Model training method, security protection method, related device, equipment, storage medium and computer program product

Abstract

The invention discloses a model training method, a safety protection method, a model training device, a safety protection device, first equipment, second equipment, a storage medium and a computer program product. The model training method comprises the steps that a first training data set and a second training data set are determined, and each sample in the first training data set comprises related information of network security threats and classification results of M levels for the network security threats, each sample in the second training data set comprises related information of the network security threat, classification results of M levels for the network security threat, and a security protection scheme for the network security threat; m is an integer greater than 1, the classification result of the Mth level in the classification results of the M levels is determined based on the classification result of the (M-1) th level, and the classification fineness of the classification results of the M levels increases step by step; and training a first model by using the first training data set, and training a second model by using the second training data set.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a model training method, a security protection method, related devices, equipment, storage media, and computer program products. Background Technology

[0002] In related technologies, such as Figure 1 As shown, the modular framework of a security protection system can include five layers: a resource layer (also known as a security resource layer), a decision layer, a control layer, a management layer, and a business layer. The resource layer can contain sensors and data sources for various security tools, and can provide raw security tool data such as network traffic, logs, and endpoint status. The decision layer can perform in-depth analysis of security tool data, discover and confirm security threats, generate security protection plans, and make corresponding response decisions. The control layer can uniformly control the resource layer based on resource orchestration and scheduling capabilities, realizing security capability scheduling. The management layer is responsible for managing modules, data, and tasks within the security protection system. The business layer can correspond to the customer's business platform, covering various customer businesses; furthermore, the business layer can interface with the security tools in the resource layer and is protected by these security tools.

[0003] However, the aforementioned security protection systems urgently need to improve their ability to identify and respond to new and / or complex security threats. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide a model training method, a security protection method, related devices, equipment, storage media, and computer program products.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a model training method, including:

[0007] A first training dataset and a second training dataset are determined. Each sample in the first training dataset includes relevant information about cybersecurity threats and M levels of classification results for the cybersecurity threats. Each sample in the second training dataset includes relevant information about cybersecurity threats, M levels of classification results for the cybersecurity threats, and security protection schemes for the cybersecurity threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively.

[0008] A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

[0009] In the above scheme, the first model includes N feature extraction network layers and M cascaded classification network layers. The N feature extraction network layers are used to extract N dimensions of features of the network security threat based on relevant information of the network security threat, where N is an integer greater than 1. The M classification network layers are used to determine M levels of classification results for the network security threat based on the N dimensions of features of the network security threat. The classification result output by the Mth classification network layer is determined based on the N dimensions of features of the network security threat and the classification result output by the (M-1)th classification network layer. The classification precision of the M classification network layers increases progressively.

[0010] In the above scheme, when both M and N are equal to 2, the first model includes:

[0011] The first feature extraction network layer is used to extract the temporal features of the network security threat;

[0012] The second feature extraction network layer is used to extract global features of the network security threat;

[0013] A global pooling layer is used to aggregate the temporal and global features of the network security threat to obtain the original features of the network security threat.

[0014] The first classification network layer is used to classify the original characteristics of the network security threats to obtain the first-level classification result;

[0015] An embedding layer is used to embed the first-level classification result into the feature space of the original feature to obtain the first-level classification feature;

[0016] The merging layer is used to merge the original features and the first-level classification features to obtain merged features;

[0017] The second classification network layer is used to classify the merged features to obtain the second-level classification result; wherein...

[0018] The classification precision of the second classification network layer is higher than that of the first classification network layer.

[0019] In the above scheme, the first model further includes:

[0020] The first input layer is used to input relevant information about the cybersecurity threat;

[0021] The first output layer is used to output the first-level classification result and the second-level classification result;

[0022] The ensemble learning layer is used for ensemble learning that combines gradient boosting classifiers.

[0023] In the above scheme, the first feature extraction network layer includes a Long Short-Term Memory (LSTM) network, and / or the second feature extraction network layer includes a Transformer encoder.

[0024] In the above scheme, the second model includes a first sub-model and a second sub-model. The first sub-model is used to analyze the relevant information of the network security threat and the classification results of the network security threat at M levels to obtain analysis results. The analysis results include one or more of the following: relevant information of attack behavior, relevant information of attack / intrusion mode, and relevant information of threat source. The second sub-model is used to generate a security protection scheme for the network security threat based on the analysis results.

[0025] In the above scheme, the second model further includes:

[0026] The second input layer is used to input relevant information about the network security threat and the classification results of the network security threat at M levels;

[0027] The second output layer is used to output security protection solutions against the aforementioned network security threats.

[0028] The method in the above scheme further includes:

[0029] The first model is optimized using the analysis results.

[0030] This application also provides a security protection method, including:

[0031] The relevant information of network security threats is obtained, and the relevant information of network security threats is input into a first model to obtain the classification results of the network security threats at M levels output by the first model; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively.

[0032] The relevant information of the network security threat and the classification results of the network security threat at M levels are input into the second model to obtain the security protection scheme for the network security threat output by the second model.

[0033] Based on the aforementioned security protection scheme, security protection is implemented against the aforementioned network security threats; wherein,

[0034] The first model and the second model are models trained using any of the above-mentioned model training methods.

[0035] The method in the above scheme further includes:

[0036] Based on the classification results of the M levels, optimize the first model;

[0037] And / or,

[0038] Based on the aforementioned security protection scheme, the second model is optimized.

[0039] This application embodiment also provides a model training apparatus, including:

[0040] A first processing unit is configured to determine a first training dataset and a second training dataset. Each sample in the first training dataset includes relevant information about a cybersecurity threat and M levels of classification results for the cybersecurity threat. Each sample in the second training dataset includes relevant information about a cybersecurity threat, M levels of classification results for the cybersecurity threat, and a security protection scheme for the cybersecurity threat. M is an integer greater than 1. The M-th level classification result is determined based on the (M-1)-th level classification result, and the classification granularity of the M levels of classification results increases progressively.

