A network printing negative sample generation method based on machine learning and related equipment

Abstract

The application is suitable for the field of information security technology, and provides a network printing negative sample generation method based on machine learning and related equipment. The method comprises the following steps: obtaining a plurality of real negative samples; the real negative sample is a network data flow capable of triggering an abnormality of a printer; training a generative adversarial network by using the plurality of real negative samples to obtain a trained generative adversarial network; generating a plurality of negative samples by using a generator of the trained generative adversarial network; screening a target negative sample capable of triggering an abnormality of the printer from the generated plurality of negative samples, and taking the target negative sample as a negative sample of network printing protocol data. The application can generate a large number of negative samples with diversified structures and functions.

Description

Technical Field

[0001] This application belongs to the field of information security technology, and in particular relates to a method and related equipment for generating negative samples for network printing based on machine learning. Background Technology

[0002] Machine learning and large language modeling technologies have seen significant development in recent years, with applications expanding across various industries, particularly in software and firmware vulnerability discovery. However, we have observed a striking lack of AI and machine learning-based vulnerability analysis for printers, a crucial network node in the Internet of Things (IoT). This is primarily due to the relatively closed nature of printer systems and the scarcity of print job data containing actual exploit code. The number of publicly available exploit codes is limited, and their structure is often simplistic, failing to cover all attack vectors. Consequently, machine learning-based vulnerability analysis of printer job languages ​​has been slow to progress.

[0003] To mitigate this issue, printer manufacturers typically use the following two methods when assessing product safety:

[0004] 1. Extracting data from the Common Vulnerability Disclosure (CVE) database and vendor announcements is the most important source of information for obtaining printer job language vulnerability information. However, this data is natural language description data, which is not structured and can be directly used for training, and the amount is not large enough.

[0005] 2. Use penetration testing tools such as PRET (PRET is a tool designed specifically for printer security testing) to perform penetration testing and obtain vulnerability attack packets by listening to the network. However, this tool cannot generate diverse negative sample data on a large scale. It can only listen to vulnerability sample data supported by known tools, and the data is relatively homogeneous.

[0006] In summary, machine learning-based printer job language vulnerability analysis suffers from insufficient negative samples. Summary of the Invention

[0007] This application provides a machine learning-based method and related equipment for generating negative samples for web printing, which can solve the problem of insufficient negative samples in machine learning-based printer job language vulnerability analysis.

[0008] In a first aspect, embodiments of this application provide a machine learning-based method for generating negative samples via network printing, including:

[0009] Acquire multiple real negative samples; real negative samples are network data streams that can trigger printer malfunctions.

[0010] The generative adversarial network is trained using multiple real negative samples to obtain the trained generative adversarial network.

[0011] The generator of the trained generative adversarial network generates multiple negative samples.

[0012] From the generated negative samples, select the target negative sample that can trigger printer malfunctions, and use the target negative sample as the negative sample for network printing protocol data.

[0013] Optionally, the generative adversarial network can be trained using multiple real negative samples to obtain a trained generative adversarial network, including:

[0014] Obtain the vector representation of each true negative sample;

[0015] The generative adversarial network is trained using the vector representations of multiple real negative samples to obtain the trained generative adversarial network.

[0016] Optionally, obtain the vector representation of each true negative sample, including:

[0017] For each true negative sample, perform the following steps:

[0018] The real negative sample is divided into multiple tokens, and the multiple tokens are used as a token sequence;

[0019] Feature extraction is performed on the token sequence to obtain N-Gram sequence features;

[0020] A program dependency graph for generating real negative samples based on N-Gram sequence features is generated. Multiple nodes in the program dependency graph correspond one-to-one with multiple control instructions contained in the real negative sample. The directed edges in the program dependency graph represent the calling relationship between the two control instructions corresponding to the directed edge. The attributes of each node in the program dependency graph include the N-Gram sequence features corresponding to that node.

