Network printing negative sample generation method based on machine learning and related equipment

Abstract

The invention is suitable for the technical field of information security, and provides a network printing negative sample generation method based on machine learning and related equipment, and the method comprises the steps: obtaining a plurality of real negative samples; the real negative sample is a network data flow capable of triggering the printer to generate abnormity; training the generative adversarial network by using the plurality of real negative samples to obtain a trained generative adversarial network; generating a plurality of negative samples by using a generator of the trained generative adversarial network; and screening out a target negative sample capable of triggering the printer to generate abnormity from the generated multiple negative samples, and taking the target negative sample as the negative sample of the network printing protocol data. A large number of negative samples with diversified structures and functions can be generated.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a network printing negative sample generation method based on machine learning and related equipment. BACKGROUND

[0002] Machine learning or large language model technology has been fully developed in recent years, and its application has been expanded to various industries, especially in software or firmware vulnerability mining. However, we found that in the Internet of Things, a particularly important network node, the printer, lacks AI and machine learning-based vulnerability analysis. The main reason is that the printer system itself is relatively closed, and another important reason is that printer job data containing real exploit codes are very rare, the number of public exploit codes is limited, and the structure is single, which cannot cover the attack vector. Therefore, the printer job language vulnerability analysis based on machine learning has not made much progress.

[0003] In order to alleviate this problem, the printer manufacturer usually uses the following two methods when evaluating product security:

[0004] 1. Extract from the Common Vulnerabilities and Exposures (CVE) database and vendor announcements. This is the most important source of information for obtaining printer job language vulnerability information, but this part of the data is natural language description data, not structured and directly applicable to training, and the number is not enough;

[0005] 2. Use PRET (PRET is a tool designed for printer security testing) and other penetration testing tools for penetration, and use network monitoring to obtain vulnerability attack messages, but the tool cannot generate diversified negative sample data on a large scale, and it can only monitor vulnerability sample data supported by known tools and is relatively single.

[0006] In summary, the printer job language vulnerability analysis based on machine learning has the problem of insufficient negative samples. SUMMARY

[0007] The embodiments of the application provide a network printing negative sample generation method based on machine learning and related equipment, which can solve the problem of insufficient negative samples in printer job language vulnerability analysis based on machine learning.

[0008] In a first aspect, the embodiments of the application provide a network printing negative sample generation method based on machine learning, comprising:

[0009] Obtaining a plurality of real negative samples; the real negative sample is a network data stream that can trigger the printer to occur abnormally;

[0010] The plurality of real negative samples are used to train the generative adversarial network to obtain a trained generative adversarial network.

[0011] The generator of the trained generative adversarial network is used to generate a plurality of negative samples.

[0012] A target negative sample that can trigger an abnormality of the printer is screened from the generated plurality of negative samples, and the target negative sample is used as a negative sample of network printing protocol data.

[0013] Optionally, the plurality of real negative samples are used to train the generative adversarial network to obtain a trained generative adversarial network, comprising:

[0014] A vector representation of each real negative sample is obtained.

[0015] The plurality of real negative samples are used to train the generative adversarial network to obtain a trained generative adversarial network.

[0016] Optionally, the vector representation of each real negative sample is obtained, comprising:

[0017] The following steps are performed for each real negative sample respectively:

[0018] The real negative sample is divided into a plurality of tokens, and the plurality of tokens are used as a token sequence.

[0019] Feature extraction is performed on the token sequence to obtain an N-Gram sequence feature.

[0020] A program dependency graph of the real negative sample is generated based on the N-Gram sequence feature; a plurality of nodes in the program dependency graph correspond one-to-one to a plurality of control instructions contained in the real negative sample; a directed edge in the program dependency graph represents a calling relationship between two control instructions corresponding to the directed edge; and an attribute of each node in the program dependency graph includes an N-Gram sequence feature corresponding to the node.

[0021] The program dependency graph is encoded into a vector representation, and the vector representation is used as the vector representation of the real negative sample.

[0022] Optionally, the negative sample generation method further comprises:

[0023] The following steps are performed for each control instruction of the real negative sample respectively:

[0024] It is determined whether the control instruction contains a preset high-risk instruction and a preset high-risk string.

[0025] According to the determination result, a first indicator for indicating whether the preset high-risk instruction exists and a second indicator for indicating whether the preset high-risk string exists are configured.

[0026] The first indicator and the second indicator are added to attributes of nodes corresponding to the control instructions in the program dependency graph.

