Self-learning optimization method and device for secure digital fingerprints

Abstract

The application discloses a self-learning optimization method and device for a security digital fingerprint, and belongs to the field of network security. The method comprises the following steps: collecting and processing multi-source data in real time to form spatiotemporal alignment structured data; using a security digital fingerprint model to detect the spatiotemporal alignment structured data in real time; a self-learning optimization module running in the background uses a replica of the security digital fingerprint model and a supervised model to simultaneously perform collaborative analysis on the real-time spatiotemporal alignment structured data, uses a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to dynamically calibrate the analysis results, determines a normal sample pool, an abnormal sample pool and a false positive sample pool, performs self-learning optimization on the replica of the security digital fingerprint model, and uses a hot update interface to replace an old security digital fingerprint model. The scheme realizes full-process automatic closed-loop security detection, and can continuously evolve the detection capability of the security digital fingerprint model without affecting real-time detection tasks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a self-learning optimization method and apparatus for secure digital fingerprints. Background Technology

[0002] Existing industrial network security protection mainly relies on rule matching, feature signatures, or static model reasoning. When facing unknown threats, although there are security detection methods that introduce online learning and proactive feedback, they are mostly focused on specific protocols or single data types, and lack the combination of multi-dimensional security digital fingerprints and self-learning closed-loop architecture, resulting in the inability of overall detection capabilities to continuously evolve.

[0003] Therefore, there is an urgent need to provide a self-learning optimization method and device for secure digital fingerprints. Summary of the Invention

[0004] To address the problem that traditional secure digital fingerprint detection methods lack the integration of multi-dimensional secure digital fingerprints and a self-learning closed-loop architecture, resulting in the inability to continuously evolve overall detection capabilities, this invention provides a self-learning optimization method and apparatus for secure digital fingerprints.

[0005] On the one hand, a self-learning optimization method for secure digital fingerprints is provided, the method comprising:

[0006] Real-time collection of network traffic, industrial protocol messages, device logs and sensor time-series data; using a protocol semantic parser and a log structured generalization engine to process multi-source data and form spatiotemporally aligned structured data.

[0007] The spatiotemporally aligned structured data is detected in real time using an unsupervised secure digital fingerprint model.

[0008] The self-learning optimization module running in the background uses a copy of the secure digital fingerprint model and a supervised model to perform collaborative analysis on the real-time spatiotemporally aligned structured data. It uses a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to dynamically calibrate the analysis results, determine the normal sample pool, the abnormal sample pool, and the false alarm sample pool, so as to perform self-learning optimization on the copy of the secure digital fingerprint model. Finally, it uses a hot update interface to replace the old secure digital fingerprint model with the optimized secure digital fingerprint model for real-time detection.

[0009] On the other hand, a self-learning optimization device for secure digital fingerprints based on the steps described in any method embodiment of the specification is provided, the device comprising:

[0010] The data acquisition module is used to collect network traffic, industrial protocol messages, equipment logs and sensor time-series data in real time. It uses a protocol semantic parser and a log structured generalization engine to process multi-source data and form spatiotemporally aligned structured data.

[0011] The detection module is used to perform real-time detection on the spatiotemporally aligned structured data using an unsupervised secure digital fingerprint model;

[0012] The optimization module, running in the background, is used to simultaneously perform collaborative analysis on the real-time spatiotemporally aligned structured data using a copy of the secure digital fingerprint model and a supervised model. It dynamically calibrates the analysis results using a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to determine normal sample pools, abnormal sample pools, and false alarm sample pools. This allows for self-learning optimization of the copy of the secure digital fingerprint model, and a hot update interface is used to replace the old secure digital fingerprint model for real-time detection. The optimization module includes a multi-level confidence fusion unit and a self-organizing threat topology mapping unit.

[0013] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for executing the computer program stored in the memory to implement the steps of the method described above.

[0014] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the method described above.