[0021] The program dependency graph is encoded into a vector representation, and this vector representation is used as the vector representation of the true negative samples.

[0022] Alternatively, negative sample generation methods also include:

[0023] For each control instruction given a real negative sample, perform the following steps:

[0024] Determine whether the control commands contain preset high-risk commands and preset high-risk strings;

[0025] Based on the judgment result, configure a first indicator to indicate whether there is a preset high-risk instruction, and a second indicator to indicate whether there is a preset high-risk string;

[0026] Add the first and second indicator to the properties of the nodes corresponding to the control instructions in the program dependency graph.

[0027] Optionally, target negative samples that can trigger printer malfunctions can be selected from the generated negative samples, including:

[0028] Negative samples that conform to the syntax of the printer job language among multiple negative samples are selected as candidate negative samples.

[0029] Select the target negative sample that can trigger printer malfunction from all candidate negative samples.

[0030] Optionally, select target negative samples from all candidate negative samples that can trigger printer malfunctions, including:

[0031] Obtain the vector representation of each candidate negative sample;

[0032] Based on the vector representation of all candidate negative samples, some candidate negative samples are eliminated from all candidate negative samples;

[0033] For each candidate negative sample remaining after elimination, the candidate negative sample is transmitted to the printer, and the printer is monitored for any abnormalities. If an abnormality occurs, the candidate negative sample is used as the target negative sample that can trigger an abnormality in the printer.

[0034] Optionally, based on the vector representations of all candidate negative samples, a portion of the candidate negative samples are removed, including:

[0035] Each real negative sample and each candidate negative sample are treated as a comparison negative sample;

[0036] Based on the vector representations of all candidate negative samples and the vector representation of each real negative sample, the similarity between every two paired negative samples is calculated.

[0037] If the calculated similarity satisfies the preset sample removal condition, and there is a candidate negative sample among the two negative samples corresponding to the similarity, then the candidate negative sample is removed.

[0038] If the calculated similarity satisfies the preset sample removal conditions, and both of the two negative samples corresponding to the similarity are candidate negative samples, then either of the two candidate negative samples corresponding to the similarity will be removed.

[0039] Optionally, the preset sample removal condition is that the similarity is greater than a preset similarity threshold.

[0040] Secondly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned negative sample generation method.

[0041] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned negative sample generation method.

[0042] The above-mentioned solution in this application has the following beneficial effects:

[0043] In the embodiments of this application, the generative adversarial network is trained using real negative samples from printers, enabling the generator of the generative adversarial network to generate a large number of negative samples with diverse structures and functions by learning the inherent grammatical and semantic patterns of real negative samples.

[0044] Furthermore, this application improves the quality of negative samples by screening the negative samples generated by the generator and removing those that cannot successfully trigger vulnerabilities.

[0045] Other beneficial effects of this application will be described in detail in the following detailed description section. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a machine learning-based network negative sample generation method is provided in one embodiment of this application.

[0048] Figure 2 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Detailed Implementation

[0049] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0050] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0051] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0052] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0053] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0054] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0055] To address the problem of insufficient negative samples in current machine learning-based printer job language vulnerability analysis, this application provides a machine learning-based network printing negative sample generation method. This method trains a generative adversarial network (GAN) using real negative samples from printers, enabling the GAN's generator to learn the inherent grammatical and semantic patterns of real negative samples and generate a large number of negative samples with diverse structures and functions.

[0056] Furthermore, this application improves the quality of negative samples by screening the negative samples generated by the generator and removing those that cannot successfully trigger vulnerabilities.

[0057] The following describes, with reference to specific embodiments, an exemplary method for generating negative samples for printing networks based on machine learning provided in this application.

[0058] like Figure 1As shown in the embodiments of this application, a method for generating negative samples for printing networks based on machine learning includes the following steps:

[0059] Step 11: Obtain multiple real negative samples. Real negative samples are network data streams that can trigger printer malfunctions.

