Network access behavior detection model training method and device, medium and product

Abstract

The invention discloses a training method and device of a network access behavior detection model, a medium and a product. Obtaining a plurality of training sample sets, and inputting a first training sample into the first sub-model to obtain a first loss value; processing the second training sample based on the first sub-model to obtain a first prediction result and a second prediction result; processing the second training sample based on the second sub-model to obtain a third prediction result and a fourth prediction result; determining a second loss value based on a confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result and the fourth prediction result; and correcting the first sub-model and the second sub-model based on the first loss value and the second loss value so as to determine the network access behavior detection model based on the first sub-model meeting the model convergence condition, thereby realizing training of the network access behavior detection model, and improving the network access behavior detection efficiency. And the detection accuracy and the detection efficiency of the network access behavior detection model are improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a training method, device, medium, and product for a network access behavior detection model. Background Technology

[0002] With the development of information technology, cybersecurity has received widespread attention. Since abnormal network access behavior can threaten information system security, it is necessary to monitor such behavior to promptly detect and prevent various non-compliant or abnormal network access actions.

[0003] Currently, there are two main methods for detecting anomalous network access behavior. One is based on manually defined rules and expert experience, detecting anomalous network access behavior by matching its features with known characteristics. However, this method relies on expert experience, which has significant limitations and is difficult to effectively handle complex and ever-changing anomalous network access behaviors, lacking good adaptability. The other method is based on conventional deep learning models for detecting anomalous network access behavior. However, conventional deep learning models rely on large amounts of labeled data for training, and obtaining labeled data is both expensive and time-consuming. Furthermore, with the emergence of new types of anomalous network access behaviors, conventional deep learning models struggle to detect unknown anomalous access behaviors, and their accuracy decreases without sufficient labeled data. Summary of the Invention

[0004] This invention provides a training method, device, medium, and product for a network access behavior detection model, which enables the training of the network access behavior detection model, improves the detection accuracy and efficiency of the network access behavior detection model, and gives the trained network access behavior detection model good adaptability.

[0005] According to one aspect of the present invention, a method for training a network access behavior detection model is provided, the method comprising:

[0006] Multiple training sample sets are obtained, wherein each training sample set includes at least one first training sample and at least one second training sample, and each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access type, and the second training sample includes: second sample data.

[0007] For multiple training sample sets, the first training sample in the training sample set is input into the first sub-model to obtain the first loss value, and the second training sample in the training sample set is processed based on the first sub-model to obtain the first prediction result and the second prediction result; wherein, the first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type.

[0008] Based on the second sub-model, the second training sample in the training sample set is processed to obtain the third prediction result and the fourth prediction result. The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type.

[0009] The second loss value is determined based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result;

[0010] The model parameters of the first sub-model are corrected based on the first loss value and the second loss value to obtain the updated first sub-model. The model parameters of the second sub-model are then updated based on the updated first sub-model to obtain the updated second sub-model.

[0011] The model parameters of the first and second sub-models are updated sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

[0012] According to another aspect of the present invention, a training apparatus for a network access behavior detection model is provided, the apparatus comprising:

[0013] The sample set acquisition module is used to acquire multiple training sample sets, wherein each training sample set includes at least one first training sample and at least one second training sample, and each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access type, and the second training sample includes: second sample data.

[0014] The first sub-model processing module is used to input the first training sample in the training sample set into the first sub-model to obtain the first loss value, and to process the second training sample in the training sample set based on the first sub-model to obtain the first prediction result and the second prediction result; wherein, the first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type.

[0015] The second sub-model processing module is used to process the second training samples in the training sample set based on the second sub-model to obtain the third prediction result and the fourth prediction result. The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type.

[0016] The second loss value determination module is used to determine the second loss value based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result.

[0017] The sub-model update module is used to correct the model parameters of the first sub-model based on the first loss value and the second loss value to obtain the updated first sub-model, and to update the model parameters of the second sub-model based on the updated model parameters of the first sub-model to obtain the updated second sub-model.

[0018] The detection model determination module is used to update the model parameters of the first sub-model and the second sub-model sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] At least one processor; and

[0021] A memory that is communicatively connected to at least one processor; wherein,

[0022] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to execute the training method of the network access behavior detection model according to any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute a training method for a network access behavior detection model according to any embodiment of the present invention.

[0024] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements a training method for a network access behavior detection model as described in any embodiment of the present invention.

[0025] The technical solution of this invention involves acquiring multiple training sample sets, each including at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes first sample data and theoretical network access types, and the second training sample includes second sample data. This provides data support for the subsequent training of the first and second models. For multiple training sample sets, the first training sample is processed based on the first sub-model to obtain a first loss value. Based on this, a supervised loss value corresponding to the first sub-model is determined. The second training sample is processed based on the first sub-model to obtain a first prediction result and a second prediction result. The second training sample is processed based on the second sub-model to obtain a third prediction result and a fourth prediction result. A second loss value is determined based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result. Based on this, an unsupervised loss value corresponding to the first sub-model is determined. The model parameters of the first sub-model are corrected based on the first and second loss values ​​to obtain an updated first sub-model. The model parameters of the second sub-model are updated based on the updated model parameters of the first sub-model to obtain the updated second sub-model. The model parameters of the first and second sub-models are updated sequentially based on each training sample set. The network access behavior detection model is determined based on the updated first sub-model when the model convergence condition is met. This invention enables the training of a network access behavior detection model. By processing data related to network access behavior through the network access behavior detection model, it solves the problem of poor adaptability caused by reliance on human experience in existing technologies. Training the first sub-model using unlabeled second training samples reduces reliance on large amounts of labeled data while effectively improving the utilization rate of unlabeled second training samples. This solves the problem of time-consuming and expensive acquisition of labeled data in existing technologies, enhances the model's generalization ability and robustness, and provides technical assurance for application scenarios where labeled data is scarce and abnormal network access behaviors are diverse. The network access behavior detection model can detect access data associated with the target network, improving the accuracy and efficiency of network access behavior detection. At the same time, it can effectively discover and determine whether network access behavior belongs to unknown abnormal network access types, significantly improving the model's adaptability to new abnormal network access behaviors and environmental changes, and enhancing the foresight and security of abnormal network access behavior detection.

[0026] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart of a training method for a network access behavior detection model provided in an embodiment of the present invention;

[0029] Figure 2 These are structural example diagrams of the first and second sub-models provided in embodiments of the present invention;

[0030] Figure 3 This is a flowchart of a training method for a network access behavior detection model provided in an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of the structure of a training device for a network access behavior detection model provided in an embodiment of the present invention;

[0032] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the training method of the network access behavior detection model according to an embodiment of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] Example 1

[0036] Figure 1 This is a flowchart of a training method for a network access behavior detection model provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where abnormal network access behavior in a target network is detected to ensure network security. This method can be executed by a training device for the network access behavior detection model, which can be implemented in hardware and / or software. This training device can be configured in electronic devices such as mobile phones, computers, or servers. Figure 1 As shown, the method includes:

[0037] S110. Obtain multiple training sample sets.

[0038] Each training sample set includes at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes first sample data and a theoretical network access type, and the second training sample includes second sample data. Both the first and second sample data are network access feature data associated with network access behavior. For example, the first sample data may be preprocessed port number information, communication protocol information, etc. The theoretical network access type can be determined by labeling the first sample data, and it represents the network access type to which the network access behavior corresponding to the first sample data belongs. For example, the theoretical network access type may be a normal network access type, a known network access type such as a DoS attack, or an SQL injection attack.

[0039] Specifically, to provide detection for subsequent abnormal network access behavior, multiple network access feature data associated with network access behavior can be acquired. Some of the network access feature data are labeled to determine the theoretical network access type corresponding to the feature data. Using the network access feature data and the corresponding theoretical network access type, a first training sample is determined, and supervised training of the first sub-model is performed based on the first training sample. Unlabeled network access feature data is used as the second sample data to determine the second training sample. It should be noted that in practical applications, the number of samples in the second training sample is usually greater than the number of samples in the first training sample. A training sample set is obtained using at least one first training sample and at least one second training sample. Based on this, multiple training sample sets are obtained, providing data support for the subsequent model training.