[0041] The second processing unit is used to train a first model using the first training dataset and a second model using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

[0042] This application embodiment also provides a safety protection device, including:

[0043] The third processing unit is used to acquire relevant information about network security threats, input the relevant information about network security threats into the first model, and obtain the classification results of the first model for the network security threats at M levels; M is an integer greater than 1, and the M-th level classification result is determined based on the (M-1)-th level classification result, and the classification precision of the M-th level classification results increases progressively.

[0044] The fourth processing unit is used to input the relevant information of the network security threat and the classification results of the network security threat at M levels into the second model to obtain the security protection scheme for the network security threat output by the second model.

[0045] The fifth processing unit is used to perform security protection against the network security threat based on the security protection scheme; wherein,

[0046] The first model and the second model are models trained using any of the above-mentioned model training methods.

[0047] This application embodiment also provides a first device, including: a first communication interface and a first processor; wherein,

[0048] The first processor is configured to:

[0049] A first training dataset and a second training dataset are determined. Each sample in the first training dataset includes relevant information about cybersecurity threats and M levels of classification results for the cybersecurity threats. Each sample in the second training dataset includes relevant information about cybersecurity threats, M levels of classification results for the cybersecurity threats, and security protection schemes for the cybersecurity threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively.

[0050] A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

[0051] This application embodiment also provides a second device, including: a second communication interface and a second processor; wherein,

[0052] The second processor is used for:

[0053] The relevant information of network security threats is obtained, and the relevant information of network security threats is input into a first model to obtain the classification results of the network security threats at M levels output by the first model; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively.

[0054] The relevant information of the network security threat and the classification results of the network security threat at M levels are input into the second model to obtain the security protection scheme for the network security threat output by the second model.

[0055] Based on the aforementioned security protection scheme, security protection is implemented against the aforementioned network security threats; wherein,

[0056] The first model and the second model are models trained using any of the above-mentioned model training methods.

[0057] This application also provides a first device, including: a first processor and a first memory for storing a computer program capable of running on the processor.

[0058] Wherein, when the first processor runs the computer program, it executes the steps of any of the above-described model training methods.

[0059] This application also provides a second device, including: a second processor and a second memory for storing a computer program capable of running on the processor.

[0060] The second processor is used to execute the steps of any of the above-mentioned security protection methods when running the computer program.

[0061] This application embodiment also provides a storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described model training methods or the steps of any of the above-described security protection methods.

[0062] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described model training methods or the steps of any of the above-described security protection methods.

[0063] The model training method, security protection method, related devices, equipment, storage media, and computer program products provided in this application embodiment include: determining a first training dataset and a second training dataset, wherein each sample in the first training dataset includes relevant information about a cybersecurity threat and M levels of classification results for the cybersecurity threat, and each sample in the second training dataset includes relevant information about a cybersecurity threat, M levels of classification results for the cybersecurity threat, and a security protection scheme for the cybersecurity threat; M is an integer greater than 1, and the M-th level classification result is determined based on the (M-1)-th level classification result, with the classification granularity of the M levels of classification results increasing progressively; training a first model using the first training dataset and training a second model using the second training dataset, wherein the first model is used to determine the M levels of classification results for the cybersecurity threat based on relevant information about the cybersecurity threat, and the second model is used to generate a security protection scheme for the cybersecurity threat based on relevant information about the cybersecurity threat and the M levels of classification results for the cybersecurity threat. The solution provided in this application utilizes a specific dataset (i.e., the first training dataset) to train a first model for determining M levels of classification results for network security threats based on relevant information about network security threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result. The classification granularity of the M levels increases progressively, thereby enabling the first model to improve the accuracy and granularity of network security threat classification, and thus enhance the accuracy of identifying relevant information about network security threats. Furthermore, a second model is trained using another specific dataset (i.e., the second training dataset) to generate security protection schemes for network security threats based on relevant information and the M levels of classification results. This allows the second model to automatically generate security protection schemes, saving the expert involvement required in each threat response process. This significantly improves the security protection system's ability to identify and analyze new and / or complex security threats (or its response capabilities), thereby significantly improving the system's response speed and accuracy, achieving truly intelligent security protection. Attached Figure Description

[0064] Figure 1 This is a schematic diagram of the security protection system architecture for related technologies;

[0065] Figure 2 This is a schematic flowchart of the model training method in an embodiment of this application;

[0066] Figure 3 This is a flowchart illustrating the security protection method according to an embodiment of this application;

[0067] Figure 4 This is a schematic diagram of the improved security protection system architecture used in this application example;

[0068] Figure 5 This is a schematic diagram of the intelligent classification model architecture used in this application.

[0069] Figure 6 A schematic diagram of the model architecture for the application example protection scheme in this application is generated;

[0070] Figure 7 This is a schematic diagram of the model training device structure according to an embodiment of this application;

[0071] Figure 8 This is a schematic diagram of the safety protection device structure according to an embodiment of this application;

[0072] Figure 9 This is a schematic diagram of the structure of the first device according to an embodiment of this application;

[0073] Figure 10 This is a schematic diagram of the structure of the second device in the embodiment of this application. Detailed Implementation

[0074] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0075] In related technologies, Figure 1 The security protection system described above uses static data for security data analysis when generating network security protection solutions in response to network security threats. This means that the analysis and discovery of security events (i.e., security threats) are based on static data comparisons, making it difficult to accurately identify real alerts generated by security tools and predict potential security threats that security tools have not yet detected. Furthermore, not only does the process of discovering security threats use static data, but the handling of security threats is also static. This approach is prone to excessive false positives and false negatives in complex network environments. Too many false positives and false negatives hinder the implementation of on-demand security protection for networks such as 6G, easily leading to a waste of security protection resources. Excessive false positives and false negatives may also make business systems vulnerable to attacks. In addition, handling security events after security analysis requires expert experience, meaning a significant amount of human intervention is needed, resulting in a serious lag in preventing new threats. Therefore, it is clear that the security protection system's ability to identify and analyze new and / or complex security threats urgently needs improvement.

