Software supply chain flow detection method, system and product based on big data

Abstract

The invention discloses a software supply chain flow detection method, system and product based on big data, and belongs to the technical field of network security, and the method comprises the steps: obtaining and preprocessing a data packet sequence to obtain a preprocessed data packet sequence, and carrying out the multi-dimensional feature extraction of the preprocessed data packet sequence to obtain a multi-dimensional flow feature; obtaining the weight of the multi-dimensional traffic characteristics based on the multi-dimensional traffic characteristics, and calibrating the weight; performing weighted relevance processing and fusion on the multi-dimensional traffic features to obtain fused traffic features; and inputting the fused traffic features into a BiLSTM model to obtain space-time fusion features, carrying out anomaly detection and fusion on the space-time fusion features to obtain fusion anomaly confidence, judging the fusion anomaly confidence based on a preset threshold, and if the judgment is abnormal, triggering a traffic alarm mechanism and generating a traffic early warning scheme. According to the method, the hidden attack identification efficiency and the novel attack discovery capability can be improved, meanwhile, the behavior change of the software supply chain is self-adapted, and the false alarm rate is reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a software supply chain traffic detection method, system and product based on big data. BACKGROUND

[0002] In recent years, with the development of communication technology, network communication traffic also presents a geometric growth trend. For network communication traffic, the existing software supply chain field often adopts encryption means to encrypt and transmit traffic data. The software supply chain refers to all links, participants, software and processes involved in the entire life cycle of software from development, construction, testing, distribution to deployment and maintenance. Each link is complex, but the use of encryption transmission mode is prone to hidden traffic, and hidden data is prone to be hidden in the hidden traffic. Hidden data refers to data hidden in traffic messages and not easily detected, which includes potential malicious behavior, user privacy data, application types used by users in mobile networks, and services and application types in virtual private networks.

[0003] Moreover, the existing technology also has corresponding deficiencies in the way of detecting traffic. For example, as traditional network attack methods are updated, traditional firewalls are difficult to identify hidden attacks. The update speed of the detection system based on the rule library lags behind new attack methods, such as supply chain poisoning and legal channel data theft. The existing traffic baseline model is static and cannot adapt to changes in software supply chain behavior.

[0004] Therefore, how to provide an effective technical solution to solve the problems in the prior art that the traditional firewall is difficult to identify hidden attacks, the update speed of the detection system lags behind new attack methods, and cannot adapt to changes in software supply chain behavior has become a difficult problem to be solved in the prior art. SUMMARY

[0005] The purpose of the application is to provide a software supply chain traffic detection method, system and product based on big data to solve the above problems existing in the prior art.

[0006] In order to achieve the above purpose, the application adopts the following technical solutions: In a first aspect, the application provides a software supply chain traffic detection method based on big data, comprising: obtaining a data packet sequence of real-time traffic in a software supply chain, preprocessing the data packet sequence to obtain a preprocessed data packet sequence, and performing multi-dimensional feature extraction on the preprocessed data packet sequence to obtain multi-dimensional traffic features, wherein the multi-dimensional traffic features include time sequence features, content features and behavior features; The convolutional neural network model is used to extract weights of the multi-dimensional traffic features, and the weights of the multi-dimensional traffic features are calibrated by using the MSE to obtain calibrated weights of the multi-dimensional traffic features. The one-dimensional CNN model is used to perform weighted correlation processing on the time sequence features, the content features and the behavior features based on the calibrated weights of the multi-dimensional traffic features, to obtain the multi-dimensional traffic features after the weighted processing, and the multi-dimensional traffic features after the weighted processing are fused to obtain the fused traffic features. The fused traffic features are input into the BiLSTM model to obtain the spatio-temporal fusion features, the spatio-temporal fusion features are subjected to abnormality detection and fusion to obtain a fused abnormality confidence, and the fused abnormality confidence is judged based on a preset threshold, if the abnormality is judged, the traffic alarm mechanism is triggered to generate a traffic early warning scheme.

[0007] In a possible design, the data packet sequence is preprocessed to obtain a preprocessed data packet sequence, including: The data packet sequence is encoded using a binary grammar model to obtain a double-byte sequence; A character vocabulary table initialized using a byte pair encoding technology is obtained, the occurrence times of double-byte pairs in the double-byte sequence in the data packet sequence are calculated, and the double-byte pair with the highest occurrence times is merged to obtain a merged double-byte pair, the initialized character vocabulary table is updated using the merged double-byte pair, and the above updating step is repeated until a preset iteration termination condition is reached to obtain a final character vocabulary table, and the final character vocabulary table is converted to obtain token representation data; The token representation data is converted using One-Hot encoding to obtain binary token representation data; The binary token representation data is subjected to standardization data processing to obtain numerical token representation data; The numerical token representation data is subjected to normalization processing to obtain the preprocessed data packet sequence.