[0040] In this embodiment of the invention, the method for obtaining the training sample set may be as follows: obtaining historical network access data associated with the target network within a preset time period; wherein, the historical network access data includes at least: session start time, session end time, communication data volume, communication protocol, source port number, and target port number related to network access behavior; performing data preprocessing on the historical network access data to obtain preprocessed access data; wherein, the data preprocessing includes at least one of: data deduplication, data denoising, missing value imputation, data standardization, and data normalization; dividing the preprocessed access data according to a preset time window to obtain network access feature data; performing network access type labeling on the network access feature data to determine multiple training sample sets; wherein, the number of samples in the first training sample set is less than the number of samples in the second training sample set.

[0041] The preset duration can be a pre-set time period. Historical network access data can include historical log data of network access behavior from at least one data source, or historical log data of abnormal network access behavior generated based on at least one network security device in the target network. The target network can be the network currently requiring abnormal network access behavior detection. At least one security device can be at least one of a firewall, an intrusion prevention system, and an intrusion detection system.

[0042] The session start time can be the initial moment of a network session initiated based on network access behavior. The session end time can be the termination moment of a network session initiated based on network access behavior. The amount of communication data can include the total amount of data transmitted during the network session. The communication protocol can be the network protocol used by the network session. The source port number can be a temporary port number used by the device initiating the network session to the target network. The destination port number can be a fixed port number used by the server receiving the network session in the target network.

[0043] To improve the accuracy of subsequent network access behavior detection models, historical network access data can be preprocessed to ensure the accuracy of training samples and improve model training performance. Data preprocessing includes at least one of the following: data deduplication, data denoising, missing value imputation, data standardization, and data normalization. Data deduplication identifies and removes duplicate data from historical network access data. Data denoising filters or corrects erroneous, abnormal, or irrelevant data (noise) in historical network access data. Missing value imputation appropriately fills in or deletes missing data in historical network access data. Data standardization and data normalization unify the data range of historical network access data to a preset data range to eliminate scale differences between different historical network access data. The preprocessed access data can be the historical network access data itself.

[0044] The preset time window can be a pre-set time length. The time length corresponding to the preset time window does not exceed the time length corresponding to the preset duration. Network access feature data can be feature data obtained by dividing the pre-processed access data according to the preset time window.

[0045] Optionally, after labeling the network access feature data with network access types to obtain the theoretical network access types, one-hot encoding can be used to convert each theoretical network access type into a binary vector. The length of the vector is consistent with the number of known categories of the theoretical network access type. Only the index position corresponding to the theoretical network access type is 1, and the other positions are 0. This binary vector can be used as the label information corresponding to the first sample data in the first training sample, and the first sub-model can be trained based on this label information and the first sample data in the first training sample.

[0046] Specifically, historical network access data is acquired within a preset time period, including session start time, session end time, communication data volume, communication protocol, source port number, and destination port number, all associated with at least one network access behavior in the target network. This historical network access data undergoes at least one data preprocessing step, such as deduplication, noise reduction, missing value imputation, standardization, and normalization, to obtain preprocessed access data. The preprocessed access data is then divided according to a preset time window to obtain network access feature data. A subset of the network access feature data is labeled to obtain the theoretical network access types corresponding to the feature data. Based on the network access feature data and the corresponding theoretical network access types, a first training sample is determined. Based on the unlabeled network access feature data, a second training sample is determined. This results in multiple training sample sets. It should be noted that the theoretical network access types are known network access types; the number of known network access type categories applied in subsequent processing can be determined based on the number of labeled theoretical network access type categories.

[0047] For example, historical log data of network access behavior can be obtained from multiple data sources to ensure the comprehensiveness and accuracy of the data. Historical log data includes: session start time, session end time, communication data volume, communication protocol, source port number, and destination port number, etc., related to network access behavior.

[0048] Acquire historical log data of abnormal network access behaviors generated by network security devices such as firewalls, intrusion prevention systems, and existing intrusion detection systems in the target network. This historical log data records historical network access data corresponding to the abnormal network access behaviors, such as the abnormal network access type, source address, destination address, triggering rules, and the time of the abnormal network access behavior. Using this historical network access data, the first training sample can be identified to train the first sub-model.

[0049] To ensure the accuracy of subsequent model training, all acquired historical network access data can undergo data cleaning and denoising processes to remove duplicate and irrelevant data, and handle missing values. For example, missing historical network access data can be handled by using the mean to fill in or deleting incomplete historical network access data to ensure data consistency and completeness. The processed historical network access data is then standardized or normalized to eliminate scale differences between different historical network access data, resulting in preprocessed access data. To meet the requirements of subsequent model input data, the preprocessed access data can be divided according to a preset time window to obtain two-dimensional network access feature data for subsequent model feature extraction.

[0050] Labeling is performed on network access feature data of known network access types to determine the corresponding theoretical network access type. For example, it determines which known network access type the network access data belongs to, such as normal network access, DoS attack, or SQL injection. After obtaining the theoretical network access type, one-hot encoding can be used to process the theoretical network access type for easier subsequent model training, resulting in a binary vector. The 0 or 1 at the index position in the binary vector represents which known network access type the current network access data belongs to. Based on the network access feature data and the corresponding theoretical network access type, the first training sample is determined for subsequent supervised model training. Based on the unlabeled network access feature data, the second training sample is determined for subsequent unsupervised model training.

[0051] S120. For multiple training sample sets, the first training sample in the training sample set is input into the first sub-model to obtain the first loss value, and the second training sample in the training sample set is processed based on the first sub-model to obtain the first prediction result and the second prediction result.

[0052] The first prediction result characterizes the evaluation attribute of the second training sample belonging to each known network access type, while the second prediction result characterizes the evaluation attribute of the second training sample belonging to an unknown abnormal network access type. The evaluation attribute can be characterized by prediction probabilities. That is, the first prediction result can be the predicted probability of the second training sample belonging to each known network access type. For example, during annotation, if three theoretical network access types are identified: normal network access, DoS attack, and SQL injection, then there are three known network access types. The first prediction result can be: the predicted probability of the second training sample belonging to the normal network access type, the predicted probability of the second training sample belonging to the known network access type of DoS attack, and the predicted probability of the second training sample belonging to the known network access type of SQL injection.

[0053] Accordingly, the second prediction result can be the predicted probability that the second training sample belongs to an unknown abnormal network access type. It should be noted that known network access types include known normal network access types and known abnormal network access types. Known abnormal network access types can be currently known, non-compliant, or abnormal network access types. Unknown abnormal network access types can be unknown but risky network access types.

[0054] In this embodiment of the invention, the first sub-model includes a first feature extraction module, a first closed-set classification module, and a first open-set classification module. The first feature extraction module is used to extract features from the input first training sample or second training sample. The first closed-set classification module processes the feature-extracted first training sample and outputs the actual prediction result; it is also used to subsequently process the feature-extracted second training sample and output the corresponding prediction result. The first closed-set classification module can determine which known network access type the input training sample belongs to. The first open-set classification module processes the feature-extracted second training sample and outputs the corresponding prediction result. The first open-set classification module can determine whether the input second training sample belongs to an unknown abnormal network access type.

[0055] The first loss value can be used to characterize the degree of difference between the actual predicted result corresponding to the first training sample and the theoretical network access type. The first prediction result can be the prediction result obtained by processing the second training sample after feature extraction based on the first closed-set classification module of the first sub-model. The second prediction result can be the prediction result obtained by processing the second training sample after feature extraction based on the first open-set classification module of the first sub-model.

[0056] Specifically, for multiple training sample sets, the first training sample in each set is input into the first sub-model. The first feature extraction module and the first closed-set classification module of the first sub-model process the first sample data of the first training sample sequentially to obtain the actual prediction result. Based on the actual prediction result and the theoretical network access type in the first training sample, a first loss value is determined, and the model parameters of the first sub-model are corrected based on the first loss value.