[0060] In some embodiments of this application, the aforementioned real negative samples can be published vulnerability data, specifically obtained from databases (such as NVD, a database used to store and publish CVE vulnerability information), printer manufacturers, etc.

[0061] In other embodiments of this application, the PRET tool can be used to attack printer vulnerabilities, and a network monitoring tool can be used to monitor the attack printer job language traffic (i.e., the network data stream attacking the printer). To improve training effectiveness, after obtaining real negative samples, data cleaning of the real negative samples is required. Specifically, irrelevant network protocol headers (such as Transmission Control Protocol (TCP) and Internet Protocol (IP)) can be removed first, retaining only the protocol data (including Documentation Language, IPP protocol, and PJL protocol); then, a formatted document can be constructed, and the CWE vulnerability type can be refined by labeling it, such as indicating the vulnerability name, vulnerability number, vulnerability type, etc.

[0062] Step 12: Train the generative adversarial network using multiple real negative samples to obtain the trained generative adversarial network.

[0063] In some embodiments of this application, the vector representation of each real negative sample can be obtained first, and then the generative adversarial network can be trained using the vector representations of multiple real negative samples to obtain the trained generative adversarial network.

[0064] The specific implementation method for obtaining the vector representation of each true negative sample is as follows: For each true negative sample, perform the following steps 12.1 to 12.4:

[0065] Step 12.1: Divide the real negative sample into multiple tokens and use the multiple tokens as a token sequence.

[0066] In some embodiments of this application, the real negative sample is a network data stream that can trigger printer malfunctions. The network data stream can be in the form of streaming protocol data, such as streaming Printer Job Language (PJL) data.

[0067] For real negative samples, this parser can be used to perform lexical analysis, segmenting them into semantic segments according to PJL syntax; then, each semantic segment is divided into tokens, and these tokens are organized into a token sequence. For example, the statement "Hello CDX" is a complete string displayed in the statement, so it is divided into one token.

[0068] Step 12.2: Extract features from the token sequence to obtain N-Gram sequence features.

[0069] In related technologies, the N-Gram algorithm is a statistical language model-based algorithm that generates a continuous sequence of byte segments through a sliding window. The N-Gram algorithm is mainly used to extract text features. Its core idea is to segment the text into a sliding window of length N bytes, count the frequency of each segment, and form a list of key features as the vector feature space of the text.

[0070] Based on this, the embodiments of this application can use the N-Gram algorithm to extract features from the token sequence to obtain N-Gram sequence features.

[0071] Step 12.3: Generate a program dependency graph of the real negative sample based on the N-Gram sequence features; multiple nodes in the program dependency graph correspond one-to-one with multiple control instructions contained in the real negative sample, and the directed edges in the program dependency graph represent the calling relationship between the two control instructions corresponding to the directed edge. The attributes of each node in the program dependency graph include the N-Gram sequence features corresponding to that node.

[0072] Understandably, since the printer job language is transmitted in a streaming manner, the true negative samples in the above steps include multiple control commands. Furthermore, during transmission, some control commands are followed by corresponding page description fragments, while others are not. It should be noted that the extracted N-Gram sequence features include both the N-Gram sequence features corresponding to each control command and the N-Gram sequence features corresponding to each page description fragment.

[0073] In some embodiments of this application, to facilitate feature extraction, the N-Gram sequence features can be first converted into a graph-based list format to obtain the graph data corresponding to the N-Gram sequence features, so that the relevant features can be extracted using a graph feature extractor.

[0074] Before generating the program dependency graph, the data structure of the program dependency graph can be defined first. For example, nodes in the program dependency graph represent control instructions, directed edges represent the calling relationship between control instructions, and the attributes of the nodes include the corresponding N-Gram sequence features. Then, a graph feature extractor is used to extract the corresponding features from the graph data, and the program dependency graph is generated based on the defined data structure and the extracted features using traditional program dependency graph generation methods.