[0076] Based on this, in various embodiments of this application, a first model is trained using a specific dataset to determine M levels of classification results for network security threats based on relevant information of network security threats, where M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels increases progressively. This allows the first model to be used to improve the accuracy and granularity of network security threat classification, thereby enhancing the accuracy and granularity of network security threat classification results and improving the accuracy of identifying relevant information about network security threats. Furthermore, a second model is trained using another specific dataset to generate security protection schemes for network security threats based on relevant information of network security threats and the M levels of classification results. This allows the second model to be used to automatically generate security protection schemes for network security threats, saving the expert involvement step in each threat response process. This significantly improves the security protection system's ability to identify and respond to new and / or complex security threats (or its response capability), thus significantly improving the response speed and accuracy of the security protection system and achieving truly intelligent security protection.

[0077] It should be noted that in the various embodiments of this application, "one or more" means at least one or more items, and "multiple" means at least two or more items.

[0078] This application provides a model training method, such as... Figure 2 As shown, the method includes:

[0079] Step 201: Determine the first training dataset and the second training dataset. Each sample in the first training dataset includes relevant information about the cybersecurity threat and M levels of classification results for the cybersecurity threat. Each sample in the second training dataset includes relevant information about the cybersecurity threat, M levels of classification results for the cybersecurity threat, and security protection schemes for the cybersecurity threat. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively.

[0080] Step 202: Train a first model using the first training dataset and train a second model using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

[0081] In practical applications, the model training method provided in this application embodiment can be applied to... Figure 1 The security protection system shown can be specifically applied to the decision-making layer of the system; in other words, the first and second models, after training, can be deployed in the decision engine of the decision-making layer, which can schedule and optimize the first and second models as needed. Furthermore, it is understood that the model training method provided in this application embodiment can be implemented by the decision engine (i.e., the first and second models are trained by the decision engine), or it can be implemented by other modules inside or outside the security protection system; this application embodiment does not limit this.

[0082] In practical applications, from a hardware implementation perspective, the model training method provided in this application embodiment can be implemented by a first device, which may include a server, etc. Furthermore, after the first and second models are trained, they can be deployed to a second device, whereby the second device utilizes the first and second models to implement security protection; that is, the second device schedules and optimizes the first and second models as needed. Here, it can be understood that the second device is also used to implement the function of the decision engine, and the second device may also include a server, etc. The second device may be the same as or different from the first device.

[0083] In practical applications, the specific number of samples included in the first training dataset and the specific method of collecting these samples can be set as needed, and this application embodiment does not limit this. For example, relevant information on network security threats can be obtained from the resource layer of the security protection system. Specifically, when a user initiates an access request to a business system in the business layer of the security protection system via a terminal, all network traffic entering and leaving the business system must be detected by various security tools (also known as security protection devices, etc.) in the resource layer of the security protection system. These security tools can detect abnormal behavior in network traffic, discover malicious or suspected security threat traffic, and issue abnormal alarms (i.e., security alarms). The security management engine in the management layer of the security protection system can obtain security data from the resource layer. This security data can at least include security alarm information from security tools, and the security alarm information can at least include relevant information on network security threats detected by the corresponding security tools, such as the type of network security threat, attack behavior, attack attempts, and related risk model data. Then, the security management engine can transmit the relevant information on network security threats to the decision engine.

[0084] In practical applications, to enable the first model to determine M levels of classification results for cybersecurity threats, the first model may include N feature extraction network layers and M cascaded classification network layers. The N feature extraction network layers are used to extract N dimensions of features of the cybersecurity threat based on relevant information of the cybersecurity threat, where N is an integer greater than 1. The M classification network layers are used to determine M levels of classification results for the cybersecurity threat based on the N dimensions of features of the cybersecurity threat. Specifically, the classification result output by the Mth classification network layer is determined based on the N dimensions of features of the cybersecurity threat and the classification result output by the (M-1)th classification network layer. The classification granularity of the M classification network layers increases progressively; in other words, the classification result output by the (M-1)th classification network layer can be used as input data for the Mth classification network layer for further refined classification.

[0085] In practical applications, the specific values ​​of M and N can be set according to needs (such as the required level of granularity in classifying network security threats, the deployment requirements of security protection systems, etc.), and this application embodiment does not limit this. For example, when both M and N are equal to 2, the first model may include:

[0086] The first feature extraction network layer is used to extract the temporal features of the network security threat;

[0087] The second feature extraction network layer is used to extract global features of the network security threat;

[0088] A global pooling layer is used to aggregate the temporal and global features of the network security threat to obtain the original features of the network security threat.

[0089] The first classification network layer is used to classify the original characteristics of the network security threats to obtain the first-level classification result;

[0090] An embedding layer is used to embed the first-level classification result into the feature space of the original feature to obtain the first-level classification feature;

[0091] The merging layer is used to merge the original features and the first-level classification features to obtain merged features;

[0092] The second classification network layer is used to classify the merged features to obtain the second-level classification result; wherein...

[0093] The classification precision of the second classification network layer is higher than that of the first classification network layer.

[0094] In practical applications, the specific types of the first and second feature extraction network layers can be set as needed. For example, the first feature extraction network layer may include an LSTM network, and the second feature extraction network layer may include a Transformer encoder.

[0095] In practical applications, the specific types of the first and second classification network layers can be set as needed, and these types can be the same or different. For example, the first and second classification network layers can be the same classification network model, but the data used for model training can be different, meaning the input data for the two classification network layers is different. Specifically, the input data used by the second classification network layer during model training can include the classification results of the first classification network layer (i.e., the first-level classification results), and the first-level classification results can be labeled for a second classification (i.e., labeled sample labels). Therefore, the classification precision of the second classification network layer is higher than that of the first classification network layer, meaning a more refined classification can be achieved through the second classification network layer. Here, assuming the input data of the first classification network layer includes raw security threat information data, classification information such as alarm log information, attack log information, AI model security information, and AI framework security information can be used as training labels. After training, the first classification network layer can achieve broad classification of the raw security threat information data, such as classifying a raw security threat as AI model security information. After the first classification is completed, the first-level classification result of the first classification network layer can be used as the input data of the second classification network layer. If the first-level classification result includes AI model class security information, classification information such as YOLO model serialization attack feature information and Transformer model component class import hazard source feature information can be used as training labels. After training, the second classification network layer can achieve further refined classification of AI model class security information, such as classifying an AI model class security information as YOLO model serialization attack feature information.