[0027] Optionally, the target negative sample triggering the abnormality of the printer is screened from the generated plurality of negative samples, including:

[0028] The negative sample conforming to the syntax of the printer job language in the plurality of negative samples is taken as a candidate negative sample.

[0029] The target negative sample triggering the abnormality of the printer is screened from all the candidate negative samples.

[0030] Optionally, the target negative sample triggering the abnormality of the printer is screened from all the candidate negative samples, including:

[0031] The vector representation of each candidate negative sample is obtained.

[0032] Based on the vector representations of all the candidate negative samples, part of the candidate negative samples in all the candidate negative samples is eliminated.

[0033] Each candidate negative sample remaining after the elimination is transmitted to the printer, and whether the printer has an abnormality is monitored, if the printer has an abnormality, the candidate negative sample is taken as the target negative sample triggering the abnormality of the printer.

[0034] Optionally, based on the vector representations of all the candidate negative samples, part of the candidate negative samples in all the candidate negative samples is eliminated, including:

[0035] Each real negative sample and each candidate negative sample is taken as a comparison negative sample.

[0036] Based on the vector representations of all the candidate negative samples and the vector representation of each real negative sample, the similarity between each two comparison negative samples is calculated.

[0037] If the calculated similarity satisfies a preset sample elimination condition, and one of the two comparison negative samples corresponding to the similarity is a candidate negative sample, the candidate negative sample is eliminated.

[0038] If the calculated similarity satisfies the preset sample elimination condition, and both of the two comparison negative samples corresponding to the similarity are candidate negative samples, any one of the two candidate negative samples is eliminated.

[0039] Optionally, the preset sample elimination condition is that the similarity is greater than a preset similarity threshold.

[0040] In a second aspect, an embodiment of the present application provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the negative sample generation method when executing the computer program.

[0041] In a third aspect, the embodiments of the present application provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the negative sample generation method.

[0042] The above scheme of the present application has the following beneficial effects:

[0043] In the embodiments of the present application, the generative adversarial network is trained by using the real negative samples of the printer, so that the generator of the generative adversarial network can generate a large number of negative samples with diversified structures and functions by learning the inherent syntax and semantic patterns of the real negative samples.

[0044] In addition, the present application filters out the negative samples that cannot successfully trigger vulnerabilities by screening the negative samples generated by the generator, thereby improving the quality of the negative samples.

[0045] Other beneficial effects of the present application will be described in detail in the subsequent specific embodiments section. DETAILED DESCRIPTION

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0047] Figure 1 A flowchart of a network printing negative sample generation method based on machine learning provided by an embodiment of the present application;

[0048] Figure 2 A structural schematic diagram of a terminal device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0049] In the following description, specific details such as specific system structures, techniques, etc. are presented in order to thoroughly understand the embodiments of the present application. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits and methods are omitted to avoid unnecessary details that hinder the description of the present application.

[0050] It should be understood that when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or sets thereof.

[0051] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items, and that the term "at least one of' as used herein means "one, two, three, four, or more" and that the term "one or more of as used herein means "at least one, two, three, four, or more."

[0052] As used in the description of the application and the appended claims, the term "if' can be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted to mean "upon determining" or "in response to determining" or "upon [the described condition or event] being detected" or "in response to [the described condition or event] being detected," depending on the context.

[0053] In addition, the terms "first", "second", "third", etc. as used in the description of embodiments herein are used only to differentiate descriptions, and cannot be understood as indicating or implying relative importance.

[0054] Reference to "one embodiment" or "some embodiments" or "one implementation" or "some implementations" etc. in the present description means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Thus, the appearance of the phrases "in one embodiment", "in some embodiments", "in other embodiments", "in additional embodiments", etc. in various places in the specification are not necessarily all referring to the same embodiment, unless otherwise specifically stated. The terms "comprising", "including", "having" and their variants are meant to be construed as "including but not limited to", unless otherwise specifically stated.

[0055] In view of the problem of insufficient negative samples in current machine learning-based printer job language vulnerability analysis, the embodiments of the present application provide a network printing negative sample generation method based on machine learning. The method trains a generative adversarial network by using real negative samples of a printer, so that the generator of the generative adversarial network can generate a large number of negative samples with diversified structures and functions by learning the inherent syntax and semantic patterns of the real negative samples.

[0056] In addition, the present application filters out negative samples that cannot successfully trigger vulnerabilities by screening the negative samples generated by the generator, thereby improving the quality of the negative samples.