[0075] To enrich the information in the program dependency graph and improve the performance of subsequent training, the negative sample generation method provided in this application further includes the following steps for supplementing information in the program dependency graph for each node in the program dependency graph:

[0076] For each control instruction of a real negative sample, perform the following steps: determine whether the control instruction has a preset high-risk instruction and a preset high-risk string; based on the determination result, configure a first indicator to indicate whether a preset high-risk instruction exists, and a second indicator to indicate whether a preset high-risk string exists; add the first and second indicators to the attributes of the node corresponding to the control instruction in the program dependency graph.

[0077] The aforementioned preset high-risk commands include read, write, modify, and delete commands. These preset high-risk commands are based on expert judgment and experience, and include file read / write operations and system environment variable settings. Similarly, the aforementioned preset high-risk strings are also based on expert judgment and experience, and include directory traversal and password reading.

[0078] It is understandable that if a control command has a preset high-risk command, the first indicator will be configured to indicate the presence of the preset high-risk command; if the control command does not have a preset high-risk command, the first indicator will be configured to indicate the absence of the preset high-risk command. If a control command has a preset high-risk string, the second indicator will be configured to indicate the presence of the preset high-risk string; if the control command does not have a preset high-risk string, the second indicator will be configured to indicate the absence of the preset high-risk string.

[0079] Step 12.4: Encode the program dependency graph into a vector representation, and use the vector representation as the vector representation of the real negative sample.

[0080] In some embodiments of this application, graph neural networks can be used to encode program dependency graphs into vector representations.

[0081] After obtaining the vector representations of all real negative samples, they can be used to train a generative adversarial network (GAN). The GAN consists of a generator and a discriminator. In this application, the generator decodes randomly generated vectors step-by-step using a neural network model to generate a sequence of tokens for a printer job (which can be understood as a negative sample). The neural network model can be a recurrent neural network or a Transformer model. Before generating a negative sample, the neural network model needs to be fed a conditional vector, which represents the type of vulnerability generated. The discriminator is used to judge the negative samples generated by the generator and outputs a value between 0 and 1, representing the probability that it is a real vulnerability sample. The closer the value is to 1, the closer the generated content is to a real vulnerability sample (i.e., a real negative sample).

[0082] Similar to the training method of traditional generative adversarial networks, this application uses the vector representations of all real negative samples as training data to train the generative adversarial network. The training process is as follows:

[0083] Step 1: Discriminator training. The generator randomly generates samples without optimization. The randomly generated fake samples and real negative samples are used as training data to train the discriminator.

[0084] Step 2: Generator training. The discriminator is fixed and not optimized. The generator generates samples and feeds them into the discriminator. The output of the discriminator is used as the loss for backpropagation to update the parameters, making them more in line with the discriminator's requirements.

[0085] The discriminator and generator are trained alternately. First, the discriminator is trained to distinguish between real and fake samples. After it stabilizes, the generator is trained to generate negative samples based on the training results of the discriminator, which are then used to train the discriminator again.

[0086] Step 3: Repeat Step 1 and Step 2 N times until the loss function tends to stabilize, then end the training and obtain the trained generative adversarial network.

[0087] Step 13: Use the generator of the trained generative adversarial network to generate multiple negative samples.

[0088] It should be noted that after training, the generator of a generative adversarial network has the ability to generate token sequences of printer job language (which can be understood as a negative sample). Therefore, the generator can be used to generate a large number of negative samples with diverse structures and functions.

[0089] Step 14: Select the target negative sample that can trigger printer malfunction from the multiple generated negative samples, and use the target negative sample as the negative sample of network printing protocol data.

[0090] In some embodiments of this application, the specific implementation of filtering out target negative samples that can trigger printer malfunctions from multiple generated negative samples includes the following steps:

[0091] Step 14.1: Select negative samples that conform to the syntax of the printer job language from among the multiple negative samples as candidate negative samples.

[0092] Specifically, a syntax parser can be used to perform syntax checks on the negative samples generated by the generator, and samples that do not conform to the syntax of the printer's job language (such as PJL syntax) can be excluded.