[0008] In a possible design, multi-dimensional feature extraction is performed on the preprocessed data packet sequence to obtain multi-dimensional traffic features, including: The preprocessed data packet sequence is subjected to feature extraction using a wavelet transform or an ARIMA model to obtain time sequence features; The preprocessed data packet sequence is subjected to feature extraction using an NLP model to obtain content features; The preprocessed data packet sequence is subjected to feature extraction using a behavior model to obtain behavior features.

[0009] In a possible design, the weights of the multi-dimensional traffic features are calibrated by using the MSE to obtain the calibrated weights of the multi-dimensional traffic features, including: The SE module in the MSE is used for multi-path parallel extrusion operation on the multi-dimensional traffic features, to obtain a plurality of global statistical traffic information; The SE module is used for multi-path parallel excitation operation on the multi-dimensional traffic features, to obtain a plurality of first weighting coefficients of the global statistical traffic information; The second weighting coefficient is calculated according to each global statistical traffic information and the corresponding first weighting coefficient, and the expression of the second weighting coefficient is: ; In the formula, is the second weighting coefficient, is the excitation operation, is the extrusion operation, is the multi-dimensional traffic feature, is the global statistical traffic information, is the first weighting coefficient corresponding to the global statistical traffic information; The second weight of the multi-dimensional traffic feature is obtained by combining the second weighting coefficient and the multi-dimensional traffic feature; The second weight of the multi-dimensional traffic feature is fused with the weight of the multi-dimensional traffic feature to obtain the calibration weight of the multi-dimensional traffic feature.

[0010] In a possible design, the one-dimensional CNN model includes a one-dimensional convolution layer and a pooling layer; the one-dimensional CNN model is used to perform weighted relevance processing on the time sequence feature, the content feature and the behavior feature based on the calibration weight of the multi-dimensional traffic feature, to obtain the multi-dimensional traffic feature after the weighted processing, including: The one-dimensional convolution layer is used to perform local feature extraction on the time sequence feature, the content feature and the behavior feature, to obtain local time sequence features, local content features and local behavior features; The pooling layer is used to perform dimension reduction processing on the local time sequence features, the local content features and the local behavior features, to obtain reduced local time sequence features, reduced local content features and reduced local behavior features; The reduced local time sequence features, the reduced local content features and the reduced local behavior features are weighted processed based on the calibration weight of the multi-dimensional traffic feature, to obtain the multi-dimensional traffic feature after the weighted processing.

[0011] In a possible design, the BiLSTM model includes a forward LSTM layer and a reverse LSTM layer; the fusion traffic feature is input into the BiLSTM model to obtain the space-time fusion feature, including: The forward LSTM layer is used to extract features from the fusion traffic feature, to obtain a forward traffic feature; The reverse LSTM layer is used to extract features from the fusion traffic feature, to obtain a reverse traffic feature; The forward flow feature and the reverse flow feature are fused to obtain a spatio-temporal fusion feature.

[0012] In a possible design, the spatio-temporal fusion feature is subjected to anomaly detection and fusion to obtain a fusion anomaly confidence, including: An unsupervised detection is performed on the spatio-temporal fusion feature based on an LSTM-AE model using a parallel detection engine to obtain a first anomaly confidence. A supervised detection is performed on the spatio-temporal fusion feature based on a GBDT classifier using a parallel detection engine to obtain a second anomaly confidence. The first anomaly confidence and the second anomaly confidence are fused to obtain the fusion anomaly confidence.

[0013] In a second aspect, the present application provides a software supply chain flow detection system based on big data, including: A preprocessing module is configured to acquire a data packet sequence of real-time flow in a software supply chain, pre-process the data packet sequence to obtain a pre-processed data packet sequence, and perform multi-dimensional feature extraction on the pre-processed data packet sequence to obtain multi-dimensional flow features, wherein the multi-dimensional flow features include time sequence features, content features and behavior features. A weight calibration module is configured to extract weights of the multi-dimensional flow features by using a convolutional neural network model to obtain the weights of the multi-dimensional flow features, and calibrate the weights of the multi-dimensional flow features by using MSE to obtain calibrated weights of the multi-dimensional flow features. An association fusion module is configured to perform weighted association processing on the time sequence features, the content features and the behavior features based on the calibrated weights of the multi-dimensional flow features by using a one-dimensional CNN model to obtain weighted processed multi-dimensional flow features, and perform fusion processing on the weighted processed multi-dimensional flow features to obtain fusion flow features. A detection and early warning module is configured to input the fusion flow features into a BiLSTM model to obtain spatio-temporal fusion features, perform anomaly detection and fusion on the spatio-temporal fusion features to obtain a fusion anomaly confidence, judge the fusion anomaly confidence based on a preset threshold, trigger a flow alarm mechanism to generate a flow early warning scheme if the judgment is abnormal.