[0015] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0016] The technical solution provided by this invention can bring at least the following beneficial effects:

[0017] By allocating dedicated hardware resources, real-time detection tasks and background model self-learning optimization tasks are physically isolated. This architecture resolves the conflict between real-time detection and computational power for model iteration in industrial scenarios, resulting in a throughput increase of several times compared to traditional serial processing. Furthermore, in the background self-learning optimization, a pioneering joint confidence scoring model is used, integrating supervised and unsupervised metrics. This model, combined with a self-organizing threat topology mapping unit, dynamically calibrates the analysis results to perform self-learning optimization on the replica of the security digital fingerprint model. This achieves an industrial implementation method with a fully automated closed-loop process from detection to optimization to deployment, enabling continuous evolution of the security digital fingerprint model's detection capabilities without affecting real-time detection tasks. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a self-learning optimization method for secure digital fingerprints provided in an embodiment of the present invention;

[0020] Figure 2 This is a structural diagram of a self-learning optimization device for secure digital fingerprints provided in an embodiment of the present invention;

[0021] Figure 3 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0023] The following describes the specific implementation of the above concept.

[0024] Please refer to Figure 1 This invention provides a self-learning optimization method for secure digital fingerprints, the method comprising:

[0025] Step 100: Collect network traffic, industrial protocol messages, device logs and sensor time-series data in real time, and use the protocol semantic parser and log structured generalization engine to process the multi-source data and form spatiotemporally aligned structured data.

[0026] Step 102: Real-time detection of spatiotemporally aligned structured data is performed using an unsupervised secure digital fingerprint model;

[0027] Step 104: The self-learning optimization module running in the background uses the copy of the secure digital fingerprint model and the supervised model to perform collaborative analysis on real-time spatiotemporally aligned structured data. It uses a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to dynamically calibrate the analysis results, determine the normal sample pool, abnormal sample pool, and false alarm sample pool, so as to perform self-learning optimization on the copy of the secure digital fingerprint model. Then, it uses a hot update interface to replace the old secure digital fingerprint model with the optimized secure digital fingerprint model for real-time detection.

[0028] In this embodiment of the invention, by allocating dedicated hardware resources, the real-time detection task and the background model self-learning optimization task are physically isolated from each other. This architecture resolves the conflict between real-time detection and computational power for model iteration in industrial scenarios, resulting in a throughput improvement of several times compared to traditional serial processing. Furthermore, in the background self-learning optimization, a supervised model is used to fuse unsupervised indicators, pioneering a joint confidence scoring model. This model, combined with a self-organizing threat topology mapping unit, dynamically calibrates the analysis results to perform self-learning optimization on the replica of the secure digital fingerprint model. This achieves an industrial implementation method with a fully automated closed-loop process from detection to optimization to deployment, enabling continuous evolution of the secure digital fingerprint model's detection capabilities without affecting the real-time detection task.

[0029] The following description Figure 1 The execution method for each step is shown.

[0030] For step 100:

[0031] This step achieves the autonomous evolution of equipment security digital fingerprints through dynamic fusion and closed-loop feedback mechanisms of multi-source industrial behavior data. First, it synchronously collects network traffic, industrial protocol messages, equipment logs, and sensor time-series data, i.e., a multi-dimensional security digital fingerprint encompassing four dimensions: network traffic, protocol behavior, equipment status, and user operations. Key fields (such as Modbus function codes and register addresses) are extracted by a protocol semantic parser, event-operation object tuples are generated by a log structured generalization engine, and millisecond-level time synchronization and outlier cleansing modules are used for processing. This constructs a globally unified equipment behavior flow, forming spatiotemporally aligned structured data composed of equipment identifiers, precise timestamps, operation types, and feature summaries, completely resolving the problem of multi-source semantic fragmentation.

[0032] Deep feature extraction of industrial network traffic is achieved through reverse engineering of the protocol stack. First, raw data packets are captured from the underlying driver, and the protocol encapsulation structure is parsed layer by layer: the MAC address and physical interface identifier are extracted from the link layer frame header; basic fields such as IP / TTL are decoded from the network layer; the TCP / UDP ports and session states of the transport layer are reconstructed; and finally, the application protocol type (such as HTTP, FTP, SMB, DNS) is identified based on port and payload characteristics. Semantic-level fine-grained parsing is then performed on the identified application protocol traffic.

[0033] The parsing process synchronously integrates device hardware logs (such as login events and process start / stop) with email protocol metadata (sender, recipient, subject) to construct a multi-dimensional feature vector. The final output is structured feature metadata in the format of [protocol type, session ID, key-value pairs of key fields, timestamp, device identifier], forming a unified feature base across protocols and devices, providing multi-dimensional training input for subsequent secure digital fingerprint modeling.