[0057] The first feature extraction module based on the first sub-model processes the second sample data in the second training samples, and inputs the processed data into the first closed set classification module and the first open set classification module respectively, to obtain the first prediction result output by the first closed set classification module and the second prediction result output by the first open set classification module.

[0058] The first loss value can be obtained by processing the first training sample using the first sub-model as follows: the first feature extraction module of the first sub-model performs feature extraction processing on the first sample data of the first training sample to obtain the first feature data; the first closed set classification module of the first sub-model performs classification processing on the first feature data and outputs the actual prediction result, wherein the actual prediction result is used to characterize the actual evaluation attribute of each known network access type output by the first sub-model; and the theoretical evaluation attribute and actual prediction result corresponding to the theoretical network access type in the first training sample are processed based on the cross-entropy loss function to determine the first loss value.

[0059] The first feature data can be the feature data obtained by the first feature extraction module through feature extraction processing of the first sample data. The actual prediction result is the prediction result determined by the first closed-set classification module after classifying the first feature data. The actual evaluation attribute can be characterized by the actual prediction probability, so the actual prediction result can be the actual prediction probability that the first training sample belongs to each known network access type. The cross-entropy loss function can be a loss function used to determine the degree of difference between the theoretical evaluation attribute and the actual prediction result. The theoretical evaluation attribute can be used to characterize the theoretical probability of the theoretical network access type. Optionally, the theoretical evaluation attribute can be 100%.

[0060] Specifically, the first feature extraction module based on the first sub-model extracts features from the first sample data in the first training samples to obtain the first feature data. The first closed-set classification module based on the first sub-model classifies the first feature data and outputs the actual prediction result. The cross-entropy loss function is used to process the theoretical evaluation attribute corresponding to the theoretical network access type in the first training samples and the actual prediction result to obtain the first loss value. It should be noted that the one-hot encoding corresponding to the theoretical network access type and the one-hot encoding corresponding to the actual prediction result can be determined, and the first loss value is determined based on these two one-hot encodings.

[0061] For example, see Figure 2 , Figure 2 This is a structural example diagram of the first sub-model and the second sub-model provided in the embodiments of the present invention. Figure 2 The student network in the second sub-model corresponds to Figure 2 The teacher network in the above-mentioned first sub-model. The first feature extraction module corresponds to the teacher network in the above-mentioned first sub-model. Figure 2 The backbone network f in s Among them, the backbone network f s The network parameters can be θ s Optional, backbone network f s Pre-trained networks such as DensNet121 or ResNet50 can be used, and the classifier can be a three-layer Multilayer Perceptron (MLP). The first closed-set classification module of the first sub-model mentioned above corresponds to... Figure 2 Closed set classifier g in s Closed set classifier g s The network parameters are φ sc Correspondingly, the first open-set classification module of the first sub-model corresponds to... Figure 2 Open set classifier in o s Open set classifier s The network parameters are φso .

[0062] The first sample data from the first training sample Input to the backbone network f s Feature extraction is performed to obtain the first feature data. Based on closed set classifier g s For the first feature data The classification process is performed to obtain the actual prediction results. The actual prediction result can be determined by the following function.

[0063]

[0064] Where, θ s Main backbone network f s Network parameters, φ represents the first sample data. sc Represents the closed-set classifier g s Network parameters, This indicates the actual predicted result.

[0065] Based on cross-entropy loss function Theoretical evaluation attributes corresponding to theoretical network access types and actual prediction results The process is performed to obtain the first loss value. The first loss value can be expressed as:

[0066]

[0067] in, Let B represent the first loss value, and let B represent the number of samples in the first training sample. Indicates the theoretical evaluation attribute, This indicates the actual predicted result.

[0068] In this embodiment of the invention, the method of processing the second training sample through the first sub-model to obtain the first prediction result and the second prediction result may be as follows: performing strong enhancement processing on the second sample data in the second training sample to obtain strongly enhanced sample data; performing feature extraction processing on the strongly enhanced sample data based on the first feature extraction module to obtain strongly enhanced feature data; performing classification processing on the strongly enhanced feature data based on the first closed set classification module to obtain the first prediction result; and performing classification processing on the strongly enhanced feature data based on the first open set classification module to obtain the second prediction result.

[0069] Strong augmentation and weak augmentation are two methods of data augmentation. Strong augmentation typically involves significantly adjusting the second sample data. Weak augmentation typically involves slightly adjusting the second sample data to retain its main features while adding a few features to improve robustness. Strongly augmented sample data can be the data obtained by performing strong augmentation on the second sample data. Strongly augmented feature data can be the data obtained after the first feature extraction module extracts features from the strongly augmented sample data.

[0070] Specifically, the second sample data in the second training sample is subjected to strong enhancement processing to obtain strongly enhanced sample data. The strongly enhanced sample data is then processed by the first feature extraction module in the first sub-model to extract features, resulting in strongly enhanced feature data. This strongly enhanced feature data is then classified using the first closed-set classification module in the first sub-model to obtain a first prediction result, and finally, the strongly enhanced feature data is classified using the first open-set classification module in the first sub-model to obtain a second prediction result.

[0071] For example, in conjunction with the above examples, see Figure 2 For the second sample data in the second training sample Perform strong enhancement processing to obtain strongly enhanced sample data. Through the backbone network f s Strongly augmented sample data After feature extraction, strongly enhanced feature data is obtained. This is based on the closed-set classifier g. s The data with strong enhancement features are classified to obtain the first prediction result. Based on open set classifier o s The data with strong enhancement features are classified to obtain the second prediction result.

[0072] S130. Based on the second sub-model, process the second training samples in the training sample set to obtain the third and fourth prediction results.

[0073] The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type. Optionally, when the evaluation attribute is characterized by prediction probability, the third prediction result can be understood as the prediction probability of the second training sample belonging to the unknown abnormal network access type; the fourth prediction result can be understood as the prediction probability of the second training sample belonging to each known network access type.

[0074] In this embodiment of the invention, the second sub-model includes a second feature extraction module, a second open-set classification module, and a second closed-set classification module. The second feature extraction module performs feature extraction processing on the second sample data of the second training samples. The second open-set classification module performs classification processing on the feature-extracted second sample data and outputs a third prediction result. The second open-set classification module can determine whether the input second training sample belongs to an unknown abnormal network access type. The second closed-set classification module performs classification processing on the feature-extracted second sample data and outputs a fourth prediction result. The second closed-set classification module can determine which known network access type the input second training sample belongs to.

[0075] Specifically, the second feature extraction module of the second sub-model performs feature extraction on the second sample data in the second training samples to obtain the feature-extracted second sample data. Based on the second open set classification module in the second sub-model, feature extraction is performed on the feature-extracted second sample data to obtain the third prediction result. Based on the second closed set classification module in the second sub-model, feature extraction is performed on the feature-extracted second sample data to obtain the fourth prediction result.

[0076] The method for processing the second training samples using the second sub-model to obtain the third and fourth prediction results can be as follows: perform weak enhancement processing on the second sample data in the second training samples to obtain weakly enhanced sample data; perform feature extraction processing on the weakly enhanced sample data based on the second feature extraction module to obtain weakly enhanced feature data; perform classification processing on the weakly enhanced feature data based on the second open set classification module to obtain the third prediction result; and perform classification processing on the weakly enhanced feature data based on the second closed set classification module to obtain the fourth prediction result.

[0077] The weakly augmented sample data can be the data obtained by weakly augmenting the second sample data. Weak augmentation typically involves slightly adjusting the second sample data to retain its main features while adding a few features to improve robustness. The weakly augmented feature data can be the feature data obtained by the second feature extraction module from the weakly augmented sample data.