[0096] In practical applications, as can be seen from the above description, the classification granularity corresponding to the second-level classification result is higher than that corresponding to the first-level classification result. For example, the first-level classification result may include one or more of the following classification information: alarm log information, attack log information, AI model security information, and AI framework security information; for AI model security information, the second-level classification result may include one or more of the following classification information: YOLO model serialization attack feature information, Transformer model component import hazard source feature information, etc.

[0097] In practical applications, when both M and N are equal to 2, the first model may also include:

[0098] The first input layer is used to input relevant information about the cybersecurity threat;

[0099] The first output layer is used to output the first-level classification result and the second-level classification result, that is, to output the M-level classification results for the network security threat.

[0100] The ensemble learning layer is used for ensemble learning that combines gradient boosting classifiers.

[0101] In practical applications, the second model may include a first sub-model and a second sub-model. The first sub-model can be used to analyze relevant information about the cybersecurity threat and the M-level classification results for the cybersecurity threat, obtaining analysis results. These analysis results may include one or more of the following: information related to attack behavior, information related to attack / intrusion patterns, and information related to threat sources. The second sub-model can be used to generate a security protection scheme for the cybersecurity threat based on the analysis results. This security protection scheme may include one or more of the following security strategies: rule updates, access control policy adjustments, and emergency response process optimization.

[0102] Additionally, the second model may also include:

[0103] The second input layer is used to input relevant information about the network security threat and the classification results of the network security threat at M levels;

[0104] The second output layer is used to output security protection solutions against the aforementioned network security threats.

[0105] In practical applications, the analysis results can be used to automatically optimize the first model.

[0106] Based on this, in one embodiment, the method may further include:

[0107] The first model is optimized using the analysis results.

[0108] In practical applications, as can be seen from the above description, after the first device completes the training of the first model and the second model, it can deploy the first model and the second model to the second device, and the second device can use the first model and the second model to achieve security protection.

[0109] Based on this, this application also provides a security protection method applied to a second device, such as... Figure 3 As shown, the method includes:

[0110] Step 301: Obtain relevant information about network security threats, input the relevant information about network security threats into the first model, and obtain the classification results of the first model for the network security threats at M levels; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively.

[0111] Step 302: Input the relevant information of the network security threat and the classification results of the M levels of the network security threat into the second model to obtain the security protection scheme for the network security threat output by the second model;

[0112] Step 303: Based on the security protection scheme, perform security protection against the network security threat; wherein,

[0113] The first model and the second model are models trained using the model training methods provided by one or more of the above-mentioned technical solutions.

[0114] Here, it can be understood that the security protection method provided in the embodiments of this application is applied to Figure 1 The security protection system shown can be specifically applied to the decision engine of the system's decision layer, that is, the function of the decision engine can be implemented by the second device.

[0115] In one embodiment, the method may further include:

[0116] Based on the classification results of the M levels, the first model is optimized.

[0117] In one embodiment, the method may further include:

[0118] Based on the aforementioned security protection scheme, the second model is optimized.

[0119] The model training method provided in this application embodiment determines a first training dataset and a second training dataset. Each sample in the first training dataset includes relevant information about network security threats and M levels of classification results for the network security threats. Each sample in the second training dataset includes relevant information about network security threats, M levels of classification results for the network security threats, and a security protection scheme for the network security threats. M is an integer greater than 1. The M-th level classification result is determined based on the (M-1)-th level classification result, and the classification granularity of the M levels of classification results increases progressively. A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine the M levels of classification results for the network security threats based on relevant information about the network security threats, and the second model is used to generate a security protection scheme for the network security threats based on relevant information about the network security threats and the M levels of classification results for the network security threats. The solution provided in this application utilizes a specific dataset (i.e., the first training dataset) to train a first model for determining M levels of classification results for network security threats based on relevant information about network security threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result. The classification granularity of the M levels increases progressively, thereby enabling the first model to improve the accuracy and granularity of network security threat classification, and thus enhance the accuracy of identifying relevant information about network security threats. Furthermore, a second model is trained using another specific dataset (i.e., the second training dataset) to generate security protection schemes for network security threats based on relevant information and the M levels of classification results. This allows the second model to automatically generate security protection schemes, saving the expert involvement required in each threat response process. This significantly improves the security protection system's ability to identify and analyze new and / or complex security threats (or its response capabilities), thereby significantly improving the system's response speed and accuracy, achieving truly intelligent security protection.

[0120] The following section provides a more detailed description of this application with reference to application examples.

[0121] This application example provides a method for security threat identification and protection scheme generation based on security threat classification. Figure 1 The security protection system shown (also known as the autonomous security protection system) has been improved, specifically by enhancing the decision engine at the decision-making level. The improved architecture of the autonomous security protection system is as follows: Figure 4 As shown, the improved decision engine (hereinafter referred to as the intelligent decision engine) deploys an improved security threat classification model (i.e., the first model mentioned above, which can be referred to as the intelligent classification model in the following description) and a protection scheme generation model (i.e., the second model mentioned above). Through the intelligent classification model, network security threats can be accurately located (i.e., classified) based on data such as security alerts (i.e., information related to network security threats). Through the protection scheme generation model, based on data such as security alerts and the refined classification results of the intelligent classification model, combined with AI technology, network security threats can be further analyzed and security protection schemes can be generated for network security threats, thereby achieving accurate and on-demand network security protection.

[0122] The following is combined with Figure 4 Describe the workflow between the modules in the improved security protection system framework of this application example.