[0034] Regarding step 102:

[0035] Unsupervised security digital fingerprint models require pre-training with normal historical data. An autoencoder (AE) is used to compress this data into a low-dimensional latent space, capturing core behavioral patterns such as traffic fluctuations and log sequence correlations. Simultaneously, a Fast Fourier Transform (FFT) is used to decompose the frequency domain features of time-series data, collectively constructing a multi-dimensional behavioral baseline. When detecting real-time spatiotemporally aligned structured data, the streaming engine uses millisecond-level windows to correlate multi-source spatiotemporally aligned structured data (such as abnormal register writes superimposed with pressure sensor mutations) consisting of abnormal device IPs, attack types, and victim targets. The security digital fingerprint model can then filter out abnormal data and trigger tiered responses based on confidence levels (automatic interception of high-frequency attacks and push of suspicious behavior for visual auditing).

[0036] Regarding step 104:

[0037] In some implementations, the step "simultaneously performing collaborative analysis on real-time spatiotemporally aligned structured data using a copy of the secure digital fingerprint model and a supervised model, dynamically calibrating the analysis results using a multi-level confidence fusion unit and a self-organizing threat topology mapping unit, and determining the normal sample pool, abnormal sample pool, and false alarm sample pool to perform self-learning optimization on the copy of the secure digital fingerprint model" includes:

[0038] The copy of the secure digital fingerprint model uses an autoencoder and a fast Fourier transform to calculate the reconstruction error between the spatiotemporally aligned structured data and the behavioral baseline, and obtains the first detection result;

[0039] The supervised model uses long short-term memory networks and multilayer perceptrons to analyze and identify domain name character sequences and file structures in spatiotemporally aligned structured data to obtain a second detection result;

[0040] The spatiotemporally aligned structured data where both the first and second detection results are normal are stored in the normal sample pool. The multi-level confidence fusion unit is used to calculate the cross-modal joint confidence score for the spatiotemporally aligned structured data where both detection results are normal.

[0041] High-confidence data is stored in the anomaly sample pool, and low-confidence data is stored in the normal sample pool. The self-organizing threat topology mapping unit is used to perform dynamic boundary clustering on the intermediate-confidence data to calculate the semantic-spatiotemporal joint distance between each intermediate-confidence data and each cluster center, so as to classify and calibrate the intermediate-confidence data and determine the false alarm sample set of the replica of the security digital fingerprint model; where the cluster centers are the high-confidence samples in the anomaly sample pool.

[0042] Real-time calculation of dynamic thresholds and threat entropy thresholds for samples, based on the sample size and threat entropy of each threat cluster in the abnormal sample pool, to determine whether to trigger fine-tuning;

[0043] When fine-tuning is triggered, the feature weight parameters of the replica of the secure digital fingerprint model are adjusted by gradient backpropagation using the false alarm sample set, and the decision boundary of the replica of the secure digital fingerprint model is elastically shrunk using the false alarm sample set.

[0044] In this embodiment, the unsupervised secure digital fingerprint model and its replica contain an autoencoder. The autoencoder is used to compress real-time behavioral features into a low-dimensional latent space and calculate the reconstruction error between the model and the behavioral baseline. When the traffic scale deviation exceeds 30%, it is considered abnormal. At the same time, the time series data is converted into a frequency domain representation through Fast Fourier Transform (FFT) to detect abrupt changes in energy distribution. When the energy in a specific frequency band surges by more than 2σ standard deviations, it is considered abnormal to obtain the first detection result.

[0045] Supervised long short-term memory network analysis of domain name character sequences identifies randomness characteristics. When the entropy value > 3.5, it is determined to be DGA behavior. Multilayer perceptron parsing of file structure identifies malicious program signatures (such as abnormal overlap of PE sections), obtaining a second detection result. This embodiment also utilizes an industrial protocol rule engine to match unauthorized operations (such as write register commands initiated by unregistered devices).