[0078] Specifically, the second sample data in the second training sample is weakly augmented to obtain weakly augmented sample data. Features are extracted from the weakly augmented sample data using the second feature extraction module in the second sub-model to obtain weakly augmented feature data. The weakly augmented feature data is then classified using the second open-set classification module of the second sub-model to obtain a third prediction result. Finally, the weakly augmented feature data is classified using the second closed-set classification module to obtain a fourth prediction result.

[0079] For example, referring to the examples above, see [link to previous section]. Figure 2The second sub-model mentioned in the above embodiments corresponds to Figure 2 The teacher network in the second sub-model. The second feature extraction module corresponds to... Figure 2 The backbone network f in the teacher network t The second open-set classification module in the second sub-model corresponds to Figure 2 Open set classifier in o t The second closed-set classification module in the second sub-model corresponds to Figure 2 Closed set classifier g in t .

[0080] The second sample data from the second training sample Weak enhancement processing is performed to obtain weakly enhanced sample data. Weakly augmented sample data Input to the backbone network of the teacher network f t Feature extraction is performed to obtain weakly enhanced feature data. This is based on an open-set classifier. t The weakly enhanced feature data is classified to obtain a third prediction result. Based on closed set classifier g t The weakly enhanced feature data is classified to obtain the fourth prediction result.

[0081] S140. Based on the confidence threshold, determine the function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result, and determine the second loss value.

[0082] The confidence threshold determination function can be used to determine the confidence thresholds corresponding to the third and fourth prediction results. The corresponding second loss value can then be determined using these confidence thresholds. This second loss value can be the loss value from unsupervised training.

[0083] Specifically, the third and fourth prediction results are processed using a confidence threshold determination function to determine two confidence thresholds. Based on these two confidence thresholds, the first, second, third, and fourth prediction results, and the corresponding unsupervised training loss function, two unsupervised training loss values ​​are determined. These two unsupervised training loss values ​​are then used as the second loss value.

[0084] S150. Based on the first loss value and the second loss value, the model parameters of the first sub-model are corrected to obtain the updated first sub-model. Based on the updated model parameters of the first sub-model, the model parameters of the second sub-model are updated to obtain the updated second sub-model.

[0085] The updated first sub-model can be a first sub-model whose model parameters have been updated or corrected. The updated second sub-model can be a second sub-model whose model parameters have been updated or corrected.

[0086] Specifically, based on the first and second loss values, a total loss value is calculated. The gradient is then calculated based on the total loss value, and the model parameters of the first sub-model are updated or corrected to obtain the updated first sub-model. Based on the updated model parameters of the first sub-model, an exponential moving average of the updated model parameters is determined. The model parameters of the second sub-model are then updated based on this exponential moving average to obtain the updated second sub-model.

[0087] S160. Update the model parameters of the first sub-model and the second sub-model sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

[0088] The model convergence condition can be that the number of model updates reaches a preset threshold, or the rate of change of model parameters after a preset number of consecutive updates is lower than a preset rate of change. The network access behavior detection model can detect access data associated with network access behavior to determine whether the current network access behavior belongs to an abnormal network access type.

[0089] Specifically, the model parameters of the first and second sub-models are updated sequentially based on the first and second training samples in each training sample set. The model convergence condition is determined when the number of model updates reaches a preset threshold, or when the rate of change of the model parameters after a preset number of consecutive updates is lower than a preset rate of change. Upon reaching convergence, the updated first and second sub-models are identified, the updated second sub-model is removed, and the updated first sub-model is used as the network access behavior detection model.

[0090] The technical solution of this embodiment obtains multiple training sample sets, each including at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes first sample data and theoretical network access types, and the second training sample includes second sample data. This provides data support for the subsequent training of the first and second models. For multiple training sample sets, the first training sample is processed based on the first sub-model to obtain a first loss value. Based on this, a supervised loss value corresponding to the first sub-model is determined. The second training sample is processed based on the first sub-model to obtain a first prediction result and a second prediction result. The second training sample is processed based on the second sub-model to obtain a third prediction result and a fourth prediction result. A second loss value is determined based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result. Based on this, an unsupervised loss value corresponding to the first sub-model is determined. The model parameters of the first sub-model are corrected based on the first and second loss values ​​to obtain an updated first sub-model. The model parameters of the second sub-model are updated based on the updated model parameters of the first sub-model to obtain an updated second sub-model. The model parameters of the first and second sub-models are updated sequentially based on each training sample set. The network access behavior detection model is then determined based on the updated first sub-model when the model convergence condition is met. This invention enables the training of a network access behavior detection model. By processing data related to network access behavior through this model, it addresses the lack of good adaptive capabilities caused by reliance on human experience in existing technologies. Training the first sub-model using unlabeled second training samples reduces dependence on large amounts of labeled data while effectively improving the utilization rate of unlabeled second training samples. This solves the problem of time-consuming and expensive acquisition of labeled data in existing technologies, enhancing the model's generalization ability and robustness. It provides a technical guarantee for application scenarios where labeled data is scarce and abnormal network access behaviors are diverse. The network access behavior detection model can detect access data associated with the target network, improving the accuracy and efficiency of network access behavior detection. At the same time, it can effectively discover and determine whether network access behavior belongs to unknown abnormal network access types, significantly improving the model's adaptability to new abnormal network access behaviors and environmental changes, and enhancing the foresight and security of abnormal network access behavior detection.

[0091] Example 2

[0092] Figure 3This is a flowchart of a training method for a network access behavior detection model provided in Embodiment 2 of the present invention. This embodiment refines the step of "determining a second loss value based on a confidence threshold function, a first prediction result, a second prediction result, a third prediction result, and a fourth prediction result" from the above embodiments. Specific implementation details can be found in the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 3 As shown, the method includes:

[0093] S210. Obtain multiple training sample sets.

[0094] Each training sample set includes at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access types. The second training sample includes: second sample data.

[0095] S220. For multiple training sample sets, the first training sample in the training sample set is input into the first sub-model to obtain the first loss value, and the second training sample in the training sample set is processed based on the first sub-model to obtain the first prediction result and the second prediction result.

[0096] The first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to an unknown abnormal network access type.

[0097] S230. Based on the second sub-model, process the second training samples in the training sample set to obtain the third and fourth prediction results.

[0098] The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type.

[0099] S240. Determine the number of known categories of known network access types, the number of unknown categories of unknown abnormal network access types, and the number of samples in the second training sample set.

[0100] The known network access types include known abnormal network access types and normal network access types. The number of known categories of known network access types can be the total number of all known network access types. For example, the number of known categories can be K categories. Optionally, the number of unknown categories of unknown abnormal network access types can be determined based on the third prediction results output by the second sub-model. The number of samples in the second training sample set is the total number of samples in the second training sample set when training the model based on the current training sample set.

[0101] Specifically, determine the number of known categories for known network access types, and determine the number of unknown categories for unknown abnormal network access types based on the third prediction results in the current training sample set. Determine the number of samples in the second training sample set.

[0102] S250. Substitute the number of unknown categories, the number of samples, and the third prediction result corresponding to each second training sample into the first confidence threshold determination sub-function to obtain the first confidence threshold.

[0103] The confidence threshold determination function may include: a first confidence threshold determination subfunction and a second confidence threshold determination subfunction. The first confidence threshold determination subfunction is used to determine the confidence threshold corresponding to the open set classification module, i.e., the first confidence threshold. The second confidence threshold determination subfunction is used to determine the confidence threshold corresponding to the closed set classification module, i.e., the second confidence threshold.

[0104] Optionally, the first confidence threshold determination subfunction can be expressed as:

[0105]

[0106] in, This represents the first confidence threshold corresponding to the s-th training iteration. It should be noted that one training sample set corresponds to one training iteration. K+1 represents the number of unknown categories; in addition to the known K categories, the unknown abnormal network access type can be defined as the (K+1)-th category. s represents the current training iteration number. γ represents the confidence smoothing coefficient, typically a constant value between 0.9 and 0.99. This represents the first confidence threshold corresponding to the (s-1)th training iteration. Bu represents the number of samples in the second training sample. This indicates the third prediction result. This indicates the confidence level corresponding to the third prediction result.