[0014] In a third aspect, the present application provides a software supply chain flow detection device based on big data, including a memory, a processor and a transceiver which are connected in sequence and communicate with each other, wherein the memory is configured to store a computer program, the transceiver is configured to transceive messages, and the processor is configured to read the computer program and execute the software supply chain flow detection method based on big data as described in the first aspect.

[0015] In a fourth aspect, the present application provides a computer program product comprising instructions which, when executed on a computer, cause the computer to carry out the method for detecting software supply chain traffic based on big data according to any one of the preceding aspects.

[0016] The beneficial effects of the present application are as follows: (1) The present application discloses a method, system and product for detecting software supply chain traffic based on big data, which extracts multi-dimensional features from pre-processed data packet sequences to obtain multi-dimensional traffic features, wherein the multi-dimensional traffic features include time sequence features, content features and behavior features, which can identify abnormal patterns or hidden instructions that deviate from normal communication patterns, and can also construct the interaction relationship between entities in the software supply chain. When software supply chain poisoning or data theft behavior occurs, the behavior features will change abnormally, thereby identifying hidden attacks and improving the efficiency of identifying hidden attacks. (2) The present application uses a BiLSTM model to identify the fused traffic features to obtain spatio-temporal fusion features, and performs anomaly detection and fusion on the spatio-temporal fusion features to obtain fused anomaly confidence, thereby improving the ability to discover new attacks and strengthening the accurate identification of known threats, forming a detection system with both closed-loop and open-loop capabilities, and no longer relying on the update of the rule base. (3) The present application calibrates the weights of the multi-dimensional traffic features through the SE mechanism in the MSE to obtain calibrated weights of the multi-dimensional traffic features. The SE mechanism can dynamically determine the importance of different features in the current context and automatically increase the weight of important features, which can adapt to the behavior changes of the software supply chain, understand the normal periodicity and trend changes of the software supply chain traffic, reduce the false positive rate, and realize dynamic baseline. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A flowchart of a method for detecting software supply chain traffic based on big data according to the first aspect of the present application is provided. Figure 2 A module block diagram of a system for detecting software supply chain traffic based on big data according to the second aspect of the present application is provided. Figure 3 A structural schematic diagram of a device for detecting software supply chain traffic based on big data according to the third aspect of the present application is provided. DETAILED DESCRIPTION

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the present application will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the drawings is only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings. It should be noted that the description of these embodiments is used to help understand the present application, but does not constitute a limitation on the present application.

[0019] It should be understood that although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element can be called a second element, and similarly, a second element can be called a first element without departing from the scope of the example embodiments of the present application.

[0020] It should be understood that for the term "and / or" that may appear herein, it is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, B alone, and A and B together; for the term " / and" that may appear herein, it is another description of the association relationship of another associated object, which means that there can be two relationships, for example, A / and B, which means that there are two cases of A alone and A and B together; in addition, for the character " / " that may appear herein, it generally means that the associated objects before and after are an "or" relationship.

[0021] Embodiment: As Figure 1 shown, the first aspect of the present embodiment provides a software supply chain traffic detection method based on big data, which can be executed by a computer device or a virtual machine with certain computing resources, such as a personal computer or a smart phone, or a virtual machine; the software supply chain traffic detection method includes but is not limited to the following steps: S1. Obtain the data packet sequence of real-time traffic in the software supply chain, pre-process the data packet sequence to obtain the pre-processed data packet sequence, and perform multi-dimensional feature extraction on the pre-processed data packet sequence to obtain multi-dimensional traffic features, the multi-dimensional traffic features including time sequence features, content features and behavior features; Specifically, in step S1, the data packet sequence is pre-processed to obtain the pre-processed data packet sequence, including: S1.1. Encode the data packet sequence using a binary grammar model to obtain a double-byte sequence; S1.2. Obtain a character vocabulary table initialized using a byte pair encoding technique, calculate the number of occurrences of byte pairs in the double-byte sequence in the data packet sequence, and merge the byte pair with the highest number of occurrences to obtain a merged byte pair. Update the initialized character vocabulary table using the merged byte pair, repeat the above update steps until a preset iteration termination condition is reached, and obtain a final character vocabulary table. Convert the final character vocabulary table to obtain token representation data; S1.3. Convert the token representation data using One-Hot encoding to obtain binary token representation data; S1.4. Standardize the binary token representation data to obtain numerical token representation data; S1.5. Normalize the numerical token representation data to obtain a preprocessed data packet sequence.