[0046] The model collaboration employs a dynamic decision-making mechanism. When both the unsupervised and supervised models determine the data to be normal, it is stored in the normal sample pool. For cases other than both detection results being normal (i.e., when the two models' judgments are inconsistent or both models determine the data to be abnormal), a multi-level confidence fusion unit is used to calculate a cross-modal joint confidence score for these spatiotemporally aligned structured data. This joint confidence score is then used to adaptively calibrate the data judgment results. Traditionally, calibration is achieved through static thresholds and sample labeling. This embodiment uses a triple calibration mechanism of multi-level confidence fusion, self-organized sample mapping, and collaborative parameter evolution, which greatly improves automation and accuracy, breaking through the bottlenecks of traditional methods.

[0047] In some implementations, the cross-modal joint confidence score is calculated using the following formula:

[0048]

[0049] In the formula, For the reconstruction error of the automatic encoder, These are the mean and standard deviation of the historical error, respectively. For the classification probabilities of a supervised model, For the first Protocol rule matching degree For the first Weighting coefficients for protocol-like rules This is the dynamic decay factor.

[0050] In this embodiment, real-time data undergoes parallel inference via a copy of the secure digital fingerprint model (autoencoder AE and fast Fourier transform FFT) and a supervised model (LSTM / MLP), and then passes through a rule matching engine to calculate the cross-modal joint confidence score using the above formula. This joint confidence scoring formula utilizes a multi-dimensional decision-making mechanism that dynamically fuses the confidence probability output by a supervised model with unsupervised indicators. It pioneers a joint confidence scoring model where the standardized deviation of the autoencoder reconstruction error, the classification probability of the LSTM network, and the matching degree of industrial protocol rules are weighted and fused, with the weighting factors dynamically adjusted according to the attack type. This mechanism upgrades the decision boundary from a static scalar to a probabilistic dynamic surface, reducing false alarm rates in industrial control systems.

[0051] when If it is determined to be a high-confidence threat, an alarm is generated and the data is written to the abnormal sample pool as a negative example benchmark; if Then it is stored in the normal sample pool. (Regarding...) For fuzzy samples located at intermediate confidence levels, an innovative self-organizing threat topology mapping unit is designed to perform dynamic boundary clustering on intermediate confidence data, so as to calculate the semantic-spatiotemporal joint distance between each intermediate confidence data and each cluster center, and to classify and calibrate the intermediate confidence data.

[0052] Specifically, the self-organizing threat topology mapping unit first performs dimensionality reduction of the feature space, projecting high-dimensional features onto a two-dimensional manifold space while preserving protocol semantic correlations (such as the causal constraint between Modbus register writes and temperature sensor readings). Ordinary topology mapping algorithms only preserve the similarity of data structures, while the self-organizing threat topology mapping unit in this embodiment deliberately preserves the semantic correlations of the protocols. For example, it knows that the "Modbus register write" operation and the "temperature sensor reading" change have a causal constraint relationship under normal circumstances. Even if they appear unrelated in the original data, they will be placed in close proximity in the dimensionality-reduced space. Dynamic boundary clustering is then performed to classify and calibrate ambiguous samples.

[0053] In some implementations, the semantic-spatiotemporal joint distance is calculated using the following formula:

[0054]

[0055] In the formula, It is the semantic-spatiotemporal joint distance between the intermediate confidence data and the k-th threat cluster center. It is a weighting factor used to balance the importance of semantic distance and temporal distance. It is the protocol operation semantic vector of the intermediate confidence data. It is the protocol operation semantic vector of the kth threat cluster cluster center. For Euclidean distance It is the time offset of the intermediate confidence level data. It is the time offset of the kth threat cluster center. It is the maximum time offset.

[0056] In this embodiment, by preserving the semantic relevance of the protocol, the semantic-spatiotemporal joint distance is calculated to accurately calculate the similarity between each fuzzy sample and the known threat cluster, and calibration is performed.

[0057] In some implementations, dynamic thresholds for samples and threat entropy thresholds are calculated in real time to determine whether fine-tuning should be triggered based on the sample size and threat entropy of each threat cluster in the abnormal sample pool, including:

[0058]

[0059]

[0060] The conditions for triggering fine-tuning are as follows:

[0061]

[0062] In the formula, For the sample dynamic threshold, This is the minimum sample size requirement for the system to initiate fine-tuning. It is the threshold at the initial moment. It is the time decay factor, where t is the number of hours since the last fine-tuning; Let be the threat entropy of the k-th threat cluster, used to measure the degree of disorder in the feature values ​​within the threat cluster. denoted as the frequency of occurrence of a feature value in a threat cluster, and m is the number of feature value types in a threat cluster; The threshold value of threat entropy. Here, η is the baseline entropy value, and η is the entropy adjustment coefficient. For smoothing parameters, Let be the sample size of the k-th threat cluster.