[0107] Specifically, the number of unknown categories, the number of samples, and the third prediction result corresponding to each second training sample are substituted into the first confidence threshold determination sub-function to obtain the first confidence threshold. Based on the above example, the first confidence threshold is... Figure 2 The threshold is 1.

[0108] S260. Substitute the known number of categories, the number of samples, and the fourth prediction result corresponding to each second training sample into the second confidence threshold determination sub-function to obtain the second confidence threshold.

[0109] Optionally, the second confidence threshold determination subfunction can be expressed as:

[0110]

[0111] Where K represents the number of known categories, This represents the second confidence threshold corresponding to the s-th training iteration, obtained through... It can filter unlabeled network access feature data in the closed-set classification module. γ represents the confidence level smoothing coefficient, which is usually a constant value between 0.9 and 0.99. This represents the second confidence threshold corresponding to the (s-1)th training iteration. Bu represents the number of samples in the second training set. This indicates the fourth prediction result. This indicates the confidence level corresponding to the fourth prediction result.

[0112] Specifically, the number of known categories, the number of samples, and the fourth prediction result corresponding to each second training sample are substituted into the second confidence threshold determination sub-function to obtain the second confidence threshold. Combining the above example, the second confidence threshold is... Figure 2 The threshold 2.

[0113] It should be noted that using the maximum predicted value as the confidence score of the second sub-model, and then calculating the confidence threshold based on this confidence score, can filter out unreliable, unlabeled network access feature data. The confidence score is used to characterize and evaluate whether the second sub-model provides accurate predictions. Since the number of samples in the second training set is too large, to reduce computational cost, the confidence threshold can be estimated as the exponential moving average (EMA) of the confidence score over each training iteration. Based on this approach, it can be ensured that the model confidence mechanism can dynamically adjust the confidence threshold according to the real-time training state of the second sub-model.

[0114] S270. Based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result, determine the second loss value.

[0115] Specifically, the second loss value is determined based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result, as well as the corresponding function.

[0116] In this embodiment of the invention, the second loss value is the loss value of unsupervised training, and the second loss value includes: the loss value of the open set classifier and the loss value of the closed set classifier.

[0117] Optionally, the method for determining the second loss value based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result can be as follows: substituting the first confidence threshold and the third prediction result into the first selection function to obtain the first selection result, and substituting the second confidence threshold and the fourth prediction result into the second selection function to obtain the second selection result; determining the first cross-entropy loss value based on the third prediction result and the second prediction result; substituting the first selection result, the second selection result, and the first cross-entropy loss value into the open-set classifier loss function to obtain the open-set classifier loss value; substituting the second confidence threshold and the fourth prediction result into the third selection function to obtain the third selection result; determining the second cross-entropy loss value based on the fourth prediction result and the first prediction result; substituting the third selection result and the second cross-entropy loss value into the closed-set classifier loss function to obtain the closed-set classifier loss value; and using the open-set classifier loss value and the closed-set classifier loss value as the second loss value.

[0118] The first selection function can be a selection function corresponding to the third prediction result. The first selection result is the data whose confidence level corresponding to the selected third prediction result is higher than the first confidence threshold. Optionally, the first selection function can be expressed as:

[0119]

[0120] in, This indicates the third prediction result. This indicates the confidence level corresponding to the third prediction result. This represents the first confidence threshold. The first selection function can be used to select data above the first confidence threshold in the open set classification module.

[0121] The second selection function can be the selection function corresponding to the fourth prediction result. The second selection result is the data whose confidence level corresponding to the selected fourth prediction result is lower than the second confidence threshold. Optionally, the second selection function can be expressed as follows:

[0122]

[0123] in, This indicates the fourth prediction result. This indicates the confidence level corresponding to the fourth prediction result. This represents the second confidence threshold. The second selection function can be used to remove data from the closed-set classification module that is determined to belong to a known network access type.

[0124] The first cross-entropy loss value can be used to characterize the degree of difference between the second and third prediction results. Optionally, the first cross-entropy loss value can be determined by the following function.

[0125]

[0126] in, It is based on the third prediction result The determined one-hot encoding (pseudo-tag). That is, This indicates the second prediction result.

[0127] The open-set classifier loss function can be a function used to determine the open-set classifier loss value. The open-set classifier loss value characterizes the label-free loss of the open-set classification module of the first sub-model. Optionally, the open-set classifier loss function can be expressed as:

[0128]

[0129] in, This represents the loss value of the open set classifier. This indicates the first choice result. This indicates the second choice result. denoted by , where represents the first cross-entropy loss value, and Bu represents the number of samples in the second training sample.

[0130] The third selection function can be the selection function corresponding to the fourth prediction result. The third selection result can be the selected data where the confidence level of the fourth prediction result is higher than the second confidence threshold. Optionally, the third selection function can be expressed as:

[0131]

[0132] in, This indicates the fourth prediction result. This indicates the confidence level corresponding to the fourth prediction result. This represents the second confidence threshold.

[0133] The second cross-entropy loss value is used to characterize the degree of difference between the first and fourth prediction results. Optionally, the second cross-entropy loss value can be expressed as:

[0134]

[0135] in, It is the one-hot code (pseudo-label) determined by the fourth prediction result, that is, This indicates the first prediction result.

[0136] The function for determining the loss value of a closed-set classifier can be a function used to determine the loss value of the closed-set classifier. The closed-set classifier loss value is used to characterize the unlabeled loss corresponding to the closed-set classification module of the first sub-model. The function for determining the loss value of a closed-set classifier can be expressed as:

[0137]

[0138] in, Let Bu represent the loss value of the closed-set classifier, and Bu represent the number of samples in the second training sample. This indicates the third choice result. This represents the second cross-entropy loss value.

[0139] Specifically, the first confidence threshold and the third prediction result are substituted into the first selection function to select data whose confidence level is higher than the first confidence threshold, thus obtaining the first selection result. The second confidence threshold and the fourth prediction result are substituted into the second selection function to select data whose confidence level is lower than the second confidence threshold, thus obtaining the second selection result. The third and second prediction results are processed using the cross-entropy loss function to obtain the first cross-entropy loss value. The first selection result, the second selection result, and the first cross-entropy loss value are then substituted into the open-set classifier loss function to obtain the open-set classifier loss value.

[0140] Substituting the second confidence threshold and the fourth prediction result into the third selection function, data with a confidence level higher than the second confidence threshold are selected to obtain the third selection result. The first and fourth prediction results are then processed using the cross-entropy loss function to obtain the second cross-entropy loss value. The third selection result and the second cross-entropy loss value are then substituted into the closed-set classifier loss function to obtain the closed-set classifier loss value. The open-set classifier loss value and the closed-set classifier loss value are used as the second loss value.

[0141] S280. Based on the first loss value and the second loss value, the model parameters of the first sub-model are corrected to obtain the updated first sub-model. Based on the updated model parameters of the first sub-model, the model parameters of the second sub-model are updated to obtain the updated second sub-model.

[0142] In this embodiment of the invention, the method for correcting the model parameters of the first sub-model based on the first loss value and the second loss value may be as follows: determine the total loss value based on the first loss value and the first weight coefficient corresponding to the first loss value, the open set classifier loss value and the second weight coefficient corresponding to the open set classifier loss value, and the closed set classifier loss value and the third weight coefficient corresponding to the closed set classifier loss value; update the model parameters of the first sub-model based on the total loss value to obtain the updated first sub-model.

[0143] The first weight coefficient can be a pre-set coefficient corresponding to the first loss value. The second weight coefficient can be a pre-set coefficient corresponding to the open-set classifier loss value in the second loss value. Correspondingly, the third weight coefficient is also pre-set, corresponding to the closed-set classifier loss value in the second loss value. The total loss value can be the sum of the loss values ​​obtained by multiplying the first loss value by the first weight coefficient, the open-set classifier loss value by the second weight coefficient, and the closed-set classifier loss value by the third weight coefficient. Optionally, in the s-th training iteration, the total loss value can be represented by the following function:

[0144]

[0145] in, This represents the total loss value. This represents the first loss value, with a first weighting coefficient of 1. This represents the loss value of the closed-set classifier, and α represents the third weight coefficient. β represents the loss value of the open set classifier, and β represents the second weight coefficient.