[0022] It should be noted that the binary grammar model divides the hexadecimal data in the data packet sequence into consecutive double-byte sequences, such as 1A2B3C4D, which is divided into 1A2B and 3C4D. The segmented double-byte sequences are then serialized into a sequence, and each element in the sequence represents a double-byte pair. The sequence is then processed using a byte pair encoding technique (BPE, byte-pair encoding). Specifically, the binary grammar model belongs to natural language processing technology, which predicts the rationality of a text sequence by statistically analyzing the probability of adjacent word pairs. Its core principle is based on the Markov assumption, and the byte pair encoding technique is a data compression algorithm. The preset iteration termination condition includes reaching a predetermined character vocabulary table size or reaching a preset merging number. When converting the final character vocabulary table to obtain token representation data, several special tokens are introduced, including classification token, separation token, padding token, and masking token. The classification token is used to represent the representative token of the complete sequence, the separation token is used to separate different paragraphs, the padding token is used to fill the token to meet the minimum length requirement, and the masking token is used to mask specific tokens during pre-training to learn the context. One-Hot encoding is a technique for converting a classification vector into a binary vector, which independently encodes N states using an N-bit state register.

[0023] Further, in step S1, multi-dimensional feature extraction is performed on the preprocessed data packet sequence to obtain multi-dimensional traffic features, including: S1.6. Perform feature extraction on the preprocessed data packet sequence using wavelet transform or ARIMA model to obtain time series features; S1.7. Perform feature extraction on the preprocessed data packet sequence using an NLP model to obtain content features; S1.8. extracting features from the preprocessed packet sequence using a behavior model to obtain behavior features.

[0024] In implementation, the specific steps of extracting features from the preprocessed packet sequence using wavelet transform to obtain time sequence features include decomposing the preprocessed packet sequence by a preset number of layers based on a wavelet base and a decomposition layer number to obtain approximation coefficients and detail coefficients, extracting features from each detail coefficient to obtain a plurality of feature vectors, splicing the plurality of feature vectors to obtain a high-dimensional feature vector, and reducing the dimension of the high-dimensional feature vector using PCA (Principal Component Analysis) to obtain time sequence features. The PCA is a prior art and will not be described in detail herein. The ARIMA model (Autoregressive Integrated Moving Average Model) is a time series prediction method combining autoregressive, difference, and moving average components. The model is built after a non-stationary sequence is converted into a stationary sequence through difference processing. The core parameters include the autoregressive order p, the difference order d, and the moving average order q. The principle of NLP (Natural Language Processing) is to simulate human language processing mechanisms through computer technology and algorithms to convert unstructured text into structured data, enabling machines to understand, interpret, and generate human language.

[0025] It should be noted that extracting features from the preprocessed packet sequence using a behavior model to obtain behavior features includes using NER (named entity recognition) to perform entity recognition on the preprocessed packet sequence to obtain traffic entities, extracting the interaction relationships and behaviors of the traffic entities, and constructing an interaction relationship graph based on the traffic entities, the interaction relationships of the traffic entities, and the behaviors of the traffic entities, and extracting features from the interaction relationship graph to obtain behavior features. The behavior model is constructed based on an NLP model. This embodiment extracts features to obtain behavior features, not just analyzes a single packet, but analyzes the access patterns, communication frequencies, and dependency relationships between traffic entities through an interaction relationship graph. In this embodiment, the traffic entities include but are not limited to servers, microservices, and users. When supply chain poisoning or data theft occurs, it usually causes changes in the interaction relationship graph to appear abnormal, such as a compilation server suddenly accessing an external address that has never been contacted. This technical solution can sensitively capture this anomaly, bypassing decryption to directly analyze the statistical features, deep patterns, and behavior associations of traffic, and fundamentally improves the ability to identify hidden attacks.

