the operating data into the trained security perception model, and obtain the security status of the power dispatch optical transmission monitoring system under the current situation.

[0122] This application provides a network security situational awareness device. Compared with existing technologies, it constructs an initial decision tree model based on a first training sample, key features related to network security in a power dispatch optical transmission monitoring system, and their corresponding feature attributes. To avoid overfitting, the initial decision tree model is optimized by eliminating non-compliant nodes, resulting in an initial security awareness model that meets the expected goals. Data distillation technology is applied to the second training sample to process it, fusing multi-level features. While retaining key information from the original data, it achieves efficient compression of data volume, resulting in more valuable training samples. The initial security awareness model is trained based on the distilled training samples. The operational data of the power dispatch optical transmission monitoring system under the current situation is input into the trained security awareness model to obtain the security status of the power dispatch optical transmission monitoring system under the current situation. The security status is directly judged based on the operational data, improving the accuracy of security event perception. Because data distillation technology is used to process the training samples, more valuable high-level concentrated samples are obtained, avoiding the problem of poor perception coverage performance due to insufficient training data, and also improving the accuracy of security event perception.

[0123] In one embodiment, the initial model acquisition module is further configured to:

[0124] Multiple optimized samples are selected from the training samples. Based on the optimized samples, the backpropagation method is used to identify features of the initial decision tree model to obtain inverse features.

[0125] In the initial decision tree model, only the nodes and branches corresponding to the reverse features are retained to obtain the intermediate decision tree model;

[0126] Calculate the information gain for each node in the intermediate decision tree model, and remove nodes whose information gain is less than the gain threshold from the intermediate decision tree model.

[0127] Based on the intermediate decision tree model with deleted nodes, the backpropagation method is used again to identify features and obtain new reverse features. Based on the new reverse features, a new intermediate decision tree model is obtained. Nodes in the new decision tree model are deleted until the number of iterations is reached, and the initial security perception model is obtained.

[0128] In one embodiment, the initial model acquisition module is further configured to:

[0129] Based on the preset decision objective formula, the decision objective corresponding to the key feature of each node in the initial decision tree model is calculated;

[0130] Substitute the decision objectives corresponding to the key features of each node into the preset relevant calculation formula to obtain the first correlation value between the key features of each node and network security.

[0131] When the key feature corresponding to each node and the first correlation value of network security fall within a preset correlation range, the key feature corresponding to the node is a reverse feature.

[0132] In one embodiment, the formula for calculating information gain is:

[0133]

[0134] Where, p t For the t-th feature x t The information gain of the corresponding node, C(x) t ) represents the t-th feature x t The first correlation value between the feature x and network security, B is the correlation value with the t-th feature x. t The number of optimized samples for corresponding node matching; w c For the t-th feature x t The number of node splits corresponding to the node, α e Let be the information entropy, v be the feature matrix, and β be the adjustment value.

[0135] In one embodiment, the model training module is also used for:

[0136] The second training samples are divided into multiple sample groups, and the samples in each sample group are written into multiple modal data according to a preset format.

[0137] A pre-trained feature extraction model is used to extract semantic and structural features from each modality of data.

[0138] Semantic and structural features in each modality are fused using cross-modal attention to obtain multiple distilled training samples.

[0139] In one embodiment, cross-modal attention fusion is performed on the semantic and structural features in each modality of data using the following formula:

[0140]

[0141] Among them, W q W k Here, is a learnable parameter, and d is the feature dimension. For semantic features, Let m be the structural feature, m be the m-th mode, and M be the number of modes.

[0142] In one embodiment, the initial model acquisition module is further configured to:

[0143] The network communication characteristics, equipment operation characteristics, and service application characteristics of the power dispatch optical transmission monitoring system are obtained. Among them, the network communication characteristics include network traffic data, port connection data, and communication protocol data; the equipment operation characteristics include optical power data, equipment temperature data, and equipment alarm data; and the service application characteristics include service transmission data and user operation behavior.

[0144] Calculate the second correlation value between each of the network communication features, device operation features, and business application features and network security, and use the features whose second correlation value is greater than a preset threshold as key features.

[0145] According to one embodiment of the present invention, a storage medium is provided, the storage medium storing at least one executable instruction, which can execute the network security situation awareness method in any of the above method embodiments.

[0146] Figure 5 The diagram illustrates a structural schematic of a computer device according to an embodiment of the present invention. The specific embodiments of the present invention do not limit the specific implementation of the computer device.

[0147] like Figure 5 As shown, the computer device may include: a processor 502, a communications interface 504, a memory 506, and a communications bus 508.

[0148] The processor 502, communication interface 504, and memory 506 communicate with each other via communication bus 508.

[0149] Communication interface 504 is used to communicate with other network elements such as clients or other servers.

[0150] The processor 502 is used to execute program 510, which can specifically execute the relevant steps in the above-described network security situation awareness method embodiment.

[0151] Specifically, program 510 may include program code that includes computer operation instructions.

[0152] Processor 502 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The computer device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0153] Memory 506 is used to store program 510. Memory 506 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0154] Specifically, program 510 can be used to cause processor 502 to perform the following operations:

[0155] Key features related to network security in the power dispatch optical transmission monitoring system are obtained. Based on the first training sample, key features and their corresponding feature attributes, an initial decision tree model is constructed. The initial decision tree model is then optimized to obtain an initial security perception model.

[0156] A second training sample is obtained, and the second training sample is processed using the data distillation method to obtain a distilled training sample. The initial security perception model is trained based on the distilled sample to obtain a trained security perception model.

[0157] The system acquires operational data of the power dispatch optical transmission monitoring system under the current situation, inputs the operational data into the trained security perception model, and obtains the security status of the power dispatch optical transmission monitoring system under the current situation.