[0057] The network printing negative sample generation method based on machine learning provided by the present application will be described below in conjunction with specific embodiments.

[0058] As Figure 1As shown, the network printing negative sample generation method based on machine learning provided by the embodiment of the application includes the following steps:

[0059] Step 11, obtaining a plurality of real negative samples, the real negative sample being a network data stream capable of triggering the printer to occur an abnormality.

[0060] In some embodiments of the application, the above-mentioned real negative sample can be a published vulnerability data, and specifically, the published vulnerability data can be obtained from a database (such as NVD, a database for storing and publishing CVE vulnerability information), a printer manufacturer, etc.

[0061] In some embodiments of the application, the PRET tool can be used to attack the printer vulnerability, and the network monitoring tool can be used to monitor the attack printer job language traffic (i.e. the network data stream of the attack printer). In order to improve the training effect, after obtaining the real negative sample, the real negative sample needs to be cleaned. Specifically, irrelevant network protocol headers (such as Transmission Control Protocol (TCP), Internet Protocol (IP)) can be removed, and only protocol data (including document description language, IPP protocol, PJL protocol) can be retained; then a formatted document is constructed, and the label CWE vulnerability type is refined, such as indicating the vulnerability name, vulnerability number, vulnerability type and other information.

[0062] Step 12, training the generative adversarial network by using the plurality of real negative samples to obtain the trained generative adversarial network.

[0063] In some embodiments of the application, the vector representation of each real negative sample can be obtained first, and then the vector representation of the plurality of real negative samples is used to train the generative adversarial network to obtain the trained generative adversarial network.

[0064] Wherein, the specific implementation of obtaining the vector representation of each real negative sample is: for each real negative sample, the following steps 12.1 to 12.4 are performed:

[0065] Step 12.1, dividing the real negative sample into a plurality of tokens, and taking the plurality of tokens as a token sequence.

[0066] In some embodiments of the application, the real negative sample is a network data stream capable of triggering the printer to occur an abnormality, and the form of the network data stream can be a streaming protocol data, such as streaming Printer Job Language (PJL, Printer Job Language) data.

[0067] For real negative samples, the method analyzer can be used to analyze the real negative samples, and the real negative samples are divided into semantic fragments according to the PJL grammar; then each semantic fragment is divided into a token, and the tokens are arranged into a token sequence. For example, the statement "Hello CDX" is divided into a token because it is a complete string displayed in the statement.

[0068] Step 12.2, feature extraction is performed on the token sequence to obtain N-Gram sequence features.

[0069] In the related art, the N-Gram algorithm is an algorithm based on a statistical language model, which generates a continuous byte fragment sequence through a sliding window. The N-Gram algorithm is mainly used to extract text features. The core idea is to divide the text into sliding windows with a length of N bytes, count the frequency of each fragment, and form a key feature list as a vector feature space of the text.

[0070] Based on this, the embodiments of the present application can use the N-Gram algorithm to extract features from the token sequence to obtain N-Gram sequence features.

[0071] Step 12.3, generating a program dependence graph of the real negative sample based on the N-Gram sequence features; the plurality of nodes in the program dependence graph correspond one-to-one to the plurality of control instructions contained in the real negative sample, the directed edges in the program dependence graph represent the calling relationship between the two control instructions corresponding to the directed edges, and the attributes of each node in the program dependence graph include the N-Gram sequence features corresponding to the node.

[0072] It can be understood that, since the printer job language is streamed, the above-mentioned real negative sample includes a plurality of control instructions, and when the specific transmission is performed, some control instructions have corresponding page description fragments after them, and some control instructions do not have corresponding page description fragments after them. It should be noted that the above-mentioned N-Gram sequence features extracted include N-Gram sequence features corresponding to each control instruction, and also include N-Gram sequence features corresponding to each page description fragment.

[0073] In some embodiments of the present application, in order to facilitate feature extraction, the N-Gram sequence features can be converted into a list form based on a graph to obtain graph data corresponding to the N-Gram sequence features, so as to extract related features by using a graph feature extractor.

[0074] Before generating the program dependence graph, the data structure of the program dependence graph can be defined first, for example, the node in the program dependence graph represents a control instruction, the directed edge represents the calling relationship between the control instructions, and the attributes of the node include the corresponding N-Gram sequence features. Then, the corresponding features are extracted from the graph data by using the graph feature extractor, and the program dependence graph is generated based on the defined data structure and the extracted features by using the traditional program dependence graph generation method.