[0123] The first stage involves users accessing various scenarios and services within the communication network, where traffic filtering and security assessments are performed. Specifically, when an end user initiates an access request to a communication network service or AI system service through a client, all network traffic entering and leaving the service system must be inspected by various security tools in the resource layer. These security tools can detect abnormal behavior in network traffic, identify malicious or suspected security threat traffic, record it as detailed access logs and monitoring scan results, and report abnormal alarms (i.e., security alarms), attack attempts, and risk model data (i.e., information related to network security threats) in real time to the traditional security tool engine and AI security tool engine in the resource layer. These engines can perform preliminary cleaning, deduplication, and aggregation of relevant traffic data and security information. The processed security data (which can at least contain information related to network security threats) can be reported to the security management engine. The security management engine can simultaneously perform data storage and other operations while transmitting security data to the intelligent decision engine.

[0124] Following this is the centralized analysis and intelligent distribution phase. The intelligent decision engine employs innovative methods to accurately identify cybersecurity threats based on data such as security alerts (i.e., information related to cybersecurity threats) and automatically generate security protection solutions. Specifically, the intelligent decision engine can use an LSTM-Transformer aggregated intelligent classification model (the first model mentioned above) that incorporates gradient boosting classification improvements to perform intelligent classification based on the characteristics of security threat information (i.e., information related to cybersecurity threats). This intelligent classification model can achieve progressively refined classification through a serialized, multi-level classification architecture.

[0125] Specifically, the architecture of this intelligent classification model is as follows: Figure 5As shown, firstly, after receiving information related to cybersecurity threats, a combined LSTM and Transformer network can be used to extract features from both temporal and global perspectives, thereby enhancing the understanding of security threat information. Then, a global pooling layer can be used to aggregate temporal and global features and perform effective feature extraction to obtain the results of the first major category classification (i.e., the major category classification results output by the first classification layer, also known as the first-level classification results mentioned above), such as alarm log information, attack log information, AI model security information, and AI framework security information. Next, a dual classification layer is introduced to perform a two-stage fine-grained classification of feature information from major category classification to sub-category classification. Specifically, the first-stage classification result embedding layer can embed the major category classification results output by the first classification layer (i.e., the first-level classification results mentioned above), and then input the embedded features into the feature merging layer to merge the embedded features and the original features. Specifically, the feature results after the first-stage major category classification (i.e., the major category classification results) can be mapped and labeled and applied to the original features. The security feature information after the first classification and feature merging (i.e., the features output by the feature merging layer) can be used as the input for the second classification. The second classification layer can further refine the feature information after it has been labeled with major categories (i.e., the merged features mentioned above). For example, it can obtain a refined classification result such as "AI model class security information: YOLO model serialization attack feature information, Transformer model component class import hazard source feature information" (i.e., the second-level classification result mentioned above). This enables fine differentiation from major categories to subcategories for different security alarm information, threat attack information, and AI model security and high-risk frameworks, which is beneficial for the targeted analysis and deep security vulnerability mining of subsequent protection scheme generation models. At the same time, this intelligent classification model can also introduce an ensemble learning gradient boosting classifier after feature extraction and secondary classification, thereby ensuring that the multi-layer nested combination network contained in the intelligent classification model has a good learning rate and fitting effect during training, and improving the overall robustness and accuracy of the intelligent classification model.

[0126] In this application example, the information related to cybersecurity threats after fine-grained classification by the aforementioned intelligent classification model (i.e., information related to cybersecurity threats including major categories (i.e., the first-level classification results mentioned above) and subcategories (i.e., the second-level classification results mentioned above) can be sent to the protection scheme generation model (i.e., the second model mentioned above). This model, containing a high-level deep learning large-scale model network, further analyzes attack behaviors and identifies complex intrusion patterns and hidden threat sources. Specifically, the architecture of this protection scheme generation model is as follows: Figure 6As shown, firstly, a high-level deep learning model within the protection scheme generation model (i.e., the first sub-model mentioned above) can learn and extract features from historical data, perform attack behavior analysis and feedback, and identify complex attack patterns that are difficult to detect with conventional rules. It can analyze hidden threat sources to obtain analysis results (such as one or more of the following: attack behavior information, attack / intrusion pattern information, and threat source information), and feed these results back to optimize the classification model parameters. This design improves the accuracy and coverage of threat detection. Next, another high-level deep learning model within the protection scheme generation model (i.e., the second sub-model mentioned above) can generate targeted protection strategy schemes (i.e., security protection schemes) based on the above analysis results. These security protection schemes may include, but are not limited to, rule updates, access control policy adjustments, and emergency response process optimization. These security protection schemes can be synchronously reported back to the security management engine, providing guidance for subsequent policy decision-making, execution, and optimization. Simultaneously, the analysis results of the large model can also be fed back into the classification model, thereby continuously optimizing the classification model parameters, forming a closed loop, and improving the system's intelligence.

[0127] In this application example, following the centralized analysis and intelligent distribution phase comes the policy integration and report compilation phase. Specifically, after receiving the protection policy scheme (i.e., security protection scheme) from the intelligent decision engine, the security management engine can combine it with the current policy configuration (i.e., security policy) of the security protection devices (i.e., related security tools) to generate a comprehensive protection analysis report. This report can include not only a threat overview (i.e., information related to cybersecurity threats) and protection recommendations (i.e., security protection scheme), but also device performance statistics and system health assessments. This report information can then be sent to the intelligent orchestration engine (also known as the security orchestration engine) at the control layer. The security orchestration engine can combine it with the current policies (i.e., security policies) of the security tools to orchestrate and optimize policies, ensuring the feasibility and compatibility of the new policies. Afterward, the orchestration scheme generated by the security orchestration engine can be returned to the security management engine, which can then issue instructions to the security tool engine to carry out security protection according to the orchestration scheme.

[0128] The improved LSTM-Transformer classification model proposed in this application example (i.e., the intelligent classification model mentioned above, also known as the first model) far surpasses traditional networks in terms of recognition accuracy and overall protection capability in security information classification, significantly improving the system's response capability to new and complex security threats. Specifically, this model has the following advantages:

[0129] 1) An improved LSTM-Transformer classification network is adopted, which combines the advantages of LSTM and Transformer models. It extracts temporal features and captures long- and short-term dependencies through LSTM, and then extracts global features through the Transformer encoder layer. This can enhance the understanding of contextual information and thus significantly improve the recognition accuracy of security information classification.