[0146] Specifically, the first loss value and its corresponding first weight coefficient are multiplied to obtain the first multiplication result. The open-set classifier loss value and the second weight coefficient are multiplied to obtain the second multiplication result. The closed-set classifier loss value and the third weight coefficient are multiplied to obtain the third multiplication result. The first, second, and third multiplication results are summed to obtain the total loss value. Based on the total loss value, the model parameters of the first sub-model are updated to obtain the updated first sub-model.

[0147] Optionally, the method for updating the second sub-model based on the updated first sub-model can be: determining the exponential moving average of the model parameters of the updated first sub-model; and updating the model parameters of the second sub-model based on the exponential moving average to obtain the updated second sub-model.

[0148] The Exponential Moving Average (EMA) is a weighted moving average method widely used in time series analysis. The exponential moving average of the updated first sub-model parameters can be determined by calculating a weighted average of the updated first and second sub-model parameters.

[0149] Specifically, the exponential moving average of the model parameters of the updated first sub-model is determined, and the model parameters of the second sub-model are updated based on the exponential moving average to obtain the updated second sub-model.

[0150] For example, in the s-th training iteration, after updating the model parameters of the first sub-model based on the total loss value, the updated model parameters of the first sub-model can be obtained. A weighted average is then calculated using the updated model parameters of the first sub-model and the model parameters of the second sub-model in the (s-1)-th training iteration to determine the exponential moving average. The model parameters of the second sub-model in the s-th training iteration are then updated based on this exponential moving average to obtain the updated second sub-model.

[0151] S290. The model parameters of the first sub-model and the second sub-model are updated sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

[0152] In this embodiment of the invention, after determining the network access behavior detection model, the method further includes: acquiring access data to be detected associated with the target network; performing network access type detection processing on the access data to be detected based on the network access behavior detection model to obtain the target network access type corresponding to the access data to be detected, so as to process the target network based on the target network access type.

[0153] The data to be detected includes network access feature data related to the current network access behavior. It should be noted that the data to be detected is preprocessed data. The network access behavior detection model is the first sub-model that achieves the model convergence condition. The target network access type can be one of the following: a known abnormal network access type, a normal network access type, or an unknown abnormal network access type.

[0154] Specifically, the system acquires access data associated with the target network and performs network access type detection processing on this data based on a network access behavior detection model to obtain the target network access type corresponding to the data. If the target network access type is determined to be a normal network access type, no defensive action is required for the network access behavior corresponding to the data. If the target network access type is determined to be one of the known abnormal network access types, corresponding predefined security policies (e.g., blocking, isolation, or rate limiting) can be triggered based on the relevant security control system to ensure the security of the target network. If the target network access type is determined to be an unknown abnormal network access type, it is marked as an abnormal network access type and reported to the security management center for further analysis or dynamic updates to the defense rules.

[0155] The technical solution of this embodiment provides data support for the subsequent training of the first and second models by acquiring multiple training sample sets. For multiple training sample sets, the first training samples are processed based on the first sub-model to obtain a first loss value, and based on this, the supervised loss value corresponding to the first sub-model is determined. The second training samples are processed based on the first sub-model to obtain a first prediction result and a second prediction result. The second training samples are processed based on the second sub-model to obtain a third prediction result and a fourth prediction result. The number of known categories of known network access types, the number of unknown categories of unknown abnormal network access types, and the number of samples in the second training sample set are determined. The number of unknown categories, the number of samples, and the third prediction result corresponding to each second training sample are substituted into the first confidence threshold determination sub-function to obtain the first confidence threshold. The number of known categories, the number of samples, and the fourth prediction result corresponding to each second training sample are substituted into the second confidence threshold determination sub-function to obtain the second confidence threshold. Based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result, the second loss value is determined. By introducing a dynamically adjusted dual-threshold mechanism, a confidence threshold is determined based on the confidence level during model training, and the selection result is dynamically determined based on the two confidence thresholds to obtain the second loss value. This not only improves the accuracy and stability of the second loss value but also effectively avoids interference from unreliable data, improves the efficiency of sample data utilization for the second training samples, and enhances the robustness and reliability of the subsequent network access behavior detection model when facing diverse abnormal network access behaviors. The model parameters of the first sub-model are corrected based on the first and second loss values ​​to obtain the updated first sub-model. The model parameters of the second sub-model are then updated based on the updated model parameters of the first sub-model to obtain the updated second sub-model. The model parameters of the first and second sub-models are updated sequentially based on each training sample set, and the network access behavior detection model is determined based on the updated first sub-model when the model convergence condition is met. This invention enables the training of a network access behavior detection model. By processing data related to network access behavior through the network access behavior detection model, it can solve the problem of poor adaptability caused by reliance on human experience in existing technologies. By training the first sub-model with unlabeled second training samples, it can effectively improve the utilization rate of unlabeled second training samples while reducing the dependence on a large amount of labeled data. This solves the problem of time-consuming and expensive acquisition of labeled data in existing technologies, enhances the generalization ability and robustness of the model, and provides technical guarantee for dealing with application scenarios where labeled data is scarce and abnormal network access behaviors are diverse.The network access behavior detection model can detect access data associated with the target network, improving the accuracy and efficiency of network access behavior detection. At the same time, it can effectively discover and determine whether network access behavior belongs to unknown abnormal network access types, significantly improving the model's adaptability to new abnormal network access behaviors and environmental changes, and enhancing the foresight and security of abnormal network access behavior detection.

[0156] Example 3

[0157] Figure 4 This is a schematic diagram of the structure of a training device for a network access behavior detection model provided in Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a sample set acquisition module 310, a first sub-model processing module 320, a second sub-model processing module 330, a second loss value determination module 340, a sub-model update module 350, and a detection model determination module 360.

[0158] The sample set acquisition module 310 is used to acquire multiple training sample sets, wherein each training sample set includes at least one first training sample and at least one second training sample, and each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access type; the second training sample includes: second sample data. The first sub-model processing module 320 is used to input the first training sample in the training sample set into the first sub-model to obtain a first loss value, and to process the second training sample in the training sample set based on the first sub-model to obtain a first prediction result and a second prediction result. The first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to an unknown abnormal network access type. The second sub-model processing module 330 is used to process the second training sample in the training sample set based on the second sub-model. The sample processing yields a third prediction result and a fourth prediction result. The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to an unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type. The second loss value determination module 340 is used to determine the second loss value based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result. The sub-model update module 350 is used to correct the model parameters of the first sub-model based on the first loss value and the second loss value to obtain the updated first sub-model, and update the model parameters of the second sub-model based on the updated model parameters of the first sub-model to obtain the updated second sub-model. The detection model determination module 360 ​​is used to update the model parameters of the first sub-model and the second sub-model sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model that reaches the model convergence condition.

[0159] The technical solution of this embodiment obtains multiple training sample sets, each including at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes first sample data and theoretical network access types, and the second training sample includes second sample data. This provides data support for the subsequent training of the first and second models. For multiple training sample sets, the first training sample is processed based on the first sub-model to obtain a first loss value. Based on this, a supervised loss value corresponding to the first sub-model is determined. The second training sample is processed based on the first sub-model to obtain a first prediction result and a second prediction result. The second training sample is processed based on the second sub-model to obtain a third prediction result and a fourth prediction result. A second loss value is determined based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result. Based on this, an unsupervised loss value corresponding to the first sub-model is determined. The model parameters of the first sub-model are corrected based on the first and second loss values ​​to obtain an updated first sub-model. The model parameters of the second sub-model are updated based on the updated model parameters of the first sub-model to obtain an updated second sub-model. The model parameters of the first and second sub-models are updated sequentially based on each training sample set. The network access behavior detection model is then determined based on the updated first sub-model when the model convergence condition is met. This invention enables the training of a network access behavior detection model. By processing data related to network access behavior through this model, it addresses the lack of good adaptive capabilities caused by reliance on human experience in existing technologies. Training the first sub-model using unlabeled second training samples reduces dependence on large amounts of labeled data while effectively improving the utilization rate of unlabeled second training samples. This solves the problem of time-consuming and expensive acquisition of labeled data in existing technologies, enhancing the model's generalization ability and robustness. It provides a technical guarantee for application scenarios where labeled data is scarce and abnormal network access behaviors are diverse. The network access behavior detection model can detect access data associated with the target network, improving the accuracy and efficiency of network access behavior detection. At the same time, it can effectively discover and determine whether network access behavior belongs to unknown abnormal network access types, significantly improving the model's adaptability to new abnormal network access behaviors and environmental changes, and enhancing the foresight and security of abnormal network access behavior detection.