[0063] This embodiment achieves adaptive optimization of the detection model through a threat entropy-driven elastic training mechanism. When the sample size of a certain threat cluster in the abnormal sample pool... Reaching dynamic threshold or threat entropy Exceeding the critical value At that time, fine-tuning training is triggered.

[0064] In this embodiment, dynamic threshold The calculation formula involves a time decay factor. And the number of hours since the last fine-tuning, t. When time t is large, It will approach This formula implements a time-sensitive elastic threshold, which decreases when there is no training for a long time, ensuring that low-frequency threats can be updated in a timely manner.

[0065] Threat Entropy Critical Value The degree of disorder in feature values ​​within the threat cluster was considered, and the critical value was determined. The model adapts and adjusts as the number of samples increases. The more samples there are, the higher the tolerance for entropy. The higher the threat entropy, the more complex and variable the behavior pattern of the threat cluster is, requiring more urgent model optimization. It is not just based on fixed time adjustments. The timing of model optimization is determined by combining the fine-tuning time interval and threat entropy. The more chaotic the threat entropy, the earlier it should be updated. It can be urgently optimized when there are too many attack samples, and can detect more unknown threats.

[0066] In some implementations, the feature weight parameters of the replica of the secure digital fingerprint model are adjusted in the following manner:

[0067]

[0068] In the formula, Let be the update amount of the i-th feature weight, and η be the meta-learning rate, used to control the overall update step size. The meta-loss function for weights The gradient descent term, Let be the standard deviation of the i-th feature in the false positive sample set, and max(σ) be the maximum value of the standard deviations of all features.

[0069] In this formula, the standard deviation of the feature in the false alarm sample set... When it is very small, the feature weight parameters Approaching 1, normal update, when When the coefficient is large, it approaches 0, significantly reducing the update magnitude. This penalizes unstable features and rewards stable ones. Features whose values ​​change drastically in false positive samples have their weight updates suppressed, while features with consistent values ​​in false positive samples have their weights updated normally. In this way, the secure digital fingerprint model gradually relies on features that perform stably in false positives for decision-making. Reducing the decision weight of unstable features increases the model's reliance on stable discrimination patterns.

[0070] In some implementations, the replica of the secure digital fingerprint model is elastically shrunk at the decision boundary in the following manner:

[0071]

[0072] In the formula, The adjusted decision boundary parameters, These are the original decision boundary parameters. The number of false alarm samples for threat cluster k. Let k be the sample size of the k-th threat cluster. This is a sensitive factor for false alarms.

[0073] In this embodiment, when the secure digital fingerprint model frequently generates false alarms for a specific type of normal behavior, the system does not globally reduce the detection sensitivity. Instead, it precisely and flexibly tightens the judgment criteria for this specific behavior. A more conservative judgment criterion is adopted for high-false-alarm threat clusters, achieving precise narrowing by only tightening the boundaries of problematic clusters without affecting other clusters.

[0074] After completing the self-learning optimization of the replica of the secure digital fingerprint model, the system automatically initiates a triple verification process: First, the new model is loaded, and historical normal traffic and known threat samples are injected to verify the false positive rate (≤5%) and recall rate (≥95%); second, the differences between the outputs of the new and old models are compared through real-time traffic mirroring to ensure the consistency of detection for key industrial protocols (such as Modbus register writing); finally, stress testing is performed to verify inference latency. The verified new model seamlessly replaces the online inference model via a versioned hot deployment interface. This process uses a double buffering mechanism to ensure zero service interruption—the old model continues to process current session traffic, the new model takes over new sessions, and the old version resources are automatically unloaded after the old session ends.