[0075] To enrich the information in the program dependence graph and improve the effect of subsequent training, for each node in the program dependence graph, the negative sample generation method provided in the embodiments of the present application further includes the following steps of supplementing information to the program dependence graph:

[0076] For each control instruction of the real negative sample, the following steps are performed: judging whether the control instruction exists a preset high-risk instruction and a preset high-risk string; according to the judgment result, configuring a first indicator for indicating whether the preset high-risk instruction exists, and a second indicator for indicating whether the preset high-risk string exists; adding the first indicator and the second indicator to the attributes of the node corresponding to the control instruction in the program dependence graph.

[0077] The above-mentioned preset high-risk instructions include read-write, modification, deletion and the like. These preset high-risk instructions are expert judgments given based on experience, including file read-write, system environment variable setting and the like. The above-mentioned preset high-risk strings are also expert judgments given based on experience, including directory traversal, password reading and the like.

[0078] It can be understood that if the control instruction exists the preset high-risk instruction, the first indicator is configured to indicate that the preset high-risk instruction exists, and if the control instruction does not exist the preset high-risk instruction, the first indicator is configured to indicate that the preset high-risk instruction does not exist; if the control instruction exists the preset high-risk string, the second indicator is configured to indicate that the preset high-risk string exists, and if the control instruction does not exist the preset high-risk string, the second indicator is configured to indicate that the preset high-risk string does not exist.

[0079] Step 12.4, encoding the program dependence graph into a vector representation, and taking the vector representation as the vector representation of the real negative sample.

[0080] In some embodiments of the present application, the graph neural network can be used to encode the program dependence graph into a vector representation.

[0081] After obtaining the vector representation of all real negative samples, the generated adversarial network can be trained using the same. The generated adversarial network consists of a generator and a discriminator. In this application, the generator decodes a randomly generated random vector step by step to generate a token sequence of the printer job language (which can be understood as a negative sample) through a neural network model. The neural network model can be a recurrent neural network or a Transformer model. The neural network model also needs to input a conditional vector to the neural network model before generating the negative sample. The conditional vector is used to represent the generated vulnerability type. The discriminator is used to distinguish the negative sample generated by the generator and output a value between 0 and 1, representing the probability that it is a real vulnerability sample. The closer to 1, the more the generated content is close to the real vulnerability sample (i.e. the real negative sample).

[0082] Like the traditional training method of the generated adversarial network, the vector representation of all real negative samples is used as training data to train the generated adversarial network as follows:

[0083] Step one, discriminator training, generator randomly generates and optimizes, the generated adversarial network generates a false sample and a real negative sample as training data to train the discriminator.

[0084] Step two, generator training, the discriminator is fixed and not optimized, the generator generates a sample and inputs it into the discriminator, and the output of the discriminator is used as a loss to update the parameters in the reverse direction, so that it meets the requirements of the discriminator.

[0085] The discriminator and the generator are trained alternately. First, the discriminator is trained to identify true and false samples. After stabilization, the generator is trained to generate negative samples according to the training of the discriminator, and the discriminator is trained again.

[0086] Step three, repeat steps one and two for N rounds until the loss function tends to be stable, end the training, and obtain the trained generated adversarial network.

[0087] Step 13, use the generator of the trained generated adversarial network to generate multiple negative samples.

[0088] It should be noted that after the generated adversarial network is trained, the generator has the ability to generate token sequences of the printer job language (which can be understood as a negative sample), so a large number of negative samples with various structures and functions can be generated using the generator.

[0089] Step 14, select a target negative sample from the generated multiple negative samples that can trigger an abnormality of the printer, and use the target negative sample as a negative sample of the network printing protocol data.

[0090] In some embodiments of the present application, the specific implementation of screening the target negative sample capable of triggering the printer to occur an abnormality from the generated plurality of negative samples includes the following steps:

[0091] Step 14.1, taking the negative samples in the plurality of negative samples that conform to the syntax of the printer job language as candidate negative samples.

[0092] Specifically, the syntax of the negative sample generated by the generator can be detected by using a syntax parser to exclude samples that do not conform to the syntax of the printer job language (for example, the syntax of PJL).

[0093] Step 14.2, screening the target negative sample capable of triggering the printer to occur an abnormality from all candidate negative samples.

[0094] In some embodiments of the present application, the target negative sample capable of triggering the printer to occur an abnormality can be screened from all candidate negative samples by the following steps 14.21 to 14.23:

[0095] Step 14.21, obtaining the vector representation of each candidate negative sample.