[0130] 2) Compared with the single feature extraction methods of Transformer and other traditional network models, it adopts a serial multi-level classification architecture. By extracting features at multiple levels and serial classification, the results of the first classification are used as input data for the second classification, and the classification is gradually refined. This ensures the accuracy and precision of the classification, which can significantly improve the accuracy and coverage of the classification.

[0131] 3) Gradient boosting, an ensemble learning technique, is introduced into the LSTM-Transformer classification network. By combining gradient boosting classifiers, the accuracy and robustness of the classification results are further improved. Specifically, this ensemble method effectively reduces the error and bias of a single model and effectively avoids the gradient vanishing and gradient explosion problems that are prone to occur during the training of multi-level networks. During training, the gradient can be continuously iterated and optimized to gradually reduce the model's prediction error, so that the trained model can maintain efficient and stable performance when facing complex and ever-changing security threats.

[0132] Furthermore, the protection scheme generation model proposed in this application example (i.e., the second model mentioned above) can call upon its internal advanced deep learning intelligent model to automatically learn and extract complex features from a large amount of historical security threat data. Combined with accurate threat classification, it can identify covert attack patterns that are difficult to detect through manual rules within security threat information, significantly improving the accuracy and coverage of threat detection. Moreover, compared to traditional methods that rely on manual analysis and traditional strategy generation, this protection scheme generation model can not only process massive amounts of data in real time, but also dynamically update and optimize protection strategies (i.e., security protection schemes). Specifically, this includes rule updates, access control policy adjustments, and emergency response process optimization. This automated generation of security protection schemes avoids errors and delays that may occur in manual analysis. In addition, this protection scheme generation model can continuously optimize and adjust the classification model through continuous learning and feedback mechanisms, forming an adaptive closed-loop system. Compared to the traditional neural network model improvement method of manually inputting training data and adjusting parameters, this model optimization is more efficient. As can be seen, this application example, based on the automated threat analysis and policy generation mechanism of deep learning, not only significantly improves response speed and accuracy, but also enhances the system's ability to respond to new and / or complex security threats.

[0133] In summary, the solution provided in this application example introduces advanced gradient boosting technology through a multi-level classification architecture and ensemble learning methods to construct a high-precision identification model for security information classification (i.e., the aforementioned intelligent classification model, also known as the first model). Based on accurate classification, combined with information such as alarm logs, and leveraging the comprehensive analysis capabilities of the large model (i.e., the capabilities of the aforementioned protection scheme generation model, also known as the capabilities of the second model), it achieves accurate identification and confirmation of security threats. Furthermore, based on the existing expert knowledge of the large model, it automatically generates security protection strategy schemes (i.e., security protection schemes), saving the expert involvement in each threat response process and significantly improving the security protection system's ability to identify and analyze new and / or complex security threats, thus achieving truly intelligent security protection.

[0134] To implement the model training method of this application embodiment, this application embodiment also provides a model training apparatus, such as... Figure 7 As shown, the device includes:

[0135] The first processing unit 701 is used to determine a first training dataset and a second training dataset. Each sample in the first training dataset includes relevant information about network security threats and M levels of classification results for the network security threats. Each sample in the second training dataset includes relevant information about network security threats, M levels of classification results for the network security threats, and security protection schemes for the network security threats. M is an integer greater than 1. The M-th level classification result is determined based on the (M-1)-th level classification result, and the classification precision of the M levels of classification results increases progressively.

[0136] The second processing unit 702 is used to train a first model using the first training dataset and to train a second model using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information of the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information of the network security threat and the M levels of classification results for the network security threat.

[0137] In one embodiment, the second model includes a first sub-model and a second sub-model. The first sub-model is used to analyze the relevant information of the network security threat and the classification results of the network security threat at M levels to obtain analysis results. The analysis results include one or more of the following: relevant information of attack behavior, relevant information of attack / intrusion mode, and relevant information of threat source. The second sub-model is used to generate a security protection scheme for the network security threat based on the analysis results.

[0138] Accordingly, the second processing unit 702 is also used to optimize the first model using the analysis results.

[0139] In practical applications, the functions of the first processing unit 701 and the second processing unit 702 can be equivalent to the functions of the intelligent decision engine in the application example described above. Furthermore, the first processing unit 701 and the second processing unit 702 can be implemented by a processor in a model training device.

[0140] It should be noted that the model training device provided in the above embodiments is only illustrated by the division of the above program modules during model training. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules (such as the intelligent decision engine in the above application example) to complete all or part of the processing described above. In addition, the model training device and the model training method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0141] To implement the security protection method of this application embodiment, this application embodiment also provides a security protection device, such as... Figure 8 As shown, the device includes:

[0142] The third processing unit 801 is used to acquire relevant information about network security threats, input the relevant information about network security threats into the first model, and obtain the classification results of the first model for the network security threats at M levels; M is an integer greater than 1, and the M-th level classification result is determined based on the (M-1)-th level classification result, and the classification precision of the M-th level classification results increases progressively.

[0143] The fourth processing unit 802 is used to input the relevant information of the network security threat and the classification results of the network security threat at M levels into the second model to obtain the security protection scheme for the network security threat output by the second model.

[0144] The fifth processing unit 803 is used to perform security protection against the network security threat based on the security protection scheme; wherein,

[0145] The first model and the second model are models trained using the model training methods provided by one or more of the above-mentioned technical solutions.

[0146] In one embodiment, the third processing unit 801 is further configured to optimize the first model based on the classification results of the M levels.

[0147] In one embodiment, the fourth processing unit 802 is further configured to optimize the second model based on the security protection scheme.