[0026] S2. The multi-dimensional flow feature is subjected to weight extraction by using a convolutional neural network model to obtain the weight of the multi-dimensional flow feature, and the weight of the multi-dimensional flow feature is subjected to calibration processing by using the MSE to obtain the calibrated weight of the multi-dimensional flow feature; Specifically, in step S2, the weight of the multi-dimensional flow feature is subjected to calibration processing by using the MSE to obtain the calibrated weight of the multi-dimensional flow feature, including: S2.1. The multi-dimensional flow feature is subjected to multi-path parallel extrusion operation by using the SE module in the MSE to obtain a plurality of global statistical flow information; S2.2. The multi-dimensional flow feature is subjected to multi-path parallel excitation operation by using the SE module to obtain a first weighting coefficient of the plurality of global statistical flow information; S2.3. The second weighting coefficient is calculated according to each global statistical flow information and the corresponding first weighting coefficient; It should be noted that the expression of the second weighting coefficient is: ; In the formula, is the second weighting coefficient, is the excitation operation, is the extrusion operation, is the multi-dimensional flow feature, is the global statistical flow information, is the first weighting coefficient corresponding to the global statistical flow information; S2.4. The second weighting coefficient and the multi-dimensional flow feature are combined to obtain the second weight of the multi-dimensional flow feature; S2.5. The second weight of the multi-dimensional flow feature and the weight of the multi-dimensional flow feature are fused to obtain the calibrated weight of the multi-dimensional flow feature.

[0027] In this embodiment, MSE (Mean squared, mechanism mean square error) is a lightweight model with strong portability, which includes multiple parallel SE (Squeeze and excitation, multi-head squeeze excitation) modules in the model, which are used to adjust the feature weights of multi-dimensional traffic features. The multi-head SE module can effectively fuse different perspective information to improve the mining ability of feature potential dependence. Through the SE module, the model can dynamically determine the importance of different features in the current context. For example, during "618" and "Double Eleven", the large traffic flow of traffic peak in the time sequence feature of the e-commerce platform is a normal behavior. At this time, the model should automatically reduce the weight of the time sequence feature, and pay attention to whether the content feature and behavior feature are abnormal. Conversely, in the early morning low peak period, the weight of the time sequence feature is automatically increased, and the small time sequence fluctuations are paid attention to, so as to realize dynamic self-adaptive adjustment. The fusion processing includes but is not limited to average processing or weighted fusion processing. After the fusion processing, fine tuning is performed to compensate for partial offset.

[0028] S3. Adopting a one-dimensional CNN model, the time sequence feature, the content feature and the behavior feature are weighted and associated based on the calibration weight of the multi-dimensional traffic feature to obtain the weighted processed multi-dimensional traffic feature, and the weighted processed multi-dimensional traffic feature is fused to obtain the fused traffic feature; The one-dimensional CNN (Convolutional Neural Networks) model includes a one-dimensional convolution layer and a pooling layer.

[0029] Specifically, in step S3, a one-dimensional CNN model is adopted, and the time sequence feature, the content feature and the behavior feature are weighted and associated based on the calibration weight of the multi-dimensional traffic feature to obtain the weighted processed multi-dimensional traffic feature, including: S3.1. The one-dimensional convolution layer is used to extract local features of the time sequence feature, the content feature and the behavior feature to obtain local time sequence features, local content features and local behavior features; S3.2. The pooling layer is used to reduce the dimension of the local time sequence feature, the local content feature and the local behavior feature to obtain the reduced local time sequence feature, the local content feature and the local behavior feature; S3.3. The reduced local time sequence feature, the local content feature and the local behavior feature are weighted based on the calibration weight of the multi-dimensional traffic feature to obtain the weighted processed multi-dimensional traffic feature.

[0030] S4. The fused traffic feature is input into the BiLSTM model to obtain the spatio-temporal fusion feature, the spatio-temporal fusion feature is detected and fused to obtain the fused abnormal confidence, the fused abnormal confidence is judged based on the preset threshold, if the judgment is abnormal, the traffic alarm mechanism is triggered, and the traffic early warning scheme is generated.

[0031] The BiLSTM model comprises a forward LSTM layer and a reverse LSTM layer.

[0032] Specifically, in step S4, the fusion traffic feature is input into the BiLSTM model to obtain a space-time fusion feature, comprising: S4.1. performing feature extraction on the fusion traffic feature by using the forward LSTM layer to obtain a forward traffic feature; S4.2. performing feature extraction on the fusion traffic feature by using the reverse LSTM layer to obtain a reverse traffic feature; S4.3. fusing the forward traffic feature and the reverse traffic feature to obtain the space-time fusion feature.

[0033] It should be noted that the BiLSTM model is controlled by a forgetting gate, a cell state update, an output gate and an input gate at each time step, wherein the forgetting gate is responsible for the forgetting operation of the BiLSTM model; the cell state update is responsible for information storage and determines which information needs to be stored under the current cell state; the output gate is used to select and control the output information; and the input gate is used to select and control the input information.