[0096] It should be noted that the manner of obtaining the vector representation of the candidate negative sample is the same as the manner of obtaining the vector representation of the real negative sample described above, and therefore, the manner of obtaining the vector representation of the candidate negative sample is not described here.

[0097] Step 14.22, based on the vector representation of all candidate negative samples, eliminating part of the candidate negative samples in all candidate negative samples.

[0098] Specifically, each real negative sample and each candidate negative sample can be taken as a pair of comparison negative samples; then based on the vector representation of all candidate negative samples and the vector representation of each real negative sample, the similarity between each two pair of comparison negative samples is calculated; if the calculated similarity satisfies the preset sample elimination condition, and there is a candidate negative sample in the two pair of comparison negative samples corresponding to the similarity, the candidate negative sample is eliminated; if the calculated similarity satisfies the preset sample elimination condition, and both of the two pair of comparison negative samples corresponding to the similarity are candidate negative samples, any one of the two candidate negative samples corresponding to the similarity is eliminated.

[0099] The above-mentioned preset sample elimination condition is that the similarity is greater than a preset similarity threshold. That is, in some embodiments of the present application, if the similarity between two pair of comparison negative samples is greater than a preset similarity threshold (such as 0.95), it is considered that the two pair of comparison negative samples are highly similar, at this time, if the two pair of comparison negative samples include a real negative sample and a candidate negative sample, the candidate negative sample is eliminated, and if the two pair of comparison negative samples are both candidate negative samples, any one of the two candidate negative samples is eliminated.

[0100] When calculating the similarity between two negative samples based on their vector representations, the cosine similarity of the vector representations of the two negative samples can be calculated and used as the similarity between the two negative samples.

[0101] Step 14.23: For each candidate negative sample remaining after elimination, transmit the candidate negative sample to the printer and monitor whether the printer malfunctions. If an malfunction occurs, use the candidate negative sample as the target negative sample that can trigger the printer malfunction.

[0102] In some embodiments of this application, for the remaining candidate negative samples, a dynamic verification script can be written using Scapy to verify the generated data one by one (i.e., transmit the dynamic verification script to the printer) and observe whether it causes the expected vulnerability (i.e., anomaly). If the expected vulnerability is caused, the corresponding candidate negative sample is used as the target negative sample.

[0103] In summary, the negative sample generation method of this application trains a generative adversarial network (GAN) using real negative samples from printers. This allows the GAN's generator to learn the inherent grammatical and semantic patterns of real negative samples, enabling it to generate a large number of negative samples with diverse structures and functions. Furthermore, by filtering the negative samples generated by the generator and removing those that cannot successfully exploit vulnerabilities, the quality of the negative samples is improved.

[0104] The relevant devices provided in this application will be described by way of example below with reference to specific embodiments.

[0105] like Figure 2 As shown, an embodiment of this application provides a terminal device, wherein the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 2 The diagram shows only one processor, a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 executes the computer program D102 to implement the steps in any of the above method embodiments.

[0106] Specifically, when the processor D100 executes the computer program D102, it trains the generative adversarial network using real negative samples from the printer, enabling the generator of the generative adversarial network to generate a large number of negative samples with diverse structures and functions by learning the inherent grammatical and semantic patterns of real negative samples.

[0107] The processor D100 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0108] The memory D101 can be an internal storage unit of the terminal device D10 in some embodiments, for example, a hard disk or a memory of the terminal device D10. The memory D101 can also be an external storage device of the terminal device D10 in other embodiments, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory D101 can include both the internal storage unit and the external storage device of the terminal device D10. The memory D101 is used to store an operating system, application programs, a boot loader, data, and other programs, for example, program codes of the computer programs, etc. The memory D101 can also be used to temporarily store data that has been output or is to be output.

[0109] It should be noted that the information interaction and execution process between the above apparatuses / units are based on the same concept as the method embodiments of the present application, and the specific functions and the technical effects brought by the same can be referred to the method embodiments part, which will not be described herein.

[0110] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or software functional unit. In addition, the specific name of each functional unit and module is only for easy distinction, and does not limit the protection scope of the application. The specific working process of the unit and module in the above system can refer to the corresponding process in the foregoing method embodiment, which will not be described here.

[0111] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps in each method embodiment.

[0112] The embodiment of the application provides a computer program product, when the computer program product is run on a terminal device, so that the terminal device executes to realize the steps in each method embodiment.