[0093] Step 14.2: Select the target negative sample that can trigger printer malfunction from all candidate negative samples.

[0094] In some embodiments of this application, target negative samples that can trigger printer malfunctions can be selected from all candidate negative samples through the following steps 14.21 to 14.23:

[0095] Step 14.21: Obtain the vector representation of each candidate negative sample.

[0096] It should be noted that the method for obtaining the vector representation of candidate negative samples is the same as the method for obtaining the vector representation of real negative samples. Therefore, the method for obtaining the vector representation of candidate negative samples will not be elaborated here.

[0097] Step 14.22: Based on the vector representation of all candidate negative samples, remove some candidate negative samples from all candidate negative samples.

[0098] Specifically, each real negative sample and each candidate negative sample can be treated as a comparison negative sample. Then, based on the vector representations of all candidate negative samples and the vector representation of each real negative sample, the similarity between each pair of comparison negative samples is calculated. If the calculated similarity satisfies the preset sample removal condition, and there is a candidate negative sample among the two comparison negative samples corresponding to the similarity, then the candidate negative sample is removed. If the calculated similarity satisfies the preset sample removal condition, and both comparison negative samples corresponding to the similarity are candidate negative samples, then either of the two candidate negative samples corresponding to the similarity is removed.

[0099] The aforementioned preset sample removal condition is that the similarity is greater than a preset similarity threshold. That is, in some embodiments of this application, if the similarity between two negative samples is greater than a preset similarity threshold (e.g., 0.95), then the two negative samples are considered to be highly similar. In this case, if the two negative samples include a real negative sample and a candidate negative sample, then the candidate negative sample is removed; if both negative samples are candidate negative samples, then either of the two candidate negative samples is removed.

[0100] When calculating the similarity between two negative samples based on their vector representations, the cosine similarity of the vector representations of the two negative samples can be calculated and used as the similarity between the two negative samples.

[0101] Step 14.23: For each candidate negative sample remaining after elimination, transmit the candidate negative sample to the printer and monitor whether the printer malfunctions. If an malfunction occurs, use the candidate negative sample as the target negative sample that can trigger the printer malfunction.

[0102] In some embodiments of this application, for the remaining candidate negative samples, a dynamic verification script can be written using Scapy to verify the generated data one by one (i.e., transmit the dynamic verification script to the printer) and observe whether it causes the expected vulnerability (i.e., anomaly). If the expected vulnerability is caused, the corresponding candidate negative sample is used as the target negative sample.

[0103] In summary, the negative sample generation method of this application trains a generative adversarial network (GAN) using real negative samples from printers. This allows the GAN's generator to learn the inherent grammatical and semantic patterns of real negative samples, enabling it to generate a large number of negative samples with diverse structures and functions. Furthermore, by filtering the negative samples generated by the generator and removing those that cannot successfully exploit vulnerabilities, the quality of the negative samples is improved.

[0104] The relevant devices provided in this application will be described by way of example below with reference to specific embodiments.

[0105] like Figure 2 As shown, an embodiment of this application provides a terminal device, wherein the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 2 The diagram shows only one processor, a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 executes the computer program D102 to implement the steps in any of the above method embodiments.

[0106] Specifically, when the processor D100 executes the computer program D102, it trains the generative adversarial network using real negative samples from the printer, enabling the generator of the generative adversarial network to generate a large number of negative samples with diverse structures and functions by learning the inherent grammatical and semantic patterns of real negative samples.

[0107] The processor D100 can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0108] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may be an external storage device of the terminal device D10, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the terminal device D10. Furthermore, the memory D101 may include both internal and external storage units of the terminal device D10. The memory D101 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory D101 can also be used to temporarily store data that has been output or will be output.

[0109] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0110] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0111] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0112] This application provides a computer program product that, when run on a terminal device, enables the terminal device to implement the steps described in the various method embodiments above.