[0075] This invention boasts four core advantages over existing best-in-class technologies: In terms of adaptive learning capabilities, it achieves dynamic evolution of the defense boundary during inference through real-time threat entropy monitoring and online sample absorption mechanisms, completely resolving the blind spot problem in new threat detection caused by offline training in traditional technologies. Regarding efficiency, it leverages a dual-channel architecture to achieve physical isolation and parallel processing of detection and training, combined with automatic feedback of false alarm samples to optimize the decision boundary, reducing the frequency of manual intervention to a negligible level and significantly compressing the threat response cycle through full-process automation. In terms of low cost, it employs incremental meta-learning optimization instead of full retraining, requiring only conventional computing resources to fine-tune threat clusters, breaking through the strong dependence of traditional solutions on high-performance hardware and achieving an order-of-magnitude reduction in maintenance costs. In terms of generalization capabilities, the multimodal fusion engine dynamically adapts to fragmented protocol variants in industrial environments through seamless protocol parsing, improving the cross-scenario detection consistency of network traffic, device logs, and sensor data to a near-perfect level. This technology system is the first to construct a self-evolving proactive immune system in the industrial security field, forming a full-stack technical barrier covering perception, decision-making, and optimization.

[0076] Please refer to Figure 2 This invention provides a self-learning optimization device for secure digital fingerprints, used to implement the steps of any method embodiment in the specification. The device includes:

[0077] The acquisition module 201 is used to collect network traffic, industrial protocol messages, equipment logs and sensor time series data in real time. It uses a protocol semantic parser and a log structured generalization engine to process multi-source data and form spatiotemporally aligned structured data.

[0078] Detection module 202 is used to perform real-time detection of spatiotemporally aligned structured data using an unsupervised secure digital fingerprint model;

[0079] The optimization module 203, running in the background, is used to collaboratively analyze real-time spatiotemporally aligned structured data using a copy of the secure digital fingerprint model and a supervised model. It dynamically calibrates the analysis results using a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to determine the normal sample pool, abnormal sample pool, and false alarm sample pool. This allows for self-learning optimization of the copy of the secure digital fingerprint model, and the optimized secure digital fingerprint model is used to replace the old one for real-time detection via a hot update interface. The optimization module includes a multi-level confidence fusion unit and a self-organizing threat topology mapping unit.

[0080] It should be noted that the above device embodiments and method embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0081] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the self-learning optimization method for secure digital fingerprints provided in the above-described method embodiments.

[0082] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the self-learning optimization method for secure digital fingerprints provided in the above-described method embodiments.

[0083] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform any of the self-learning optimization methods for secure digital fingerprints described in the above embodiments.

[0084] For ease of description, the above devices or apparatuses are described separately according to their functions, divided into various modules or units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0085] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of the embodiments of this application.

[0086] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0087] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A self-learning optimization method for secure digital fingerprints, characterized in that, include: Real-time collection of network traffic, industrial protocol messages, device logs and sensor time-series data; using a protocol semantic parser and a log structured generalization engine to process multi-source data and form spatiotemporally aligned structured data. The spatiotemporally aligned structured data is detected in real time using an unsupervised secure digital fingerprint model. The self-learning optimization module running in the background uses the copy of the secure digital fingerprint model and the supervised model to perform collaborative analysis on the real-time spatiotemporally aligned structured data. It uses a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to dynamically calibrate the analysis results, determine the normal sample pool, the abnormal sample pool, and the false alarm sample pool, so as to perform self-learning optimization on the copy of the secure digital fingerprint model. It also uses a hot update interface to replace the old secure digital fingerprint model with the optimized secure digital fingerprint model for real-time detection. The method involves simultaneously performing collaborative analysis on the real-time spatiotemporally aligned structured data using a replica of the secure digital fingerprint model and a supervised model. Multi-level confidence fusion units and self-organizing threat topology mapping units are used to dynamically calibrate the analysis results, determining normal sample pools, abnormal sample pools, and false alarm sample pools. This process enables self-learning optimization of the replica of the secure digital fingerprint model, including: The copy of the secure digital fingerprint model uses an autoencoder and a fast Fourier transform to calculate the reconstruction error between the spatiotemporally aligned structured data and the behavioral baseline, and obtains the first detection result. The supervised model uses a long short-term memory network and a multilayer perceptron to analyze and identify the domain name character sequence and file structure in the spatiotemporally aligned structured data to obtain a second detection result; The spatiotemporal aligned structured data in which both the first and second detection results are normal are stored in the normal sample pool. The multi-level confidence fusion unit is used to calculate the cross-modal joint confidence score for the spatiotemporal aligned structured data except for those in which both detection results are normal. High-confidence data is stored in an anomaly sample pool, and low-confidence data is stored in a normal sample pool. A self-organizing threat topology mapping unit is used to perform dynamic boundary clustering on the intermediate-confidence data to calculate the semantic-spatiotemporal joint distance between each intermediate-confidence data point and each cluster center. This is used to classify and calibrate the intermediate-confidence data and determine the false alarm sample set of the replica of the secure digital fingerprint model. The cluster centers are the high-confidence samples in the anomaly sample pool. Real-time calculation of dynamic thresholds and threat entropy thresholds for samples, based on the sample size and threat entropy of each threat cluster in the abnormal sample pool, to determine whether to trigger fine-tuning; When fine-tuning is triggered, the feature weight parameters of the replica of the secure digital fingerprint model are adjusted by gradient backpropagation using the false alarm sample set, and the decision boundary of the replica of the secure digital fingerprint model is elastically shrunk using the false alarm sample set.