[0160] Based on the above embodiments, optionally, a sample set acquisition module is used to acquire historical network access data associated with the target network within a preset time period; wherein, the historical network access data includes at least: session start time, session end time, communication data volume, communication protocol, source port number, and target port number related to network access behavior; the historical network access data is preprocessed to obtain preprocessed access data; wherein, the data preprocessing includes at least one of: data deduplication, data denoising, missing value imputation, data standardization, and data normalization; the preprocessed access data is divided according to a preset time window to obtain network access feature data; the network access feature data is labeled with network access type to determine multiple training sample sets; wherein, the number of samples in the first training sample set is less than the number of samples in the second training sample set.

[0161] Optionally, the first sub-model includes a first feature extraction module, a first closed-set classification module, and a first open-set classification module. The first sub-model processing module includes: a first loss value determination unit, used to perform feature extraction processing on the first sample data of the first training samples based on the first feature extraction module of the first sub-model to obtain first feature data; to perform classification processing on the first feature data based on the first closed-set classification module of the first sub-model and output actual prediction results, wherein the actual prediction results are used to characterize the actual evaluation attributes of each known network access type output by the first sub-model; and to process the theoretical evaluation attributes and actual prediction results corresponding to the theoretical network access types in the first training samples based on the cross-entropy loss function to determine the first loss value.

[0162] Optionally, the first sub-model includes a first feature extraction module, a first closed-set classification module, and a first open-set classification module. The first sub-model processing module includes: a strongly enhanced sample processing unit, used to perform strongly enhanced processing on the second sample data in the second training samples to obtain strongly enhanced sample data; to perform feature extraction processing on the strongly enhanced sample data based on the first feature extraction module to obtain strongly enhanced feature data; to perform classification processing on the strongly enhanced feature data based on the first closed-set classification module to obtain a first prediction result; and to perform classification processing on the strongly enhanced feature data based on the first open-set classification module to obtain a second prediction result.

[0163] Optionally, the second sub-model includes a second feature extraction module, a second open-set classification module, and a second closed-set classification module. The second sub-model processing module is used to perform weak enhancement processing on the second sample data in the second training samples to obtain weakly enhanced sample data; perform feature extraction processing on the weakly enhanced sample data based on the second feature extraction module to obtain weakly enhanced feature data; perform classification processing on the weakly enhanced feature data based on the second open-set classification module to obtain a third prediction result; and perform classification processing on the weakly enhanced feature data based on the second closed-set classification module to obtain a fourth prediction result.

[0164] Optionally, the confidence threshold determination function includes: a first confidence threshold determination subfunction and a second confidence threshold determination subfunction; the second loss value determination module includes: an information determination unit, used to determine the number of known categories of known network access types, the number of unknown categories of unknown abnormal network access types, and the number of samples in the second training sample set; the first confidence threshold determination unit, used to substitute the number of unknown categories, the number of samples, and the third prediction result corresponding to each second training sample into the first confidence threshold determination subfunction to obtain the first confidence threshold; the second confidence threshold determination unit, used to substitute the number of known categories, the number of samples, and the fourth prediction result corresponding to each second training sample into the second confidence threshold determination subfunction to obtain the second confidence threshold; and the second loss value determination unit, used to determine the second loss value based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result.

[0165] Optionally, the second loss value includes: an open-set classifier loss value and a closed-set classifier loss value. The second loss value determination unit is used to substitute a first confidence threshold and a third prediction result into a first selection function to obtain a first selection result, and to substitute a second confidence threshold and a fourth prediction result into a second selection function to obtain a second selection result; determine a first cross-entropy loss value based on the third and second prediction results; substitute the first selection result, the second selection result, and the first cross-entropy loss value into the open-set classifier loss function to obtain an open-set classifier loss value; substitute the second confidence threshold and the fourth prediction result into a third selection function to obtain a third selection result; determine a second cross-entropy loss value based on the fourth prediction result and the first prediction result; substitute the third selection result and the second cross-entropy loss value into the closed-set classifier loss function to obtain a closed-set classifier loss value; and use the open-set classifier loss value and the closed-set classifier loss value as the second loss value.

[0166] Optionally, the second loss value includes: the open-set classifier loss value and the closed-set classifier loss value. The sub-model update module includes: a first sub-model update unit, used to determine the total loss value based on the first loss value and the first weight coefficient corresponding to the first loss value, the open-set classifier loss value and the second weight coefficient corresponding to the open-set classifier loss value, and the closed-set classifier loss value and the third weight coefficient corresponding to the closed-set classifier loss value; and to update the model parameters of the first sub-model based on the total loss value to obtain the updated first sub-model.

[0167] Optionally, the sub-model update module includes: a second sub-model update unit, used to determine the exponential moving average of the model parameters of the updated first sub-model; and to update the model parameters of the second sub-model based on the exponential moving average to obtain the updated second sub-model.

[0168] Optionally, the device further includes: a model application module for acquiring access data to be detected associated with the target network; performing network access type detection processing on the access data to be detected based on the network access behavior detection model to obtain the target network access type corresponding to the access data to be detected, so as to process the target network based on the target network access type.

[0169] The training device for the network access behavior detection model provided in this embodiment of the invention can execute the training method for the network access behavior detection model provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0170] Example 4

[0171] Figure 5 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0172] like Figure 5As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0173] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0174] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the training method for a network access behavior detection model.

[0175] In some embodiments, the training method for the network access behavior detection model can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the training method for the network access behavior detection model described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the training method for the network access behavior detection model by any other suitable means (e.g., by means of firmware).

[0176] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0177] Computer programs used for training methods of the network access behavior detection model of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0178] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0179] Example 5

[0180] Embodiment 5 of the present invention also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a training method for a network access behavior detection model, the method comprising:

[0181] Multiple training sample sets are acquired, each including at least one first training sample and at least one second training sample. Each training sample includes network access feature data associated with network access behavior. The first training sample includes first sample data and theoretical network access types, and the second training sample includes second sample data. For multiple training sample sets, the first training sample in each set is input into a first sub-model to obtain a first loss value. The second training sample in the training sample set is then processed based on the first sub-model to obtain a first prediction result and a second prediction result. The first prediction result characterizes the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result characterizes the evaluation attribute of the second training sample belonging to an unknown abnormal network access type. The second training sample in the training sample set is then processed based on the second sub-model. Sample processing yields a third and a fourth prediction result. The third prediction result characterizes the evaluation attribute of the second training sample belonging to an unknown abnormal network access type, while the fourth prediction result characterizes the evaluation attribute of the second training sample belonging to each known network access type. A second loss value is determined based on the confidence threshold function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result. The model parameters of the first sub-model are corrected based on the first and second loss values ​​to obtain an updated first sub-model. The model parameters of the second sub-model are then updated based on the updated first sub-model parameters to obtain an updated second sub-model. The model parameters of the first and second sub-models are updated sequentially based on each training sample set. Based on the first sub-model that meets the model convergence condition, a network access behavior detection model is determined.