[0148] In practical applications, the functions of the third processing unit 801, the fourth processing unit 802, and the fifth processing unit 803 can be equivalent to the functions of the intelligent decision engine in the application example described above. Furthermore, the third processing unit 801, the fourth processing unit 802, and the fifth processing unit 803 can be implemented by a processor in the security protection device.

[0149] It should be noted that the security protection device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules (such as the intelligent decision engine in the above application example) to complete all or part of the processing described above. In addition, the security protection device and the security protection method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0150] Based on the hardware implementation of the above program modules, and in order to implement the model training method of the embodiments of this application, the embodiments of this application also provide a first device, such as... Figure 9 As shown, the first device 900 includes:

[0151] The first communication interface 901 is capable of exchanging information with other electronic devices;

[0152] The first processor 902 is connected to the first communication interface 901 to enable information interaction with other electronic devices and to execute the model training method provided by one or more of the above technical solutions when running a computer program.

[0153] The computer program is stored in the first memory 903.

[0154] Specifically, the first processor 902 is used for:

[0155] A first training dataset and a second training dataset are determined. Each sample in the first training dataset includes relevant information about cybersecurity threats and M levels of classification results for the cybersecurity threats. Each sample in the second training dataset includes relevant information about cybersecurity threats, M levels of classification results for the cybersecurity threats, and security protection schemes for the cybersecurity threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively.

[0156] A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

[0157] In one embodiment, the second model includes a first sub-model and a second sub-model. The first sub-model is used to analyze the relevant information of the network security threat and the classification results of the network security threat at M levels to obtain analysis results. The analysis results include one or more of the following: relevant information of attack behavior, relevant information of attack / intrusion mode, and relevant information of threat source. The second sub-model is used to generate a security protection scheme for the network security threat based on the analysis results.

[0158] Accordingly, the first processor 902 is also used to optimize the first model using the analysis results.

[0159] It should be noted that the specific processing procedure of the first processor 902 can be understood by referring to the above method, and will not be repeated here.

[0160] Of course, in practical applications, the various components in the first device 900 are coupled together via a bus system 904. It can be understood that the bus system 904 is used to implement communication between these components. In addition to a data bus, the bus system 904 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 9 The general designated all buses as Bus System 904.

[0161] The first memory 903 in this embodiment is used to store various types of data to support the operation of the first device 900. Examples of such data include any computer program used to operate on the first device 900.

[0162] The methods disclosed in the above embodiments of this application can be applied to the first processor 902, or implemented by the first processor 902. The first processor 902 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 902. The first processor 902 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 902 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly reflected as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 903. The first processor 902 reads the information in the first memory 903 and completes the steps of the aforementioned method in combination with its hardware.

[0163] In an exemplary embodiment, the first device 900 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0164] Based on the hardware implementation of the above program modules, and in order to implement the security protection method of this application embodiment, this application embodiment also provides a second device, such as... Figure 10 As shown, the second device 1000 includes:

[0165] The second communication interface 1001 is capable of exchanging information with other electronic devices;

[0166] The second processor 1002 is connected to the second communication interface 1001 to enable information interaction with other electronic devices and to execute the security protection methods provided by one or more of the above-mentioned technical solutions when running computer programs.

[0167] The computer program is stored in the second memory 1003.

[0168] Specifically, the second processor 1002 is used for:

[0169] The relevant information of network security threats is obtained, and the relevant information of network security threats is input into a first model to obtain the classification results of the network security threats at M levels output by the first model; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively.

[0170] The relevant information of the network security threat and the classification results of the network security threat at M levels are input into the second model to obtain the security protection scheme for the network security threat output by the second model.

[0171] Based on the aforementioned security protection scheme, security protection is implemented against the aforementioned network security threats; wherein,

[0172] The first model and the second model are models trained using the model training methods provided by one or more of the above-mentioned technical solutions.

[0173] In one embodiment, the second processor 1002 is further configured to optimize the first model based on the classification results of the M levels.

[0174] In one embodiment, the second processor 1002 is further configured to optimize the second model based on the security protection scheme.

[0175] It should be noted that the specific processing procedure of the second processor 1002 can be understood by referring to the above method, and will not be repeated here.

[0176] Of course, in practical applications, the various components in the second device 1000 are coupled together via the bus system 1004. It can be understood that the bus system 1004 is used to implement communication between these components. In addition to a data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 10 The general labeled all buses as Bus System 1004.

[0177] The second memory 1003 in this embodiment is used to store various types of data to support the operation of the second device 1000. Examples of such data include any computer program used to operate on the second device 1000.

[0178] The methods disclosed in the above embodiments of this application can be applied to the second processor 1002, or implemented by the second processor 1002. The second processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the second processor 1002. The second processor 1002 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1002 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the second memory 1003. The second processor 1002 reads the information in the second memory 1003 and completes the steps of the aforementioned method in combination with its hardware.

[0179] In an exemplary embodiment, the second device 1000 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0180] It is understood that the memories (first memory 903, second memory 1003) in the embodiments of this application can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0181] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory 903 storing a computer program, which can be executed by a first processor 902 of a first device 900 to complete the steps of any of the aforementioned model training methods. Another example is a second memory 1003 storing a computer program, which can be executed by a second processor 1002 of a second device 1000 to complete the steps of any of the aforementioned security protection methods. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0182] In an exemplary embodiment, this application also provides a computer program product, including a computer program that can be executed by a first processor 902 of a first device 900 to complete the steps of any of the aforementioned model training methods; or, the computer program can be executed by a second processor 1002 of a second device 1000 to complete the steps of any of the aforementioned security protection methods.

[0183] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0184] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0185] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A model training method, characterized in that, include: A first training dataset and a second training dataset are determined. Each sample in the first training dataset includes relevant information about cybersecurity threats and M levels of classification results for the cybersecurity threats. Each sample in the second training dataset includes relevant information about cybersecurity threats, M levels of classification results for the cybersecurity threats, and security protection schemes for the cybersecurity threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively. A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

2. The method according to claim 1, characterized in that, The first model comprises N feature extraction network layers and M cascaded classification network layers. The N feature extraction network layers are used to extract N dimensions of features of the cybersecurity threat based on relevant information of the cybersecurity threat, where N is an integer greater than 1. The M classification network layers are used to determine M levels of classification results for the cybersecurity threat based on the N dimensions of features of the cybersecurity threat. The classification result output by the Mth classification network layer is determined based on the N dimensions of features of the cybersecurity threat and the classification result output by the (M-1)th classification network layer. The classification precision of the M classification network layers increases progressively.