[0034] In specific implementation, the expression for performing feature extraction on the fusion traffic feature by using the forward LSTM layer is: ; In the formula, is an input gate at time t, is a forgetting gate at time t, is an output gate at time t, is a cell state update at time t, is an activation function, is a weight of the input gate, is a weight of the forgetting gate, is a weight of the output gate, is a forward traffic feature, is a fusion traffic feature, is a weight of the input gate, is a bias term of the forgetting gate, is a bias term of the output gate, is a cell upper state, is a to-be-selected value vector, obtained by a tanh function.

[0035] The expression for performing feature extraction on the fusion traffic feature by using the reverse LSTM layer is: ; In the formula, is a reverse traffic feature, is a reverse cell upper state.

[0036] Furthermore, in step S4, anomaly detection and fusion are performed on the spatiotemporal fusion features to obtain the fusion anomaly confidence score, including: S4.4. Using a parallel detection engine, unsupervised detection is performed on the spatiotemporal fusion features based on the LSTM-AE model to obtain the first anomaly confidence score; S4.5. Using a parallel detection engine, supervised detection is performed on the spatiotemporal fusion features based on the GBDT classifier to obtain the second anomaly confidence. S4.6. Combine the first and second anomaly confidence scores to obtain the combined anomaly confidence score.

[0037] It should be noted that the LSTM-AE model is built on Long Short-Term Memory (LSTM) networks and autoencoders (AEs) to handle unsupervised learning tasks for time-series data. It reconstructs the input by learning the spatiotemporal patterns of normal traffic and performs unsupervised detection on the spatiotemporal fusion features. When subjected to any new type of attack that does not conform to the normal pattern, it will lead to a high reconstruction error and thus be detected as an anomaly. It does not rely on any known attack rules and can detect new attack methods and variants that have never appeared before. At the same time, the GBDT classifier is used to perform supervised detection on the spatiotemporal fusion features, outputting classification probabilities. Based on the classification probabilities, a second anomaly confidence score is obtained. By fusing unsupervised and supervised detection, supervised detection can use historical attack data to improve the detection accuracy of known attack variants, while unsupervised detection is responsible for discovering unknown threats. Combining the two ensures the ability to discover new threats and enhances the accurate identification of known threats.

[0038] In practice, the preset threshold is dynamically adjusted according to the network load. If an anomaly is detected, a traffic alarm mechanism is triggered to generate a corresponding traffic warning plan. The traffic alarm mechanism can be exemplified as a tiered response mechanism. When a level 1 response occurs, the corresponding protection service is activated, and when a level 2 response occurs, firewall rules are enabled. Traffic warning plans include, but are not limited to, blocking abnormal IP access through security group rules and directing attack traffic to CDN nodes or high-defense servers.

[0039] In one possible design, the method further includes using a sliding time window to update the normal traffic model in real time. Using a sliding time window can solve the model drift problem caused by software version iterations; the sliding time window can be 24 hours.

[0040] like Figure 2 As shown, the second aspect of this embodiment provides a software supply chain flow detection system based on big data, including: The acquisition preprocessing module is configured to acquire a data packet sequence of real-time traffic in a software supply chain, pre-process the data packet sequence to obtain a pre-processed data packet sequence, and perform multi-dimensional feature extraction on the pre-processed data packet sequence to obtain multi-dimensional traffic features, wherein the multi-dimensional traffic features include time sequence features, content features, and behavior features. The weight calibration module is configured to extract weights of the multi-dimensional traffic features by using a convolutional neural network model, calibrate the weights of the multi-dimensional traffic features by using MSE, and obtain calibrated weights of the multi-dimensional traffic features. The correlation fusion module is configured to perform weighted correlation processing on the time sequence features, the content features, and the behavior features based on the calibrated weights of the multi-dimensional traffic features by using a one-dimensional CNN model, obtain weighted processed multi-dimensional traffic features, and perform fusion processing on the weighted processed multi-dimensional traffic features to obtain fused traffic features. The detection and early warning module is configured to input the fused traffic features into a BiLSTM model to obtain spatio-temporal fused features, perform anomaly detection and fusion on the spatio-temporal fused features to obtain a fused anomaly confidence, judge the fused anomaly confidence based on a preset threshold, trigger a traffic warning mechanism to generate a traffic early warning scheme if the judgment is abnormal.

[0041] The working process, working details, and technical effects of the software supply chain traffic detection system based on big data provided in the second aspect of the embodiment can be referred to the software supply chain traffic detection method based on big data described in the first aspect, and will not be described here.