[0158] It will be apparent to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. In one embodiment, they can be implemented using device-executable program code, thereby allowing them to be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular hardware and software combination.

[0159] The above embodiments are merely exemplary embodiments of this application and are not intended to limit this application. The scope of protection of this application is defined by the claims. Those skilled in the art can make various modifications or equivalent substitutions to this application within its substance and scope of protection, and such modifications or equivalent substitutions should also be considered to fall within the scope of protection of this application.

Claims

1. A network security situation awareness method, characterized in that, include: Key features related to network security in the power dispatch optical transmission monitoring system are obtained. Based on the first training sample, the key features and their corresponding feature attributes, an initial decision tree model is constructed. The initial decision tree model is then optimized to obtain an initial security perception model. A second training sample is obtained, and the second training sample is processed using a data distillation method to obtain a distilled training sample. The initial security awareness model is trained based on the distilled sample to obtain a trained security awareness model. The second training sample consists of recent network operation data and security status. The system acquires the operational data of the power dispatch optical transmission monitoring system under the current situation, inputs the operational data into the trained security perception model, and obtains the security status of the power dispatch optical transmission monitoring system under the current situation. The key features related to network security in the power dispatch optical transmission monitoring system include: The network communication characteristics, equipment operation characteristics, and service application characteristics of the power dispatch optical transmission monitoring system are acquired. The network communication characteristics include network traffic data, port connection data, and communication protocol data. The equipment operation characteristics include optical power data, equipment temperature data, and equipment alarm data. The service application characteristics include service transmission data and user operation behavior. Calculate the second correlation value between each of the network communication features, the device operation features, and the business application features and network security, and use the features whose second correlation value is greater than a preset threshold as key features.

2. The network security situation awareness method as described in claim 1, characterized in that, The optimization process of the initial decision tree model to obtain the initial security awareness model includes: Multiple optimized samples are selected from the training samples. Based on the optimized samples, the backpropagation method is used to perform feature recognition on the initial decision tree model to obtain inverse features. In the initial decision tree model, only the nodes and branches corresponding to the reverse features are retained to obtain the intermediate decision tree model; Calculate the information gain for each node in the intermediate decision tree model, and remove nodes whose information gain is less than the gain threshold from the intermediate decision tree model; Based on the intermediate decision tree model with deleted nodes, the backpropagation method is used again to identify features and obtain new reverse features. Based on the new reverse features, a new intermediate decision tree model is obtained. Nodes in the new decision tree model are deleted until the number of iterations is reached, and the initial security perception model is obtained.

3. The network security situation awareness method as described in claim 2, characterized in that, Based on the optimized samples, the backpropagation method is used to perform feature recognition on the initial decision tree model to obtain inverse features, including: Based on the preset decision objective formula, the decision objective corresponding to the key feature of each node in the initial decision tree model is calculated; Substitute the decision target corresponding to the key feature of each node into the preset relevant calculation formula to obtain the first correlation value between the key feature of each node and network security; When the key feature corresponding to each node and the first correlation value of network security fall within a preset correlation range, the key feature corresponding to the node is a reverse feature.

4. The network security situation awareness method as described in claim 2, characterized in that, The formula for calculating information gain is: Where, p t For the t-th feature x t The information gain of the corresponding node, C(x) t ) represents the t-th feature x t The first correlation value between the feature x and network security, B is the correlation value with the t-th feature x. t The number of optimized samples for corresponding node matching; w a For the t-th feature x t The number of node splits corresponding to the node, α e Let be the information entropy, v be the feature matrix, and β be the adjustment value.

5. The network security situation awareness method as described in claim 1, characterized in that, The process of processing the second training sample using a data distillation method to obtain the distilled training sample includes: The second training samples are divided into multiple sample groups, and the samples in each sample group are written into multiple modal data according to a preset format; A pre-trained feature extraction model is used to extract semantic and structural features from each modality of data. Semantic and structural features in each modality are fused using cross-modal attention to obtain multiple distilled training samples.

6. The network security situation awareness method as described in claim 5, characterized in that, The following formula is used to perform cross-modal attention fusion on the semantic and structural features in each modality of data: Among them, W q W k Here, is a learnable parameter, and d is the feature dimension. For semantic features, Let m be the structural feature, m be the m-th mode, and M be the number of modes.

7. A network security situation awareness device, characterized in that, include: The initial model acquisition module is used to acquire key features related to network security in the power dispatch optical transmission monitoring system. Based on the first training sample, the key features and their corresponding feature attributes, an initial decision tree model is constructed, and the initial decision tree model is optimized to obtain an initial security perception model. The model training module is used to acquire a second training sample, process the second training sample using a data distillation method to obtain a distilled training sample, and train the initial security awareness model based on the distilled sample to obtain a trained security awareness model. The second training sample is recent network operation data and security status. The security perception module is used to acquire the operating data of the power dispatch optical transmission monitoring system under the current situation, input the operating data into the trained security perception model, and obtain the security status of the power dispatch optical transmission monitoring system under the current situation. The initial model acquisition module is also used for: The network communication characteristics, equipment operation characteristics, and service application characteristics of the power dispatch optical transmission monitoring system are acquired. The network communication characteristics include network traffic data, port connection data, and communication protocol data. The equipment operation characteristics include optical power data, equipment temperature data, and equipment alarm data. The service application characteristics include service transmission data and user operation behavior. Calculate the second correlation value between each of the network communication features, the device operation features, and the business application features and network security, and use the features whose second correlation value is greater than a preset threshold as key features.

8. A storage medium storing at least one executable instruction that causes a processor to perform an operation corresponding to the network security situation awareness method as described in any one of claims 1-6.

9. A computer device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the network security situation awareness method as described in any one of claims 1-6.

Images