3. The method according to claim 2, characterized in that, When both M and N are equal to 2, the first model includes: The first feature extraction network layer is used to extract the temporal features of the network security threat; The second feature extraction network layer is used to extract global features of the network security threat; A global pooling layer is used to aggregate the temporal and global features of the network security threat to obtain the original features of the network security threat. The first classification network layer is used to classify the original characteristics of the network security threats to obtain the first-level classification result; An embedding layer is used to embed the first-level classification result into the feature space of the original feature to obtain the first-level classification feature; The merging layer is used to merge the original features and the first-level classification features to obtain merged features; The second classification network layer is used to classify the merged features to obtain the second-level classification result; wherein... The classification precision of the second classification network layer is higher than that of the first classification network layer.

4. The method according to claim 3, characterized in that, The first model also includes: The first input layer is used to input relevant information about the cybersecurity threat; The first output layer is used to output the first-level classification result and the second-level classification result; The ensemble learning layer is used for ensemble learning that combines gradient boosting classifiers.

5. The method according to claim 3, characterized in that, The first feature extraction network layer includes a Long Short-Term Memory (LSTM) network, and / or the second feature extraction network layer includes a Transformer encoder.

6. The method according to claim 1, characterized in that, The second model includes a first sub-model and a second sub-model. The first sub-model is used to analyze the relevant information of the network security threat and the classification results of the network security threat at M levels to obtain analysis results. The analysis results include one or more of the following: relevant information of attack behavior, relevant information of attack / intrusion mode, and relevant information of threat source. The second sub-model is used to generate a security protection scheme for the network security threat based on the analysis results.

7. The method according to claim 6, characterized in that, The second model also includes: The second input layer is used to input relevant information about the network security threat and the classification results of the network security threat at M levels; The second output layer is used to output security protection solutions against the aforementioned network security threats.

8. The method according to claim 6, characterized in that, The method further includes: The first model is optimized using the analysis results.

9. A safety protection method, characterized in that, include: The relevant information of network security threats is obtained, and the relevant information of network security threats is input into a first model to obtain the classification results of the network security threats at M levels output by the first model; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively. The relevant information of the network security threat and the classification results of the network security threat at M levels are input into the second model to obtain the security protection scheme for the network security threat output by the second model. Based on the aforementioned security protection scheme, security protection is implemented against the aforementioned network security threats; wherein, The first model and the second model are models trained using the model training method described in any one of claims 1 to 8.

10. The method according to claim 9, characterized in that, The method further includes: Based on the classification results of the M levels, optimize the first model; And / or, Based on the aforementioned security protection scheme, the second model is optimized.

11. A model training device, characterized in that, include: A first processing unit is configured to determine a first training dataset and a second training dataset. Each sample in the first training dataset includes relevant information about a cybersecurity threat and M levels of classification results for the cybersecurity threat. Each sample in the second training dataset includes relevant information about a cybersecurity threat, M levels of classification results for the cybersecurity threat, and a security protection scheme for the cybersecurity threat. M is an integer greater than 1. The M-th level classification result is determined based on the (M-1)-th level classification result, and the classification granularity of the M levels of classification results increases progressively. The second processing unit is used to train a first model using the first training dataset and a second model using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

12. A safety protection device, characterized in that, include: The third processing unit is used to acquire relevant information about network security threats, input the relevant information about network security threats into the first model, and obtain the classification results of the first model for the network security threats at M levels; M is an integer greater than 1, and the M-th level classification result is determined based on the (M-1)-th level classification result, and the classification precision of the M-th level classification results increases progressively. The fourth processing unit is used to input the relevant information of the network security threat and the classification results of the network security threat at M levels into the second model to obtain the security protection scheme for the network security threat output by the second model. The fifth processing unit is used to perform security protection against the network security threat based on the security protection scheme; wherein, The first model and the second model are models trained using the model training method described in any one of claims 1 to 8.

13. A first device, characterized in that, include: A first communication interface and a first processor; wherein... The first processor is configured to: A first training dataset and a second training dataset are determined. Each sample in the first training dataset includes relevant information about cybersecurity threats and M levels of classification results for the cybersecurity threats. Each sample in the second training dataset includes relevant information about cybersecurity threats, M levels of classification results for the cybersecurity threats, and security protection schemes for the cybersecurity threats. M is an integer greater than 1. The Mth level classification result is determined based on the (M-1)th level classification result, and the classification granularity of the M levels of classification results increases progressively. A first model is trained using the first training dataset, and a second model is trained using the second training dataset. The first model is used to determine M levels of classification results for the network security threat based on relevant information about the network security threat. The second model is used to generate a security protection scheme for the network security threat based on relevant information about the network security threat and the M levels of classification results for the network security threat.

14. A second device, characterized in that, include: The second communication interface and the second processor; wherein... The second processor is used for: The relevant information of network security threats is obtained, and the relevant information of network security threats is input into a first model to obtain the classification results of the network security threats at M levels output by the first model; M is an integer greater than 1, and the classification result at the M level is determined based on the classification result at the (M-1)th level. The classification precision of the classification results at the M levels increases progressively. The relevant information of the network security threat and the classification results of the network security threat at M levels are input into the second model to obtain the security protection scheme for the network security threat output by the second model. Based on the aforementioned security protection scheme, security protection is implemented against the aforementioned network security threats; wherein, The first model and the second model are models trained using the model training method described in any one of claims 1 to 8.

15. A first device, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 8.

16. A second device, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method of claim 9 or 10.

17. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8, or the steps of the method according to claim 9 or 10.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8, or the steps of the method according to claim 9 or 10.

Images