[0182] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0183] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0184] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0185] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0186] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0187] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A training method for a network access behavior detection model, characterized in that, include: Multiple training sample sets are obtained, wherein each training sample set includes at least one first training sample and at least one second training sample, and each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access type, and the second training sample includes: second sample data. For multiple training sample sets, the first training sample in the training sample set is input into the first sub-model to obtain the first loss value, and the second training sample in the training sample set is processed based on the first sub-model to obtain the first prediction result and the second prediction result; wherein, the first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type. Based on the second sub-model, the second training sample in the training sample set is processed to obtain a third prediction result and a fourth prediction result. The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type. The second loss value is determined based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result; The model parameters of the first sub-model are corrected based on the first loss value and the second loss value to obtain the updated first sub-model, and the model parameters of the second sub-model are updated based on the updated first sub-model to obtain the updated second sub-model. The model parameters of the first sub-model and the second sub-model are updated sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

2. The method according to claim 1, characterized in that, The acquisition of multiple training sample sets includes: Obtain historical network access data associated with the target network within a preset time period; wherein, the historical network access data includes at least: session start time, session end time, communication data volume, communication protocol, source port number and target port number related to network access behavior; The historical network access data is preprocessed to obtain preprocessed access data; wherein the data preprocessing includes at least one of the following: data deduplication, data denoising, missing value imputation, data standardization, and data normalization. The preprocessed access data is divided according to a preset time window to obtain network access feature data; The network access feature data is labeled with network access type to determine multiple training sample sets; wherein the number of samples in the first training sample set is less than the number of samples in the second training sample set.

3. The method according to claim 1, characterized in that, The first sub-model includes a first feature extraction module, a first closed-set classification module, and a first open-set classification module. The step of inputting the first training samples from the training sample set into the first sub-model to obtain a first loss value includes: Based on the first feature extraction module of the first sub-model, feature extraction processing is performed on the first sample data of the first training sample to obtain the first feature data; The first closed-set classification module of the first sub-model performs classification processing on the first feature data and outputs actual prediction results, wherein the actual prediction results are used to characterize the actual evaluation attributes of each known network access type output by the first sub-model. The first loss value is determined by processing the theoretical evaluation attributes corresponding to the theoretical network access types in the first training sample and the actual prediction results based on the cross-entropy loss function.

4. The method according to claim 1, characterized in that, The first sub-model includes a first feature extraction module, a first closed set classification module, and a first open set classification module. The step of processing the second training samples in the training sample set based on the first sub-model to obtain a first prediction result and a second prediction result includes: The second sample data in the second training sample is subjected to strong enhancement processing to obtain strongly enhanced sample data; Based on the first feature extraction module, feature extraction processing is performed on the strongly enhanced sample data to obtain strongly enhanced feature data; Based on the first closed set classification module, the strongly enhanced feature data is classified to obtain a first prediction result; The strong enhancement feature data is classified based on the first open set classification module to obtain the second prediction result.

5. The method according to claim 1, characterized in that, The second sub-model includes a second feature extraction module, a second open set classification module, and a second closed set classification module. The processing of the second training samples in the training sample set based on the second sub-model to obtain the third and fourth prediction results includes: Weakly augmented sample data is obtained by performing weak augmentation on the second sample data in the second training sample. Based on the second feature extraction module, feature extraction processing is performed on the weakly enhanced sample data to obtain weakly enhanced feature data; Based on the second open set classification module, the weakly enhanced feature data is classified to obtain a third prediction result; The weakly enhanced feature data is classified based on the second closed set classification module to obtain the fourth prediction result.

6. The method according to claim 1, characterized in that, The confidence threshold determination function includes: a first confidence threshold determination subfunction and a second confidence threshold determination subfunction. The determination of the second loss value based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result includes: Determine the number of known categories of known network access types, the number of unknown categories of unknown abnormal network access types, and the number of samples in the second training sample set; Substitute the number of unknown categories, the number of samples, and the third prediction result corresponding to each second training sample into the first confidence threshold determination sub-function to obtain the first confidence threshold; Substitute the number of known categories, the number of samples, and the fourth prediction result corresponding to each second training sample into the second confidence threshold determination sub-function to obtain the second confidence threshold; A second loss value is determined based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result.

7. The method according to claim 6, characterized in that, The second loss value includes: the open set classifier loss value and the closed set classifier loss value. Determining the second loss value based on the first confidence threshold, the second confidence threshold, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result includes: Substituting the first confidence threshold and the third prediction result into the first selection function yields the first selection result; and substituting the second confidence threshold and the fourth prediction result into the second selection function yields the second selection result. Based on the third prediction result and the second prediction result, the first cross-entropy loss value is determined; Substitute the first selection result, the second selection result, and the first cross-entropy loss value into the open set classifier loss function to obtain the open set classifier loss value. Substitute the second confidence threshold and the fourth prediction result into the third selection function to obtain the third selection result; Based on the fourth prediction result and the first prediction result, the second cross-entropy loss value is determined; Substitute the third selection result and the second cross-entropy loss value into the closed-set classifier loss function to obtain the closed-set classifier loss value; The loss values ​​of the open set classifier and the closed set classifier are used as the second loss value.

8. The method according to claim 1, characterized in that, The second loss value includes: the open set classifier loss value and the closed set classifier loss value. The step of correcting the model parameters of the first sub-model based on the first loss value and the second loss value to obtain the updated first sub-model includes: The total loss value is determined based on the first loss value and the first weight coefficient corresponding to the first loss value, the open set classifier loss value and the second weight coefficient corresponding to the open set classifier loss value, and the closed set classifier loss value and the third weight coefficient corresponding to the closed set classifier loss value. The model parameters of the first sub-model are updated based on the total loss value to obtain the updated first sub-model.

9. The method according to claim 1, characterized in that, The step of updating the model parameters of the second sub-model based on the updated model parameters of the first sub-model to obtain the updated second sub-model includes: Determine the exponential moving average of the model parameters of the updated first sub-model; The model parameters of the second sub-model are updated based on the exponential moving average to obtain the updated second sub-model.

10. The method according to claim 1, characterized in that, After determining the network access behavior detection model, the method further includes: Obtain the access data to be detected that is associated with the target network; Based on the network access behavior detection model, the network access type detection processing is performed on the access data to be detected to obtain the target network access type corresponding to the access data to be detected, so as to process the target network based on the target network access type.

11. A training device for a network access behavior detection model, characterized in that, include: The sample set acquisition module is used to acquire multiple training sample sets, wherein each training sample set includes at least one first training sample and at least one second training sample, and each training sample includes network access feature data associated with network access behavior. The first training sample includes: first sample data and theoretical network access type, and the second training sample includes: second sample data. The first sub-model processing module is used to input a first training sample from the training sample set into a first sub-model to obtain a first loss value, and to process a second training sample from the training sample set based on the first sub-model to obtain a first prediction result and a second prediction result; wherein, the first prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type, and the second prediction result is used to characterize the evaluation attribute of the second training sample belonging to an unknown abnormal network access type. The second sub-model processing module is used to process the second training samples in the training sample set based on the second sub-model to obtain a third prediction result and a fourth prediction result. The third prediction result is used to characterize the evaluation attribute of the second training sample belonging to the unknown abnormal network access type, and the fourth prediction result is used to characterize the evaluation attribute of the second training sample belonging to each known network access type. The second loss value determination module is used to determine the second loss value based on the confidence threshold determination function, the first prediction result, the second prediction result, the third prediction result, and the fourth prediction result; The sub-model update module is used to correct the model parameters of the first sub-model based on the first loss value and the second loss value to obtain the updated first sub-model, and to update the model parameters of the second sub-model based on the updated model parameters of the first sub-model to obtain the updated second sub-model. The detection model determination module is used to update the model parameters of the first sub-model and the second sub-model sequentially based on each training sample set, so as to determine the network access behavior detection model based on the first sub-model when the model convergence condition is met.

12. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the training method of the network access behavior detection model according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the training method for the network access behavior detection model according to any one of claims 1-10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the training method of the network access behavior detection model as described in any one of claims 1-10.

Images