2. The method as described in claim 1, characterized in that, The cross-modal joint confidence score is calculated using the following formula: In the formula, The reconstruction error of the autoencoder. These are the mean and standard deviation of the historical error, respectively. Let be the classification probability of the supervised model. For the first Protocol rule matching degree For the first Weighting coefficients for protocol-like rules This is the dynamic decay factor.

3. The method as described in claim 1, characterized in that, The semantic-spatiotemporal joint distance is calculated using the following formula: In the formula, It is the semantic-spatiotemporal joint distance between the intermediate confidence data and the k-th threat cluster center. It is a weighting factor used to balance the importance of semantic distance and temporal distance. It is the protocol operation semantic vector of the intermediate confidence data. It is the protocol operation semantic vector of the kth threat cluster cluster center. For Euclidean distance It is the time offset of the intermediate confidence level data. It is the time offset of the kth threat cluster center. It is the maximum time offset.

4. The method as described in claim 1, characterized in that, The real-time calculation of sample dynamic thresholds and threat entropy critical values, based on the sample size and threat entropy of each threat cluster in the abnormal sample pool, determines whether to trigger fine-tuning, including: The conditions for triggering fine-tuning are as follows: In the formula, For the sample dynamic threshold, This is the minimum sample size requirement for the system to initiate fine-tuning. It is the threshold at the initial moment. It is the time decay factor, where t is the number of hours since the last fine-tuning; Let be the threat entropy of the k-th threat cluster, used to measure the degree of disorder in the feature values ​​within the threat cluster. denoted as the frequency of occurrence of a feature value in a threat cluster, and m is the number of feature value types in a threat cluster; The threshold value of threat entropy. Here, η is the baseline entropy value, and η is the entropy adjustment coefficient. For smoothing parameters, Let be the sample size of the k-th threat cluster.

5. The method as described in claim 1, characterized in that, The replica of the secure digital fingerprint model achieves elastic shrinkage of the decision boundary in the following manner: In the formula, The adjusted decision boundary parameters, These are the original decision boundary parameters. The number of false alarm samples for threat cluster k. Let k be the sample size of the k-th threat cluster. This is a sensitive factor for false alarms.

6. A self-learning optimization device for secure digital fingerprints, used to implement the steps of the method according to any one of claims 1-5, characterized in that, include: The data acquisition module is used to collect network traffic, industrial protocol messages, equipment logs and sensor time-series data in real time. It uses a protocol semantic parser and a log structured generalization engine to process multi-source data and form spatiotemporally aligned structured data. The detection module is used to perform real-time detection on the spatiotemporally aligned structured data using an unsupervised secure digital fingerprint model; The optimization module, running in the background, is used to simultaneously perform collaborative analysis on the real-time spatiotemporally aligned structured data using a copy of the secure digital fingerprint model and a supervised model. It dynamically calibrates the analysis results using a multi-level confidence fusion unit and a self-organizing threat topology mapping unit to determine normal sample pools, abnormal sample pools, and false alarm sample pools. This allows for self-learning optimization of the copy of the secure digital fingerprint model, and a hot update interface is used to replace the old secure digital fingerprint model for real-time detection. The optimization module includes a multi-level confidence fusion unit and a self-organizing threat topology mapping unit.

7. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-5.

Images