[0042] As shown in Figure 3 The third aspect of the embodiment provides a software supply chain traffic detection device based on big data, which includes a memory, a processor, and a transceiver that are communicatively connected in sequence. The memory is configured to store a computer program, the transceiver is configured to transceive messages, and the processor is configured to read the computer program and execute the software supply chain traffic detection method based on big data described in the first aspect. Specifically, the memory can include, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a flash memory, a first-in first-out memory (FIFO), a first-in last-out memory (FILO), and the like; and the processor can be, but is not limited to, a microprocessor with a model number of STM32F105 series. In addition, the computer device can further include, but is not limited to, a power module, a display screen, and other necessary components.

[0043] The working process, working details and technical effects of the foregoing software supply chain traffic detection device based on big data provided by the third aspect of the embodiment can be referred to the software supply chain traffic detection method based on big data described in the first aspect, and will not be repeated here.

[0044] The fourth aspect of the embodiment provides a computer program product, including a computer program or instructions, which, when executed by a computer, is used to implement the software supply chain traffic detection method based on big data as described in the first aspect.

[0045] The working process, working details and technical effects of the foregoing computer program product provided by the embodiment can be referred to the software supply chain traffic detection method based on big data as described in the first aspect, and will not be repeated here.

[0046] Finally, it should be noted that: the above only for the preferred embodiments of the present application, and not for limiting the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A big data based software supply chain traffic detection method, characterized in that, The application relates to a method for detecting abnormal traffic in a software supply chain. The method comprises the following steps: acquiring a data packet sequence of real-time traffic in a software supply chain, preprocessing the data packet sequence to obtain a preprocessed data packet sequence, performing multi-dimensional feature extraction on the preprocessed data packet sequence to obtain multi-dimensional traffic features, wherein the multi-dimensional traffic features comprise time sequence features, content features and behavior features; a convolutional neural network model is used to extract weights of the multi-dimensional traffic features, and the weights of the multi-dimensional traffic features are calibrated by using MSE to obtain calibrated weights of the multi-dimensional traffic features; a one-dimensional CNN model is used to perform weighted correlation processing on the time sequence features, the content features and the behavior features based on the calibrated weights of the multi-dimensional traffic features, and the weighted processing is performed on the multi-dimensional traffic features to obtain fused traffic features; the fused traffic features are input into a BiLSTM model to obtain spatio-temporal fusion features, the spatio-temporal fusion features are subjected to abnormality detection and fusion to obtain a fused abnormal confidence, and the fused abnormal confidence is judged based on a preset threshold; if the abnormality is judged, a traffic alarm mechanism is triggered to generate a traffic early warning scheme.

2. The software supply chain traffic detection method based on big data according to claim 1, characterized in that, The preprocessed data packet sequence is obtained by preprocessing the data packet sequence, and the preprocessing comprises the following steps: a binary grammar model is used to encode the data packet sequence to obtain a double-byte sequence; a character vocabulary table initialized by using a byte pair encoding technology is acquired, the occurrence frequency of double-byte pairs in the double-byte sequence in the data packet sequence is calculated, and the double-byte pair with the highest occurrence frequency is merged to obtain a merged double-byte pair; the initialized character vocabulary table is updated by using the merged double-byte pair, and the above updating step is repeated until a preset iteration termination condition is reached to obtain a final character vocabulary table; the final character vocabulary table is converted to obtain token representation data; the token representation data is converted by using One-Hot encoding to obtain binary token representation data; the binary token representation data is subjected to standardization data processing to obtain numerical token representation data; the numerical token representation data is subjected to normalization processing to obtain the preprocessed data packet sequence.

3. The method of claim 1, wherein, The multi-dimensional traffic features are obtained by performing multi-dimensional feature extraction on the preprocessed data packet sequence, and the multi-dimensional feature extraction comprises the following steps: wavelet transform or an ARIMA model is used to extract features from the preprocessed data packet sequence to obtain time sequence features; an NLP model is used to extract features from the preprocessed data packet sequence to obtain content features; a behavior model is used to extract features from the preprocessed data packet sequence to obtain behavior features.