[0113] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0114] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0116] In the embodiments provided in this application, it should be understood that the disclosed apparatus / network devices and methods can be implemented in other ways. For example, the apparatus / network device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0117] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0118] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A machine learning-based network-based negative sample generation method, characterized in that, include: Obtain multiple real negative samples; The true negative sample is a network data stream that can trigger printer malfunctions. The generative adversarial network is trained using the multiple real negative samples to obtain the trained generative adversarial network. The generator of the trained generative adversarial network is used to generate multiple negative samples; Target negative samples that can trigger printer malfunctions are selected from the generated plurality of negative samples, and these target negative samples are used as negative samples of network printing protocol data. The step of training the generative adversarial network using the multiple real negative samples to obtain the trained generative adversarial network includes: Obtain the vector representation of each of the real negative samples; The generative adversarial network is trained using the vector representations of the multiple real negative samples to obtain the trained generative adversarial network. The step of obtaining the vector representation of each of the true negative samples includes: For each of the stated true negative samples, perform the following steps: The real negative sample is divided into multiple tokens, and the multiple tokens are used as a token sequence; Feature extraction is performed on the token sequence to obtain N-Gram sequence features; A program dependency graph of the real negative sample is generated based on the N-Gram sequence features; multiple nodes in the program dependency graph correspond one-to-one with multiple control instructions contained in the real negative sample; the directed edges in the program dependency graph represent the calling relationship between the two control instructions corresponding to the directed edge; and the attributes of each node in the program dependency graph include the N-Gram sequence features corresponding to that node. The program dependency graph is encoded into a vector representation, and the vector representation is used as the vector representation of the true negative sample.

2. The negative sample generation method according to claim 1, characterized in that, The negative sample generation method further includes: For each control instruction of the real negative sample, perform the following steps: Determine whether the control command contains a preset high-risk command or a preset high-risk string; Based on the judgment result, configure a first indicator to indicate whether there is a preset high-risk instruction, and a second indicator to indicate whether there is a preset high-risk string; Add the first indicator and the second indicator to the attributes of the node corresponding to the control instruction in the program dependency graph.

3. The negative sample generation method according to claim 1, characterized in that, The step of selecting target negative samples that can trigger printer malfunctions from the generated plurality of negative samples includes: Among the multiple negative samples, those that conform to the syntax of the printer operation language are selected as candidate negative samples. Select the target negative sample that can trigger printer malfunction from all candidate negative samples.

4. The negative sample generation method according to claim 3, characterized in that, The process of selecting target negative samples that can trigger printer malfunctions from all candidate negative samples includes: Obtain the vector representation of each of the candidate negative samples; Based on the vector representation of all candidate negative samples, some candidate negative samples are eliminated from all candidate negative samples; For each candidate negative sample remaining after elimination, the candidate negative sample is transmitted to the printer, and the printer is monitored for any abnormalities. If an abnormality occurs, the candidate negative sample is used as the target negative sample that can trigger an abnormality in the printer.

5. The negative sample generation method according to claim 4, characterized in that, The vector representation based on all candidate negative samples, which removes a portion of the candidate negative samples, includes: Each of the real negative samples and each candidate negative sample is used as a comparison negative sample; Based on the vector representations of all candidate negative samples and the vector representation of each real negative sample, the similarity between every two paired negative samples is calculated. If the calculated similarity satisfies the preset sample removal condition, and there is a candidate negative sample among the two negative samples corresponding to the similarity, then the candidate negative sample is removed. If the calculated similarity satisfies the preset sample removal conditions, and both of the two negative samples corresponding to the similarity are candidate negative samples, then either of the two candidate negative samples corresponding to the similarity will be removed.

6. The negative sample generation method according to claim 5, characterized in that, The preset sample removal condition is that the similarity is greater than a preset similarity threshold.

7. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the negative sample generation method as described in any one of claims 1 to 6.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the negative sample generation method as described in any one of claims 1 to 6.

Images