[0113] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the embodiment of the application realizes all or part of the processes in the above method, which can be completed by a computer program to instruct related hardware, and the computer program can be stored in a computer readable storage medium. The computer program is executed by a processor to realize the steps in each method embodiment. The computer program includes computer program code, which can be in the form of source code, object code, executable file or some intermediate form, etc. The computer readable medium at least includes any entity or device capable of carrying the computer program code to the terminal device, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium. For example, U disk, mobile hard disk, magnetic disk or optical disk, etc. In some jurisdictions, according to legislation and patent practice, the computer readable medium cannot be an electrical carrier signal and a telecommunication signal.

[0114] In the above embodiments, the description of each embodiment focuses on different aspects, and the parts not described or recorded in a certain embodiment can be referred to the relevant description of other embodiments.

[0115] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solutions. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0116] In the embodiments provided in the present application, it should be understood that the disclosed apparatus / network device and method can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely schematic, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0117] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0118] The above described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for generating a network printing negative sample based on machine learning, characterized in that, The method comprises the following steps: obtaining a plurality of real negative samples; the real negative samples are network data streams that can trigger the printer to occur abnormity; training the generative adversarial network using the plurality of real negative samples to obtain a trained generative adversarial network; generating a plurality of negative samples using the generator of the trained generative adversarial network; screening target negative samples that can trigger the printer to occur abnormity from the generated plurality of negative samples, and taking the target negative samples as negative samples of network printing protocol data.

2. The negative sample generation method according to claim 1, wherein, The method comprises the following steps: obtaining a vector representation of each real negative sample; training the generative adversarial network using the vector representations of the plurality of real negative samples to obtain a trained generative adversarial network.

3. The negative sample generation method according to claim 2, wherein The method comprises the following steps: respectively for each real negative sample, the following steps are performed: segmenting the real negative sample into a plurality of tokens, and taking the plurality of tokens as a token sequence; performing feature extraction on the token sequence to obtain N-Gram sequence features; generating a program dependency graph of the real negative sample based on the N-Gram sequence features; the plurality of nodes in the program dependency graph correspond one-to-one to a plurality of control instructions contained in the real negative sample, the directed edges in the program dependency graph represent the calling relationship between the two control instructions corresponding to the directed edges, and the attributes of each node in the program dependency graph include the N-Gram sequence features corresponding to the node; encoding the program dependency graph into a vector representation, and taking the vector representation as the vector representation of the real negative sample.

4. The negative sample generation method according to claim 3, wherein The method further comprises the following steps: respectively for each control instruction of the real negative sample, the following steps are performed: determining whether the control instruction contains a preset high-risk instruction and a preset high-risk string; configuring a first indicator for indicating whether the preset high-risk instruction exists and a second indicator for indicating whether the preset high-risk string exists according to the determination result; adding the first indicator and the second indicator to the attributes of the node corresponding to the control instruction in the program dependency graph.

5. The negative sample generation method of claim 1, wherein, The method further comprises the following steps: selecting negative samples that conform to the syntax of the printer job language from the plurality of negative samples as candidate negative samples; screening target negative samples that can trigger the printer to occur abnormity from all candidate negative samples.

6. The negative sample generation method according to claim 5, wherein The method further comprises the following steps: obtaining a vector representation of each candidate negative sample; based on the vector representations of all candidate negative samples, removing part of the candidate negative samples in all candidate negative samples; respectively for each candidate negative sample remaining after removal, transmitting the candidate negative sample to the printer and monitoring whether the printer occurs abnormity, if the printer occurs abnormity, taking the candidate negative sample as the target negative sample that can trigger the printer to occur abnormity.

7. The negative sample generation method according to claim 6, wherein The vector representation of all candidate negative samples is based on the vector representation of all candidate negative samples, and the vector representation of each real negative sample. Each of the real negative samples and each of the candidate negative samples is taken as a comparison negative sample. The similarity between each two comparison negative samples is calculated based on the vector representation of all candidate negative samples and the vector representation of each real negative sample. If the calculated similarity satisfies a preset sample elimination condition, and one of the two comparison negative samples corresponding to the similarity is a candidate negative sample, the candidate negative sample is eliminated. If the calculated similarity satisfies a preset sample elimination condition, and both of the two comparison negative samples corresponding to the similarity are candidate negative samples, either of the two candidate negative samples corresponding to the similarity is eliminated.

8. The negative sample generation method of claim 7, wherein, The preset sample elimination condition is that the similarity is greater than a preset similarity threshold.

9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the negative sample generation method of any one of claims 1-8.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to implement the negative sample generation method of any one of claims 1-8.

Images