4. The software supply chain traffic detection method based on big data according to claim 1, characterized in that, The calibrated weights of the multi-dimensional traffic features are obtained by calibrating the weights of the multi-dimensional traffic features by using MSE, and the calibration comprises the following steps: a SE module in the MSE is used to perform multi-path parallel extrusion operation on the multi-dimensional traffic features to obtain a plurality of global statistical traffic information; the SE module is used to perform multi-path parallel excitation operation on the multi-dimensional traffic features to obtain a first weighting coefficient of the plurality of global statistical traffic information; the second weighting coefficient is calculated according to each global statistical traffic information and the corresponding first weighting coefficient, and the expression of the second weighting coefficient is: ； In the formula, is a second weighting coefficient, is an excitation operation, is a squeezing operation, is a multi-dimensional flow feature, is global statistical flow information, is a first weighting coefficient corresponding to the global statistical flow information. The second weight of the multi-dimensional traffic feature is obtained according to the second weight coefficient and the multi-dimensional traffic feature; The second weight of the multi-dimensional traffic feature is fused with the weight of the multi-dimensional traffic feature to obtain a calibration weight of the multi-dimensional traffic feature.

5. The software supply chain traffic detection method based on big data according to claim 1, characterized in that, The one-dimensional CNN model comprises a one-dimensional convolution layer and a pooling layer; the one-dimensional CNN model is used to perform weighted relevance processing on the time sequence feature, the content feature and the behavior feature based on the calibration weight of the multi-dimensional traffic feature to obtain the multi-dimensional traffic feature after weighted processing, which comprises: The one-dimensional convolution layer is used to perform local feature extraction on the time sequence feature, the content feature and the behavior feature to obtain local time sequence features, local content features and local behavior features; The pooling layer is used to perform dimension reduction processing on the local time sequence features, the local content features and the local behavior features to obtain reduced local time sequence features, reduced local content features and reduced local behavior features; The reduced local time sequence features, the reduced local content features and the reduced local behavior features are processed based on the calibration weight of the multi-dimensional traffic feature to obtain the multi-dimensional traffic feature after weighted processing.

6. The software supply chain traffic detection method based on big data according to claim 1, wherein, The BiLSTM model comprises a forward LSTM layer and a reverse LSTM layer; the fusion traffic feature is input into the BiLSTM model to obtain a space-time fusion feature, which comprises: The forward LSTM layer is used to extract features from the fusion traffic feature to obtain a forward traffic feature; The reverse LSTM layer is used to extract features from the fusion traffic feature to obtain a reverse traffic feature; The forward traffic feature and the reverse traffic feature are fused to obtain the space-time fusion feature.

7. The software supply chain traffic detection method based on big data according to claim 1, characterized in that, The space-time fusion feature is subjected to anomaly detection and fusion to obtain a fusion anomaly confidence, which comprises: An unsupervised detection is performed on the space-time fusion feature based on the LSTM-AE model by using a parallel detection engine to obtain a first anomaly confidence; A supervised detection is performed on the space-time fusion feature based on the GBDT classifier by using the parallel detection engine to obtain a second anomaly confidence; The first anomaly confidence and the second anomaly confidence are fused to obtain the fusion anomaly confidence.

8. A big data based software supply chain traffic detection system for implementing the method of any one of claims 1-7. It comprises: A preprocessing module is configured to obtain a data packet sequence of real-time traffic in a software supply chain, pre-process the data packet sequence to obtain a pre-processed data packet sequence, and extract multi-dimensional features from the pre-processed data packet sequence to obtain a multi-dimensional traffic feature, wherein the multi-dimensional traffic feature comprises a time sequence feature, a content feature and a behavior feature; A weight calibration module is configured to extract weights of the multi-dimensional traffic feature by using a convolutional neural network model, calibrate the weights of the multi-dimensional traffic feature by using MSE, and obtain a calibration weight of the multi-dimensional traffic feature; An association fusion module is configured to use a one-dimensional CNN model to perform weighted relevance processing on the time sequence feature, the content feature and the behavior feature based on the calibration weight of the multi-dimensional traffic feature, obtain the multi-dimensional traffic feature after weighted processing, and fuse the multi-dimensional traffic feature after weighted processing to obtain a fusion traffic feature. The detection and early warning module is configured to input the fused traffic feature into a BiLSTM model to obtain a spatio-temporal fusion feature, perform abnormality detection and fusion on the spatio-temporal fusion feature, obtain a fused abnormality confidence, judge the fused abnormality confidence based on a preset threshold, trigger a traffic alarm mechanism to generate a traffic early warning scheme if the judgment is abnormal. 9.A big data based software supply chain traffic detection apparatus, characterized in that, The computer program or the instructions realize the software supply chain traffic detection method based on big data as claimed in any one of claims 1-7 when executed by a computer.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or the instructions realize the software supply chain traffic detection method based on big data as claimed in any one of claims 1-7 when executed by a computer.

Images